A team collects and routes behavioral data for an entire company. The company runs a Multi-AZ VPC environment with public subnets, private subnets, and in internet gateway. Each public subnet also contains a NAT gateway. Most of the company’s applications read from and write to Amazon Kinesis Data Streams. Most of the workloads run in private subnets.A solutions architect must review the infrastructure. The solution architect needs to reduce costs and maintain the function of the applications. The solutions architect uses Cost Explorer and notices that the cost in the EC2-Other category is consistently high. A further review shows that NatGateway-Bytes charges are increasing the cost in the EC2-Other category.What should the solutions architect do to meet these requirements?
Answer(s): D
To reduce costs associated with NAT Gateway charges while maintaining application functionality:D) Adding an interface VPC endpoint for Kinesis Data Streams allows the applications running in private subnets to send and receive data directly to and from Kinesis without routing the traffic through the NAT gateway. This setup significantly lowers the data transfer costs (NatGateway-Bytes charges) by eliminating the need for the NAT gateway for Kinesis communications, while ensuring that the applications continue to function as required.
A retail company has an on-premises data center in Europe. The company also has a multi-Region AWS presence that includes the eu-west-1 and us-east-1 Regions. The company wants to be able to route network traffic from its on-premises infrastructure into VPCs in either of those Regions. The company also needs to support traffic that is routed directly between VPCs in those Regions. No single points of failure can exist on the network.The company already has created two 1 Gbps AWS Direct Connect connections from its on-premises data center. Each connection goes into a separate Direct Connect location in Europe for high availability. These two locations are named DX-A and DX-B, respectively. Each Region has a single AWS Transit Gateway that is configured to route all inter-VPC traffic within that Region.Which solution will meet these requirements?
To meet the requirements of routing network traffic from the on-premises infrastructure into VPCs in both the eu-west-1 and us-east-1 Regions, while ensuring high availability and supporting direct traffic routing between VPCs:D) Creating a transit VIF from both the DX-A and DX-B connections into the same Direct Connect gateway provides high availability and redundancy. Associating both the eu-west-1 and us-east-1 transit gateways with this Direct Connect gateway allows for cross-Region routing. Peering the transit gateways facilitates inter-VPC communication across the Regions. This solution effectively eliminates single points of failure while ensuring that the network traffic is efficiently routed.
A company is running an application in the AWS Cloud. The company's security team must approve the creation of all new IAM users. When a new IAM user is created, all access for the user must be removed automatically. The security team must then receive a notification to approve the user. The company has a multi-Region AWS CloudTrail trail in the AWS account.Which combination of steps will meet these requirements? (Choose three.)
Answer(s): A,D,E
To implement a solution that ensures all new IAM users require security team approval and that their access is removed automatically:A) Creating an Amazon EventBridge rule allows monitoring of specific API calls via CloudTrail, specifically the CreateUser event. This setup captures the creation of new IAM users.D) Invoking an AWS Step Functions state machine to remove access provides a controlled and automated way to handle the removal of permissions for the new IAM users. This approach allows for more complex workflows, including handling the approval process.E) Using Amazon Simple Notification Service (SNS) to notify the security team ensures that they receive timely alerts for each new user creation, enabling them to take necessary actions for approval.This combination effectively automates the IAM user creation process while maintaining the required security checks and balances.
A company wants to migrate to AWS. The company wants to use a multi-account structure with centrally managed access to all accounts and applications. The company also wants to keep the traffic on a private network. Multi-factor authentication (MFA) is required at login, and specific roles are assigned to user groups.The company must create separate accounts for development. staging, production, and shared network. The production account and the shared network account must have connectivity to all accounts. The development account and the staging account must have access only to each other.Which combination of steps should a solutions architect take 10 meet these requirements? (Choose three.)
Answer(s): A,C,D
To meet the company's requirements for a multi-account structure with centralized management and secure access, the following steps are recommended:A) Deploying a landing zone environment using AWS Control Tower simplifies the setup of a multi-account structure and enables centralized management of accounts within AWS Organizations. It helps enforce best practices, including account enrollment and organization setup.C) Creating transit gateways and VPC attachments allows for secure connectivity between the production account, shared network account, and other accounts. This setup ensures private network traffic and the necessary connectivity for resources across accounts.D) Setting up AWS IAM Identity Center (formerly AWS Single Sign-On) provides centralized access management across accounts. Creating permission sets with required MFA ensures secure access for users when logging in, aligning with the company's security requirements.This combination allows the company to manage access efficiently while ensuring compliance with security policies like MFA and traffic isolation.
A company runs its application in the eu-west-1 Region and has one account for each of its environments: development, testing, and production. All the environments are running 24 hours a day, 7 days a week by using stateful Amazon EC2 instances and Amazon RDS for MySQL databases. The databases are between 500 GB and 800 GB in size.The development team and testing team work on business days during business hours, but the production environment operates 24 hours a day, 7 days a week. The company wants to reduce costs. All resources are tagged with an environment tag with either development, testing, or production as the key.What should a solutions architect do to reduce costs with the LEAST operational effort?
Answer(s): B
To effectively reduce costs with minimal operational effort, the recommended solution is:B) This approach involves creating two Amazon EventBridge rules to manage the state of the EC2 instances for the development and testing environments. The first rule runs every business day in the evening to stop instances that are not needed after business hours, and the second rule runs every business day in the morning to start those instances back up. This scheduling aligns with the usage patterns of the development and testing teams, ensuring that they only incur costs for the EC2 instances and RDS databases when they are actively being used.This method leverages automation to minimize manual intervention and ensure cost efficiency without compromising the operational requirements of the production environment.
A company is building a software-as-a-service (SaaS) solution on AWS. The company has deployed an Amazon API Gateway REST API with AWS Lambda integration in multiple AWS Regions and in the same production account.The company offers tiered pricing that gives customers the ability to pay for the capacity to make a certain number of API calls per second. The premium tier offers up to 3,000 calls per second, and customers are identified by a unique API key. Several premium tier customers in various Regions report that they receive error responses of 429 Too Many Requests from multiple API methods during peak usage hours. Logs indicate that the Lambda function is never invoked.What could be the cause of the error messages for these customers?
Answer(s): C
The error messages indicating "429 Too Many Requests" suggest that the API Gateway is rejecting requests due to exceeding allowed limits. The correct answer is:C) The company reached its API Gateway account limit for calls per second. This is because API Gateway has account-level limits on the total number of requests it can handle across all APIs in a specific account and region. If multiple premium tier customers attempt to make calls that, in aggregate, exceed this limit, they will receive 429 errors, even if the Lambda function itself is not being invoked.This situation is typical when the service is under heavy load and the total number of API calls exceeds the provisioned capacity, leading to throttling by the API Gateway.
A financial company is planning to migrate its web application from on premises to AWS. The company uses a third-party security tool to monitor the inbound traffic to the application. The company has used the security tool for the last 15 years, and the tool has no cloud solutions available from its vendor. The company's security team is concerned about how to integrate the security tool with AWS technology.The company plans to deploy the application migration to AWS on Amazon EC2 instances. The EC2 instances will run in an Auto Scaling group in a dedicated VPC. The company needs to use the security tool to inspect all packets that come in and out of the VPC. This inspection must occur in real time and must not affect the application's performance. A solutions architect must design a target architecture on AWS that is highly available within an AWS Region.Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
Answer(s): A,D
To integrate the third-party security tool with the AWS architecture while ensuring high availability and minimal impact on application performance, the following steps are recommended:A) Deploy the security tool on EC2 instances in a new Auto Scaling group in the existing VPC. This allows the security tool to be scalable and available to handle fluctuations in traffic without compromising performance.D) Provision a Gateway Load Balancer for each Availability Zone to redirect the traffic to the security tool. This setup allows traffic to be routed transparently to the security tool for inspection, while still ensuring that the architecture is highly available across multiple Availability Zones.Together, these steps create a robust architecture that allows for real-time packet inspection without affecting application performance, while maintaining high availability in the AWS environment.
A company has purchased appliances from different vendors. The appliances all have IoT sensors. The sensors send status information in the vendors' proprietary formats to a legacy application that parses the information into JSON. The parsing is simple, but each vendor has a unique format. Once daily, the application parses all the JSON records and stores the records in a relational database for analysis.The company needs to design a new data analysis solution that can deliver faster and optimize costs.Which solution will meet these requirements?
Answer(s): A
To design a new data analysis solution that delivers faster performance and optimizes costs, the recommended approach is:A) Connect the IoT sensors to AWS IoT Core. Set a rule to invoke an AWS Lambda function to parse the information and save a .csv file to Amazon S3. Use AWS Glue to catalog the files. This solution effectively utilizes serverless architecture to handle incoming data, which scales automatically based on demand, reducing operational overhead.Then, leveraging Amazon Athena for querying the data stored in S3 allows for cost-effective and fast analysis since Athena charges based on the amount of data scanned. Amazon QuickSight can then be used for visualization, enabling the company to analyze the data efficiently without needing to manage servers or complex infrastructure.This architecture not only streamlines the parsing process but also improves data accessibility and analysis capabilities while optimizing costs by using serverless components.
Post your Comments and Discuss Amazon AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL content, but please register or login to continue.