QUESTION: 241

A company has a data lake in Amazon S3 that needs to be accessed by hundreds of applications across many AWS accounts. The company's information security policy states that the S3 bucket must not be accessed over the public internet and that each application should have the minimum permissions necessary to function.

To meet these requirements, a solutions architect plans to use an S3 access point that is restricted to specific VPCs for each application.

Which combination of steps should the solutions architect take to implement this solution? (Choose two.)

Create an S3 access point for each application in the AWS account that owns the S3 bucket. Configure each access point to be accessible only from the application’s VPC. Update the bucket policy to require access from an access point.
Create an interface endpoint for Amazon S3 in each application's VPC. Configure the endpoint policy to allow access to an S3 access point. Create a VPC gateway attachment for the S3 endpoint.
Create a gateway endpoint for Amazon S3 in each application's VPConfigure the endpoint policy to allow access to an S3 access point. Specify the route table that is used to access the access point.
Create an S3 access point for each application in each AWS account and attach the access points to the S3 bucket. Configure each access point to be accessible only from the application's VPC. Update the bucket policy to require access from an access point.
Create a gateway endpoint for Amazon S3 in the data lake's VPC. Attach an endpoint policy to allow access to the S3 bucket. Specify the route table that is used to access the bucket.

Answer(s): A,C

Explanation:

A) Creating an S3 access point for each application in the AWS account that owns the S3 bucket and restricting access to the application's VPC ensures that access to the bucket is secured within the VPC and meets the security requirement of avoiding public internet access. Updating the bucket policy to require access through the access point provides additional security control.
C) Creating a gateway endpoint for Amazon S3 in each application's VPC and configuring the endpoint policy to allow access to the S3 access point ensures that all access remains within the VPC and doesn't traverse the public internet. This meets the requirement of securing the connection and providing minimum permissions necessary for each application.
This combination provides a secure, controlled access mechanism that aligns with the company's security policies.

Reveal Solution Next Question

QUESTION: 242

A company has developed a hybrid solution between its data center and AWS. The company uses Amazon VPC and Amazon EC2 instances that send application logs to Amazon CloudWatch. The EC2 instances read data from multiple relational databases that are hosted on premises.

The company wants to monitor which EC2 instances are connected to the databases in near-real time. The company already has a monitoring solution that uses Splunk on premises. A solutions architect needs to determine how to send networking traffic to Splunk.

How should the solutions architect meet these requirements?

Enable VPC flows logs, and send them to CloudWatch. Create an AWS Lambda function to periodically export the CloudWatch logs to an Amazon S3 bucket by using the pre-defined export function. Generate ACCESS_KEY and SECRET_KEY AWS credentials. Configure Splunk to pull the logs from the S3 bucket by using those credentials.
Create an Amazon Kinesis Data Firehose delivery stream with Splunk as the destination. Configure a pre-processing AWS Lambda function with a Kinesis Data Firehose stream processor that extracts individual log events from records sent by CloudWatch Logs subscription filters. Enable VPC flows logs, and send them to CloudWatch. Create a CloudWatch Logs subscription that sends log events to the Kinesis Data Firehose delivery stream.
Ask the company to log every request that is made to the databases along with the EC2 instance IP address. Export the CloudWatch logs to an Amazon S3 bucket. Use Amazon Athena to query the logs grouped by database name. Export Athena results to another S3 bucket. Invoke an AWS Lambda function to automatically send any new file that is put in the S3 bucket to Splunk.
Send the CloudWatch logs to an Amazon Kinesis data stream with Amazon Kinesis Data Analytics for SQL Applications. Configure a 1-minute sliding window to collect the events. Create a SQL query that uses the anomaly detection template to monitor any networking traffic anomalies in near-real time. Send the result to an Amazon Kinesis Data Firehose delivery stream with Splunk as the destination.

Answer(s): B

Explanation:

B) Using Amazon Kinesis Data Firehose with Splunk as the destination ensures that log data is sent to Splunk in near real-time. Configuring a pre-processing AWS Lambda function to handle log events from CloudWatch Logs allows for efficient extraction and delivery of logs to Splunk. Enabling VPC flow logs and sending them to CloudWatch ensures that the required networking traffic is captured and processed correctly.
This solution meets the requirements for monitoring EC2 instances connected to databases in near-real-time while seamlessly integrating with the existing Splunk solution.

Reveal Solution Next Question

QUESTION: 243

A company has five development teams that have each created five AWS accounts to develop and host applications. To track spending, the development teams log in to each account every month, record the current cost from the AWS Billing and Cost Management console, and provide the information to the company's finance team.

The company has strict compliance requirements and needs to ensure that resources are created only in AWS Regions in the United States. However, some resources have been created in other Regions.

A solutions architect needs to implement a solution that gives the finance team the ability to track and consolidate expenditures for all the accounts. The solution also must ensure that the company can create resources only in Regions in the United States.

Which combination of steps will meet these requirements in the MOST operationally efficient way? (Choose three.)

Create a new account to serve as a management account. Create an Amazon S3 bucket for the finance team. Use AWS Cost and Usage Reports to create monthly reports and to store the data in the finance team's S3 bucket.
Create a new account to serve as a management account. Deploy an organization in AWS Organizations with all features enabled. Invite all the existing accounts to the organization. Ensure that each account accepts the invitation.
Create an OU that includes all the development teams. Create an SCP that allows the creation of resources only in Regions that are in the United States. Apply the SCP to the OU.
Create an OU that includes all the development teams. Create an SCP that denies the creation of resources in Regions that are outside the United States. Apply the SCP to the OU.
Create an IAM role in the management account. Attach a policy that includes permissions to view the Billing and Cost Management console. Allow the finance team users to assume the role. Use AWS Cost Explorer and the Billing and Cost Management console to analyze cost.
Create an IAM role in each AWS account. Attach a policy that includes permissions to view the Billing and Cost Management console. Allow the finance team users to assume the role.

Answer(s): B,D,E

Explanation:

B) Creating a management account and deploying an organization in AWS Organizations enables centralized management of accounts, allowing you to consolidate billing and apply organization-wide policies. This ensures operational efficiency and cost tracking.
D) Applying a Service Control Policy (SCP) that denies the creation of resources in Regions outside the United States ensures compliance with the company's requirement to create resources only in US Regions.
E) Creating an IAM role in the management account with permissions to view the Billing and Cost Management console allows the finance team to analyze costs across all accounts without needing to log in to each individual account, simplifying cost tracking.
These steps provide an efficient, scalable solution for cost tracking and ensuring compliance across multiple AWS accounts.

Reveal Solution Next Question

QUESTION: 244

A company needs to create and manage multiple AWS accounts for a number of departments from a central location. The security team requires read-only access to all accounts from its own AWS account. The company is using AWS Organizations and created an account for the security team.

How should a solutions architect meet these requirements?

Use the OrganizationAccountAccessRole IAM role to create a new IAM policy with read-only access in each member account. Establish a trust relationship between the IAM policy in each member account and the security account. Ask the security team to use the IAM policy to gain access.
Use the OrganizationAccountAccessRole IAM role to create a new IAM role with read-only access in each member account. Establish a trust relationship between the IAM role in each member account and the security account. Ask the security team to use the IAM role to gain access.
Ask the security team to use AWS Security Token Service (AWS STS) to call the AssumeRole API for the OrganizationAccountAccessRole IAM role in the management account from the security account. Use the generated temporary credentials to gain access.D. Ask the security team to use AWS Security Token Service (AWS STS) to call the AssumeRole API for the OrganizationAccountAccessRole IAM role in the member account from the security account. Use the generated temporary credentials to gain access.

Answer(s): B

Explanation:

B) Creating an IAM role with read-only access in each member account and establishing a trust relationship between the IAM role and the security account allows the security team to assume the role and gain access. This solution leverages AWS Organizations and IAM roles to provide centralized, secure read-only access to all member accounts from the security account. This approach is efficient and scalable for managing multiple accounts.

Reveal Solution Next Question

Free SAP-C01 Exam Braindumps (page: 61)

QUESTION: 241

Explanation:

QUESTION: 242

Explanation:

QUESTION: 243

Explanation:

QUESTION: 244

Explanation: