Amazon AWS-Certified-Solutions-Architect-Professional Dumps 2021

NEW QUESTION 1
Your startup wants to implement an order fulfillment process for selling a personalized gadget that needs an average of 3-4 days to produce with some orders taking up to 6 months you expect 10 orders per day on your first day. 1000 orders per day after 6 months and 10,000 orders after 12 months.
Orders coming in are checked for consistency men dispatched to your manufacturing plant for production quality control packaging shipment and payment processing If the product does not meet the quality standards at any stage of the process employees may force the process to repeat a step Customers are notified via email about order status and any critical issues with their orders such as payment failure.
Your case architecture includes AWS Elastic Beanstalk for your website with an RDS MySQL instance for customer data and orders.
How can you implement the order fulfillment process while making sure that the emails are delivered reliably?

• A. Add a business process management application to your Elastic Beanstalk app sewers and re-use the ROS database for tracking order status use one of the Elastic Beanstalk instances to send emails to customers.
• B. Use SWF with an Auto Scaling group of actMty workers and a decider instance in another Auto Scaling group with min/max=1 Use the decider instance to send emails to customers.
• C. Use SWF with an Auto Scaling group of actMty workers and a decider instance in another Auto Scaling group with min/max=1 use SES to send emails to customers.
• D. Use an SQS queue to manage all process tasks Use an Auto Scaling group of EC2 Instances that poll the tasks and execute the
• E. Use SES to send emails to customers.

Answer: C

NEW QUESTION 2
The Statement element, of an AWS IAM policy, contains an array of indMdual statements. Each indMdual statement is a(n) block enclosed in braces { }.

• A. XML
• B. JavaScript
• C. JSON
• D. AJAX

Answer: C

Explanation: The Statement element, of an IAM policy, contains an array of indMdual statements. Each indMdual statement is a JSON block enclosed in braces { }.
Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPoIicyLanguage_EIementDescriptions.html

NEW QUESTION 3
You are running a news website in the eu-west-1 region that updates every 15 minutes. The website has a world-wide audience it uses an Auto Scaling group behind an Elastic Load Balancer and an Amazon
RDS database Static content resides on Amazon S3, and is distributed through Amazon CIoudFront. Your Auto Scaling group is set to trigger a scale up event at 60% CPU utilization, you use an Amazon RDSextra large DB instance with 10.000 Provisioned IOPS its CPU utilization is around 80%. While freeable memory is in the 2 GB range.
Web analytics reports show that the average load time of your web pages is around 1.5 to 2 seconds, but your SEO consultant wants to bring down the average load time to under 0.5 seconds.
How would you improve page load times for your users? (Choose 3 answers)

• A. Lower the scale up trigger of your Auto Scaling group to 30% so it scales more aggressively.
• B. Add an Amazon EIastiCache caching layer to your application for storing sessions and frequent DB quenes
• C. Configure Amazon CIoudFront dynamic content support to enable caching of re-usable content from your site
• D. Switch the Amazon RDS database to the high memory extra large Instance type
• E. Set up a second installation in another region, and use the Amazon Route 53 latency-based routing feature to select the right region.

Answer: ABD

NEW QUESTION 4
In the context of AWS IAM, identify a true statement about user passwords (login profiles).

• A. They must contain Unicode characters.
• B. They can contain any Basic Latin (ASCII) characters.
• C. They must begin and end with a fonrvard slash (/).
• D. They cannot contain Basic Latin (ASCII) characters.

Answer: B

Explanation: The user passwords (login profiles) of IAM users can contain any Basic Latin (ASCII) characters. Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/LimitationsOnEntities.html

NEW QUESTION 5
You have been asked to design the storage layer for an application. The application requires disk performance of at least 100,000 IOPS. In addition, the storage layer must be able to survive the loss of an indMdual disk, EC2 instance, or Availability Zone without any data loss. The volume you provide must have a capacity of at least 3 TB. Which of the following designs will meet these objectives?

