Highest Quality AWS-Certified-Solutions-Architect-Professional Dumps 2021

NEW QUESTION 1
A user has configured EBS volume with PIOPS. The user is not experiencing the optimal throughput. Which of the following could not be factor affecting I/O performance of that EBS volume?

• A. EBS bandwidth of dedicated instance exceeding the PIOPS
• B. EC2 bandwidth
• C. EBS volume size
• D. Instance type is not EBS optimized

Answer: C

Explanation: If the user is not experiencing the expected IOPS or throughput that is provisioned, ensure that the EC2 bandwidth is not the limiting factor, the instance is EBS-optimized (or include 10 Gigabit network
connectMty) and the instance type EBS dedicated bandwidth exceeds the IOPS more than he has provisioned.
Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-io-characteristics.html

NEW QUESTION 2
An enterprise wants to use a third-party SaaS application. The SaaS application needs to have access to issue several API commands to discover Amazon EC2 resources running within the enterprise's account The enterprise has internal security policies that require any outside access to their environment must conform to the principles of least prMlege and there must be controls in place to ensure that the credentials used by the SaaS vendor cannot be used by any other third party. Which of the following would meet all of these conditions?

• A. From the AWS Management Console, navigate to the Security Credentials page and retrieve the access and secret key for your account.
• B. Create an IAM user within the enterprise account assign a user policy to the IAM user that allows only the actions required by the SaaS application create a new access and secret key for the user and provide these credentials to the SaaS provider.
• C. Create an IAM role for cross-account access allows the SaaS provider's account to assume the role and assign it a policy that allows only the actions required by the SaaS application.
• D. Create an IAM role for EC2 instances, assign it a policy that allows only the actions required tor the Saas application to work, provide the role ARN to the SaaS provider to use when launching their application instances.

Answer: C

NEW QUESTION 3
Which of the following are characteristics of Amazon VPC subnets? Choose 2 answers

• A. Each subnet spans at least 2 Availability Zones to provide a high-availability environment.
• B. Each subnet maps to a single Availability Zone.
• C. CIDR block mask of /25 is the smallest range supported.
• D. By default, all subnets can route between each other, whether they are private or public.
• E. Instances in a private subnet can communicate with the Internet only if they have an Elastic I

Answer: AE

NEW QUESTION 4
An organization is planning to host a web application in the AWS VPC. The organization does not want to host a database in the public cloud due to statutory requirements. How can the organization setup in this scenario?

• A. The organization should plan the app server on the public subnet and database in the organization’s data center and connect them with the VPN gateway.
• B. The organization should plan the app server on the public subnet and use RDS with the private subnet for a secure data operation.
• C. The organization should use the public subnet for the app server and use RDS with a storage gateway to access as well as sync the data securely from the local data center.
• D. The organization should plan the app server on the public subnet and database in a private subnet so it will not be in the public cloud.

Answer: A

Explanation: A Virtual Private Cloud (VPC) is a virtual network dedicated to the user’s AWS account.
The user can create subnets as per the requirement within a VPC. If the user wants to connect VPC from his own data centre, he can setup a public and VPN only subnet which uses hardware VPN access to
connect with his data centre. When the user has configured this setup with Wizard, it will create a virtual private gateway to route all the traffic of the VPN subnet.
If the virtual private gateway is attached with VPC and the user deletes the VPC from the console it will first automatically detach the gateway and only then delete the VPC.
Reference: http://docs.aws.amazon.com/AmazonVPC/Iatest/UserGuide/VPC_Subnets.html

NEW QUESTION 5
Your company is storing millions of sensitive transactions across thousands of 100-GB files that must be encrypted in transit and at rest. Analysts concurrently depend on subsets of files, which can consume up to 5 TB of space, to generate simulations that can be used to steer business decisions. You are required to design an AWS solution that can cost effectively accommodate the long-term storage and in-flight subsets of data.

• A. Use Amazon Simple Storage Service (S3) with server-side encryption, and run simulations on subsets in ephemeral drives on Amazon EC2.
• B. Use Amazon S3 with server-side encryption, and run simulations on subsets in-memory on Amazon EC2.
• C. Use HDFS on Amazon EMR, and run simulations on subsets in ephemeral drives on Amazon EC2.
• D. Use HDFS on Amazon Elastic MapReduce (EMR), and run simulations on subsets in-memory on Amazon Elastic Compute Cloud (EC2).
• E. Store the full data set in encrypted Amazon Elastic Block Store (EBS) volumes, and regularly capturesnapshots that can be cloned to EC2 workstation

Answer: D

NEW QUESTION 6
Which of the following statements is correct about the number of security groups and rules applicable for an EC2-Classic instance and an EC2-VPC network interface?

