A company has an application that runs on Amazon EC2 instances in an Amazon EC2 Auto Scaling group. The company uses AWS CodePipeline to deploy the application. The instances that run in the Auto Scaling group are constantly changing because of scaling events.When the company deploys new application code versions, the company installs the AWS CodeDeploy agent on any new target EC2 instances and associates the instances with the CodeDeploy deployment group. The application is set to go live within the next 24 hours.What should a solutions architect recommend to automate the application deployment process with the LEAST amount of operational overhead?
Answer(s): D
D) Creating a new AMI that has the CodeDeploy agent installed and configuring the Auto Scaling group’s launch template to use the new AMI automates the process of ensuring that new EC2 instances are ready for deployment as soon as they are launched. Associating the CodeDeploy deployment group with the Auto Scaling group instead of individual EC2 instances eliminates the need to manually install the CodeDeploy agent and register instances each time new instances are launched. This solution minimizes operational overhead and ensures smooth deployments with minimal effort.
A company has a website that runs on four Amazon EC2 instances that are behind an Application Load Balancer (ALB). When the ALB detects that an EC2 instance is no longer available, an Amazon CloudWatch alarm enters the ALARM state. A member of the company's operations team then manually adds a new EC2 instance behind the ALB.A solutions architect needs to design a highly available solution that automatically handles the replacement of EC2 instances. The company needs to minimize downtime during the switch to the new solution.Which set of steps should the solutions architect take to meet these requirements?
Answer(s): B
B) Creating an Auto Scaling group that is configured to handle the web application traffic and attaching the existing ALB and EC2 instances to the Auto Scaling group allows for seamless integration with minimal downtime. This solution ensures high availability by automatically replacing failed instances. By attaching the Auto Scaling group to the existing ALB, the company avoids the need to create a new ALB, thus minimizing downtime and the impact on the live environment.This approach automates the process of replacing EC2 instances, improving fault tolerance and reducing manual intervention.
A company wants to optimize AWS data-transfer costs and compute costs across developer accounts within the company's organization in AWS Organizations. Developers can configure VPCs and launch Amazon EC2 instances in a single AWS Region. The EC2 instances retrieve approximately 1 TB of data each day from Amazon S3.The developer activity leads to excessive monthly data-transfer charges and NAT gateway processing charges between EC2 instances and S3 buckets, along with high compute costs. The company wants to proactively enforce approved architectural patterns for any EC2 instance and VPC infrastructure that developers deploy within the AWS accounts. The company does not want this enforcement to negatively affect the speed at which the developers can perform their tasks.Which solution will meet these requirements MOST cost-effectively?
Answer(s): C
C) Creating an AWS Service Catalog portfolio allows the company to provide developers with pre-approved VPC configurations and EC2 instance types, which can include S3 gateway endpoints to minimize data transfer costs. By sharing the portfolio with the developer accounts, the company ensures that only approved infrastructure is deployed. Configuring an AWS Service Catalog launch constraint to use an approved IAM role and scoping developer permissions to Service Catalog enables governance without negatively impacting developer productivity. This solution provides cost optimization and proactive architectural enforcement with minimal operational overhead, making it the most cost-effective option.
A company is expanding. The company plans to separate its resources into hundreds of different AWS accounts in multiple AWS Regions. A solutions architect must recommend a solution that denies access to any operations outside of specifically designated Regions.Which solution will meet these requirements?
C) Launching an AWS Control Tower landing zone allows the company to create organizational units (OUs) and attach Service Control Policies (SCPs) that explicitly deny access to services in regions outside of the approved list. SCPs are enforced across all accounts within the organization, ensuring compliance with the designated region restrictions. This solution provides centralized governance and control over multiple accounts and regions, making it the most effective and scalable approach to meet the company's requirements.
A company wants to refactor its retail ordering web application that currently has a load-balanced Amazon EC2 instance fleet for web hosting, database API services, and business logic. The company needs to create a decoupled, scalable architecture with a mechanism for retaining failed orders while also minimizing operational costs.Which solution will meet these requirements?
C) Using Amazon S3 for web hosting and AWS AppSync for database API services provides a highly scalable and cost-effective architecture. For order queuing, Amazon Simple Queue Service (SQS) ensures decoupling and scalability. Integrating AWS Lambda for business logic provides a serverless, scalable solution that minimizes operational overhead. Implementing an SQS dead-letter queue ensures that failed orders are retained for future processing or debugging. This solution effectively refactors the application to meet the requirements of scalability, decoupling, and operational cost minimization.
A company hosts a web application on AWS in the us-east-1 Region. The application servers are distributed across three Availability Zones behind an Application Load Balancer. The database is hosted in a MySQL database on an Amazon EC2 instance. A solutions architect needs to design a cross-Region data recovery solution using AWS services with an RTO of less than 5 minutes and an RPO of less than 1 minute. The solutions architect is deploying application servers in us-west-2, and has configured Amazon Route 53 health checks and DNS failover to us-west-2.Which additional step should the solutions architect take?
B) Using an Amazon Aurora global database provides a highly available and low-latency cross-Region replication solution. With the primary database in us-east-1 and a secondary in us-west-2, Aurora ensures RPO of less than 1 minute due to asynchronous replication with low lag. In case of a failure in us-east-1, the secondary in us-west-2 can be promoted to primary within the required RTO of less than 5 minutes. This solution meets both the RTO and RPO requirements and ensures seamless cross-Region disaster recovery.
A company is using AWS Organizations to manage multiple accounts. Due to regulatory requirements, the company wants to restrict specific member accounts to certain AWS Regions, where they are permitted to deploy resources. The resources in the accounts must be tagged, enforced based on a group standard, and centrally managed with minimal configuration.What should a solutions architect do to meet these requirements?
D) Associating the specific member accounts with a new Organizational Unit (OU) and applying both a tag policy and a Service Control Policy (SCP) is the best approach. The SCP can be used to restrict access to certain AWS Regions, while the tag policy ensures consistent tagging across resources in those accounts. This solution allows for centralized management and enforces the required limitations on Region access and tagging, fulfilling the regulatory requirements with minimal configuration.
A company has an application that generates reports and stores them in an Amazon S3 bucket. When a user accesses their report, the application generates a signed URL to allow the user to download the report. The company's security team has discovered that the files are public and that anyone can download them without authentication. The company has suspended the generation of new reports until the problem is resolved.Which set of actions will immediately remediate the security issue without impacting the application's normal workflow?
D) Using the Block Public Access feature in Amazon S3 and setting the IgnorePublicAcls option to TRUE on the bucket will immediately prevent any public access to the objects in the bucket without disrupting the application's normal workflow. This will ensure that only authenticated and authorized users can access the reports via signed URLs, addressing the security issue while maintaining the application's functionality.
Post your Comments and Discuss Amazon AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AWS-SOLUTIONS-ARCHITECT-PROFESSIONAL content, but please register or login to continue.