A company has a data lake in Amazon S3 that needs to be accessed by hundreds of applications across many AWS accounts. The company's information security policy states that the S3 bucket must not be accessed over the public internet and that each application should have the minimum permissions necessary to function.To meet these requirements, a solutions architect plans to use an S3 access point that is restricted to specific VPCs for each application.Which combination of steps should the solutions architect take to implement this solution? (Choose two.)
Answer(s): A,C
A) Creating an S3 access point for each application in the AWS account that owns the S3 bucket and restricting access to the application's VPC ensures that access to the bucket is secured within the VPC and meets the security requirement of avoiding public internet access. Updating the bucket policy to require access through the access point provides additional security control.C) Creating a gateway endpoint for Amazon S3 in each application's VPC and configuring the endpoint policy to allow access to the S3 access point ensures that all access remains within the VPC and doesn't traverse the public internet. This meets the requirement of securing the connection and providing minimum permissions necessary for each application.This combination provides a secure, controlled access mechanism that aligns with the company's security policies.
A company has developed a hybrid solution between its data center and AWS. The company uses Amazon VPC and Amazon EC2 instances that send application logs to Amazon CloudWatch. The EC2 instances read data from multiple relational databases that are hosted on premises.The company wants to monitor which EC2 instances are connected to the databases in near-real time. The company already has a monitoring solution that uses Splunk on premises. A solutions architect needs to determine how to send networking traffic to Splunk.How should the solutions architect meet these requirements?
Answer(s): B
B) Using Amazon Kinesis Data Firehose with Splunk as the destination ensures that log data is sent to Splunk in near real-time. Configuring a pre-processing AWS Lambda function to handle log events from CloudWatch Logs allows for efficient extraction and delivery of logs to Splunk. Enabling VPC flow logs and sending them to CloudWatch ensures that the required networking traffic is captured and processed correctly.This solution meets the requirements for monitoring EC2 instances connected to databases in near-real-time while seamlessly integrating with the existing Splunk solution.
A company has five development teams that have each created five AWS accounts to develop and host applications. To track spending, the development teams log in to each account every month, record the current cost from the AWS Billing and Cost Management console, and provide the information to the company's finance team.The company has strict compliance requirements and needs to ensure that resources are created only in AWS Regions in the United States. However, some resources have been created in other Regions.A solutions architect needs to implement a solution that gives the finance team the ability to track and consolidate expenditures for all the accounts. The solution also must ensure that the company can create resources only in Regions in the United States.Which combination of steps will meet these requirements in the MOST operationally efficient way? (Choose three.)
Answer(s): B,D,E
B) Creating a management account and deploying an organization in AWS Organizations enables centralized management of accounts, allowing you to consolidate billing and apply organization-wide policies. This ensures operational efficiency and cost tracking.D) Applying a Service Control Policy (SCP) that denies the creation of resources in Regions outside the United States ensures compliance with the company's requirement to create resources only in US Regions.E) Creating an IAM role in the management account with permissions to view the Billing and Cost Management console allows the finance team to analyze costs across all accounts without needing to log in to each individual account, simplifying cost tracking.These steps provide an efficient, scalable solution for cost tracking and ensuring compliance across multiple AWS accounts.
A company needs to create and manage multiple AWS accounts for a number of departments from a central location. The security team requires read-only access to all accounts from its own AWS account. The company is using AWS Organizations and created an account for the security team.How should a solutions architect meet these requirements?
B) Creating an IAM role with read-only access in each member account and establishing a trust relationship between the IAM role and the security account allows the security team to assume the role and gain access. This solution leverages AWS Organizations and IAM roles to provide centralized, secure read-only access to all member accounts from the security account. This approach is efficient and scalable for managing multiple accounts.
A large company runs workloads in VPCs that are deployed across hundreds of AWS accounts. Each VPC consists of public subnets and private subnets that span across multiple Availability Zones. NAT gateways are deployed in the public subnets and allow outbound connectivity to the internet from the private subnets.A solutions architect is working on a hub-and-spoke design. All private subnets in the spoke VPCs must route traffic to the internet through an egress VPC. The solutions architect already has deployed a NAT gateway in an egress VPC in a central AWS account.Which set of additional steps should the solutions architect take to meet these requirements?
B) Creating a transit gateway and sharing it with the existing AWS accounts allows the spoke VPCs to route traffic to the egress VPC. By attaching the existing VPCs to the transit gateway, the solution centralizes the outbound traffic flow, enabling private subnets in the spoke VPCs to access the internet through the egress VPC’s NAT gateway. This approach efficiently manages routing and scales across multiple AWS accounts, making it the best fit for the hub-and-spoke design.
An education company is running a web application used by college students around the world. The application runs in an Amazon Elastic Container Service (Amazon ECS) cluster in an Auto Scaling group behind an Application Load Balancer (ALB). A system administrator detects a weekly spike in the number of failed login attempts, which overwhelm the application's authentication service. All the failed login attempts originate from about 500 different IP addresses that change each week. A solutions architect must prevent the failed login attempts from overwhelming the authentication service.Which solution meets these requirements with the MOST operational efficiency?
B) Creating an AWS WAF web ACL with a rate-based rule that blocks IP addresses generating excessive failed login attempts is the most operationally efficient solution. This rule can automatically detect and block IP addresses that exceed a specified request threshold, preventing the authentication service from being overwhelmed. The web ACL can be connected to the ALB to provide centralized protection for the entire application. This solution is automated and requires minimal ongoing management.
A company operates an on-premises software-as-a-service (SaaS) solution that ingests several files daily. The company provides multiple public SFTP endpoints to its customers to facilitate the file transfers. The customers add the SFTP endpoint IP addresses to their firewall allow list for outbound traffic. Changes to the SFTP endpoint IP addresses are not permitted.The company wants to migrate the SaaS solution to AWS and decrease the operational overhead of the file transfer service.Which solution meets these requirements?
Answer(s): A
A) Registering the customer-owned block of IP addresses in the company's AWS account and assigning Elastic IP addresses to an AWS Transfer for SFTP endpoint allows the company to maintain the same IP addresses that customers have added to their firewall allow lists. AWS Transfer for SFTP enables secure and managed SFTP file transfers with files stored in Amazon S3, reducing operational overhead by eliminating the need to manage SFTP servers directly.This solution meets the requirements of preserving IP addresses while decreasing operational effort.
A company has a new application that needs to run on five Amazon EC2 instances in a single AWS Region. The application requires high-throughput, low-latency network connections between all of the EC2 instances where the application will run. There is no requirement for the application to be fault tolerant.Which solution will meet these requirements?
A) Launching the EC2 instances into a cluster placement group provides high-throughput, low-latency network connections between instances within the same group. A cluster placement group is designed to achieve low-latency networking by keeping instances physically close together in the same Availability Zone. Ensuring that the EC2 instance type supports enhanced networking further improves network performance.This solution meets the requirement for high-throughput, low-latency connections between the EC2 instances.
Post your Comments and Discuss Amazon AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL content, but please register or login to continue.