QUESTION: 29

A company has 50 AWS accounts that are members of an organization in AWS Organizations. Each account contains multiple VPCs. The company wants to use AWS Transit Gateway to establish connectivity between the VPCs in each member account. Each time a new member account is created, the company wants to automate the process of creating a new VPC and a transit gateway attachment.

Which combination of steps will meet these requirements? (Choose two.)

From the management account, share the transit gateway with member accounts by using AWS Resource Access Manager.
From the management account, share the transit gateway with member accounts by using an AWS Organizations SCP.
Launch an AWS CloudFormation stack set from the management account that automatically creates a new VPC and a VPC transit gateway attachment in a member account. Associate the attachment with the transit gateway in the management account by using the transit gateway ID.
Launch an AWS CloudFormation stack set from the management account that automatically creates a new VPC and a peering transit gateway attachment in a member account. Share the attachment with the transit gateway in the management account by using a transit gateway service-linked role.
From the management account, share the transit gateway with member accounts by using AWS Service Catalog.

Answer(s): A,C

Explanation:

A) From the management account, share the transit gateway with member accounts by using AWS Resource Access Manager and
C) Launch an AWS CloudFormation stack set from the management account that automatically creates a new VPC and a VPC transit gateway attachment in a member account. Associate the attachment with the transit gateway in the management account by using the transit gateway ID are the correct answers.

AWS Resource Access Manager (RAM) allows the sharing of resources such as transit gateways across AWS accounts within an organization, which is crucial for setting up the connectivity between VPCs across multiple accounts.
AWS CloudFormation stack sets automate the creation of new VPCs and transit gateway attachments in member accounts, ensuring that the process is streamlined whenever new accounts are added. This automation ensures consistency and reduces manual configuration errors.
This combination ensures the connectivity and automation needed to manage the multi-account VPC setup using AWS Transit Gateway.

Reveal Solution Next Question

QUESTION: 30

An enterprise company wants to allow its developers to purchase third-party software through AWS Marketplace. The company uses an AWS Organizations account structure with full features enabled, and has a shared services account in each organizational unit (OU) that will be used by procurement managers. The procurement team’s policy indicates that developers should be able to obtain third-party software from an approved list only and use Private Marketplace in AWS Marketplace to achieve this requirement. The procurement team wants administration of Private Marketplace to be restricted to a role named procurement-manager-role, which could be assumed by procurement managers. Other IAM users, groups, roles, and account administrators in the company should be denied Private Marketplace administrative access.

What is the MOST efficient way to design an architecture to meet these requirements?

Create an IAM role named procurement-manager-role in all AWS accounts in the organization. Add the PowerUserAccess managed policy to the role. Apply an inline policy to all IAM users and roles in every AWS account to deny permissions on the AWSPrivateMarketplaceAdminFullAccess managed policy.
Create an IAM role named procurement-manager-role in all AWS accounts in the organization. Add the AdministratorAccess managed policy to the role. Define a permissions boundary with the AWSPrivateMarketplaceAdminFullAccess managed policy and attach it to all the developer roles.
Create an IAM role named procurement-manager-role in all the shared services accounts in the organization. Add the AWSPrivateMarketplaceAdminFullAccess managed policy to the role. Create an organization root-level SCP to deny permissions to administer Private Marketplace to everyone except the role named procurement-manager-role. Create another organization root-level SCP to deny permissions to create an IAM role named procurement-manager-role to everyone in the organization.
Create an IAM role named procurement-manager-role in all AWS accounts that will be used by developers. Add the AWSPrivateMarketplaceAdminFullAccess managed policy to the role. Create an SCP in Organizations to deny permissions to administer Private Marketplace to everyone except the role named procurement-manager-role. Apply the SCP to all the shared services accounts in the organization.

Answer(s): C

Explanation:

C) Create an IAM role named procurement-manager-role in all the shared services accounts in the organization. Add the AWSPrivateMarketplaceAdminFullAccess managed policy to the role. Create an organization root-level SCP to deny permissions to administer Private Marketplace to everyone except the role named procurement-manager-role. Create another organization root-level SCP to deny permissions to create an IAM role named procurement-manager-role to everyone in the organization is the correct answer.

This solution efficiently restricts administrative access to Private Marketplace while allowing only the procurement managers to manage it through the procurement-manager-role in shared services accounts. The Service Control Policies (SCPs) at the organization root level enforce these restrictions across the entire AWS Organization, preventing unauthorized access to manage Private Marketplace or to create an impersonating role. This ensures compliance with the procurement team's policy while minimizing operational overhead.

This design meets the company’s requirements for security and control over the management of AWS Marketplace, ensuring that only approved software is available for developers through Private Marketplace.

Reveal Solution Next Question

QUESTION: 31

A company is in the process of implementing AWS Organizations to constrain its developers to use only Amazon EC2, Amazon S3, and Amazon DynamoDB. The developers account resides in a dedicated organizational unit (OU). The solutions architect has implemented the following SCP on the developers account:

When this policy is deployed, IAM users in the developers account are still able to use AWS services that are not listed in the policy.

What should the solutions architect do to eliminate the developers’ ability to use services outside the scope of this policy?

Create an explicit deny statement for each AWS service that should be constrained.
Remove the FullAWSAccess SCP from the developers account’s OU.
Modify the FullAWSAccess SCP to explicitly deny all services.
Add an explicit deny statement using a wildcard to the end of the SCP.

Answer(s): B

Explanation:

B) Remove the FullAWSAccess SCP from the developers account’s OU is the correct answer.

In AWS Organizations, Service Control Policies (SCPs) act as a permission boundary that can limit the use of AWS services. When a FullAWSAccess SCP is applied, it allows all AWS services unless explicitly constrained. Even though the solutions architect has created a restrictive SCP, the FullAWSAccess SCP would still allow the use of all services unless it is removed.

To enforce the limitation to only Amazon EC2, Amazon S3, and Amazon DynamoDB, the FullAWSAccess SCP must be removed, ensuring that only the restrictive SCP with the allowed services is applied. This eliminates the developers' ability to access services outside of the defined scope in the SCP.

Adding explicit deny statements (option A) is not necessary because the restrictive SCP should already limit access, and keeping the FullAWSAccess SCP overrides those restrictions.

Reveal Solution Next Question

QUESTION: 32

A company is hosting a monolithic REST-based API for a mobile app on five Amazon EC2 instances in public subnets of a VPC. Mobile clients connect to the API by using a domain name that is hosted on Amazon Route 53. The company has created a Route 53 multivalue answer routing policy with the IP addresses of all the EC2 instances. Recently, the app has been overwhelmed by large and sudden increases to traffic. The app has not been able to keep up with the traffic.

A solutions architect needs to implement a solution so that the app can handle the new and varying load. Which solution will meet these requirements with the LEAST operational overhead?

Separate the API into individual AWS Lambda functions. Configure an Amazon API Gateway REST API with Lambda integration for the backend. Update the Route 53 record to point to the API Gateway API.
Containerize the API logic. Create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. Run the containers in the cluster by using Amazon EC2. Create a Kubernetes ingress. Update the Route 53 record to point to the Kubernetes ingress.
Create an Auto Scaling group. Place all the EC2 instances in the Auto Scaling group. Configure the Auto Scaling group to perform scaling actions that are based on CPU utilization. Create an AWS Lambda function that reacts to Auto Scaling group changes and updates the Route 53 record.
Create an Application Load Balancer (ALB) in front of the API. Move the EC2 instances to private subnets in the VPC. Add the EC2 instances as targets for the ALB. Update the Route 53 record to point to the ALB.

Answer(s): D

Explanation:

D) Create an Application Load Balancer (ALB) in front of the API. Move the EC2 instances to private subnets in the VPC. Add the EC2 instances as targets for the ALB. Update the Route 53 record to point to the ALB is the correct answer because it provides a scalable and efficient solution with low operational overhead. An ALB distributes incoming traffic across multiple targets (EC2 instances) automatically, ensuring better load balancing and handling of traffic spikes. Moving the EC2 instances to private subnets enhances security while the ALB manages external traffic. This solution allows the infrastructure to scale efficiently with traffic changes while reducing manual intervention.

Reveal Solution Next Question

Free SAP-C01 Exam Braindumps (page: 8)

QUESTION: 29

Explanation:

QUESTION: 30

Explanation:

QUESTION: 31

Explanation:

QUESTION: 32

Explanation: