A global media company is planning a multi-Region deployment of an application. Amazon DynamoDB global tables will back the deployment to keep the user experience consistent across the two continents where users are concentrated. Each deployment will have a public Application Load Balancer (ALB). The company manages public DNS internally. The company wants to make the application available through an apex domain.Which solution will meet these requirements with the LEAST effort?
Answer(s): C
The selected solution is:C) Create an AWS Global Accelerator accelerator with multiple endpoint groups that target endpoints in appropriate AWS Regions. Use the accelerator’s static IP address to create a record in public DNS for the apex domain.This approach efficiently meets the requirements by providing static IP addresses that can route traffic to the application in multiple Regions, ensuring low latency and high availability. Global Accelerator handles routing intelligently based on the user's location and the health of the endpoints, which simplifies the deployment and minimizes effort compared to managing DNS records for each Region. Additionally, it allows the use of an apex domain without needing a CNAME record, which is not permitted for apex domains in traditional DNS configurations.
A company is developing a new serverless API by using Amazon API Gateway and AWS Lambda. The company integrated the Lambda functions with API Gateway to use several shared libraries and custom classes.A solutions architect needs to simplify the deployment of the solution and optimize for code reuse.Which solution will meet these requirements?
Answer(s): D
The selected solution is:D) Deploy the shared libraries, custom classes, and code for the API's Lambda functions to a Docker image. Upload the image to Amazon Elastic Container Registry (Amazon ECR). Configure the API's Lambda functions to use the Docker image as the deployment package.This approach optimizes for code reuse and simplifies the deployment by packaging both the application code and shared dependencies (libraries and classes) into a single Docker image. By using Amazon ECR to store the Docker image, the company can manage versioning and updates more efficiently. Lambda can directly use the Docker image, eliminating the need for separate deployment packages for the API's Lambda functions and enhancing the overall maintainability of the solution.
A manufacturing company is building an inspection solution for its factory. The company has IP cameras at the end of each assembly line. The company has used Amazon SageMaker to train a machine learning (ML) model to identify common defects from still images.The company wants to provide local feedback to factory workers when a defect is detected. The company must be able to provide this feedback even if the factory’s internet connectivity is down. The company has a local Linux server that hosts an API that provides local feedback to the workers.How should the company deploy the ML model to meet these requirements?
Answer(s): B
The selected solution is:B) Deploy AWS IoT Greengrass on the local server. Deploy the ML model to the Greengrass server. Create a Greengrass component to take still images from the cameras and run inference. Configure the component to call the local API when a defect is detected.This approach allows the manufacturing company to run the ML model locally on the Greengrass server, enabling real-time processing of images captured by the IP cameras. Since the Greengrass environment operates locally, it can function even when the factory's internet connectivity is down. This setup ensures that factory workers receive immediate feedback regarding defects, thereby meeting the company's requirements for operational continuity and low-latency feedback.
A solutions architect must create a business case for migration of a company's on-premises data center to the AWS Cloud. The solutions architect will use a configuration management database (CMDB) export of all the company's servers to create the case.Which solution will meet these requirements MOST cost-effectively?
The selected solution is:B) Use Migration Evaluator to perform an analysis. Use the data import template to upload the data from the CMDB export.Reasoning:-Cost-effectiveness: Migration Evaluator provides detailed insights into the current infrastructure and helps estimate costs for migrating to AWS. It utilizes the data from the CMDB to provide tailored recommendations and financial assessments, making it a cost-effective choice for creating a business case.-Ease of use: The provided data import template simplifies the process of uploading the CMDB export, allowing for a streamlined analysis without the need for extensive manual data entry or transformation.-Actionable insights: Migration Evaluator can provide insights on potential savings, resource optimization, and required configurations, which are critical for building a compelling business case for migration.
A company has a website that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The ALB is associated with an AWS WAF web ACL.The website often encounters attacks in the application layer. The attacks produce sudden and significant increases in traffic on the application server. The access logs show that each attack originates from different IP addresses. A solutions architect needs to implement a solution to mitigate these attacks.Which solution will meet these requirements with the LEAST operational overhead?
The selected solution is:B) Deploy AWS Shield Advanced in addition to AWS WAF. Add the ALB as a protected resource.Reasoning:Mitigation of application layer attacks: AWS Shield Advanced provides enhanced protection against DDoS attacks, particularly for layer 7 (application layer) attacks, which is essential for safeguarding the web application hosted behind the ALB.Automatic detection and mitigation: Shield Advanced automatically detects attacks and applies mitigations, reducing the need for manual intervention and allowing the application to remain available during an attack.Minimal operational overhead: By integrating with AWS WAF and being managed by AWS, this solution reduces the administrative burden compared to creating and maintaining custom alarm and Lambda functions to respond to threats. It provides a comprehensive, robust security posture with less ongoing maintenance.Enhanced reporting: Shield Advanced offers detailed attack diagnostics and insights, allowing for better understanding and future prevention strategies.
A company has a critical application in which the data tier is deployed in a single AWS Region. The data tier uses an Amazon DynamoDB table and an Amazon Aurora MySQL DB cluster. The current Aurora MySQL engine version supports a global database. The application tier is already deployed in two Regions.Company policy states that critical applications must have application tier components and data tier components deployed across two Regions. The RTO and RPO must be no more than a few minutes each. A solutions architect must recommend a solution to make the data tier compliant with company policy.Which combination of steps will meet these requirements? (Choose two.)
Answer(s): A,D
The selected solutions are:A) Add another Region to the Aurora MySQL DB cluster.D) Convert the existing DynamoDB table to a global table by adding another Region to its configuration.Reasoning:-A (Aurora MySQL Global Database): Adding another Region to the Aurora MySQL DB cluster allows for the creation of a global database setup. This provides high availability and low-latency reads across multiple Regions while ensuring that the data tier is compliant with the company's requirement for multi-Region deployment. The global database feature supports near real-time replication, which helps in meeting the RTO and RPO requirements.-D (DynamoDB Global Tables): By converting the existing DynamoDB table to a global table and adding another Region, the application can maintain a fully replicated table across the specified Regions. This approach ensures that the data is available and consistent across both Regions, complying with the requirement for cross-Region deployment and minimizing the potential for data loss.Both solutions ensure that the data tier can meet the company policy's requirements for redundancy, availability, and minimal downtime.
A telecommunications company is running an application on AWS. The company has set up an AWS Direct Connect connection between the company's on-premises data center and AWS. The company deployed the application on Amazon EC2 instances in multiple Availability Zones behind an internal Application Load Balancer (ALB). The company's clients connect from the on-premises network by using HTTPS. The TLS terminates in the ALB. The company has multiple target groups and uses path-based routing to forward requests based on the URL path.The company is planning to deploy an on-premises firewall appliance with an allow list that is based on IP address. A solutions architect must develop a solution to allow traffic flow to AWS from the on-premises network so that the clients can continue to access the application.Which solution will meet these requirements?
The selected solution is:B) Create a Network Load Balancer (NLB). Associate the NLB with one static IP address in multiple Availability Zones. Create an ALB-type target group for the NLB and add the existing ALB. Add the NLB IP addresses to the firewall appliance. Update the clients to connect to the NLB.Reasoning:1.Static IP Addresses: By using a Network Load Balancer (NLB) with static IP addresses, the solution allows the on-premises firewall to allow traffic based on these known IPs. This is essential for the firewall appliance's allow list, ensuring that only traffic from these static IPs is permitted.2.Integration with ALB: The NLB can direct traffic to the existing Application Load Balancer (ALB) via a target group. This setup maintains the current architecture while enabling the use of static IPs for the firewall configuration.3.Traffic Flow: Clients can continue to access the application without changes to the internal architecture, as the NLB will forward the requests to the ALB, preserving the path-based routing that the application relies on.Overall, this solution minimizes disruption to the existing setup while meeting the security requirements imposed by the new firewall.
A company runs an application on a fleet of Amazon EC2 instances that are in private subnets behind an internet-facing Application Load Balancer (ALB). The ALB is the origin for an Amazon CloudFront distribution. An AWS WAF web ACL that contains various AWS managed rules is associated with the CloudFront distribution.The company needs a solution that will prevent internet traffic from directly accessing the ALB.Which solution will meet these requirements with the LEAST operational overhead?
The selected solution is:C) Add a security group rule to the ALB to allow traffic from the AWS managed prefix list for CloudFront only.Reasoning:1.Restricting Access: By adding a security group rule to the Application Load Balancer (ALB) that only allows traffic from the AWS managed prefix list for CloudFront, the solution effectively prevents any direct internet traffic from accessing the ALB. This ensures that all traffic must go through the CloudFront distribution first.2.Minimal Operational Overhead: Using the AWS managed prefix list simplifies management because it automatically updates to include the necessary IP address ranges for CloudFront, reducing the need for manual updates or maintenance.3.Maintaining Existing Setup: This solution leverages the existing architecture, allowing CloudFront to handle incoming requests and route them to the ALB while ensuring that direct access is blocked, thus maintaining the intended security posture.Overall, this solution provides a straightforward and efficient way to achieve the desired outcome with minimal operational overhead.
Post your Comments and Discuss Amazon AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL content, but please register or login to continue.