QUESTION: 121

A company is migrating some of its applications to AWS. The company wants to migrate and modernize the applications quickly after it finalizes networking and security strategies. The company has set up an AWS Direct Connect connection in a central network account.

The company expects to have hundreds of AWS accounts and VPCs in the near future. The corporate network must be able to access the resources on AWS seamlessly and also must be able to communicate with all the VPCs. The company also wants to route its cloud resources to the internet through its on-premises data center.

Which combination of steps will meet these requirements? (Choose three.)

Create a Direct Connect gateway in the central account. In each of the accounts, create an association proposal by using the Direct Connect gateway and the account ID for every virtual private gateway.
Create a Direct Connect gateway and a transit gateway in the central network account. Attach the transit gateway to the Direct Connect gateway by using a transit VIF.
Provision an internet gateway. Attach the internet gateway to subnets. Allow internet traffic through the gateway.
Share the transit gateway with other accounts. Attach VPCs to the transit gateway.
Provision VPC peering as necessary.
Provision only private subnets. Open the necessary route on the transit gateway and customer gateway to allow outbound internet traffic from AWS to flow through NAT services that run in the data center.

Answer(s): B,D,F

Explanation:

To successfully migrate and modernize the applications while ensuring seamless access to AWS resources from the corporate network, the following steps are essential:

B) Create a Direct Connect gateway and a transit gateway in the central network account. Attach the transit gateway to the Direct Connect gateway using a transit VIF. This setup enables a central point for routing traffic from the on-premises data center to multiple VPCs across various AWS accounts, leveraging the high bandwidth and low latency of AWS Direct Connect.

D) Share the transit gateway with other accounts. Attach VPCs to the transit gateway. By sharing the transit gateway, all associated VPCs can communicate with one another and with the on-premises data center, facilitating efficient routing between accounts.

F) Provision only private subnets. Open the necessary route on the transit gateway and customer gateway to allow outbound internet traffic from AWS to flow through NAT services that run in the data center. This ensures that internet-bound traffic is routed through the on-premises data center, maintaining compliance with the company's networking strategy.

This approach ensures scalability, efficient resource access, and the ability to route traffic as required, all while minimizing operational complexity.

Reveal Solution Next Question

QUESTION: 122

A company has hundreds of AWS accounts. The company recently implemented a centralized internal process for purchasing new Reserved Instances and modifying existing Reserved Instances. This process requires all business units that want to purchase or modify Reserved Instances to submit requests to a dedicated team for procurement. Previously, business units directly purchased or modified Reserved Instances in their own respective AWS accounts autonomously.

A solutions architect needs to enforce the new process in the most secure way possible.

Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)

Ensure that all AWS accounts are part of an organization in AWS Organizations with all features enabled.
Use AWS Config to report on the attachment of an IAM policy that denies access to the ec2:PurchaseReservedInstancesOffering action and the ec2:ModifyReservedInstances action.
In each AWS account, create an IAM policy that denies the ec2:PurchaseReservedInstancesOffering action and the ec2:ModifyReservedInstances action.
Create an SCP that denies the ec2:PurchaseReservedInstancesOffering action and the ec2:ModifyReservedInstances action. Attach the SCP to each OU of the organization.
Ensure that all AWS accounts are part of an organization in AWS Organizations that uses the consolidated billing feature.

Answer(s): A,D

Explanation:

To enforce a centralized process for purchasing and modifying Reserved Instances in a secure manner across multiple AWS accounts, the following steps should be taken:

A) Ensure that all AWS accounts are part of an organization in AWS Organizations with all features enabled. This setup allows for centralized management of policies and permissions across all accounts, enabling the implementation of Service Control Policies (SCPs) to restrict actions at the organizational level.

D) Create an SCP that denies the ec2:PurchaseReservedInstancesOffering action and the ec2:ModifyReservedInstances action. Attach the SCP to each OU of the organization. By using SCPs, the organization can enforce the new procurement process across all accounts within the specified OUs, ensuring that no business unit can independently purchase or modify Reserved Instances without going through the designated procurement team.

Together, these steps ensure that the process is both secure and compliant with the new centralized purchasing strategy.

Reveal Solution Next Question

QUESTION: 123

A company is running a critical application that uses an Amazon RDS for MySQL database to store data. The RDS DB instance is deployed in Multi-AZ mode.

A recent RDS database failover test caused a 40-second outage to the application. A solutions architect needs to design a solution to reduce the outage time to less than 20 seconds.

Which combination of steps should the solutions architect take to meet these requirements? (Choose three.)

Use Amazon ElastiCache for Memcached in front of the database
Use Amazon ElastiCache for Redis in front of the database
Use RDS Proxy in front of the database.
Migrate the database to Amazon Aurora MySQL.
Create an Amazon Aurora Replica.
Create an RDS for MySQL read replica

Answer(s): C,D,E

Explanation:

To reduce the outage time during RDS database failover to less than 20 seconds, the following steps should be taken:

C) Use RDS Proxy in front of the database. RDS Proxy helps manage connections to the RDS database and allows for connection pooling, which can reduce failover times by maintaining connections through the proxy. In case of a failover, the proxy can quickly redirect connections to the new primary database instance.

D) Migrate the database to Amazon Aurora MySQL. Amazon Aurora is designed for high availability and can provide faster failover times compared to RDS for MySQL. It offers a more resilient architecture that can minimize downtime during failovers.

E) Create an Amazon Aurora Replica. Aurora Replicas can be used to offload read traffic and, during a failover, they can be promoted quickly to a primary instance, thus significantly reducing the downtime experienced during a failover.

By implementing these solutions, the company can enhance its application's availability and ensure that failover times are minimized.

Reveal Solution Next Question

QUESTION: 124

An AWS partner company is building a service in AWS Organizations using its organization named org1. This service requires the partner company to have access to AWS resources in a customer account, which is in a separate organization named org2. The company must establish least privilege security access using an API or command line tool to the customer account.

What is the MOST secure way to allow org1 to access resources in org2?

The customer should provide the partner company with their AWS account access keys to log in and perform the required tasks.
The customer should create an IAM user and assign the required permissions to the IAM user. The customer should then provide the credentials to the partner company to log in and perform the required tasks.
The customer should create an IAM role and assign the required permissions to the IAM role. The partner company should then use the IAM role’s Amazon Resource Name (ARN) when requesting access to perform the required tasks.
The customer should create an IAM role and assign the required permissions to the IAM role. The partner company should then use the IAM role’s Amazon Resource Name (ARN), including the external ID in the IAM role’s trust policy, when requesting access to perform the required tasks.

Answer(s): D

Explanation:

The most secure way to allow the partner company in org1 to access resources in the customer account in org2 is:

D) The customer should create an IAM role and assign the required permissions to that role. The partner company should then use the IAM role’s Amazon Resource Name (ARN), including an external ID in the IAM role’s trust policy, when requesting access to perform the required tasks.

This approach provides several security benefits:

IAM Role: Roles are designed for temporary access and can have permissions tailored to specific tasks, adhering to the principle of least privilege.
Trust Policy with External ID: Using an external ID helps mitigate the risk of the confused deputy problem, ensuring that only the intended third party (the partner company) can assume the role, even if the ARN is known to others.
By using IAM roles with external IDs, the customer can securely grant access without sharing long-term credentials or access keys, minimizing the risk of unauthorized access.

Reveal Solution Next Question

Free SAP-C01 Exam Braindumps (page: 31)

QUESTION: 121

Explanation:

QUESTION: 122

Explanation:

QUESTION: 123

Explanation:

QUESTION: 124

Explanation: