A company is running an application that uses an Amazon ElastiCache for Redis cluster as a caching layer. A recent security audit revealed that the company has configured encryption at rest for ElastiCache. However, the company did not configure ElastiCache to use encryption in transit. Additionally, users can access the cache without authentication.A solutions architect must make changes to require user authentication and to ensure that the company is using end-to-end encryption.Which solution will meet these requirements?
Answer(s): B
The selected solution is:B) Create an AUTH token. Store the token in AWS Secrets Manager. Configure the existing cluster to use the AUTH token, and configure encryption in transit. Update the application to retrieve the AUTH token from Secrets Manager when necessary and to use the AUTH token for authentication.Reasoning:1.Authentication: By creating an AUTH token, the solution implements user authentication for accessing the Amazon ElastiCache for Redis cluster, which addresses the audit finding of allowing access without authentication.2.Storing the AUTH Token Securely: Using AWS Secrets Manager to store the AUTH token ensures that it is kept secure and encrypted, which is a best practice for managing sensitive information. Secrets Manager provides easy retrieval and management of the AUTH token.3.Configuring Encryption in Transit: Configuring the existing ElastiCache cluster to use encryption in transit ensures that data exchanged between the client application and the Redis cluster is secure from eavesdropping or tampering.4.Least Operational Overhead: This approach allows the company to make necessary changes to the existing setup with minimal disruption while effectively meeting both the authentication and encryption requirements.Overall, this solution addresses both security audit concerns effectively while ensuring ease of management and implementation.
A company is running a compute workload by using Amazon EC2 Spot Instances that are in an Auto Scaling group. The launch template uses two placement groups and a single instance type.Recently, a monitoring system reported Auto Scaling instance launch failures that correlated with longer wait times for system users. The company needs to improve the overall reliability of the workload.Which solution will meet this requirement?
B) Create a new launch template version that uses attribute-based instance type selection. Configure the Auto Scaling group to use the new launch template version.1.Attribute-Based Instance Type Selection: This allows the Auto Scaling group to automatically select from multiple instance types, increasing the chances of successfully launching instances.2.Improving Reliability: Using multiple instance types helps mitigate launch failures, especially during Spot Instance unavailability, enhancing overall reliability.3.Flexibility: This method optimizes resource allocation and usage across different instance types, maintaining compute capacity without excessive costs.4.Minimal Changes Required: Updating to a new launch template version is straightforward and maintains existing configurations.This solution effectively addresses the need for improved workload reliability while leveraging the cost benefits of Spot Instances.
A company is migrating a document processing workload to AWS. The company has updated many applications to natively use the Amazon S3 API to store, retrieve, and modify documents that a processing server generates at a rate of approximately 5 documents every second. After the document processing is finished, customers can download the documents directly from Amazon S3.During the migration, the company discovered that it could not immediately update the processing server that generates many documents to support the S3 API. The server runs on Linux and requires fast local access to the files that the server generates and modifies. When the server finishes processing, the files must be available to the public for download within 30 minutes.Which solution will meet these requirements with the LEAST amount of effort?
B) Set up an Amazon S3 File Gateway and configure a file share that is linked to the document store. Mount the file share on an Amazon EC2 instance by using NFS. When changes occur in Amazon S3, initiate a RefreshCache API call to update the S3 File Gateway.1.Immediate Access: The S3 File Gateway provides fast local access to files while still leveraging Amazon S3 for storage, allowing the processing server to operate without immediate changes.2.Seamless Integration: By mounting the file share on the EC2 instance using NFS, the server can interact with files in a familiar manner while they are stored in S3.3.Public Accessibility: Once the documents are processed, they can be made available in Amazon S3 for public download within the required timeframe.4.Minimal Effort: This solution requires minimal changes to the existing infrastructure and avoids the complexities of modifying the processing server to natively use the S3 API.
A delivery company is running a serverless solution in the AWS Cloud. The solution manages user data, delivery information, and past purchase details. The solution consists of several microservices. The central user service stores sensitive data in an Amazon DynamoDB table. Several of the other microservices store a copy of parts of the sensitive data in different storage services.The company needs the ability to delete user information upon request. As soon as the central user service deletes a user, every other microservice must also delete its copy of the data immediately.Which solution will meet these requirements?
Answer(s): C
C) Configure the central user service to post an event on a custom Amazon EventBridge event bus when the company deletes a user. Create an EventBridge rule for each microservice to match the user deletion event pattern and invoke logic in the microservice to delete the user from the DynamoDB table.1.Event-Driven Architecture: Using Amazon EventBridge allows for a decoupled architecture where microservices can react to specific events (in this case, user deletions) without needing direct coupling to the central user service.2.Immediate Action: When the central user service deletes a user, it triggers an event that is published to EventBridge. Each microservice can subscribe to these events, allowing them to take immediate action in response to the deletion.3.Scalability and Flexibility: This solution scales well with the addition of new microservices since they can simply subscribe to the EventBridge event bus without any changes to the central user service.4.Reduced Complexity: It simplifies the workflow as each microservice only needs to implement logic to handle deletion events rather than managing its own polling or direct notifications.
A company is running a web application in a VPC. The web application runs on a group of Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is using AWS WAF.An external customer needs to connect to the web application. The company must provide IP addresses to all external customers.Which solution will meet these requirements with the LEAST operational overhead?
C) Create an AWS Global Accelerator standard accelerator. Specify the ALB as the accelerator's endpoint. Provide the accelerator's IP addresses to the customer.1.IP Address Provisioning: AWS Global Accelerator provides static IP addresses that can be used by clients to connect to the application. This eliminates the need for clients to change IP addresses if the underlying infrastructure changes.2.Load Balancing: By specifying the ALB as the endpoint for the Global Accelerator, it maintains the load balancing functionality while directing traffic efficiently to the application instances.3.High Availability and Performance: Global Accelerator automatically routes traffic to the optimal endpoint based on performance, health, and routing policies, ensuring low latency and high availability.4.Least Operational Overhead: Once set up, the Global Accelerator requires minimal ongoing management, making it a low-overhead solution for providing stable IP addresses to external customers.
A company has a few AWS accounts for development and wants to move its production application to AWS. The company needs to enforce Amazon Elastic Block Store (Amazon EBS) encryption at rest current production accounts and future production accounts only. The company needs a solution that includes built-in blueprints and guardrails.Which combination of steps will meet these requirements? (Choose three.)
Answer(s): C,D,F
C) Create a new AWS Control Tower landing zone in the company’s management account. Add production and development accounts to production and development OUs, respectively.-Landing Zone Setup: Setting up a Control Tower landing zone in the management account establishes a governance framework for managing multiple AWS accounts and provides built-in guardrails.D) Invite existing accounts to join the organization in AWS Organizations. Create SCPs to ensure compliance.-Account Management: Inviting existing accounts to join ensures they are managed under the organization's governance model. Service Control Policies (SCPs) can be used to enforce compliance with EBS encryption at rest.F) Create a guardrail for the production OU to detect EBS encryption.-Guardrail Implementation: Guardrails in AWS Control Tower help enforce best practices and compliance. Creating a specific guardrail for the production OU will ensure that EBS encryption is enforced for all production accounts automatically.These steps provide a comprehensive solution to enforce EBS encryption at rest while leveraging AWS Control Tower’s capabilities for governance and compliance.
A company is running a critical stateful web application on two Linux Amazon EC2 instances behind an Application Load Balancer (ALB) with an Amazon RDS for MySQL database. The company hosts the DNS records for the application in Amazon Route 53. A solutions architect must recommend a solution to improve the resiliency of the application.The solution must meet the following objectives:•Application tier: RPO of 2 minutes. RTO of 30 minutes•Database tier: RPO of 5 minutes. RTO of 30 minutesThe company does not want to make significant changes to the existing application architecture. The company must ensure optimal latency after a failover.Which solution will meet these requirements?
Answer(s): A
A) Configure the EC2 instances to use AWS Elastic Disaster Recovery. Create a cross-Region read replica for the RDS DB instance. Create an ALB in a second AWS Region. Create an AWS Global Accelerator endpoint, and associate the endpoint with the ALBs. Update DNS records to point to the Global Accelerator endpoint.-AWS Elastic Disaster Recovery: This service provides continuous replication of the EC2 instances to a second region, ensuring a low RPO (Recovery Point Objective) and facilitating quick recovery.-Cross-Region Read Replica for RDS: This setup helps achieve the required RPO and ensures that the database can be quickly promoted to a master if the primary fails.-Global Accelerator: By routing traffic through Global Accelerator, you can direct users to the closest healthy region, reducing latency during failover scenarios and ensuring optimal performance after a disaster.This solution aligns with the company's requirements for RPO and RTO while minimizing changes to the existing architecture.
A solutions architect wants to cost-optimize and appropriately size Amazon EC2 instances in a single AWS account. The solutions architect wants to ensure that the instances are optimized based on CPU, memory, and network metrics.Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
Answer(s): C,D
C) Install the Amazon CloudWatch agent and configure memory metric collection on the EC2 instances.-By installing the CloudWatch agent, you can gather detailed metrics about memory usage, which is not available by default. This allows for a comprehensive analysis of instance performance, including CPU, memory, and network utilization.D) Configure AWS Compute Optimizer in the AWS account to receive findings and optimization recommendations.-AWS Compute Optimizer analyzes your historical utilization data and provides recommendations for optimal instance types based on your actual resource usage patterns. This helps in resizing instances to match workload requirements effectively.These two steps will allow the solutions architect to gather detailed utilization data and obtain actionable recommendations for cost optimization and proper sizing of EC2 instances.
Post your Comments and Discuss Amazon AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL content, but please register or login to continue.