• A. In EC2-Classic, you can associate an instance with up to 5 security groups and add up to 50 rules to a security grou
• B. In EC2-VPC, you can associate a network interface with up to 500 security groups and add up to 100 rules to a security group.
• C. In EC2-Classic, you can associate an instance with up to 500 security groups and add up to 50 rules to a security grou
• D. In EC2-VPC, you can associate a network interface with up to 5 security groups and add up to 100 rules to a security group.
• E. In EC2-Classic, you can associate an instance with up to 5 security groups and add up to 100 rules to a security grou
• F. In EC2-VPC, you can associate a network interface with up to 500 security groups and add up to 50 rules to a security group.
• G. In EC2-Classic, you can associate an instance with up to 500 security groups and add up to 100 rules to a security grou
• H. In EC2-VPC, you can associate a network interface with up to 5 security groups and add up to 50 rules to a security group.

Answer: D

Explanation: A security group acts as a virtual firewall that controls the traffic for one or more instances. When you launch an instance, you associate one or more security groups with the instance. You add rules to each security group that allow traffic to or from its associated instances. If you're using EC2-Classic, you must use security groups created specifically for EC2-Classic. In EC2-Classic, you can associate an instance with up to 500 security groups and add up to 100 rules to a security group. If you're using EC2-VPC, you must use security groups created specifically for your VPC. In EC2-VPC, you can associate a network interface with up to 5 security groups and add up to 50 rules to a security group.
Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html

NEW QUESTION 7
You are designing a photo-sharing mobile app. The application will store all pictures in a single Amazon S3 bucket. Users will upload pictures from their mobile device directly to Amazon S3 and will be able to view and download their own pictures directly from Amazon S3.
You want to configure security to handle potentially millions of users in the most secure manner possible. What should your server-side application do when a new user registers on the photo-sharing mobile application?

• A. Create an IAM use
• B. Update the bucket policy with appropriate permissions for the IAM use
• C. Generate an access key and secret key for the IAM user, store them in the mobile app and use these credentials to access Amazon S3.
• D. Create an IAM use
• E. Assign appropriate permissions to the IAM use
• F. Generate an access key and secret key for the IAM user, store them in the mobile app and use these credentials to access Amazon S3.
• G. Create a set of long-term credentials using AWS Security Token Service with appropriate permission
• H. Store these credentials in the mobile app and use them to access Amazon S3.
• I. Record the user's information in Amazon RDS and create a role in IAM with appropriate permission
• J. When the user uses their mobile app, create temporary credentials using the AWS Security Token Service "AssumeRoIe" functio
• K. Store these credentials in the mobile app’s memory and use them to access Amazon S3. Generate new credentials the next time the user runs the mobile app.
• L. Record the user's information in Amazon DynamoD
• M. When the user uses their mobile app, create temporary credentials using AWS Security Token Service with appropriate permission
• N. Store these credentials in the mobile app's memory and use them to access Amazon S3. Generate new credentials the next time the user runs the mobile app.

Answer: D

NEW QUESTION 8
An ERP application is deployed across multiple AZs in a single region. In the event of failure, the Recovery Time Objective (RTO) must be less than 3 hours, and the Recovery Point Objective (RPO) must be 15 minutes the customer realizes that data corruption occurred roughly 1.5 hours ago.
What DR strategy could be used to achieve this RTO and RPO in the event of this kind of failure?

• A. Take hourly DB backups to S3, with transaction logs stored in S3 every 5 minutes.
• B. Use synchronous database master-slave replication between two availability zones.
• C. Take hourly DB backups to EC2 Instance store volumes with transaction logs stored In S3 every 5 minutes.
• D. Take 15 minute DB backups stored In Glacier with transaction logs stored in S3 every 5 minute

Answer: A

NEW QUESTION 9
A benefits enrollment company is hosting a 3-tier web application running in a VPC on AWS which includes a NAT (Network Address Translation) instance in the public Web tier. There is enough provisioned capacity for the expected workload tor the new fiscal year benefit enrollment period plus some extra overhead Enrollment proceeds nicely for two days and then the web tier becomes unresponsive, upon investigation using CIoudWatch and other monitoring tools it is discovered that there is an extremely large and unanticipated amount of inbound traffic coming from a set of 15 specific IP addresses over port 80 from a country where the benefits company has no customers. The web tier instances are so overloaded that benefit enrollment administrators cannot even SSH into them. Which actMty would be useful in defending against this attack?

• A. Create a custom route table associated with the web tier and block the attacking IP addresses from the IGW (Internet Gateway)
• B. Change the EIP (Elastic IP Address) of the NAT instance in the web tier subnet and update the Nlain Route Table with the new EIP
• C. Create 15 Security Group rules to block the attacking IP addresses over port 80
• D. Create an inbound NACL (Network Access control list) associated with the web tier subnet with deny rules to block the attacking IP addresses

Answer: D

NEW QUESTION 10
Do you need to use Amazon Cognito to use the Amazon Mobile Analytics service?

• A. N
• B. However, it is recommend by AWS to use Amazon Cognito for security best practices.
• C. Ye
• D. You need to use it only if you have IAM root access.
• E. N
• F. You cannot use it at all, and you need to use AWS IAM accounts.
• G. Ye
• H. It is recommended by AWS to use Amazon Cognito to use Amazon Mobile Analytics servic

Answer: A

Explanation: You can initialize Amazon Mobile Analytics using AWS IAM accounts. AWS recommend using Amazon Cognito for security best practices.
Reference: http://aws.amazon.com/mobi|eanaIytics/faqs/

NEW QUESTION 11
IAM Secure And Scalable is an organization which provides scalable and secure SAAS to its clients. They are planning to host a web server and App server on AWS VPC as separate tiers. The organization wants to implement the scalability by configuring Auto Scaling and load balancer with their app servers (middle tier) too. Which of the below mentioned options suits their requirements?

• A. Since ELB is internet facing, it is recommended to setup HAProxy as the Load balancer within the VPC.
• B. Create an Internet facing ELB with VPC and configure all the App servers with it.
• C. The user should make ELB with EC2-CLASSIC and enable SSH with it for security.
• D. Create an Internal Load balancer with VPC and register all the App sewers with i

Answer: D

Explanation: The Amazon Virtual Private Cloud (Amazon VPC) allows the user to define a virtual networking environment in a private, isolated section of the Amazon Web Services (AWS) cloud. The user has complete control over the virtual networking environment. Within this virtual private cloud, the user can launch AWS resources, such as an ELB, and EC2 instances.
There are two ELBs available with VPC: internet facing and internal (private) ELB. For internal servers, such as App sewers the organization can create an internal load balancer in their VPC and then place back-end application instances behind the internal load balancer. The internal load balancer will route
requests to the back-end application instances, which are also using private IP addresses and only accept requests from the internal load balancer.
Reference:
http://docs.aws.amazon.com/EIasticLoadBalancing/latest/DeveIoperGuide/vpc-IoadbaIancer-types.html

NEW QUESTION 12
Your website is serving on-demand training videos to your workforce. Videos are uploaded monthly in high resolution MP4 format. Your workforce is distributed globally often on the move and using company-provided tablets that require the HTTP Live Streaming (HLS) protocol to watch a video. Your company has no video transcoding expertise and it required you may need to pay for a consultant.
How do you implement the most cost-efficient architecture without compromising high availability and quality of video delivery'?

• A. A video transcoding pipeline running on EC2 using SQS to distribute tasks and Auto Scaling to adjust the number of nodes depending on the length of the queu
• B. EBS volumes to host videos and EBS snapshots to incrementally backup original files after a few day
• C. CIoudFront to serve HLS transcoded videos from EC2.
• D. Elastic Transcoder to transcode original high-resolution MP4 videos to HL
• E. EBS volumes to host videos and EBS snapshots to incrementally backup original files after a few day
• F. CIoudFront to serve HLS transcoded videos from EC2.
• G. Elastic Transcoder to transcode original high-resolution MP4 videos to HL
• H. S3 to host videos with Lifecycle Management to archive original files to Glacier after a few day
• I. C|oudFront to serve HLS transcoded videos from S3.
• J. A video transcoding pipeline running on EC2 using SQS to distribute tasks and Auto Scaling to adjust the number of nodes depending on the length of the queu
• K. S3 to host videos with Lifecycle Management to archive all files to Glacier after a few day
• L. CIoudFront to serve HLS transcoded videos from Glacier.

Answer: C

NEW QUESTION 13
True or False: Amazon EIastiCache supports the Redis key-value store.

• A. True, EIastiCache supports the Redis key-value store, but with limited functionalities.
• B. False, EIastiCache does not support the Redis key-value store.
• C. True, EIastiCache supports the Redis key-value store.
• D. False, EIastiCache supports the Redis key-value store only if you are in a VPC environmen

Answer: C

Explanation: This is true. EIastiCache supports two open-source in-memory caching engines: 1. Memcached - a widely adopted memory object caching system. EIastiCache is protocol compliant with Memcached, so popular tools that you use today with existing Nlemcached environments will work seamlessly with the service. 2.
Redis - a popular open-source in-memory key-value store that supports data structures such as sorted sets and lists. EIastiCache supports Master / Slave replication and Multi-AZ which can be used to achieve cross AZ redundancy.
Reference: https://aws.amazon.com/eIasticache/

NEW QUESTION 14
In which step of using AWS Direct Connect should the user determine the required port speed?

