An online gaming company needs to rehost its gaming platform on AWS. The company's gaming application requires high performance computing (HPC) processing and has a leaderboard that changes frequently. An Ubuntu instance that is optimized for compute generation hosts a Node.js application for game display. Game state is tracked in an on-premises Redis instance.The company needs a migration strategy that optimizes application performance.Which solution will meet these requirements?
Answer(s): C
-C) Create an Auto Scaling group of c5.large Amazon EC2 On-Demand Instances behind an Application Load Balancer. Use an Amazon ElastiCache for Redis cluster to maintain the leaderboard: This solution is optimized for high-performance computing (HPC) because the c5.large instance type is designed for compute-intensive workloads. Using On-Demand Instances ensures consistent performance for the gaming platform, while ElastiCache for Redis provides in-memory data storage that is ideal for maintaining frequently updated data like a gaming leaderboard. Redis is well-suited for real-time applications, which optimizes both game state tracking and performance.
A solutions architect is designing an application to accept timesheet entries from employees on their mobile devices. Timesheets will be submitted weekly, with most of the submissions occurring on Friday. The data must be stored in a format that allows payroll administrators to run monthly reports. The infrastructure must be highly available and scale to match the rate of incoming data and reporting requests.Which combination of steps meets these requirements while minimizing operational overhead? (Choose two.)
Answer(s): C,E
-C) Deploy the application front end to an Amazon S3 bucket served by Amazon CloudFront. Deploy the application backend using Amazon API Gateway with an AWS Lambda proxy integration: This solution provides a highly available, scalable, and serverless architecture with minimal operational overhead. S3 and CloudFront can handle large numbers of users without requiring infrastructure management, while API Gateway and Lambda automatically scale to match the demand.-E) Store the timesheet submission data in Amazon S3. Use Amazon Athena and Amazon QuickSight to generate the reports using Amazon S3 as the data source: Storing data in S3 is cost-effective and highly available. Using Athena allows for querying data directly in S3 without the need for complex ETL processes, and QuickSight provides an easy way to visualize the data. This combination minimizes operational complexity and provides the ability to generate reports as needed.These options ensure scalability, availability, and minimal operational overhead while supporting reporting and data storage needs.
A company is storing sensitive data in an Amazon S3 bucket. The company must log all activities for objects in the S3 bucket and must keep the logs for 5 years. The company's security team also must receive an email notification every time there is an attempt to delete data in the S3 bucket.Which combination of steps will meet these requirements MOST cost-effectively? (Choose three.)
Answer(s): A,D,F
-A) Configure AWS CloudTrail to log S3 data events: CloudTrail can log S3 object-level API activity, including data access and deletion events. This helps meet the requirement of logging all activities for objects in the S3 bucket.-D) Configure Amazon S3 to send object deletion events to an Amazon EventBridge event bus that publishes to an Amazon Simple Notification Service (Amazon SNS) topic: This setup allows for automatic email notifications to be sent whenever there is an attempt to delete an object in the S3 bucket. SNS sends the email, and EventBridge triggers the notification based on deletion events.-F) Configure a new S3 bucket to store the logs with an S3 Lifecycle policy: Storing logs in S3 is cost-effective. Using an S3 Lifecycle policy ensures that logs are automatically archived or deleted after 5 years, meeting the retention requirement.This solution meets the company's needs for logging, notifications, and cost-effectiveness with minimal operational complexity.
A company is building a hybrid environment that includes servers in an on-premises data center and in the AWS Cloud. The company has deployed Amazon EC2 instances in three VPCs. Each VPC is in a different AWS Region. The company has established an AWS Direct. Connect connection to the data center from the Region that is closest to the data center.The company needs the servers in the on-premises data center to have access to the EC2 instances in all three VPCs. The servers in the on-premises data center also must have access to AWS public services.Which combination of steps will meet these requirements with the LEAST cost? (Choose two.)
Answer(s): A,D
-A) Create a Direct Connect gateway in the Region that is closest to the data center. Attach the Direct Connect connection to the Direct Connect gateway. Use the Direct Connect gateway to connect the VPCs in the other two Regions: The Direct Connect gateway allows for centralized and cost-effective connectivity between on-premises data centers and VPCs in multiple AWS Regions. This setup avoids the need for multiple Direct Connect connections, reducing costs.-D) Create a public VIF. Establish an AWS Site-to-Site VPN connection over the public VIF to the VPCs in the other two Regions: A public VIF allows access to public AWS services like S3 and DynamoDB. Establishing a VPN over the public VIF provides secure communication between the on-premises data center and AWS services without additional Direct Connect connections, minimizing costs.This combination provides secure, scalable, and cost-effective access to EC2 instances in multiple Regions and AWS public services.
A company is using an organization in AWS Organizations to manage hundreds of AWS accounts. A solutions architect is working on a solution to provide baseline protection for the Open Web Application Security Project (OWASP) top 10 web application vulnerabilities. The solutions architect is using AWS WAF for all existing and new Amazon CloudFront distributions that are deployed within the organization.Which combination of steps should the solutions architect take to provide the baseline protection? (Choose three.)
Answer(s): A,C,D
-A) Enable AWS Config in all accounts: AWS Config is essential for tracking configuration changes and compliance across all accounts. It ensures that security measures like AWS WAF and other services are properly monitored and consistently applied across the organization.-C) Enable all features for the organization: Enabling all features in AWS Organizations allows centralized management and the use of AWS Security and Compliance services like AWS Firewall Manager across all AWS accounts. This step is necessary for organization-wide security control.-D) Use AWS Firewall Manager to deploy AWS WAF rules in all accounts for all CloudFront distributions: AWS Firewall Manager simplifies the deployment and management of AWS WAF rules across multiple AWS accounts and resources, including CloudFront distributions, ensuring baseline protection against OWASP top 10 vulnerabilities.This combination ensures centralized, consistent security policies across all accounts with minimal operational overhead.
A solutions architect has implemented a SAML 2.0 federated identity solution with their company's on-premises identity provider (IdP) to authenticate users' access to the AWS environment. When the solutions architect tests authentication through the federated identity web portal, access to the AWS environment is granted. However, when test users attempt to authenticate through the federated identity web portal, they are not able to access the AWS environment.Which items should the solutions architect check to ensure identity federation is properly configured? (Choose three.)
Answer(s): B,C,E
-B) The IAM roles created for the federated users' or federated groups' trust policy have set the SAML provider as the principal: The trust policy of the IAM roles must properly set the SAML provider as the principal to allow federated users access to AWS resources. Without this, the SAML assertions won't map correctly, causing access issues.-C) Test users are not in the AWSFederatedUsers group in the company's IdP: Federated users must belong to the correct group in the IdP for their SAML assertions to map to the corresponding IAM roles in AWS. Ensuring the users are in the right group is critical for proper access.-F) The company's IdP defines SAML assertions that properly map users or groups to IAM roles with appropriate permissions: The SAML assertions from the IdP must be correctly configured to map users or groups to corresponding IAM roles with appropriate permissions in AWS. This ensures that users receive the permissions they are entitled to when authenticating.These checks ensure proper configuration for the federated identity solution.
A solutions architect needs to improve an application that is hosted in the AWS Cloud. The application uses an Amazon Aurora MySQL DB instance that is experiencing overloaded connections. Most of the application’s operations insert records into the database. The application currently stores credentials in a text-based configuration file.The solutions architect needs to implement a solution so that the application can handle the current connection load. The solution must keep the credentials secure and must provide the ability to rotate the credentials automatically on a regular basis.Which solution will meet these requirements?
Answer(s): A
-A) Deploy an Amazon RDS Proxy layer in front of the DB instance. Store the connection credentials as a secret in AWS Secrets Manager: RDS Proxy helps manage and pool database connections efficiently, which can reduce the load on the database by reusing connections. Storing the credentials in AWS Secrets Manager ensures that the credentials are kept secure and can be rotated automatically. This solution addresses both the connection load issue and the need for secure and regularly rotated credentials.This approach meets the requirements for connection load management and credential security with minimal operational complexity.
A company needs to build a disaster recovery (DR) solution for its ecommerce website. The web application is hosted on a fleet of t3.large Amazon EC2 instances and uses an Amazon RDS for MySQL DB instance. The EC2 instances are in an Auto Scaling group that extends across multiple Availability Zones.In the event of a disaster, the web application must fail over to the secondary environment with an RPO of 30 seconds and an RTO of 10 minutes.Which solution will meet these requirements MOST cost-effectively?
Answer(s): B
-B) Use infrastructure as code (IaC) to provision the new infrastructure in the DR Region. Create a cross-Region read replica for the DB instance. Set up AWS Elastic Disaster Recovery to continuously replicate the EC2 instances to the DR Region. Run the EC2 instances at the minimum capacity in the DR Region. Use an Amazon Route 53 failover routing policy to automatically fail over to the DR Region in the event of a disaster. Increase the desired capacity of the Auto Scaling group: This solution is cost-effective and meets the RPO of 30 seconds and the RTO of 10 minutes. The cross-Region read replica ensures near-real-time data availability in the DR Region, and AWS Elastic Disaster Recovery ensures continuous replication of EC2 instances. Running EC2 instances at the minimum capacity in the DR Region saves costs while ensuring quick recovery. Route 53 failover routing allows for automatic failover to the DR Region in case of a disaster.This solution balances cost and performance while meeting the RPO and RTO requirements.
Post your Comments and Discuss Amazon AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL content, but please register or login to continue.