QUESTION: 197

A company is using an organization in AWS Organizations to manage hundreds of AWS accounts. A solutions architect is working on a solution to provide baseline protection for the Open Web Application Security Project (OWASP) top 10 web application vulnerabilities. The solutions architect is using AWS WAF for all existing and new Amazon CloudFront distributions that are deployed within the organization.

Which combination of steps should the solutions architect take to provide the baseline protection? (Choose three.)

Enable AWS Config in all accounts
Enable Amazon GuardDuty in all accounts
Enable all features for the organization
Use AWS Firewall Manager to deploy AWS WAF rules in all accounts for all CloudFront distributions
Use AWS Shield Advanced to deploy AWS WAF rules in all accounts for all CloudFront distributions
Use AWS Security Hub to deploy AWS WAF rules in all accounts for all CloudFront distributions

Answer(s): A,C,D

Explanation:

-A) Enable AWS Config in all accounts: AWS Config is essential for tracking configuration changes and compliance across all accounts. It ensures that security measures like AWS WAF and other services are properly monitored and consistently applied across the organization.
-C) Enable all features for the organization: Enabling all features in AWS Organizations allows centralized management and the use of AWS Security and Compliance services like AWS Firewall Manager across all AWS accounts. This step is necessary for organization-wide security control.
-D) Use AWS Firewall Manager to deploy AWS WAF rules in all accounts for all CloudFront distributions: AWS Firewall Manager simplifies the deployment and management of AWS WAF rules across multiple AWS accounts and resources, including CloudFront distributions, ensuring baseline protection against OWASP top 10 vulnerabilities.
This combination ensures centralized, consistent security policies across all accounts with minimal operational overhead.

Reveal Solution Next Question

QUESTION: 198

A solutions architect has implemented a SAML 2.0 federated identity solution with their company's on-premises identity provider (IdP) to authenticate users' access to the AWS environment. When the solutions architect tests authentication through the federated identity web portal, access to the AWS environment is granted. However, when test users attempt to authenticate through the federated identity web portal, they are not able to access the AWS environment.

Which items should the solutions architect check to ensure identity federation is properly configured? (Choose three.)

The IAM user's permissions policy has allowed the use of SAML federation for that user.
The IAM roles created for the federated users' or federated groups' trust policy have set the SAML provider as the principal.
Test users are not in the AWSFederatedUsers group in the company's IdP.
The web portal calls the AWS STS AssumeRoleWithSAML API with the ARN of the SAML provider, the ARN of the IAM role, and the SAML assertion from IdP.
The on-premises IdP's DNS hostname is reachable from the AWS environment VPCs.
The company's IdP defines SAML assertions that properly map users or groups. In the company to IAM roles with appropriate permissions.

Answer(s): B,C,E

Explanation:

-B) The IAM roles created for the federated users' or federated groups' trust policy have set the SAML provider as the principal: The trust policy of the IAM roles must properly set the SAML provider as the principal to allow federated users access to AWS resources. Without this, the SAML assertions won't map correctly, causing access issues.
-C) Test users are not in the AWSFederatedUsers group in the company's IdP: Federated users must belong to the correct group in the IdP for their SAML assertions to map to the corresponding IAM roles in AWS. Ensuring the users are in the right group is critical for proper access.
-F) The company's IdP defines SAML assertions that properly map users or groups to IAM roles with appropriate permissions: The SAML assertions from the IdP must be correctly configured to map users or groups to corresponding IAM roles with appropriate permissions in AWS. This ensures that users receive the permissions they are entitled to when authenticating.
These checks ensure proper configuration for the federated identity solution.

Reveal Solution Next Question

QUESTION: 199

A solutions architect needs to improve an application that is hosted in the AWS Cloud. The application uses an Amazon Aurora MySQL DB instance that is experiencing overloaded connections. Most of the application’s operations insert records into the database. The application currently stores credentials in a text-based configuration file.

The solutions architect needs to implement a solution so that the application can handle the current connection load. The solution must keep the credentials secure and must provide the ability to rotate the credentials automatically on a regular basis.

Which solution will meet these requirements?

Deploy an Amazon RDS Proxy layer. In front of the DB instance. Store the connection credentials as a secret in AWS Secrets Manager.
Deploy an Amazon RDS Proxy layer in front of the DB instance. Store the connection credentials in AWS Systems Manager Parameter Store
Create an Aurora Replica. Store the connection credentials as a secret in AWS Secrets Manager
Create an Aurora Replica. Store the connection credentials in AWS Systems Manager Parameter Store.

Answer(s): A

Explanation:

-A) Deploy an Amazon RDS Proxy layer in front of the DB instance. Store the connection credentials as a secret in AWS Secrets Manager: RDS Proxy helps manage and pool database connections efficiently, which can reduce the load on the database by reusing connections. Storing the credentials in AWS Secrets Manager ensures that the credentials are kept secure and can be rotated automatically. This solution addresses both the connection load issue and the need for secure and regularly rotated credentials.
This approach meets the requirements for connection load management and credential security with minimal operational complexity.

Reveal Solution Next Question

QUESTION: 200

A company needs to build a disaster recovery (DR) solution for its ecommerce website. The web application is hosted on a fleet of t3.large Amazon EC2 instances and uses an Amazon RDS for MySQL DB instance. The EC2 instances are in an Auto Scaling group that extends across multiple Availability Zones.

In the event of a disaster, the web application must fail over to the secondary environment with an RPO of 30 seconds and an RTO of 10 minutes.

Which solution will meet these requirements MOST cost-effectively?

Use infrastructure as code (IaC) to provision the new infrastructure in the DR Region. Create a cross-Region read replica for the DB instance. Set up a backup plan in AWS Backup to create cross-Region backups for the EC2 instances and the DB instance. Create a cron expression to back up the EC2 instances and the DB instance every 30 seconds to the DR Region. Recover the EC2 instances from the latest EC2 backup. Use an Amazon Route 53 geolocation routing policy to automatically fail over to the DR Region in the event of a disaster.
Use infrastructure as code (IaC) to provision the new infrastructure in the DR Region. Create a cross-Region read replica for the DB instance. Set up AWS Elastic Disaster Recovery to continuously replicate the EC2 instances to the DR Region. Run the EC2 instances at the minimum capacity in the DR Region. Use an Amazon Route 53 failover routing policy to automatically fail over to the DR Region in the event of a disaster. Increase the desired capacity of the Auto Scaling group.
Set up a backup plan in AWS Backup to create cross-Region backups for the EC2 instances and the DB instance. Create a cron expression to back up the EC2 instances and the DB instance every 30 seconds to the DR Region. Use infrastructure as code (IaC) to provision the new infrastructure in the DR Region. Manually restore the backed-up data on new instances. Use an Amazon Route 53 simple routing policy to automatically fail over to the DR Region in the event of a disaster.
Use infrastructure as code (IaC) to provision the new infrastructure in the DR Region. Create an Amazon Aurora global database. Set up AWS Elastic Disaster Recovery to continuously replicate the EC2 instances to the DR Region. Run the Auto Scaling group of EC2 instances at full capacity in the DR Region. Use an Amazon Route 53 failover routing policy to automatically fail over to the DR Region in the event of a disaster.

Answer(s): B

Explanation:

-B) Use infrastructure as code (IaC) to provision the new infrastructure in the DR Region. Create a cross-Region read replica for the DB instance. Set up AWS Elastic Disaster Recovery to continuously replicate the EC2 instances to the DR Region. Run the EC2 instances at the minimum capacity in the DR Region. Use an Amazon Route 53 failover routing policy to automatically fail over to the DR Region in the event of a disaster. Increase the desired capacity of the Auto Scaling group: This solution is cost-effective and meets the RPO of 30 seconds and the RTO of 10 minutes. The cross-Region read replica ensures near-real-time data availability in the DR Region, and AWS Elastic Disaster Recovery ensures continuous replication of EC2 instances. Running EC2 instances at the minimum capacity in the DR Region saves costs while ensuring quick recovery. Route 53 failover routing allows for automatic failover to the DR Region in case of a disaster.
This solution balances cost and performance while meeting the RPO and RTO requirements.

Reveal Solution Next Question

Free SAP-C01 Exam Braindumps (page: 50)

QUESTION: 197

Explanation:

QUESTION: 198

Explanation:

QUESTION: 199

Explanation:

QUESTION: 200

Explanation: