QUESTION: 213

A solutions architect is designing an AWS account structure for a company that consists of multiple teams. All the teams will work in the same AWS Region. The company needs a VPC that is connected to the on-premises network. The company expects less than 50 Mbps of total traffic to and from the on-premises network.

Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)

Create an AWS CloudFormation template that provisions a VPC and the required subnets. Deploy the template to each AWS account.
Create an AWS CloudFormation template that provisions a VPC and the required subnets. Deploy the template to a shared services account. Share the subnets by using AWS Resource Access Manager.
Use AWS Transit Gateway along with an AWS Site-to-Site VPN for connectivity to the on-premises network. Share the transit gateway by using AWS Resource Access Manager.
Use AWS Site-to-Site VPN for connectivity to the on-premises network.
Use AWS Direct Connect for connectivity to the on-premises network.

Answer(s): B,D

Explanation:

-B: Creating a VPC in a shared services account and sharing subnets using AWS Resource Access Manager is cost-effective and allows multiple teams to use the same VPC resources without duplicating infrastructure.
-D: Using AWS Site-to-Site VPN provides a cost-effective solution for the expected low traffic (less than 50 Mbps) to and from the on-premises network, compared to more expensive options like Direct Connect.
This combination provides the required connectivity and resource sharing with minimal cost and overhead.

Reveal Solution Next Question

QUESTION: 214

A solutions architect at a large company needs to set up network security for outbound traffic to the internet from all AWS accounts within an organization in AWS Organizations. The organization has more than 100 AWS accounts, and the accounts route to each other by using a centralized AWS Transit Gateway. Each account has both an internet gateway and a NAT gateway for outbound traffic to the internet. The company deploys resources only into a single AWS Region.

The company needs the ability to add centrally managed rule-based filtering on all outbound traffic to the internet for all AWS accounts in the organization. The peak load of outbound traffic will not exceed 25 Gbps in each Availability Zone.

Which solution meets these requirements?

Create a new VPC for outbound traffic to the internet. Connect the existing transit gateway to the new VPC. Configure a new NAT gateway. Create an Auto Scaling group of Amazon EC2 instances that run an open-source internet proxy for rule-based filtering across all Availability Zones in the Region. Modify all default routes to point to the proxy's Auto Scaling group.
Create a new VPC for outbound traffic to the internet. Connect the existing transit gateway to the new VPC. Configure a new NAT gateway. Use an AWS Network Firewall firewall for rule-based filtering. Create Network Firewall endpoints in each Availability Zone. Modify all default routes to point to the Network Firewall endpoints.
Create an AWS Network Firewall firewall for rule-based filtering in each AWS account. Modify all default routes to point to the Network Firewall firewalls in each account.
In each AWS account, create an Auto Scaling group of network-optimized Amazon EC2 instances that run an open-source internet proxy for rule-based filtering. Modify all default routes to point to the proxy's Auto Scaling group.

Answer(s): B

Explanation:

B: Using AWS Network Firewall in a centralized VPC connected to the existing transit gateway is the most scalable and cost-effective solution for centrally managing outbound traffic filtering for over 100 AWS accounts. This setup provides rule-based filtering across all Availability Zones and requires modifying the default routes to point to Network Firewall endpoints. This solution supports the required 25 Gbps peak traffic per Availability Zone while minimizing operational complexity compared to deploying firewalls or proxies in each individual account.

Reveal Solution Next Question

QUESTION: 215

A company uses a load balancer to distribute traffic to Amazon EC2 instances in a single Availability Zone. The company is concerned about security and wants a solutions architect to re-architect the solution to meet the following requirements:

•Inbound requests must be filtered for common vulnerability attacks.
•Rejected requests must be sent to a third-party auditing application.
•All resources should be highly available.

Which solution meets these requirements?

Configure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Use Amazon Inspector to monitor traffic to the ALB and EC2 instances. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB. Use an AWS Lambda function to frequently push the Amazon Inspector report to the third-party auditing application.
Configure an Application Load Balancer (ALB) and add the EC2 instances as targets. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB name and enable logging with Amazon CloudWatch Logs. Use an AWS Lambda function to frequently push the logs to the third-party auditing application.
Configure an Application Load Balancer (ALB) along with a target group adding the EC2 instances as targets. Create an Amazon Kinesis Data Firehose with the destination of the third-party auditing application. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination. Subscribe to AWS Managed Rules in AWS Marketplace, choosing the WAF as the subscriber.
Configure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Create an Amazon Kinesis Data Firehose with a destination of the third-party auditing application. Create a web ACL in WAF. Create an AWS WAF using the WebACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination. Subscribe to AWS Managed Rules in AWS Marketplace, choosing the WAF as the subscriber.

Answer(s): D

Explanation:

D: This solution meets all the requirements. It sets up a Multi-AZ Auto Scaling group to ensure high availability, uses an Application Load Balancer (ALB) to distribute traffic, and integrates AWS WAF for filtering inbound traffic against common vulnerabilities. AWS WAF is configured with a web ACL and logging is enabled via Amazon Kinesis Data Firehose, which sends rejected requests to the third-party auditing application. Additionally, subscribing to AWS Managed Rules provides enhanced security against known vulnerabilities.
This ensures security, auditing, and high availability while minimizing operational complexity.

Reveal Solution Next Question

QUESTION: 216

A company is running an application in the AWS Cloud. The application consists of microservices that run on a fleet of Amazon EC2 instances in multiple Availability Zones behind an Application Load Balancer. The company recently added a new REST API that was implemented in Amazon API Gateway. Some of the older microservices that run on EC2 instances need to call this new API.

The company does not want the API to be accessible from the public internet and does not want proprietary data to traverse the public internet.

What should a solutions architect do to meet these requirements?

Create an AWS Site-to-Site VPN connection between the VPC and the API Gateway. Use API Gateway to generate a unique API Key for each microservice. Configure the API methods to require the key.
Create an interface VPC endpoint for API Gateway, and set an endpoint policy to only allow access to the specific API. Add a resource policy to API Gateway to only allow access from the VPC endpoint. Change the API Gateway endpoint type to private.
Modify the API Gateway to use IAM authentication. Update the IAM policy for the IAM role that is assigned to the EC2 instances to allow access to the API Gateway. Move the API Gateway into a new VPDeploy a transit gateway and connect the VPCs.
Create an accelerator in AWS Global Accelerator, and connect the accelerator to the API Gateway. Update the route table for all VPC subnets with a route to the created Global Accelerator endpoint IP address. Add an API key for each service to use for authentication.

Answer(s): B

Explanation:

B: Creating an interface VPC endpoint for API Gateway and setting a private endpoint ensures that the API is accessible only from within the VPC and does not traverse the public internet. By applying an endpoint policy and a resource policy, access can be restricted to specific microservices running in the VPC. This solution securely meets the requirement of keeping the API private and ensuring that proprietary data does not traverse the public internet.

Reveal Solution Next Question

Free SAP-C01 Exam Braindumps (page: 54)

QUESTION: 213

Explanation:

QUESTION: 214

Explanation:

QUESTION: 215

Explanation:

QUESTION: 216

Explanation: