Topic 2: Exam Pool B
A company is running a containerized application in the AWS Cloud. The application is
running by using Amazon Elastic Container Service (Amazon ECS) on a set of Amazon
EC2 instances. The EC2 instances run in an Auto Scaling group.
The company uses Amazon Elastic Container Registry (Amazon ECR) to store its
container images. When a new image version is uploaded, the new image version receives
a unique tag.
The company needs a solution that inspects new image versions for common
vulnerabilities and exposures. The solution must automatically delete new image tags that
have Critical or High severity findings. The solution also must notify the development team
when such a deletion occurs.
Which solution meets these requirements?
A. Configure scan on push on the repository Use Amazon EventBridge to invoke an AWS Step Functions state machine when a scan is complete for images that have Critical or High severity findings. Use the Step Functions state machine to delete the image tag for those images and to notify the development team through Amazon Simple Notification Service (Amazon SNS).
B. Configure scan on push on the repository Configure scan results to be pushed to an Amazon Simple Queue Service (Amazon SQS) queue. Invoke an AWS Lambda function when a new message is added to the SQS queue. Use the Lambda function to delete the image tag for images that have Critical or High seventy findings. Notify the development team by using Amazon Simple Email Service (Amazon SES).
C. Schedule an AWS Lambda function to start a manual image scan every hour. Configure Amazon EventBridge to invoke another Lambda function when a scan is complete. Use the second Lambda function to delete the image tag for images that have Critical or High severity findings. Notify the development team by using Amazon Simple Notification Service (Amazon SNS).
D. Configure periodic image scan on the repository. Configure scan results to be added lo an Amazon Simple Queue Service (Amazon SQS) queue. Invoke an AWS Step Functions state machine when a new message is added to the SQS queue. Use the Step Functions state machine to delete the image tag for images that have Critical or High severity findings. Notify the development team by using Amazon Simple Email Service (Amazon SES).
A company manufactures smart vehicles. The company uses a custom application to
collect vehicle data. The vehicles use the MQTT protocol to connect to the application.
The company processes the data in 5-minute intervals. The company then copies vehicle
telematics data to on-premises storage. Custom applications analyze this data to detect
anomalies.
The number of vehicles that send data grows constantly. Newer vehicles generate high
volumes of data. The on-premises storage solution is not able to scale for peak traffic,
which results in data loss. The company must modernize the solution and migrate the
solution to AWS to resolve the scaling challenges.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS IOT Greengrass to send the vehicle data to Amazon Managed Streaming for Apache Kafka (Amazon MSK). Create an Apache Kafka application to store the data in Amazon S3. Use a pretrained model in Amazon SageMaker to detect anomalies.
B. Use AWS IOT Core to receive the vehicle data. Configure rules to route data to an Amazon Kinesis Data Firehose delivery stream that stores the data in Amazon S3. Create an Amazon Kinesis Data Analytics application that reads from the delivery stream to detect anomalies.
C. Use AWS IOT FleetWise to collect the vehicle data. Send the data to an Amazon Kinesis data stream. Use an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Use the built-in machine learning transforms in AWS Glue to detect anomalies.
D. Use Amazon MQ for RabbitMQ to collect the vehicle data. Send the data to an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Use Amazon Lookout for Metrics to detect anomalies.
Explanation: Using AWS IoT Core to receive the vehicle data will enable connecting the smart vehicles to the cloud using the MQTT protocol1. AWS IoT Core is a platform that enables you to connect devices to AWS Services and other devices, secure data and interactions, process and act upon device data, and enable applications to interact with devices even when they are offline2. Configuring rules to route data to an Amazon Kinesis Data Firehose delivery stream that stores the data in Amazon S3 will enable processing and storing the vehicle data in a scalable and reliable way3. Amazon Kinesis Data Firehose is a fully managed service that delivers real-time streaming data to destinations such as Amazon S3. Creating an Amazon Kinesis Data Analytics application that reads from the delivery stream to detect anomalies will enable analyzing the vehicle data using SQL queries or Apache Flink applications. Amazon Kinesis Data Analytics is a fully managed service that enables you to process and analyze streaming data using SQL or Java.
A solutions architect is redesigning a three-tier application that a company hosts on
premises. The application provides personalized recommendations based on user profiles.
The company already has an AWS account and has configured a VPC to host the
application.
The frontend is a Java-based application that runs in on-premises VMs. The company
hosts a personalization model on a physical application server and uses TensorFlow to
implement the model. The personalization model uses artificial intelligence and machine
learning (AI/ML). The company stores user information in a Microsoft SQL Server database. The web application calls the personalization model, which reads the user
profiles from the database and provides recommendations.
The company wants to migrate the redesigned application to AWS.
Which solution will meet this requirement with the LEAST operational overhead?
A. Use AWS Server Migration Service (AWS SMS) to migrate the on-premises physical application server and the web application VMs to AWS. Use AWS Database Migration Service (AWS DMS) to migrate the SQL Server database to Amazon RDS for SQL Server.
B. Export the personalization model. Store the model artifacts in Amazon S3. Deploy the model to Amazon SageMaker and create an endpoint. Host the Java application in AWS Elastic Beanstalk. Use AWS Database Migration Service {AWS DMS) to migrate the SQL Server database to Amazon RDS for SQL Server.
C. Use AWS Application Migration Service to migrate the on-premises personalization model and VMs to Amazon EC2 instances in Auto Scaling groups. Use AWS Database Migration Service (AWS DMS) to migrate the SQL Server database to an EC2 instance.
D. Containerize the personalization model and the Java application. Use Amazon Elastic Kubernetes Service (Amazon EKS) managed node groups to deploy the model and the application to Amazon EKS Host the node groups in a VPC. Use AWS Database Migration Service (AWS DMS) to migrate the SQL Server database to Amazon RDS for SQL Server.
Explanation:
Amazon SageMaker is a fully managed machine learning service that allows users to build,
train, and deploy machine learning models quickly and easily1. Users can export their
existing TensorFlow models and store the model artifacts in Amazon S3, a highly scalable
and durable object storage service2. Users can then deploy the model to Amazon
SageMaker and create an endpoint that can be invoked by the web application to provide
recommendations3. This way, the solution can leverage the AI/ML capabilities of Amazon
SageMaker without having to rewrite the personalization model.
AWS Elastic Beanstalk is a service that allows users to deploy and manage web
applications without worrying about the infrastructure that runs those applications. Users
can host their Java application in AWS Elastic Beanstalk and configure it to communicate
with the Amazon SageMaker endpoint. This way, the solution can reduce the operational
overhead of managing servers, load balancers, scaling, and application health monitoring.
AWS Database Migration Service (AWS DMS) is a service that helps users migrate
databases to AWS quickly and securely. Users can use AWS DMS to migrate their SQL
Server database to Amazon RDS for SQL Server, a fully managed relational database
service that offers high availability, scalability, security, and compatibility. This way, the
solution can reduce the operational overhead of managing database servers, backups,
patches, and upgrades.
Option A is incorrect because using AWS Server Migration Service (AWS SMS) to migrate
the on-premises physical application server and the web application VMs to AWS is not cost-effective or scalable. AWS SMS is a service that helps users migrate on-premises
workloads to AWS. However, for this use case, migrating the physical application server
and the web application VMs to AWS will not take advantage of the AI/ML capabilities of
Amazon SageMaker or the managed services of AWS Elastic Beanstalk and Amazon RDS.
Option C is incorrect because using AWS Application Migration Service to migrate the onpremises
personalization model and VMs to Amazon EC2 instances in Auto Scaling groups
is not cost-effective or scalable. AWS Application Migration Service is a service that helps
users migrate applications from on-premises or other clouds to AWS without making any
changes to their applications. However, for this use case, migrating the personalization
model and VMs to EC2 instances will not take advantage of the AI/ML capabilities of
Amazon SageMaker or the managed services of AWS Elastic Beanstalk and Amazon RDS.
Option D is incorrect because containerizing the personalization model and the Java
application and using Amazon Elastic Kubernetes Service (Amazon EKS) managed node
groups to deploy them to Amazon EKS is not necessary or cost-effective. Amazon EKS is a
service that allows users to run Kubernetes on AWS without needing to install, operate,
and maintain their own Kubernetes control plane or nodes. However, for this use case,
containerizing and deploying the personalization model and the Java application will not
take advantage of the AI/ML capabilities of Amazon SageMaker or the managed services
of AWS Elastic Beanstalk. Moreover, using S3 Glacier Deep Archive as a storage class for
images will incur a high retrieval fee and latency for accessing them.
A company is designing an AWS Organizations structure. The company wants to
standardize a process to apply tags across the entire organization. The company will
require tags with specific values when a user creates a new resource. Each of the
company's OUs will have unique tag values.
Which solution will meet these requirements?
A. Use an SCP to deny the creation of resources that do not have the required tags. Create a tag policy that Includes the tag values that the company has assigned to each OU. Attach the tag policies to the OUs.
B. Use an SCP to deny the creation of resources that do not have the required tags. Create a tag policy that includes the tag values that the company has assigned to each OU. Attach the tag policies to the organization's management account.
C. Use an SCP to allow the creation of resources only when the resources have the required tags. Create a tag policy that includes the tag values that the company has assigned to each OU. Attach the tag policies to the OUs.
D. Use an SCP to deny the creation of resources that do not have the required tags. Define the list of tags. Attach the SCP to the OUs
A global manufacturing company plans to migrate the majority of its applications to AWS.
However, the company is concerned about applications that need to remain within a
specific country or in the company's central on-premises data center because of data
regulatory requirements or requirements for latency of single-digit milliseconds. The
company also is concerned about the applications that it hosts in some of its factory sites,
where limited network infrastructure exists.
The company wants a consistent developer experience so that its developers can build
applications once and deploy on premises, in the cloud, or in a hybrid architecture.
The developers must be able to use the same tools, APIs, and services that are familiar to
them.
Which solution will provide a consistent hybrid experience to meet these requirements?
A. Migrate all applications to the closest AWS Region that is compliant. Set up an AWS Direct Connect connection between the central on-premises data center and AWS. Deploy a Direct Connect gateway.
B. Use AWS Snowball Edge Storage Optimized devices for the applications that have data regulatory requirements or requirements for latency of single-digit milliseconds. Retain the devices on premises. Deploy AWS Wavelength to host the workloads in the factory sites.
C. Install AWS Outposts for the applications that have data regulatory requirements or requirements for latency of single-digit milliseconds. Use AWS Snowball Edge Compute Optimized devices to host the workloads in the factory sites.
D. Migrate the applications that have data regulatory requirements or requirements for latency of single-digit milliseconds to an AWS Local Zone. Deploy AWS Wavelength to host the workloads in the factory sites.
Explanation: Installing AWS Outposts for the applications that have data regulatory requirements or requirements for latency of single-digit milliseconds will provide a fully managed service that extends AWS infrastructure, services, APIs, and tools to customer premises1. AWS Outposts allows customers to run some AWS services locally and connect to a broad range of services available in the local AWS Region1. Using AWS Snowball Edge Compute Optimized devices to host the workloads in the factory sites will provide local compute and storage resources for locations with limited network infrastructure2. AWS Snowball Edge devices can run Amazon EC2 instances and AWS Lambda functions locally and sync data with AWS when network connectivity is available2.
A company wants to run a custom network analysis software package to inspect traffic as
traffic leaves and enters a VPC. The company has deployed the solution by using AWS
Cloud Formation on three Amazon EC2 instances in an Auto Scaling group. All network
routing has been established to direct traffic to the EC2 instances.
Whenever the analysis software stops working, the Auto Scaling group replaces an
instance. The network routes are not updated when the instance replacement occurs.
Which combination of steps will resolve this issue? {Select THREE.)
A. Create alarms based on EC2 status check metrics that will cause the Auto Scaling group to replace the failed instance.
B. Update the Cloud Formation template to install the Amazon CloudWatch agent on the EC2 instances. Configure the CloudWatch agent to send process metrics for the application.
C. Update the Cloud Formation template to install AWS Systems Manager Agent on the EC2 instances. Configure Systems Manager Agent to send process metrics for the application.
D. Create an alarm for the custom metric in Amazon CloudWatch for the failure scenarios. Configure the alarm to publish a message to an Amazon Simple Notification Service {Amazon SNS) topic.
E. Create an AWS Lambda function that responds to the Amazon Simple Notification Service (Amazon SNS) message to take the instance out of service. Update the network routes to point to the replacement instance.
F. In the Cloud Formation template, write a condition that updates the network routes when a replacement instance is launched.
A company is using AWS Organizations to manage multiple AWS accounts. For security
purposes, the company requires the creation of an Amazon Simple Notification Service
(Amazon SNS) topic that enables integration with a third-party alerting system in all the
Organizations member accounts.
A solutions architect used an AWS CloudFormation template to create the SNS topic and
stack sets to automate the deployment of Cloud Formation stacks. Trusted access has
been enabled in Organizations.
What should the solutions architect do to deploy the CloudFormation StackSets in all AWS
accounts?
A. Create a stack set in the Organizations member accounts. Use service-managed permissions. Set deployment options to deploy to an organization. Use CloudFormation StackSets drift detection.
B. Create stacks in the Organizations member accounts. Use self-service permissions. Set deployment options to deploy to an organization. Enable the CloudFormation StackSets automatic deployment.
C. Create a stack set in the Organizations management account. Use service-managed permissions. Set deployment options to deploy to the organization. Enable CloudFormation StackSets automatic deployment.
D. Create stacks in the Organizations management account. Use service-managed permissions. Set deployment options to deploy to the organization. Enable CloudFormation StackSets drift detection.
A company is running an application on Amazon EC2 instances in the AWS Cloud. The
application is using a MongoDB database with a replica set as its data tier. The MongoDB
database is installed on systems in the company's on-premises data center and is
accessible through an AWS Direct Connect connection to the data center environment.
A solutions architect must migrate the on-premises MongoDB database to Amazon
DocumentDB (with MongoDB compatibility).
Which strategy should the solutions architect choose to perform this migration?
A. Create a fleet of EC2 instances. Install MongoDB Community Edition on the EC2 instances, and create a database. Configure continuous synchronous replication with the database that is running in the on-premises data center.
B. Create an AWS Database Migration Service (AWS DMS) replication instance. Create a source endpoint for the on-premises MongoDB database by using change data capture (CDC). Create a target endpoint for the Amazon DocumentDB database. Create and run a DMS migration task.
C. Create a data migration pipeline by using AWS Data Pipeline. Define data nodes for the on-premises MongoDB database and the Amazon DocumentDB database. Create a scheduled task to run the data pipeline.
D. Create a source endpoint for the on-premises MongoDB database by using AWS Glue crawlers. Configure continuous asynchronous replication between the MongoDB database and the Amazon DocumentDB database.
A company is using an organization in AWS Organizations to manage hundreds of AWS
accounts. A solutions architect is working on a solution to provide baseline protection for
the Open Web Application Security Project (OWASP) top 10 web application vulnerabilities.
The solutions architect is using AWS WAF for all existing and new Amazon CloudFront
distributions that are deployed within the organization.
Which combination of steps should the solutions architect take to provide the baseline
protection? (Select THREE.)
A. Enable AWS Config in all accounts.
B. Enable Amazon GuardDuty in all accounts.
C. Enable all features for the organization.
D. Use AWS Firewall Manager to deploy AWS WAF rules in all accounts for all CloudFront distributions.
E. Use AWS Shield Advanced to deploy AWS WAF rules in all accounts for all CloudFront distributions.
F. Use AWS Security Hub to deploy AWS WAF rules in all accounts for all CloudFront distributions.
Explanation: Enabling all features for the organization will enable using AWS Firewall Manager to centrally configure and manage firewall rules across multiple AWS accounts1. Using AWS Firewall Manager to deploy AWS WAF rules in all accounts for all CloudFront distributions will enable providing baseline protection for the OWASP top 10 web application vulnerabilities2. AWS Firewall Manager supports AWS WAF rules that can help protect against common web exploits such as SQL injection and cross-site scripting3. Configuring redirection of HTTP requests to HTTPS requests in CloudFront will enable encrypting the data in transit using SSL/TLS.
A company has built a high performance computing (HPC) cluster in AWS tor a tightly
coupled workload that generates a large number of shared files stored in Amazon EFS.
The cluster was performing well when the number of Amazon EC2 instances in the cluster
was 100. However, when the company increased the cluster size to 1,000 EC2 instances,
overall performance was well below expectations.
Which collection of design choices should a solutions architect make to achieve the
maximum performance from the HPC cluster? (Select THREE.)
A. Ensure the HPC cluster Is launched within a single Availability Zone.
B. Launch the EC2 instances and attach elastic network interfaces in multiples of four.
C. Select EC2 Instance types with an Elastic Fabric Adapter (EFA) enabled.
D. Ensure the cluster Is launched across multiple Availability Zones.
E. Replace Amazon EFS with multiple Amazon EBS volumes in a RAID array.
F. Replace Amazon EFS with Amazon FSx for Lustre.
Explanation: A. High performance computing (HPC) workload cluster should be in a single AZ. C. Elastic Fabric Adapter (EFA) is a network device that you can attach to your Amazon EC2 instances to accelerate High Performance Computing (HPC) F. Amazon FSx for Lustre - Use it for workloads where speed matters, such as machine learning, high performance computing (HPC), video processing, and financial modeling. Cluster – packs instances close together inside an Availability Zone. This strategy enables workloads to achieve the low-latency network performance necessary for tightly-coupled node-to-node communication that is typical of HPC applications.
A company is using AWS CloudFormation to deploy its infrastructure. The company is
concerned that, if a production CloudFormation stack is deleted, important data stored in
Amazon RDS databases or Amazon EBS volumes might also be deleted.
How can the company prevent users from accidentally deleting data in this way?
A. Modify the CloudFormation templates to add a DeletionPolicy attribute to RDS and EBS resources.
B. Configure a stack policy that disallows the deletion of RDS and EBS resources.
C. Modify 1AM policies to deny deleting RDS and EBS resources that are tagged with an "awsrcloudformation: stack-name" tag.
D. Use AWS Config rules to prevent deleting RDS and EBS resources.
Explanation: With the DeletionPolicy attribute you can preserve or (in some cases) backup a resource when its stack is deleted. You specify a DeletionPolicy attribute for each resource that you want to control. If a resource has no DeletionPolicy attribute, AWS CloudFormation deletes the resource by default. To keep a resource when its stack is deleted, specify Retain for that resource. You can use retain for any resource. For example, you can retain a nested stack, Amazon S3 bucket, or EC2 instance so that you can continue to use or modify those resources after you delete their stacks.
A company consists of two separate business units. Each business unit has its own AWS
account within a single organization in AWS Organizations. The business units regularly
share sensitive documents with each other. To facilitate sharing, the company created an
Amazon S3 bucket in each account and configured two-way replication between the S3
buckets. The S3 buckets have millions of objects.
Recently, a security audit identified that neither S3 bucket has encryption at rest enabled.
Company policy requires that all documents must be stored with encryption at rest. The
company wants to implement server-side encryption with Amazon S3 managed encryption
keys (SSE-S3).
What is the MOST operationally efficient solution that meets these requirements?
A. Turn on SSE-S3 on both S3 buckets. Use S3 Batch Operations to copy and encrypt the objects in the same location.
B. Create an AWS Key Management Service (AWS KMS) key in each account. Turn on server-side encryption with AWS KMS keys (SSE-KMS) on each S3 bucket by using the corresponding KMS key in that AWS account. Encrypt the existing objects by using an S3 copy command in the AWS CLI.
C. Turn on SSE-S3 on both S3 buckets. Encrypt the existing objects by using an S3 copy command in the AWS CLI.
D. Create an AWS Key Management Service (AWS KMS) key in each account. Turn on server-side encryption with AWS KMS keys (SSE-KMS) on each S3 bucket by using the corresponding KMS key in that AWS account. Use S3 Batch Operations to copy the objects into the same location.
| Page 17 out of 41 Pages |
| Previous |