A company is creating a REST API to share information with six of its partners based in the United States. The company has created an Amazon API Gateway Regional endpoint. Each of the six partners will access the API once per day to post daily sales figures.After initial deployment, the company observes 1,000 requests per second originating from 500 different IP addresses around the world. The company believes this traffic is originating from a botnet and wants to secure its API while minimizing cost.Which approach should the company take to secure its API?
Answer(s): D
D) Creating an AWS WAF web ACL to allow access only from the IP addresses of the six partners ensures that only trusted partners can access the API. Associating a usage plan with the API and creating an API key for each partner limits the number of requests they can make (e.g., one request per day). This solution effectively secures the API against botnet traffic while minimizing cost and ensuring the partners can continue to access the API as needed.
A company uses an Amazon Aurora PostgreSQL DB cluster for applications in a single AWS Region. The company's database team must monitor all data activity on all the databases.Which solution will achieve this goal?
Answer(s): C
C) Starting a database activity stream on the Aurora DB cluster and pushing the stream to an Amazon Kinesis data stream ensures that all database activities are captured in near real-time. Using Amazon Kinesis Data Firehose to deliver the data to Amazon S3 provides a scalable and durable storage solution for further analysis. This approach allows the company to monitor all data activities efficiently and provides flexibility in processing and analyzing the data.
An entertainment company recently launched a new game. To ensure a good experience for players during the launch period, the company deployed a static quantity of 12 r6g.16xlarge (memory optimized) Amazon EC2 instances behind a Network Load Balancer. The company's operations team used the Amazon CloudWatch agent and a custom metric to include memory utilization in its monitoring strategy.Analysis of the CloudWatch metrics from the launch period showed consumption at about one quarter of the CPU and memory that the company expected. Initial demand for the game has subsided and has become more variable. The company decides to use an Auto Scaling group that monitors the CPU and memory consumption to dynamically scale the instance fleet. A solutions architect needs to configure the Auto Scaling group to meet demand in the most cost-effective way.Which solution will meet these requirements?
C) Configuring the Auto Scaling group to deploy r6g.4xlarge (memory optimized) instances with a minimum capacity of 3, a desired capacity of 3, and a maximum capacity of 12 optimizes cost-effectiveness and resource utilization. Since the application was initially deployed on r6g.16xlarge instances, scaling down to smaller r6g.4xlarge instances based on actual usage patterns (lower-than-expected CPU and memory consumption) will better match the demand, while still providing the necessary memory optimization for the application. This solution ensures the instances are properly sized for the workload, improving cost-efficiency while maintaining performance.
A financial services company loaded millions of historical stock trades into an Amazon DynamoDB table. The table uses on-demand capacity mode. Once each day at midnight, a few million new records are loaded into the table. Application read activity against the table happens in bursts throughout the day. and a limited set of keys are repeatedly looked up. The company needs to reduce costs associated with DynamoDB.Which strategy should a solutions architect recommend to meet this requirement?
D) Deploying DynamoDB Accelerator (DAX) can help reduce the read traffic cost by caching frequently accessed data, reducing the need to query the DynamoDB table repeatedly. Switching to provisioned capacity mode with auto scaling allows the system to scale based on actual demand, providing a cost-effective solution for handling periodic data loading and read bursts. This setup meets the need for cost reduction while maintaining performance.
A company is creating a centralized logging service running on Amazon EC2 that will receive and analyze logs from hundreds of AWS accounts. AWS PrivateLink is being used to provide connectivity between the client services and the logging service.In each AWS account with a client, an interface endpoint has been created for the logging service and is available. The logging service running on EC2 instances with a Network Load Balancer (NLB) are deployed in different subnets. The clients are unable to submit logs using the VPC endpoint.Which combination of steps should a solutions architect take to resolve this issue? (Choose two.)
Answer(s): A,C
A) Ensuring that the NACL (Network Access Control List) attached to the logging service subnet allows communication to and from the NLB subnets is critical for the traffic flow between the EC2 instances hosting the logging service and the NLB. Similarly, the NACLs on the NLB subnets must allow communication to and from the EC2 instance subnets to ensure the connection works properly.C) Checking the security group for the EC2 instances running the logging service to ensure it allows ingress from the NLB subnets is crucial. This step ensures that traffic coming from the NLB can reach the logging service hosted on the EC2 instances.These steps address both the networking and security group configurations to resolve the issue preventing clients from submitting logs through the VPC endpoint.
A company has millions of objects in an Amazon S3 bucket. The objects are in the S3 Standard storage class. All the S3 objects are accessed frequently. The number of users and applications that access the objects is increasing rapidly. The objects are encrypted with server-side encryption with AWS KMS keys (SSE-KMS).A solutions architect reviews the company’s monthly AWS invoice and notices that AWS KMS costs are increasing because of the high number of requests from Amazon S3. The solutions architect needs to optimize costs with minimal changes to the application.Which solution will meet these requirements with the LEAST operational overhead?
Answer(s): B
B) Creating a new S3 bucket with server-side encryption using Amazon S3 managed keys (SSE-S3) and using S3 Batch Operations to copy the existing objects will significantly reduce the AWS KMS costs. SSE-S3 provides encryption without the overhead of using KMS keys, making it a cost-effective alternative while keeping encryption enabled. This solution requires minimal changes to the application and optimizes costs with the least operational overhead.
A media storage application uploads user photos to Amazon S3 for processing by AWS Lambda functions. Application state is stored in Amazon DynamoDB tables. Users are reporting that some uploaded photos are not being processed properly. The application developers trace the logs and find that Lambda is experiencing photo processing issues when thousands of users upload photos simultaneously. The issues are the result of Lambda concurrency limits and the performance of DynamoDB when data is saved.Which combination of actions should a solutions architect take to increase the performance and reliability of the application? (Choose two.)
Answer(s): B,D
B) Adjusting the WCUs (Write Capacity Units) for the DynamoDB tables will help address write performance issues, especially when large numbers of users are uploading photos simultaneously. DynamoDB's write capacity should be scaled up to handle the increased data ingestion.D) Adding an Amazon SQS queue between Amazon S3 and the Lambda functions helps decouple the photo upload and processing, allowing the system to handle bursts of traffic without hitting Lambda concurrency limits. SQS will buffer the requests, enabling Lambda to process them asynchronously and reliably.This combination improves both the performance of DynamoDB and the reliability of the Lambda functions under heavy load.
A company runs an application in an on-premises data center. The application gives users the ability to upload media files. The files persist in a file server. The web application has many users. The application server is overutilized, which causes data uploads to fail occasionally. The company frequently adds new storage to the file server. The company wants to resolve these challenges by migrating the application to AWS.Users from across the United States and Canada access the application. Only authenticated users should have the ability to access the application to upload files. The company will consider a solution that refactors the application, and the company needs to accelerate application development.Which solution will meet these requirements with the LEAST operational overhead?
D) Using AWS Amplify to create a static website for media file uploads with Amplify Hosting and Amazon CloudFront provides a highly scalable and low-maintenance solution. Amazon S3 is ideal for storing the uploaded media files, and Amazon Cognito offers a straightforward method for user authentication. This solution refactors the application with the least operational overhead, leveraging fully managed services for storage, authentication, and content delivery, which accelerates application development.
Post your Comments and Discuss Amazon AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL content, but please register or login to continue.