QUESTION: 281

A company wants to send data from its on-premises systems to Amazon S3 buckets. The company created the S3 buckets in three different accounts. The company must send the data privately without the data traveling across the internet. The company has no existing dedicated connectivity to AWS.

Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)

Establish a networking account in the AWS Cloud. Create a private VPC in the networking account. Set up an AWS Direct Connect connection with a private VIF between the on-premises environment and the private VPC.
Establish a networking account in the AWS Cloud. Create a private VPC in the networking account. Set up an AWS Direct Connect connection with a public VIF between the on-premises environment and the private VPC.
Create an Amazon S3 interface endpoint in the networking account.
Create an Amazon S3 gateway endpoint in the networking account.
Establish a networking account in the AWS Cloud. Create a private VPC in the networking account. Peer VPCs from the accounts that host the S3 buckets with the VPC in the network account.

Answer(s): A,C

Explanation:

A) Establishing a networking account in the AWS Cloud and creating a private VPC with an AWS Direct Connect connection using a private VIF ensures that data is sent securely from the on-premises environment to AWS without traveling over the internet.
C) Creating an Amazon S3 interface endpoint in the networking account allows the company to privately access Amazon S3 from within the VPC, ensuring the data is transferred securely and without the use of the internet.
These steps satisfy the requirement of sending data privately and securely to the S3 buckets in different AWS accounts.

Reveal Solution Next Question

QUESTION: 282

A company operates quick-service restaurants. The restaurants follow a predictable model with high sales traffic for 4 hours daily. Sales traffic is lower outside of those peak hours.

The point of sale and management platform is deployed in the AWS Cloud and has a backend that is based on Amazon DynamoDB. The database table uses provisioned throughput mode with 100,000 RCUs and 80,000 WCUs to match known peak resource consumption.

The company wants to reduce its DynamoDB cost and minimize the operational overhead for the IT staff.

Which solution meets these requirements MOST cost-effectively?

Reduce the provisioned RCUs and WCUs.
Change the DynamoDB table to use on-demand capacity.
Enable Dynamo DB auto scaling for the table.
Purchase 1-year reserved capacity that is sufficient to cover the peak load for 4 hours each day.

Answer(s): C

Explanation:

C) Enabling DynamoDB auto scaling is the most cost-effective solution because it allows the DynamoDB table to automatically adjust its provisioned throughput based on actual traffic patterns. This reduces operational overhead and ensures that the company is only paying for the required RCUs and WCUs during peak and off-peak hours, instead of overprovisioning.
A) Reducing provisioned capacity would result in under-provisioning during peak hours.
B) On-demand capacity is more expensive for workloads with predictable traffic patterns like this one.
D) Reserved capacity is not flexible for traffic that fluctuates daily.

Reveal Solution Next Question

QUESTION: 283

A company hosts a blog post application on AWS using Amazon API Gateway, Amazon DynamoDB, and AWS Lambda. The application currently does not use API keys to authorize requests. The API model is as follows:

•GET /posts/{postId}: to get post details
•GET /users/{userId}: to get user details
•GET /comments/{commentId}: to get comments details

The company has noticed users are actively discussing topics in the comments section, and the company wants to increase user engagement by making the comments appear in real time.

Which design should be used to reduce comment latency and improve user experience?

Use edge-optimized API with Amazon CloudFront to cache API responses.
Modify the blog application code to request GET/comments/{commentId} every 10 seconds.
Use AWS AppSync and leverage WebSockets to deliver comments.
Change the concurrency limit of the Lambda functions to lower the API response time.

Answer(s): C

Explanation:

C) Using AWS AppSync with WebSockets is the best design for delivering real-time comments. WebSockets allow bidirectional communication between the client and the server, enabling updates to be pushed instantly to users without the need for constant polling or repeated requests. This approach will improve user experience by reducing latency and providing real-time updates in the comments section.
A) CloudFront caching might reduce latency for static content but does not address real-time communication.
B) Polling every 10 seconds increases latency and puts unnecessary load on the system.
D) Changing the concurrency limit of Lambda functions doesn't specifically improve real-time capabilities for delivering comments.

Reveal Solution Next Question

QUESTION: 284

A company manages hundreds of AWS accounts centrally in an organization in AWS Organizations. The company recently started to allow product teams to create and manage their own S3 access points in their accounts. The S3 access points can be accessed only within VPCs, not on the internet.

What is the MOST operationally efficient way to enforce this requirement?

Set the S3 access point resource policy to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.
Create an SCP at the root level in the organization to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.
Use AWS CloudFormation StackSets to create a new IAM policy in each AWS account that allows the s3:CreateAccessPoint action only if the s3:AccessPointNetworkOrigin condition key evaluates to VP
Set the S3 bucket policy to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.

Answer(s): B

Explanation:

B) The most operationally efficient way to enforce the requirement that S3 access points can be accessed only within VPCs is to create a Service Control Policy (SCP) at the root level of the AWS Organization. The SCP can deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC. This ensures that all accounts in the organization comply with the policy, and the enforcement is centralized, reducing operational overhead.
A) Setting a resource policy would work for individual resources but requires manual configuration in each account, which is less efficient than using an SCP.
C) Using CloudFormation StackSets for IAM policy creation would increase operational complexity compared to using an SCP.
D) Modifying the S3 bucket policy applies to specific buckets, not the creation of access points, and would not provide a centralized solution.

Reveal Solution Next Question

Free SAP-C01 Exam Braindumps (page: 71)

QUESTION: 281

Explanation:

QUESTION: 282

Explanation:

QUESTION: 283

Explanation:

QUESTION: 284

Explanation: