🔍

SAP-C02 — questions

Page 11 of 27 · 529 total questions.

SAP-C02 Question 201

Single page →
Topic 1 · Question 201

A solutions architect needs to improve an application that is hosted in the AWS Cloud. The application uses an Amazon Aurora MySQL DB instance that is experiencing overloaded connections. Most of the application’s operations insert records into the database. The application currently stores credentials in a text-based configuration file. The solutions architect needs to implement a solution so that the application can handle the current connection load. The solution must keep the credentials secure and must provide the ability to rotate the credentials automatically on a regular basis. Which solution will meet these requirements?

  • ADeploy an Amazon RDS Proxy layer. In front of the DB instance. Store the connection credentials as a secret in AWS Secrets Manager. (correct answer)
  • BDeploy an Amazon RDS Proxy layer in front of the DB instance. Store the connection credentials in AWS Systems Manager Parameter Store
  • CCreate an Aurora Replica. Store the connection credentials as a secret in AWS Secrets Manager
  • DCreate an Aurora Replica. Store the connection credentials in AWS Systems Manager Parameter Store.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Deploy an Amazon RDS Proxy layer. In front of the DB instance. Store the connection credentials as a secret in AWS Secrets Manager.

Explanation

Amazon RDS Proxy pools and shares database connections to improve scalability and resilience. Amazon RDS is a managed relational database that handles patching, backups and failover. AWS Secrets Manager stores and automatically rotates secrets such as database credentials.

SAP-C02 Question 202

Single page →
Topic 1 · Question 202

A company needs to build a disaster recovery (DR) solution for its ecommerce website. The web application is hosted on a fleet of t3.large Amazon EC2 instances and uses an Amazon RDS for MySQL DB instance. The EC2 instances are in an Auto Scaling group that extends across multiple Availability Zones. In the event of a disaster, the web application must fail over to the secondary environment with an RPO of 30 seconds and an RTO of 10 minutes. Which solution will meet these requirements MOST cost-effectively?

  • AUse infrastructure as code (IaC) to provision the new infrastructure in the DR Region. Create a cross-Region read replica for the DB instance. Set up a backup plan in AWS Backup to create cross-Region backups for the EC2 instances and the DB instance. Create a cron expression to back up the EC2 instances and the DB instance every 30 seconds to the DR Region. Recover the EC2 instances from the latest EC2 backup. Use an Amazon Route 53 geolocation routing policy to automatically fail over to the DR Region in the event of a disaster.
  • BUse infrastructure as code (IaC) to provision the new infrastructure in the DR Region. Create a cross-Region read replica for the DB instance. Set up AWS Elastic Disaster Recovery to continuously replicate the EC2 instances to the DR Region. Run the EC2 instances at the minimum capacity in the DR Region. Use an Amazon Route 53 failover routing policy to automatically fail over to the DR Region in the event of a disaster. Increase the desired capacity of the Auto Scaling group. (correct answer)
  • CSet up a backup plan in AWS Backup to create cross-Region backups for the EC2 instances and the DB instance. Create a cron expression to back up the EC2 instances and the DB instance every 30 seconds to the DR Region. Use infrastructure as code (IaC) to provision the new infrastructure in the DR Region. Manually restore the backed-up data on new instances. Use an Amazon Route 53 simple routing policy to automatically fail over to the DR Region in the event of a disaster.
  • DUse infrastructure as code (IaC) to provision the new infrastructure in the DR Region. Create an Amazon Aurora global database. Set up AWS Elastic Disaster Recovery to continuously replicate the EC2 instances to the DR Region. Run the Auto Scaling group of EC2 instances at full capacity in the DR Region. Use an Amazon Route 53 failover routing policy to automatically fail over to the DR Region in the event of a disaster.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use infrastructure as code (IaC) to provision the new infrastructure in the DR Region. Create a cross-Region read replica for the DB instance. Set up AWS Elastic Disaster Recovery to continuously replicate the EC2 ins...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. This option delivers the requirement at the lowest cost.

SAP-C02 Question 203

Single page →
Topic 1 · Question 203

A company is planning a one-time migration of an on-premises MySQL database to Amazon Aurora MySQL in the us-east-1 Region. The company's current internet connection has limited bandwidth. The on-premises MySQL database is 60 TB in size. The company estimates that it will take a month to transfer the data to AWS over the current internet connection. The company needs a migration solution that will migrate the database more quickly. Which solution will migrate the database in the LEAST amount of time?

  • ARequest a 1 Gbps AWS Direct Connect connection between the on-premises data center and AWS. Use AWS Database Migration Service (AWS DMS) to migrate the on-premises MySQL database to Aurora MySQL.
  • BUse AWS DataSync with the current internet connection to accelerate the data transfer between the on-premises data center and AWS. Use AWS Application Migration Service to migrate the on-premises MySQL database to Aurora MySQL.
  • COrder an AWS Snowball Edge device. Load the data into an Amazon S3 bucket by using the S3 interface. Use AWS Database Migration Service (AWS DMS) to migrate the data from Amazon S3 to Aurora MySQL. (correct answer)
  • DOrder an AWS Snowball device. Load the data into an Amazon S3 bucket by using the S3 Adapter for Snowball. Use AWS Application Migration Service to migrate the data from Amazon S3 to Aurora MySQL.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Order an AWS Snowball Edge device. Load the data into an Amazon S3 bucket by using the S3 interface. Use AWS Database Migration Service (AWS DMS) to migrate the data from Amazon S3 to Aurora MySQL.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Snowball physically ships data to AWS, ideal when bandwidth is limited or data is very large. Amazon Aurora is a high-performance managed relational database with built-in replication and failover.

SAP-C02 Question 204

Single page →
Topic 1 · Question 204

A company has an application in the AWS Cloud. The application runs on a fleet of 20 Amazon EC2 instances. The EC2 instances are persistent and store data on multiple attached Amazon Elastic Block Store (Amazon EBS) volumes. The company must maintain backups in a separate AWS Region. The company must be able to recover the EC2 instances and their configuration within 1 business day, with loss of no more than 1 day's worth of data. The company has limited staff and needs a backup solution that optimizes operational efficiency and cost. The company already has created an AWS CloudFormation template that can deploy the required network configuration in a secondary Region. Which solution will meet these requirements?

  • ACreate a second CloudFormation template that can recreate the EC2 instances in the secondary Region. Run daily multivolume snapshots by using AWS Systems Manager Automation runbooks. Copy the snapshots to the secondary Region. In the event of a failure launch the CloudFormation templates, restore the EBS volumes from snapshots, and transfer usage to the secondary Region.
  • BUse Amazon Data Lifecycle Manager (Amazon DLM) to create daily multivolume snapshots of the EBS volumes. In the event of a failure, launch the CloudFormation template and use Amazon DLM to restore the EBS volumes and transfer usage to the secondary Region.
  • CUse AWS Backup to create a scheduled daily backup plan for the EC2 instances. Configure the backup task to copy the backups to a vault in the secondary Region. In the event of a failure, launch the CloudFormation template, restore the instance volumes and configurations from the backup vault, and transfer usage to the secondary Region. (correct answer)
  • DDeploy EC2 instances of the same size and configuration to the secondary Region. Configure AWS DataSync daily to copy data from the primary Region to the secondary Region. In the event of a failure, launch the CloudFormation template and transfer usage to the secondary Region.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use AWS Backup to create a scheduled daily backup plan for the EC2 instances. Configure the backup task to copy the backups to a vault in the secondary Region. In the event of a failure, launch the CloudFormation temp...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Backup centrally automates and manages backups across AWS services. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 205

Single page →
Topic 1 · Question 205 · Select all that apply

A company is designing a new website that hosts static content. The website will give users the ability to upload and download large files. According to company requirements, all data must be encrypted in transit and at rest. A solutions architect is building the solution by using Amazon S3 and Amazon CloudFront. Which combination of steps will meet the encryption requirements? (Choose three.)

  • ATurn on S3 server-side encryption for the S3 bucket that the web application uses. (correct answer)
  • BAdd a policy attribute of "aws:SecureTransport": "true" for read and write operations in the S3 ACLs.
  • CCreate a bucket policy that denies any unencrypted operations in the S3 bucket that the web application uses. (correct answer)
  • DConfigure encryption at rest on CloudFront by using server-side encryption with AWS KMS keys (SSE-KMS).
  • EConfigure redirection of HTTP requests to HTTPS requests in CloudFront. (correct answer)
  • FUse the RequireSSL option in the creation of presigned URLs for the S3 bucket that the web application uses.
Reveal answer & explanation
Correct answer: A, C, E

The correct answer is A, C, E. Option A: Turn on S3 server-side encryption for the S3 bucket that the web application uses. Option C: Create a bucket policy that denies any unencrypted operations in the S3 bucket that the web application uses. Option E: Configure redirection of HTTP requests to HTTPS requests in CloudFront.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon CloudFront caches content at edge locations to reduce latency and offload origins. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 206

Single page →
Topic 1 · Question 206

A company is implementing a serverless architecture by using AWS Lambda functions that need to access a Microsoft SQL Server DB instance on Amazon RDS. The company has separate environments for development and production, including a clone of the database system. The company's developers are allowed to access the credentials for the development database. However, the credentials for the production database must be encrypted with a key that only members of the IT security team's IAM user group can access. This key must be rotated on a regular basis. What should a solutions architect do in the production environment to meet these requirements?

  • AStore the database credentials in AWS Systems Manager Parameter Store by using a SecureString parameter that is encrypted by an AWS Key Management Service (AWS KMS) customer managed key. Attach a role to each Lambda function to provide access to the SecureString parameter. Restrict access to the SecureString parameter and the customer managed key so that only the IT security team can access the parameter and the key.
  • BEncrypt the database credentials by using the AWS Key Management Service (AWS KMS) default Lambda key. Store the credentials in the environment variables of each Lambda function. Load the credentials from the environment variables in the Lambda code. Restrict access to the KMS key so that only the IT security team can access the key.
  • CStore the database credentials in the environment variables of each Lambda function. Encrypt the environment variables by using an AWS Key Management Service (AWS KMS) customer managed key. Restrict access to the customer managed key so that only the IT security team can access the key.
  • DStore the database credentials in AWS Secrets Manager as a secret that is associated with an AWS Key Management Service (AWS KMS) customer managed key. Attach a role to each Lambda function to provide access to the secret. Restrict access to the secret and the customer managed key so that only the IT security team can access the secret and the key. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Store the database credentials in AWS Secrets Manager as a secret that is associated with an AWS Key Management Service (AWS KMS) customer managed key. Attach a role to each Lambda function to provide access to the se...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest. AWS Secrets Manager stores and automatically rotates secrets such as database credentials.

SAP-C02 Question 207

Single page →
Topic 1 · Question 207

An online retail company is migrating its legacy on-premises .NET application to AWS. The application runs on load-balanced frontend web servers, load-balanced application servers, and a Microsoft SQL Server database. The company wants to use AWS managed services where possible and does not want to rewrite the application. A solutions architect needs to implement a solution to resolve scaling issues and minimize licensing costs as the application scales. Which solution will meet these requirements MOST cost-effectively?

  • ADeploy Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer for the web tier and for the application tier. Use Amazon Aurora PostgreSQL with Babelfish turned on to replatform the SQL Server database. (correct answer)
  • BCreate images of all the servers by using AWS Database Migration Service (AWS DMS). Deploy Amazon EC2 instances that are based on the on-premises imports. Deploy the instances in an Auto Scaling group behind a Network Load Balancer for the web tier and for the application tier. Use Amazon DynamoDB as the database tier.
  • CContainerize the web frontend tier and the application tier. Provision an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. Create an Auto Scaling group behind a Network Load Balancer for the web tier and for the application tier. Use Amazon RDS for SQL Server to host the database.
  • DSeparate the application functions into AWS Lambda functions. Use Amazon API Gateway for the web frontend tier and the application tier. Migrate the data to Amazon S3. Use Amazon Athena to query the data.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Deploy Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer for the web tier and for the application tier. Use Amazon Aurora PostgreSQL with Babelfish turned on to replatform the SQL Serve...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon Aurora is a high-performance managed relational database with built-in replication and failover. This option delivers the requirement at the lowest cost.

SAP-C02 Question 208

Single page →
Topic 1 · Question 208

A software-as-a-service (SaaS) provider exposes APIs through an Application Load Balancer (ALB). The ALB connects to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that is deployed in the us-east-1 Region. The exposed APIs contain usage of a few non-standard REST methods: LINK, UNLINK, LOCK, and UNLOCK. Users outside the United States are reporting long and inconsistent response times for these APIs. A solutions architect needs to resolve this problem with a solution that minimizes operational overhead. Which solution meets these requirements?

  • AAdd an Amazon CloudFront distribution. Configure the ALB as the origin.
  • BAdd an Amazon API Gateway edge-optimized API endpoint to expose the APIs. Configure the ALB as the target.
  • CAdd an accelerator in AWS Global Accelerator. Configure the ALB as the origin. (correct answer)
  • DDeploy the APIs to two additional AWS Regions: eu-west-1 and ap-southeast-2. Add latency-based routing records in Amazon Route 53.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Add an accelerator in AWS Global Accelerator. Configure the ALB as the origin.

Explanation

AWS Global Accelerator routes users over the AWS backbone to the optimal endpoint for lower latency and fast failover. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 209

Single page →
Topic 1 · Question 209

A company runs an IoT application in the AWS Cloud. The company has millions of sensors that collect data from houses in the United States. The sensors use the MQTT protocol to connect and send data to a custom MQTT broker. The MQTT broker stores the data on a single Amazon EC2 instance. The sensors connect to the broker through the domain named iot.example.com. The company uses Amazon Route 53 as its DNS service. The company stores the data in Amazon DynamoDB. On several occasions, the amount of data has overloaded the MQTT broker and has resulted in lost sensor data. The company must improve the reliability of the solution. Which solution will meet these requirements?

  • ACreate an Application Load Balancer (ALB) and an Auto Scaling group for the MQTT broker. Use the Auto Scaling group as the target for the ALB. Update the DNS record in Route 53 to an alias record. Point the alias record to the ALB. Use the MQTT broker to store the data.
  • BSet up AWS IoT Core to receive the sensor data. Create and configure a custom domain to connect to AWS IoT Core. Update the DNS record in Route 53 to point to the AWS IoT Core Data-ATS endpoint. Configure an AWS IoT rule to store the data. (correct answer)
  • CCreate a Network Load Balancer (NLB). Set the MQTT broker as the target. Create an AWS Global Accelerator accelerator. Set the NLB as the endpoint for the accelerator. Update the DNS record in Route 53 to a multivalue answer record. Set the Global Accelerator IP addresses as values. Use the MQTT broker to store the data.
  • DSet up AWS IoT Greengrass to receive the sensor data. Update the DNS record in Route 53 to point to the AWS IoT Greengrass endpoint. Configure an AWS IoT rule to invoke an AWS Lambda function to store the data.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Set up AWS IoT Core to receive the sensor data. Create and configure a custom domain to connect to AWS IoT Core. Update the DNS record in Route 53 to point to the AWS IoT Core Data-ATS endpoint. Configure an AWS IoT r...

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 210

Single page →
Topic 1 · Question 210

A company has Linux-based Amazon EC2 instances. Users must access the instances by using SSH with EC2 SSH key pairs. Each machine requires a unique EC2 key pair. The company wants to implement a key rotation policy that will, upon request, automatically rotate all the EC2 key pairs and keep the keys in a securely encrypted place. The company will accept less than 1 minute of downtime during key rotation. Which solution will meet these requirements?

  • AStore all the keys in AWS Secrets Manager. Define a Secrets Manager rotation schedule to invoke an AWS Lambda function to generate new key pairs. Replace public keys on EC2 instances. Update the private keys in Secrets Manager. (correct answer)
  • BStore all the keys in Parameter Store, a capability of AWS Systems Manager, as a string. Define a Systems Manager maintenance window to invoke an AWS Lambda function to generate new key pairs. Replace public keys on EC2 instances. Update the private keys in Parameter Store.
  • CImport the EC2 key pairs into AWS Key Management Service (AWS KMS). Configure automatic key rotation for these key pairs. Create an Amazon EventBridge scheduled rule to invoke an AWS Lambda function to initiate the key rotation in AWS KMS.
  • DAdd all the EC2 instances to Fleet Manager, a capability of AWS Systems Manager. Define a Systems Manager maintenance window to issue a Systems Manager Run Command document to generate new key pairs and to rotate public keys to all the instances in Fleet Manager.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Store all the keys in AWS Secrets Manager. Define a Secrets Manager rotation schedule to invoke an AWS Lambda function to generate new key pairs. Replace public keys on EC2 instances. Update the private keys in Secret...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Secrets Manager stores and automatically rotates secrets such as database credentials.

SAP-C02 Question 211

Single page →
Topic 1 · Question 211

A company wants to migrate to AWS. The company is running thousands of VMs in a VMware ESXi environment. The company has no configuration management database and has little knowledge about the utilization of the VMware portfolio. A solutions architect must provide the company with an accurate inventory so that the company can plan for a cost-effective migration. Which solution will meet these requirements with the LEAST operational overhead?

  • AUse AWS Systems Manager Patch Manager to deploy Migration Evaluator to each VM. Review the collected data in Amazon QuickSight. Identify servers that have high utilization. Remove the servers that have high utilization from the migration list. Import the data to AWS Migration Hub.
  • BExport the VMware portfolio to a .csv file. Check the disk utilization for each server. Remove servers that have high utilization. Export the data to AWS Application Migration Service. Use AWS Server Migration Service (AWS SMS) to migrate the remaining servers.
  • CDeploy the Migration Evaluator agentless collector to the ESXi hypervisor. Review the collected data in Migration Evaluator. Identify inactive servers. Remove the inactive servers from the migration list. Import the data to AWS Migration Hub. (correct answer)
  • DDeploy the AWS Application Migration Service Agent to each VM. When the data is collected, use Amazon Redshift to import and analyze the data. Use Amazon QuickSight for data visualization.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Deploy the Migration Evaluator agentless collector to the ESXi hypervisor. Review the collected data in Migration Evaluator. Identify inactive servers. Remove the inactive servers from the migration list. Import the d...

Explanation

AWS Migration Hub tracks application migrations across services.

SAP-C02 Question 212

Single page →
Topic 1 · Question 212

A company runs a microservice as an AWS Lambda function. The microservice writes data to an on-premises SQL database that supports a limited number of concurrent connections. When the number of Lambda function invocations is too high, the database crashes and causes application downtime. The company has an AWS Direct Connect connection between the company's VPC and the on-premises data center. The company wants to protect the database from crashes. Which solution will meet these requirements?

  • AWrite the data to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the Lambda function to read from the queue and write to the existing database. Set a reserved concurrency limit on the Lambda function that is less than the number of connections that the database supports. (correct answer)
  • BCreate a new Amazon Aurora Serverless DB cluster. Use AWS DataSync to migrate the data from the existing database to Aurora Serverless. Reconfigure the Lambda function to write to Aurora.
  • CCreate an Amazon RDS Proxy DB instance. Attach the RDS Proxy DB instance to the Amazon RDS DB instance. Reconfigure the Lambda function to write to the RDS Proxy DB instance.
  • DWrite the data to an Amazon Simple Notification Service (Amazon SNS) topic. Invoke the Lambda function to write to the existing database when the topic receives new messages. Configure provisioned concurrency for the Lambda function to be equal to the number of connections that the database supports.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Write the data to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the Lambda function to read from the queue and write to the existing database. Set a reserved concurrency limit on the Lambda function tha...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 213

Single page →
Topic 1 · Question 213

A company uses a Grafana data visualization solution that runs on a single Amazon EC2 instance to monitor the health of the company's AWS workloads. The company has invested time and effort to create dashboards that the company wants to preserve. The dashboards need to be highly available and cannot be down for longer than 10 minutes. The company needs to minimize ongoing maintenance. Which solution will meet these requirements with the LEAST operational overhead?

  • AMigrate to Amazon CloudWatch dashboards. Recreate the dashboards to match the existing Grafana dashboards. Use automatic dashboards where possible.
  • BCreate an Amazon Managed Grafana workspace. Configure a new Amazon CloudWatch data source. Export dashboards from the existing Grafana instance. Import the dashboards into the new workspace. (correct answer)
  • CCreate an AMI that has Grafana pre-installed. Store the existing dashboards in Amazon Elastic File System (Amazon EFS). Create an Auto Scaling group that uses the new AMI. Set the Auto Scaling group's minimum, desired, and maximum number of instances to one. Create an Application Load Balancer that serves at least two Availability Zones.
  • DConfigure AWS Backup to back up the EC2 instance that runs Grafana once each hour. Restore the EC2 instance from the most recent snapshot in an alternate Availability Zone when required.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an Amazon Managed Grafana workspace. Configure a new Amazon CloudWatch data source. Export dashboards from the existing Grafana instance. Import the dashboards into the new workspace.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 214

Single page →
Topic 1 · Question 214

A company needs to migrate its customer transactions database from on premises to AWS. The database resides on an Oracle DB instance that runs on a Linux server. According to a new security requirement, the company must rotate the database password each year. Which solution will meet these requirements with the LEAST operational overhead?

  • AConvert the database to Amazon DynamoDB by using the AWS Schema Conversion Tool (AWS SCT). Store the password in AWS Systems Manager Parameter Store. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function for yearly passtard rotation.
  • BMigrate the database to Amazon RDS for Oracle. Store the password in AWS Secrets Manager. Turn on automatic rotation. Configure a yearly rotation schedule. (correct answer)
  • CMigrate the database to an Amazon EC2 instance. Use AWS Systems Manager Parameter Store to keep and rotate the connection string by using an AWS Lambda function on a yearly schedule.
  • DMigrate the database to Amazon Neptune by using the AWS Schema Conversion Tool (AWS SCT). Create an Amazon CloudWatch alarm to invoke an AWS Lambda function for yearly password rotation.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Migrate the database to Amazon RDS for Oracle. Store the password in AWS Secrets Manager. Turn on automatic rotation. Configure a yearly rotation schedule.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. AWS Secrets Manager stores and automatically rotates secrets such as database credentials. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 215

Single page →
Topic 1 · Question 215 · Select all that apply

A solutions architect is designing an AWS account structure for a company that consists of multiple teams. All the teams will work in the same AWS Region. The company needs a VPC that is connected to the on-premises network. The company expects less than 50 Mbps of total traffic to and from the on-premises network. Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)

  • ACreate an AWS CloudFormation template that provisions a VPC and the required subnets. Deploy the template to each AWS account.
  • BCreate an AWS CloudFormation template that provisions a VPC and the required subnets. Deploy the template to a shared services account. Share the subnets by using AWS Resource Access Manager. (correct answer)
  • CUse AWS Transit Gateway along with an AWS Site-to-Site VPN for connectivity to the on-premises network. Share the transit gateway by using AWS Resource Access Manager.
  • DUse AWS Site-to-Site VPN for connectivity to the on-premises network. (correct answer)
  • EUse AWS Direct Connect for connectivity to the on-premises network.
Reveal answer & explanation
Correct answer: B, D

The correct answer is B, D. Option B: Create an AWS CloudFormation template that provisions a VPC and the required subnets. Deploy the template to a shared services account. Share the subnets by using AWS Resource Access Manager. Option D: Use AWS Site-to-Site VPN for connectivity to the on-premises network.

Explanation

AWS Site-to-Site VPN provides encrypted connectivity between on premises and a VPC. AWS CloudFormation provisions infrastructure as code repeatably. This option delivers the requirement at the lowest cost.

SAP-C02 Question 216

Single page →
Topic 1 · Question 216

A solutions architect at a large company needs to set up network security for outbound traffic to the internet from all AWS accounts within an organization in AWS Organizations. The organization has more than 100 AWS accounts, and the accounts route to each other by using a centralized AWS Transit Gateway. Each account has both an internet gateway and a NAT gateway for outbound traffic to the internet. The company deploys resources only into a single AWS Region. The company needs the ability to add centrally managed rule-based filtering on all outbound traffic to the internet for all AWS accounts in the organization. The peak load of outbound traffic will not exceed 25 Gbps in each Availability Zone. Which solution meets these requirements?

  • ACreate a new VPC for outbound traffic to the internet. Connect the existing transit gateway to the new VPC. Configure a new NAT gateway. Create an Auto Scaling group of Amazon EC2 instances that run an open-source internet proxy for rule-based filtering across all Availability Zones in the Region. Modify all default routes to point to the proxy's Auto Scaling group.
  • BCreate a new VPC for outbound traffic to the internet. Connect the existing transit gateway to the new VPC. Configure a new NAT gateway. Use an AWS Network Firewall firewall for rule-based filtering. Create Network Firewall endpoints in each Availability Zone. Modify all default routes to point to the Network Firewall endpoints. (correct answer)
  • CCreate an AWS Network Firewall firewall for rule-based filtering in each AWS account. Modify all default routes to point to the Network Firewall firewalls in each account.
  • DIn each AWS account, create an Auto Scaling group of network-optimized Amazon EC2 instances that run an open-source internet proxy for rule-based filtering. Modify all default routes to point to the proxy's Auto Scaling group.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a new VPC for outbound traffic to the internet. Connect the existing transit gateway to the new VPC. Configure a new NAT gateway. Use an AWS Network Firewall firewall for rule-based filtering. Create Network Fi...

Explanation

AWS Transit Gateway centrally connects many VPCs and on-premises networks at scale. A NAT gateway lets private subnet resources reach the internet for outbound traffic only. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 217

Single page →
Topic 1 · Question 217

A company uses a load balancer to distribute traffic to Amazon EC2 instances in a single Availability Zone. The company is concerned about security and wants a solutions architect to re-architect the solution to meet the following requirements: • Inbound requests must be filtered for common vulnerability attacks. • Rejected requests must be sent to a third-party auditing application. • All resources should be highly available. Which solution meets these requirements?

  • AConfigure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Use Amazon Inspector to monitor traffic to the ALB and EC2 instances. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB. Use an AWS Lambda function to frequently push the Amazon Inspector report to the third-party auditing application.
  • BConfigure an Application Load Balancer (ALB) and add the EC2 instances as targets. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB name and enable logging with Amazon CloudWatch Logs. Use an AWS Lambda function to frequently push the logs to the third-party auditing application.
  • CConfigure an Application Load Balancer (ALB) along with a target group adding the EC2 instances as targets. Create an Amazon Kinesis Data Firehose with the destination of the third-party auditing application. Create a web ACL in WAF. Create an AWS WAF using the web ACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination. Subscribe to AWS Managed Rules in AWS Marketplace, choosing the WAF as the subscriber.
  • DConfigure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Create an Amazon Kinesis Data Firehose with a destination of the third-party auditing application. Create a web ACL in WAF. Create an AWS WAF using the WebACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination. Subscribe to AWS Managed Rules in AWS Marketplace, choosing the WAF as the subscriber. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Create an Amazon Kinesis Data Firehose...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. An Application Load Balancer distributes HTTP/HTTPS traffic and supports path/host routing. A load balancer distributes traffic across targets in multiple AZs for availability and scale. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SAP-C02 Question 218

Single page →
Topic 1 · Question 218

A company is running an application in the AWS Cloud. The application consists of microservices that run on a fleet of Amazon EC2 instances in multiple Availability Zones behind an Application Load Balancer. The company recently added a new REST API that was implemented in Amazon API Gateway. Some of the older microservices that run on EC2 instances need to call this new API. The company does not want the API to be accessible from the public internet and does not want proprietary data to traverse the public internet. What should a solutions architect do to meet these requirements?

  • ACreate an AWS Site-to-Site VPN connection between the VPC and the API Gateway. Use API Gateway to generate a unique API Key for each microservice. Configure the API methods to require the key.
  • BCreate an interface VPC endpoint for API Gateway, and set an endpoint policy to only allow access to the specific API. Add a resource policy to API Gateway to only allow access from the VPC endpoint. Change the API Gateway endpoint type to private. (correct answer)
  • CModify the API Gateway to use IAM authentication. Update the IAM policy for the IAM role that is assigned to the EC2 instances to allow access to the API Gateway. Move the API Gateway into a new VPDeploy a transit gateway and connect the VPCs.
  • DCreate an accelerator in AWS Global Accelerator, and connect the accelerator to the API Gateway. Update the route table for all VPC subnets with a route to the created Global Accelerator endpoint IP address. Add an API key for each service to use for authentication.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an interface VPC endpoint for API Gateway, and set an endpoint policy to only allow access to the specific API. Add a resource policy to API Gateway to only allow access from the VPC endpoint. Change the API Ga...

Explanation

A VPC endpoint provides private connectivity to AWS services without traversing the public internet. Amazon API Gateway is a fully managed front door for creating and securing APIs at scale. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SAP-C02 Question 219

Single page →
Topic 1 · Question 219

A company has set up its entire infrastructure on AWS. The company uses Amazon EC2 instances to host its ecommerce website and uses Amazon S3 to store static data. Three engineers at the company handle the cloud administration and development through one AWS account. Occasionally, an engineer alters an EC2 security group configuration of another engineer and causes noncompliance issues in the environment. A solutions architect must set up a system that tracks changes that the engineers make. The system must send alerts when the engineers make noncompliant changes to the security settings for the EC2 instances. What is the FASTEST way for the solutions architect to meet these requirements?

  • ASet up AWS Organizations for the company. Apply SCPs to govern and track noncompliant security group changes that are made to the AWS account.
  • BEnable AWS CloudTrail to capture the changes to EC2 security groups. Enable Amazon CloudWatch rules to provide alerts when noncompliant security settings are detected.
  • CEnable SCPs on the AWS account to provide alerts when noncompliant security group changes are made to the environment.
  • DEnable AWS Config on the EC2 security groups to track any noncompliant changes. Send the changes as alerts through an Amazon Simple Notification Service (Amazon SNS) topic. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Enable AWS Config on the EC2 security groups to track any noncompliant changes. Send the changes as alerts through an Amazon Simple Notification Service (Amazon SNS) topic.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 220

Single page →
Topic 1 · Question 220 · Select all that apply

A company has IoT sensors that monitor traffic patterns throughout a large city. The company wants to read and collect data from the sensors and perform aggregations on the data. A solutions architect designs a solution in which the IoT devices are streaming to Amazon Kinesis Data Streams. Several applications are reading from the stream. However, several consumers are experiencing throttling and are periodically encountering a ReadProvisionedThroughputExceeded error. Which actions should the solutions architect take to resolve this issue? (Choose three.)

  • AReshard the stream to increase the number of shards in the stream. (correct answer)
  • BUse the Kinesis Producer Library (KPL). Adjust the polling frequency.
  • CUse consumers with the enhanced fan-out feature. (correct answer)
  • DReshard the stream to reduce the number of shards in the stream.
  • EUse an error retry and exponential backoff mechanism in the consumer logic. (correct answer)
  • FConfigure the stream to use dynamic partitioning.
Reveal answer & explanation
Correct answer: A, C, E

The correct answer is A, C, E. Option A: Reshard the stream to increase the number of shards in the stream. Option C: Use consumers with the enhanced fan-out feature. Option E: Use an error retry and exponential backoff mechanism in the consumer logic.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. This option meets the real-time / low-latency performance requirement.

Showing questions 201–220 of 529 · Page 11 of 27