A company is migrating some of its applications to AWS. The company wants to migrate and modernize the applications quickly after it finalizes networking and security strategies. The company has set up an AWS Direct Connect connection in a central network account.The company expects to have hundreds of AWS accounts and VPCs in the near future. The corporate network must be able to access the resources on AWS seamlessly and also must be able to communicate with all the VPCs. The company also wants to route its cloud resources to the internet through its on-premises data center.Which combination of steps will meet these requirements? (Choose three.)
Answer(s): B,D,F
To successfully migrate and modernize the applications while ensuring seamless access to AWS resources from the corporate network, the following steps are essential:B) Create a Direct Connect gateway and a transit gateway in the central network account. Attach the transit gateway to the Direct Connect gateway using a transit VIF. This setup enables a central point for routing traffic from the on-premises data center to multiple VPCs across various AWS accounts, leveraging the high bandwidth and low latency of AWS Direct Connect.D) Share the transit gateway with other accounts. Attach VPCs to the transit gateway. By sharing the transit gateway, all associated VPCs can communicate with one another and with the on-premises data center, facilitating efficient routing between accounts.F) Provision only private subnets. Open the necessary route on the transit gateway and customer gateway to allow outbound internet traffic from AWS to flow through NAT services that run in the data center. This ensures that internet-bound traffic is routed through the on-premises data center, maintaining compliance with the company's networking strategy.This approach ensures scalability, efficient resource access, and the ability to route traffic as required, all while minimizing operational complexity.
A company has hundreds of AWS accounts. The company recently implemented a centralized internal process for purchasing new Reserved Instances and modifying existing Reserved Instances. This process requires all business units that want to purchase or modify Reserved Instances to submit requests to a dedicated team for procurement. Previously, business units directly purchased or modified Reserved Instances in their own respective AWS accounts autonomously.A solutions architect needs to enforce the new process in the most secure way possible.Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
Answer(s): A,D
To enforce a centralized process for purchasing and modifying Reserved Instances in a secure manner across multiple AWS accounts, the following steps should be taken:A) Ensure that all AWS accounts are part of an organization in AWS Organizations with all features enabled. This setup allows for centralized management of policies and permissions across all accounts, enabling the implementation of Service Control Policies (SCPs) to restrict actions at the organizational level.D) Create an SCP that denies the ec2:PurchaseReservedInstancesOffering action and the ec2:ModifyReservedInstances action. Attach the SCP to each OU of the organization. By using SCPs, the organization can enforce the new procurement process across all accounts within the specified OUs, ensuring that no business unit can independently purchase or modify Reserved Instances without going through the designated procurement team.Together, these steps ensure that the process is both secure and compliant with the new centralized purchasing strategy.
A company is running a critical application that uses an Amazon RDS for MySQL database to store data. The RDS DB instance is deployed in Multi-AZ mode.A recent RDS database failover test caused a 40-second outage to the application. A solutions architect needs to design a solution to reduce the outage time to less than 20 seconds.Which combination of steps should the solutions architect take to meet these requirements? (Choose three.)
Answer(s): C,D,E
To reduce the outage time during RDS database failover to less than 20 seconds, the following steps should be taken:C) Use RDS Proxy in front of the database. RDS Proxy helps manage connections to the RDS database and allows for connection pooling, which can reduce failover times by maintaining connections through the proxy. In case of a failover, the proxy can quickly redirect connections to the new primary database instance.D) Migrate the database to Amazon Aurora MySQL. Amazon Aurora is designed for high availability and can provide faster failover times compared to RDS for MySQL. It offers a more resilient architecture that can minimize downtime during failovers.E) Create an Amazon Aurora Replica. Aurora Replicas can be used to offload read traffic and, during a failover, they can be promoted quickly to a primary instance, thus significantly reducing the downtime experienced during a failover.By implementing these solutions, the company can enhance its application's availability and ensure that failover times are minimized.
An AWS partner company is building a service in AWS Organizations using its organization named org1. This service requires the partner company to have access to AWS resources in a customer account, which is in a separate organization named org2. The company must establish least privilege security access using an API or command line tool to the customer account.What is the MOST secure way to allow org1 to access resources in org2?
Answer(s): D
The most secure way to allow the partner company in org1 to access resources in the customer account in org2 is:D) The customer should create an IAM role and assign the required permissions to that role. The partner company should then use the IAM role’s Amazon Resource Name (ARN), including an external ID in the IAM role’s trust policy, when requesting access to perform the required tasks.This approach provides several security benefits:IAM Role: Roles are designed for temporary access and can have permissions tailored to specific tasks, adhering to the principle of least privilege.Trust Policy with External ID: Using an external ID helps mitigate the risk of the confused deputy problem, ensuring that only the intended third party (the partner company) can assume the role, even if the ARN is known to others.By using IAM roles with external IDs, the customer can securely grant access without sharing long-term credentials or access keys, minimizing the risk of unauthorized access.
A delivery company needs to migrate its third-party route planning application to AWS. The third party supplies a supported Docker image from a public registry. The image can run in as many containers as required to generate the route map.The company has divided the delivery area into sections with supply hubs so that delivery drivers travel the shortest distance possible from the hubs to the customers. To reduce the time necessary to generate route maps, each section uses its own set of Docker containers with a custom configuration that processes orders only in the section's area.The company needs the ability to allocate resources cost-effectively based on the number of running containers.Which solution will meet these requirements with the LEAST operational overhead?
The best solution to meet the requirements of the delivery company with the least operational overhead is:D) Create an Amazon Elastic Container Service (Amazon ECS) cluster on AWS Fargate. Use the AWS CLI run-task command and set enableECSManagedTags to true to launch the planning application. Use the --tags option to assign a custom tag to the task.This solution is optimal for several reasons:AWS Fargate: This serverless compute engine for containers allows the company to run containers without managing the underlying EC2 instances. This significantly reduces operational overhead because it abstracts away the infrastructure management.Dynamic Resource Allocation: With Fargate, the company can easily scale the number of containers based on demand, allowing cost-effective resource allocation based on the number of running containers.Managed Tags: By using enableECSManagedTags, the company can automatically manage and track resources, making it easier to categorize and manage costs effectively.Overall, this approach provides a scalable, flexible, and low-maintenance solution for running the third-party application in a containerized environment.
A software company hosts an application on AWS with resources in multiple AWS accounts and Regions. The application runs on a group of Amazon EC2 instances in an application VPC located in the us-east-1 Region with an IPv4 CIDR block of 10.10.0.0/16. In a different AWS account, a shared services VPC is located in the us-east-2 Region with an IPv4 CIDR block of 10.10.10.0/24. When a cloud engineer uses AWS CloudFormation to attempt to peer the application VPC with the shared services VPC, an error message indicates a peering failure.Which factors could cause this error? (Choose two.)
Answer(s): A,E
The factors that could cause the peering failure between the application VPC and the shared services VPC are:A) The IPv4 CIDR ranges of the two VPCs overlap.The CIDR blocks provided (10.10.0.0/16 for the application VPC and 10.10.10.0/24 for the shared services VPC) show that there is an overlap in the address space. Peering connections cannot be established between VPCs if their IP address ranges overlap, which would lead to a peering failure.B) The VPCs are not in the same Region.Peering connections must be established between VPCs in the same region or through inter-region VPC peering. However, the current setup indicates that one VPC is in us-east-1 and the other is in us-east-2, which does not inherently prevent peering but indicates that a cross-region peering connection must be specifically supported and configured correctly.C) One or both accounts do not have access to an Internet gateway.This factor is not relevant to the peering itself; VPC peering does not depend on Internet gateways since it is meant for private communication between VPCs.D) One of the VPCs was not shared through AWS Resource Access Manager.This is also not directly related to VPC peering. AWS Resource Access Manager (RAM) is used for sharing resources across accounts, but the ability to peer VPCs does not require sharing through RAM.E) The IAM role in the peer accepter account does not have the correct permissions.If the IAM role that is being used to accept the peering request does not have the necessary permissions to create VPC peering connections, this could prevent the peering from being established successfully.Thus, the correct answers indicating factors that could cause the peering failure are A and E.
An external audit of a company’s serverless application reveals IAM policies that grant too many permissions. These policies are attached to the company's AWS Lambda execution roles. Hundreds of the company's Lambda functions have broad access permissions such as full access to Amazon S3 buckets and Amazon DynamoDB tables. The company wants each function to have only the minimum permissions that the function needs to complete its task.A solutions architect must determine which permissions each Lambda function needs.What should the solutions architect do to meet this requirement with the LEAST amount of effort?
Answer(s): B
To meet the requirement of identifying and assigning the least privilege permissions to the AWS Lambda functions with the least amount of effort, the best approach is:B) Turn on AWS CloudTrail logging for the AWS account. Use AWS Identity and Access Management (IAM) Access Analyzer to generate IAM access policies based on the activity recorded in the CloudTrail log. Review the generated policies to ensure that they meet the company's business requirements.-Why this is the best option:oAWS CloudTrail provides a comprehensive log of API calls made within the AWS account, including those made by Lambda functions. By enabling CloudTrail, the solutions architect can capture detailed activity logs.oIAM Access Analyzer can analyze the CloudTrail logs and generate IAM policies based on actual usage, identifying the minimum permissions needed for each Lambda function. This approach automates much of the work involved in auditing permissions and significantly reduces manual effort.oOnce the policies are generated, the architect can review and adjust them to ensure compliance with business requirements, ensuring that only the necessary permissions are granted.This solution minimizes operational overhead and effort while providing a clear pathway to implement least privilege access effectively.
A solutions architect must analyze a company’s Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS) volumes to determine whether the company is using resources efficiently. The company is running several large, high-memory EC2 instances to host database clusters that are deployed in active/passive configurations. The utilization of these EC2 instances varies by the applications that use the databases, and the company has not identified a pattern.The solutions architect must analyze the environment and take action based on the findings.Which solution meets these requirements MOST cost-effectively?
Answer(s): C
To analyze the company's Amazon EC2 instances and Amazon EBS volumes for efficient resource usage, the best solution is:C) Install the Amazon CloudWatch agent on each of the EC2 instances. Turn on AWS Compute Optimizer, and let it run for at least 12 hours. Review the recommendations from Compute Optimizer, and rightsize the EC2 instances as directed.-Why this is the best option:oAWS Compute Optimizer provides insights into how to optimize your AWS resources for performance and cost. By enabling it, the solutions architect can get detailed recommendations for rightsizing EC2 instances based on actual usage patterns and performance data.oThe CloudWatch agent enhances monitoring capabilities by collecting additional metrics that can help identify performance bottlenecks and utilization trends.oThis approach allows for informed decisions based on actual resource usage rather than assumptions, ensuring that the company can effectively reduce costs while maintaining performance.oSince AWS Compute Optimizer specifically focuses on resource efficiency and provides actionable insights, it directly addresses the requirement to analyze and optimize the use of EC2 instances and EBS volumes.This solution is both effective and cost-efficient, leveraging existing AWS services to analyze and optimize resource usage.
Post your Comments and Discuss Amazon AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL content, but please register or login to continue.