AWS Certified Solutions Architect - Associate

• #381

  You launch an Amazon EC2 instance without an assigned AWS identity and Access Management (IAM) role. Later, you decide that the instance should be running with an IAM role. Which action must you take in order to have a running Amazon EC2 instance with an IAM role assigned to it?

  • ACreate an image of the instance, and register the image with an IAM role assigned and an Amazon EBS volume mapping.
  • BCreate a new IAM role with the same permissions as an existing IAM role, and assign it to the running instance.
  • CCreate an image of the instance, add a new IAM role with the same permissions as the desired IAM role, and deregister the image with the new role assigned.
  • DCreate an image of the instance, and use this image to launch a new instance with the desired IAM role assigned.
  উত্তর দেখুন
  💬আলোচনা
• #382

  A web company is looking to implement an external payment service into their highly available application deployed in a VPC. Their application EC2 instances are behind a public facing ELB. Auto scaling is used to add additional instances as traffic increases. Under normal load the application runs 2 instances in the Auto Scaling group but at peak it can scale 3x in size. The application instances need to communicate with the payment service over the Internet which requires whitelisting of all public IP addresses used to communicate with it. A maximum of 4 whitelisting IP addresses are allowed at a time and can be added through an API. How should they architect their solution?

  • ARoute payment requests through two NAT instances setup for High Availability and whitelist the Elastic IP addresses attached to the NAT instances.
  • BWhitelist the VPC Internet Gateway Public IP and route payment requests through the Internet Gateway.
  • CWhitelist the ELB IP addresses and route payment requests from the Application servers through the ELB.
  • DAutomatically assign public IP addresses to the application instances in the Auto Scaling group and run a script on boot that adds each instance's public IP address to the payment validation whitelist API.
  উত্তর দেখুন
  💬আলোচনা
• #383

  You have launched an EC2 instance with four (4) 500 GB EBS Provisioned IOPS volumes attached. The EC2 instance is EBS-Optimized and supports 500 Mbps throughput between EC2 and EBS. The four EBS volumes are configured as a single RAID 0 device, and each Provisioned IOPS volume is provisioned with 4,000IOPS (4,000 16KB reads or writes), for a total of 16,000 random IOPS on the instance. The EC2 instance initially delivers the expected 16,000 IOPS random read and write performance. Sometime later, in order to increase the total random I/O performance of the instance, you add an additional two 500 GB EBS Provisioned IOPS volumes to the RAID. Each volume is provisioned to 4,000 IOPs like the original four, for a total of 24,000 IOPS on the EC2 instance. Monitoring shows that the EC2 instance CPU utilization increased from 50% to 70%, but the total random IOPS measured at the instance level does not increase at all. What is the problem and a valid solution?

  • ALarger storage volumes support higher Provisioned IOPS rates; increase the provisioned volume storage of each of the 6 EBS volumes to 1TB.
  • BThe EBS-Optimized throughput limits the total IOPS that can be utilized; use an EBS Optimized instance that provides larger throughput. Mo
  • CSmall block sizes cause performance degradation, limiting the I/O throughput; configure the instance device driver and filesystem to use 64KB blocks to increase throughput.
  • DThe standard EBS Instance root volume limits the total IOPS rate; change the instance root volume to also be a 500GB 4,000 Provisioned IOPS volume.
  • ERAID 0 only scales linearly to about 4 devices; use RAID 0 with 4 EBS Provisioned IOPS volumes, but increase each Provisioned IOPS EBS volume to 6,000 IOPS.
  উত্তর দেখুন
  💬আলোচনা
• #384

  An ERP application is deployed across multiple AZs in a single region. In the event of failure, the Recovery Time Objective (RTO) must be less than 3 hours, and the Recovery Point Objective (RPO) must be 15 minutes. The customer realizes that data corruption occurred roughly 1.5 hours ago. What DR strategy could be used to achieve this RTO and RPO in the event of this kind of failure?

  • ATake hourly DB backups to S3, with transaction logs stored in S3 every 5 minutes.
  • BUse synchronous database master-slave replication between two Availability Zones.
  • CTake hourly DB backups to EC2 Instance store volumes with transaction logs stored in S3 every 5 minutes.
  • DTake 15 minute DB backups stored in Glacier with transaction logs stored in S3 every 5 minutes.
  উত্তর দেখুন
  💬আলোচনা
• #385

  A major customer has asked you to set up his AWS infrastructure so that it will be easy to recover in the case of a disaster of some sort. Which of the following is important when thinking about being able to quickly launch resources in AWS to ensure business continuity in case of a disaster?

  • ACreate and maintain AMIs of key servers where fast recovery is required.
  • BRegularly run your servers, test them, and apply any software updates and configuration changes.
  • CAll items listed here are important when thinking about disaster recovery.
  • DEnsure that you have all supporting custom software packages available in AWS.
  উত্তর দেখুন
  💬আলোচনা
• #386

  A/An [...] acts as a firewall that controls the traffic allowed to reach one or more instances.

  • Asecurity group.
  • BACL.
  • CIAM.
  • Dprivate IP Addresses.
  উত্তর দেখুন
  💬আলোচনা
• #387

  True or False: Automated backups are enabled by default for a new DB Instance

  • ATrue.
  • BFalse.
  উত্তর দেখুন
  💬আলোচনা
• #388

  Your application is using an ELB in front of an Auto Scaling group of web/application servers deployed across two AZs and a Multi-AZ RDS Instance for data persistence. The database CPU is often above 80% usage and 90% of I/O operations on the database are reads. To improve performance you recently added a single-node Memcached ElastiCache Cluster to cache frequent DB query results. In the next weeks the overall workload is expected to grow by 30%. Do you need to change anything in the architecture to maintain the high availability of the application with the anticipated additional load? Why?

  • AYes, you should deploy two Memcached ElastiCache Clusters in different AZs because the RDS instance will not be able to handle the load if the cache node fails.
  • BNo, if the cache node fails you can always get the same data from the DB without having any availability impact.
  • CNo, if the cache node fails the automated ElastiCache node recovery feature will prevent any availability impact.
  • DYes, you should deploy the Memcached ElastiCache Cluster with two nodes in the same AZ as the RDS DB master instance to handle the load if one cache node fails.
  উত্তর দেখুন
  💬আলোচনা
• #389

  A company needs to review its AWS Cloud deployment to ensure that its Amazon S3 buckets do not have unauthorized configuration changes. What should a solutions architect do to accomplish this goal?

  • ATurn on AWS Config with the appropriate rules.
  • BTurn on AWS Trusted Advisor with the appropriate checks.
  • CTurn on Amazon Inspector with the appropriate assessment template.
  • DTurn on Amazon S3 server access logging. Configure Amazon EventBridge (Amazon Cloud Watch Events).
  উত্তর দেখুন
  💬আলোচনা
• #390

  An enterprise wants to use a third-party SaaS application. The SaaS application needs to have access to issue several API commands to discover Amazon EC2 resources running within the enterprise's account The enterprise has internal security policies that require any outside access to their environment must conform to the principles of least privilege and there must be controls in place to ensure that the credentials used by the 5aa5 vendor cannot be used by any other third party. Which of the following would meet all of these conditions?

  • AFrom the AWS Management Console, navigate to the Security Credentials page and retrieve the access and secret key for your account.
  • BCreate an IAM user within the enterprise account assign a user policy to the IAM user that allows only the actions required by the SaaS application create a new access and secret key for the user and provide these credentials to the 5aa5 provider.
  • CCreate an IAM role for cross-account access allows the SaaS provider's account to assume the role and assign it a policy that allows only the actions required by the SaaS application.
  • DCreate an IAM role for EC2 instances, assign it a policy that allows only the actions required for the SaaS application to work. Provide the role ARN to the SaaS provider to use when launching their application instances.
  উত্তর দেখুন
  💬আলোচনা
• #391

  Will my standby RDS instance be in the same Region as my primary?

  • AOnly for Oracle RDS types.
  • BYes.
  • COnly if configured at launch.
  • DNo.
  উত্তর দেখুন
  💬আলোচনা
• #392

  You are responsible for a legacy web application whose server environment is approaching end of life. You would like to migrate this application to AWS as quickly as possible, since the application environment currently has the following limitations. The VM's single 10GB VMDK is almost full. The virtual network interface still uses the 10Mbps driver, which leaves your 100Mbps WAN connection completely underutilized. It is currently running on a highly customized Windows VM within a VMware environment. You do not have the installation media. This is a mission critical application with an RTO (Recovery Time Objective) of 8 hours and RPO (Recovery Point Objective) of 1 hour. How could you best migrate this application to AWS while meeting your business continuity requirements?

  • AUse the EC2 VM Import Connector for vCenter to import the VM into EC2.
  • BUse Import/Export to import the VM as an EBS snapshot and attach to EC2.
  • CUse S3 to create a backup of the VM and restore the data into EC2.
  • DUse the ec2-bundle-instance API to Import an Image of the VM into EC2.
  উত্তর দেখুন
  💬আলোচনা
• #393

  In Amazon EC2, what is the limit of Reserved Instances per Availability Zone each month?

  • A5.
  • B20.
  • C50.
  • D10.
  উত্তর দেখুন
  💬আলোচনা
• #394

  A user is planning a highly available application deployment with EC2. Which of the below mentioned options will not help to achieve HA?

  • AElastic IP address.
  • BPIOPS.
  • CAMI.
  • DAvailability Zones.
  উত্তর দেখুন
  💬আলোচনা
• #395

  You are in the process of moving your friend's WordPress site onto AWS to try and save him some money, and you have told him that he should probably also move his domain name. He asks why he can't leave his domain name where it is and just have his infrastructure on AWS. What would be an incorrect response to his question?

  • ARoute 53 offers low query latency for your end users.
  • BRoute 53 is designed to automatically answer queries from the optimal location depending on network conditions.
  • CThe globally distributed nature of AWS's DNS servers helps ensure a consistent ability to route your end users to your application.
  • DRoute 53 supports Domain Name System Security Extensions (DNSSEC).
  উত্তর দেখুন
  💬আলোচনা
• #396

  Are Reserved Instances available for Multi-AZ Deployments?

  • AOnly for Cluster Compute instances.
  • BYes for all instance types.
  • COnly for M3 instance types.
  • DNo.
  উত্তর দেখুন
  💬আলোচনা
• #397

  You need to set up security for your VPC and you know that Amazon VPC provides two features that you can use to increase security for your VPC: security groups and network access control lists (ACLs). You have already looked into security groups and you are now trying to understand ACLs. Which statement below is incorrect in relation to ACLs?

  • ASupports allow rules and deny rules.
  • BIs stateful: Return traffic is automatically allowed, regardless of any rules.
  • CProcesses rules in number order when deciding whether to allow traffic.
  • DOperates at the subnet level (second layer of defense).
  উত্তর দেখুন
  💬আলোচনা
• #398

  You are designing a data leak prevention solution for your VPC environment. You want your VPC Instances to be able to access software depots and distributions on the Internet for product updates. The depots and distributions are accessible via third party CONs by their URLs. You want to explicitly deny any other outbound connections from your VPC instances to hosts on the internet. Which of the following options would you consider?

  • AConfigure a web proxy server in your VPC and enforce URL-based ru les for outbound access Remove default routes.
  • BImplement security groups and configure outbound rules to only permit traffic to software depots.
  • CMove all your instances into private VPC subnets remove default routes from all routing tables and add specific routes to the software depots and distributions only.
  • DImplement network access control lists to all specific destinations, with an Implicit deny as a rule.
  উত্তর দেখুন
  💬আলোচনা
• #399

  After a major security breach your manager has requested a report of all users and their credentials in AWS. You discover that in IAM you can generate and download a credential report that lists all users in your account and the status of their various credentials, including passwords, access keys, MFA devices, and signing certificates. Which following statement is incorrect in regards to the use of credential reports?

  • ACredential reports are downloaded XML files.
  • BYou can get a credential report using the AWS Management Console, the AWS CLI, or the IAM API.
  • CYou can use the report to audit the effects of credential lifecycle requirements, such as password rotation.
  • DYou can generate a credential report as often as once every four hours.
  উত্তর দেখুন
  💬আলোচনা
• #400

  Which technique can be used to integrate AWS IAM (Identity and Access Management) with an on-premise LDAP (Lightweight Directory Access Protocol) directory service?

  • AUse an IAM policy that references the LDAP account identifiers and the AWS credentials.
  • BUse SAML (Security Assertion Markup Language) to enable single sign-on between AWS and LDAP.
  • CUse AWS Security Token Service from an identity broker to issue short-lived AWS credentials.
  • DUse IAM roles to automatically rotate the IAM credentials when LDAP credentials are updated.
  • EUse the LDAP credentials to restrict a group of users from launching specific EC2 instance types.
  উত্তর দেখুন
  💬আলোচনা

নিজের স্কোর রাখতে, সময়সীমার মক পরীক্ষা দিতে ও AI ব্যাখ্যা পেতে চান? বিনামূল্যে অ্যাকাউন্ট খুলুন