• A. Complete the Cross Connect
• B. Verify Your Virtual Interface
• C. Download Router Configuration
• D. Submit AWS Direct Connect Connection Request

Answer: D

Explanation: To submit an AWS Direct Connect connection request, you need to provide the following information: Your contact information.
The AWS Direct Connect Location to connect to.
Details of AWS Direct Connect partner if you use the AWS Partner Network (APN) service. The port speed you require, either 1 Gbps or 10 Gbps.
Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/getstarted.htmI#ConnectionRequest

NEW QUESTION 15
When does an AWS Data Pipeline terminate the AWS Data Pipeline-managed compute resources?

• A. AWS Data Pipeline terminates AWS Data Pipeline-managed compute resources every 2 hours.
• B. When the final actMty that uses the resources is running
• C. AWS Data Pipeline terminates AWS Data Pipeline-managed compute resources every 12 hours.
• D. When the final actMty that uses the resources has completed successfully orfailed

Answer: D

Explanation: Compute resources will be provisioned by AWS Data Pipeline when the first actMty for a scheduled time that uses those resources is ready to run, and those instances will be terminated when the final actMty that uses the resources has completed successfully or failed.
Reference: https://aws.amazon.com/datapipe|ine/faqs/

NEW QUESTION 16
An AWS customer is deploying an application mat is composed of an AutoScaIing group of EC2 Instances.
The customers security policy requires that every outbound connection from these instances to any other service within the customers Virtual Private Cloud must be authenticated using a unique x 509 certificate that contains the specific instance-id.
In addition an x 509 certificates must Designed by the customer's Key management service in order to be trusted for authentication.
Which of the following configurations will support these requirements?

• A. Configure an IAM Role that grants access to an Amazon S3 object containing a signed certificate and configure me Auto Scaling group to launch instances with this role Have the instances bootstrap get the certificate from Amazon S3 upon first boot.
• B. Embed a certificate into the Amazon Machine Image that is used by the Auto Scaling group Have the launched instances generate a certificate signature request with the instance's assigned instance-id to the Key management service for signature.
• C. Configure the Auto Scaling group to send an SNS notification of the launch of a new instance to the trusted key management servic
• D. Have the Key management service generate a signed certificate and send it directly to the newly launched instance.
• E. Configure the launched instances to generate a new certificate upon first boot Have the Key management service poll the Auto Scaling group for associated instances and send new instances a certificate signature (hat contains the specific instance-id.

Answer: A

NEW QUESTION 17
AWS has launched T2 instances which come with CPU usage credit. An organization has a requirement which keeps an instance running for 24 hours. However, the organization has high usage only during 11 AM to 12 PM. The organization is planning to use a T2 small instance for this purpose.
If the organization already has multiple instances running since Jan 2012, which of the below mentioned options should the organization implement while launching a T2 instance?

• A. The organization must migrate to the EC2-VPC platform first before launching a T2 instance.
• B. While launching a T2 instance the organization must create a new AWS account as this account does not have the EC2-VPC platform.
• C. Create a VPC and launch a T2 instance as part of one of the subnets of that VPC.
• D. While launching a T2 instance the organization must select EC2-VPC as the platform.

Answer: C

Explanation: A Virtual Private Cloud (VPC) is a virtual network dedicated to the user’s AWS account. The user can create subnets as per the requirement within a VPC. The AWS account provides two platforms:
EC2-CLASSIC and EC2-VPC, depending on when the user has created his AWS account and which regions he is using. If the user has created the AWS account after 2013-12-04, it supports only EC2-VPC. In this scenario, since the account is before the required date the supported platform will be
EC2-CLASSIC. It is required that the organization creates a VPC as the T2 instances can be launched only as a part of VPC.
Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vpc-migrate.html

NEW QUESTION 18
Select the correct statement about Amazon EIastiCache.

• A. It makes it easy to set up, manage, and scale a distributed in-memory cache environment in the cloud.
• B. It allows you to quickly deploy your cache environment only if you install software.
• C. It does not integrate with other Amazon Web Services.
• D. It cannot run in the Amazon Virtual Private Cloud (Amazon VPC) environmen

Answer: A

Explanation: EIastiCache is a web service that makes it easy to set up, manage, and scale a distributed in-memory cache environment in the cloud. It provides a high-performance, scalable, and cost-effective caching solution, while removing the complexity associated with deploying and managing a distributed cache environment. With EIastiCache, you can quickly deploy your cache environment, without having to provision hardware or install software.
Reference: http://docs.aws.amazon.com/AmazonE|astiCache/latest/UserGuide/Whatls.html

NEW QUESTION 19
By default, what is the maximum number of Cache Nodes you can run in Amazon EIastiCache?

• A. 20
• B. 50
• C. 100
• D. 200

Answer: A

Explanation: In Amazon EIastiCache, you can run a maximum of 20 Cache Nodes. Reference: http://aws.amazon.com/e|asticache/faqs/