• A. Instantiate a c3.8x|arge instance in us-east-1. Provision 4x1TB EBS volumes, attach them to the instance, and configure them as a single RAID 5 volum
• B. Ensure that EBS snapshots are performed every 15 minutes.
• C. Instantiate a c3.8xIarge instance in us-east-1. Provision 3xITB EBS volumes, attach them to the Instance, and configure them as a single RAID 0 volum
• D. Ensure that EBS snapshots are performed every 15 minutes.
• E. Instantiate an i2.8xIarge instance in us-east-1
• F. Create a RAID 0 volume using the four 800GB SSD ephemeral disks provided with the instanc
• G. Provision 3x1TB EBS volumes, attach them to the instance, and configure them as a second RAID 0 volum
• H. Configure synchronous, block-level replication from the ephemeral-backed volume to the EBS-backed volume.
• I. Instantiate a c3.8xIarge instance in us-east-1. Provision an AWS Storage Gateway and configure it for 3 TB of storage and 100,000 IOP
• J. Attach the volume to the instance.
• K. Instantiate an i2.8xIarge instance in us-east-1
• L. Create a RAID 0 volume using the four 800GB SSD ephemeral disks provided with the instanc
• M. Configure synchronous, blocklevel replication to an identically configured instance in us-east-1b.

Answer: C

NEW QUESTION 6
True or False: In Amazon EIastiCache, you can use Cache Security Groups to configure the cache clusters that are part of a VPC.

• A. FALSE
• B. TRUE
• C. True, this is applicable only to cache clusters that are running in an Amazon VPC environment.
• D. True, but only when you configure the cache clusters using the Cache Security Groups from the console navigation pane.

Answer: A

Explanation: Amazon EIastiCache cache security groups are only applicable to cache clusters that are not running in an Amazon Virtual Private Cloud environment (VPC). If you are running in an Amazon Virtual Private Cloud, Cache Security Groups is not available in the console navigation pane.
Reference: http://docs.aws.amazon.com/AmazonEIastiCache/Iatest/UserGuide/CacheSecurityGroup.html

NEW QUESTION 7
A company is storing data on Amazon Simple Storage Service (S3). The company's security policy mandates that data is encrypted at rest. Which of the following methods can achieve this?
Choose 3 answers

• A. Use Amazon S3 server-side encryption with AWS Key Management Service managed keys.
• B. Use Amazon S3 server-side encryption with customer-provided keys.
• C. Use Amazon S3 server-side encryption with EC2 key pair.
• D. Use Amazon S3 bucket policies to restrict access to the data at rest.
• E. Encrypt the data on the client-side before ingesting to Amazon S3 using their own master key.
• F. Use SSL to encrypt the data while in transit to Amazon S3.

Answer: ABE

NEW QUESTION 8
Does an AWS Direct Connect location provide access to Amazon Web Services in the region it is associated with as well as access to other US regions?

• A. No, it provides access only to the region it is associated with.
• B. No, it provides access only to the US regions other than the region it is associated with.
• C. Yes, it provides access.
• D. Yes, it provides access but only when there's just one Availability Zone in the regio

Answer: C

Explanation: An AWS Direct Connect location provides access to Amazon Web Services in the region it is associated with, as well as access to other US regions. For example, you can provision a single connection to any AWS Direct Connect location in the US and use it to access public AWS services in all US Regions and AWS GovCIoud (US).
Reference: http://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html

NEW QUESTION 9
IAM users do not have permission to create Temporary Security Credentials for federated users and roles by default. In contrast, IAM users can call without the need of any special permissions

• A. GetSessionName
• B. GetFederationToken
• C. GetSessionToken
• D. GetFederationName

Answer: C

Explanation: Currently the STS API command GetSessionToken is available to every IAM user in your account without previous permission. In contrast, the GetFederationToken command is restricted and explicit permissions need to be granted so a user can issue calls to this particular Action
Reference: http://docs.aws.amazon.com/STS/latest/UsingSTS/STSPermission.htmI

NEW QUESTION 10
What is the default maximum number of VPCs allowed per region?

• A. 5
• B. 10
• C. 100
• D. 15

Answer: A

Explanation: The maximum number of VPCs allowed per region is 5.
Reference: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_Limits.html

NEW QUESTION 11
How many g2.2xIarge on-demand instances can a user run in one region without taking any limit increase approval from AWS?

• A. 20
• B. 2
• C. 5
• D. 10

Answer: C

Explanation: Generally AWS EC2 allows running 20 on-demand instances and 100 spot instances at a time. This limit can be increased by requesting at https://aws.amazon.com/contact-us/ec2-request. Excluding certain types of instances, the limit is lower than mentioned above. For g2.2xIarge, the user can run only 5
on-demand instance at a time.
Reference: http://docs.aws.amazon.com/generaI/latest/gr/aws_service_|imits.htmI#Iimits_ec2

NEW QUESTION 12
Your customer is willing to consolidate their log streams (access logs application logs security logs etc.) in one single system. Once consolidated, the customer wants to analyze these logs in real time based on heuristics. From time to time, the customer needs to validate heuristics, which requires going back to data samples extracted from the last 12 hours?
What is the best approach to meet your customer’s requirements?

• A. Send all the log events to Amazon SQS, setup an Auto Scaling group of EC2 sewers to consume the logs and apply the heuristics.
• B. Send all the log events to Amazon Kinesis, develop a client process to apply heuristics on the logs
• C. Configure Amazon CIoudTraiI to receive custom logs, use EMR to apply heuristics the logs
• D. Setup an Auto Scaling group of EC2 syslogd servers, store the logs on S3, use EMR to apply heuristics on the logs

Answer: B

NEW QUESTION 13
How is AWS readily distinguished from other vendors in the traditional IT computing landscape?

• A. Experience
• B. Scalable and elasti
• C. Secur
• D. Cost-effectiv
• E. Reliable
• F. Secur
• G. Flexibl
• H. Cost-effectiv
• I. Scalable and elasti
• J. Global
• K. Secur
• L. Flexibl
• M. Cost-effectiv
• N. Scalable and elasti
• O. Experienced
• P. Flexibl
• Q. Cost-effectiv
• R. Dynami
• S. Secur
• T. Experience

Answer: C

NEW QUESTION 14
You are implementing AWS Direct Connect. You intend to use AWS public service end points such as Amazon S3, across the AWS Direct Connect link. You want other Internet traffic to use your existing link to an Internet Service Provider.
What is the correct way to configure AWS Direct connect for access to services such as Amazon S3?

• A. Configure a public Interface on your AWS Direct Connect link Configure a static route via your AWS Direct Connect link that points to Amazon S3 Advertise a default route to AWS using BGP.
• B. Create a private interface on your AWS Direct Connect lin
• C. Configure a static route via your AWS Direct connect link that points to Amazon S3 Configure specific routes to your network in your VPC.
• D. Create a public interface on your AWS Direct Connect link Redistribute BGP routes into your existing routing infrastructure; advertise specific routes for your network to AWS.
• E. Create a private interface on your AWS Direct connect lin
• F. Redistribute BGP routes into your existing routing infrastructure and advertise a default route to AWS.

Answer: C

NEW QUESTION 15
You are looking to migrate your Development (Dev) and Test environments to AWS. You have decided to use separate AWS accounts to host each environment. You plan to link each accounts bill to a Master AWS account using Consolidated Billing. To make sure you Keep within budget you would like to implement a way for administrators in the Master account to have access to stop, delete and/or terminate resources in both the Dev and Test accounts. Identify which option will allow you to achieve this goal.

• A. Create IAM users in the Master account with full Admin permission
• B. Create cross-account roles in the Dev and Test accounts that grant the Master account access to the resources in the account by inheriting permissions from the Master account.
• C. Create IAM users and a cross-account role in the Master account that grants full Admin permissions to the Dev and Test accounts.
• D. Create IAM users in the Master account Create cross-account roles in the Dev and Test accounts that have full Admin permissions and grant the Master account access.
• E. Link the accounts using Consolidated Billin
• F. This will give IAM users in the Master account access to resources in the Dev and Test accounts

Answer: C

NEW QUESTION 16
You have been given the task to define multiple AWS Data Pipeline schedules for different actMties in the same pipeline. Which of the following would successfully accomplish this task?

• A. Creating multiple pipeline definition files
• B. Defining multiple pipeline definitions in your schedule objects file and associating the desired schedule to the correct actMty via its schedule field
• C. Defining multiple schedule objects in your pipeline definition file and associating the desired schedule to the correct actMty via its schedule field
• D. Defining multiple schedule objects in the schedule field

Answer: C

Explanation: To define multiple schedules for different actMties in the same pipeline, in AWS Data Pipeline, you should define multiple schedule objects in your pipeline definition file and associate the desired schedule to the correct actMty via its schedule field. As an example of this, it could allow you to define a pipeline in which log files are stored in Amazon S3 each hour to drive generation of an aggregate report once a day. Reference: https://aws.amazon.com/datapipeIine/faqs/

NEW QUESTION 17
You deployed your company website using Elastic Beanstalk and you enabled log file rotation to S3. An Elastic Map Reduce job is periodically analyzing the logs on S3 to build a usage dashboard that you share with your CIO.
You recently improved overall performance of the website using Cloud Front for dynamic content delivery and your website as the origin.
After this architectural change, the usage dashboard shows that the traffic on your website dropped by an order of magnitude. How do you fix your usage dashboard'?

• A. Enable Cloud Front to deliver access logs to S3 and use them as input of the Elastic Map Reduce job.
• B. Turn on Cloud Trail and use trail log tiles on S3 as input of the Elastic Map Reduce job
• C. Change your log collection process to use Cloud Watch ELB metrics as input of the Elastic MapReduce job
• D. Use Elastic Beanstalk "Rebuild Environment" option to update log delivery to the Elastic lV|ap Reduce job.
• E. Use Elastic Beanstalk 'Restart App server(s)" option to update log delivery to the Elastic Map Reduce job.

Answer: D

NEW QUESTION 18
An organization is setting a website on the AWS VPC. The organization has blocked a few IPs to avoid a D-DOS attack. How can the organization configure that a request from the above mentioned IPs does not access the application instances?

• A. Create an IAM policy for VPC which has a condition to disallow traffic from that IP address.
• B. Configure a security group at the subnet level which denies traffic from the selected IP.
• C. Configure the security group with the EC2 instance which denies access from that IP address.
• D. Configure an ACL at the subnet which denies the traffic from that IP addres

Answer: D

Explanation: A Virtual Private Cloud (VPC) is a virtual network dedicated to the user’s AWS account. It enables the user to launch AWS resources into a virtual network that the user has defined. AWS provides two features that the user can use to increase security in VPC: security groups and network ACLs. Security group works at the instance level while ACL works at the subnet level. ACL allows both allow and deny rules.
Thus, when the user wants to reject traffic from the selected IPs it is recommended to use ACL with subnets.
Reference: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html

NEW QUESTION 19
You are the new IT architect in a company that operates a mobile sleep tracking application.
When activated at night, the mobile app is sending collected data points of 1 kilobyte every 5 minutes to your backend.
The backend takes care of authenticating the user and writing the data points into an Amazon DynamoDB table.
Every morning, you scan the table to extract and aggregate last night's data on a per user basis, and store the results in Amazon S3. Users are notified via Amazon SNS mobile push notifications that new data is available, which is parsed and visualized by the mobile app.
Currently you have around 100k users who are mostly based out of North America. You have been tasked to optimize the architecture of the backend system to lower cost. What would you recommend? Choose 2 answers

• A. Have the mobile app access Amazon DynamoDB directly Instead of JSON files stored on Amazon S3.
• B. Write data directly into an Amazon Redshift cluster replacing both Amazon DynamoDB and Amazon S3.
• C. Introduce an Amazon SQS queue to buffer writes to the Amazon DynamoDB table and reduce provisioned write throughput.
• D. Introduce Amazon Elasticache to cache reads from the Amazon DynamoDB table and reduce provisioned read throughput.
• E. Create a new Amazon DynamoDB table each day and drop the one for the previous day after its data is on Amazon S3.

Answer: AD