AWS Certified Solutions Architect - Associate

• #121

  A company creates operations data and stores the data in an Amazon S3 bucket. For the company's annual audit, an external consultant needs to access an annual report that is stored in the S3 bucket. The external consultant needs to access the report for 7 days. The company must implement a solution to allow the external consultant access to only the report. Which solution will meet these requirements with the MOST operational efficiency?

  • ACreate a new S3 bucket that is configured to host a public static website. Migrate the operations data to the new S3 bucket. Share the S3 website URL with the external consultant.
  • BEnable public access to the S3 bucket for 7 days. Remove access to the S3 bucket when the external consultant completes the audit.
  • CCreate a new IAM user that has access to the report in the S3 bucket. Provide the access keys to the external consultant. Revoke the access keys after 7 days.
  • DGenerate a presigned URL that has the required access to the location of the report on the S3 bucket. Share the presigned URL with the external consultant.
  Show answer
• #122

  You have been storing massive amounts of data on Amazon Glacier for the past 2 years and now start to wonder if there are any limitations on this. What is the correct answer to your question?

  • AThe total volume of data is limited but the number of archives you can store are unlimited.
  • BThe total volume of data is unlimited but the number of archives you can store are limited.
  • CThe total volume of data and number of archives you can store are unlimited.
  • DThe total volume of data is limited and the number of archives you can store are limited.
  Show answer
• #123

  A company is designing an application. The application uses an AWS Lambda function to receive information through Amazon API Gateway and to store the information in an Amazon Aurora PostgreSQL database. During the proof-of-concept stage, the company has to increase the Lambda quotas significantly to handle the high volumes of data that the company needs to load into the database. A solutions architect must recommend a new design to improve scalability and minimize the configuration effort. Which solution will meet these requirements?

  • ARefactor the Lambda function code to Apache Tomcat code that runs on Amazon EC2 instances. Connect the database by using native Java Database Connectivity (JDBC) drivers.
  • BChange the platform from Aurora to Amazon DynamoDProvision a DynamoDB Accelerator (DAX) cluster. Use the DAX client SDK to point the existing DynamoDB API calls at the DAX cluster.
  • CSet up two Lambda functions. Configure one function to receive the information. Configure the other function to load the information into the database. Integrate the Lambda functions by using Amazon Simple Notification
  • DSet up two Lambda functions. Configure one function to receive the information. Configure the other function to load the information into the database. Integrate the Lambda functions by using an Amazon Simple Queue Service (Amazon SQS) queue.
  Show answer
• #124

  A company uses Amazon RDS for PostgreSQL databases for its data tier. The company must implement password rotation for the databases. Which solution meets this requirement with the LEAST operational overhead?

  • AStore the password in AWS Secrets Manager. Enable automatic rotation on the secret.
  • BStore the password in AWS Systems Manager Parameter Store. Enable automatic rotation on the parameter.
  • CStore the password in AWS Systems Manager Parameter Store. Write an AWS Lambda function that rotates the password.
  • DStore the password in AWS Key Management Service (AWS KMS). Enable automatic rotation on the customer master key (CMK).
  Show answer
• #125

  After an Amazon VPC instance is launched, can I change the VPC security groups it belongs to?

  • AOnly if the tag 'VPC_Change_Group' is true.
  • BYes. You can.
  • CNo. You cannot.
  • DOnly if the tag 'VPC Change Group' is true.
  Show answer
• #126Choose 4

  You are designing a connectivity solution between on-premises infrastructure and Amazon VPC. Your servers on-premises will be communicating with your VPC instances. You will be establishing IPSec tunnels over the internet. You will be using VPN gateways and terminating the IPsec tunnels on AWS supported customer gateways. Which of the following objectives would you achieve by implementing an IPSec tunnel as outlined above? (Choose 4 answers)

  • AEnd-to-end protection of data in transit.
  • BEnd-to-end Identity authentication.
  • CData encryption across the Internet.
  • DProtection of data in transit over the Internet.
  • EPeer identity authentication between VPN gateway and customer gateway.
  • FData integrity protection across the Internet.
  Show answer
• #127

  How can you secure data at rest on an EBS volume?

  • AAttach the volume to an instance using EC2's SSL interface.
  • BWrite the data randomly instead of sequentially.
  • CEncrypt the volume using the S3 server-side encryption service.
  • DCreate an IAM policy that restricts read and write access to the volume.
  • EUse an encrypted file system on top of the EBS volume.
  Show answer
• #128

  To help you manage your Amazon EC2 instances, images, and other Amazon EC2 resources, you can assign your own metadata to each resource in the form of [...].

  • Aspecial filters.
  • Bfunctions.
  • Ctags.
  • Dwildcards.
  Show answer
• #129

  A user is sending bulk emails using AWS SES. The emails are not reaching some of the targeted audience because they are not authorized by the ISPs. How can the user ensure that the emails are all delivered?

  • ASend an email using DKIM with SE.
  • BSend an email using SMTP with SE.
  • COpen a ticket with AWS support to get it authorized with the IS.
  • DAuthorize the ISP by sending emails from the development account.
  Show answer
• #130

  You are in the process of building an online gaming site for a client and one of the requirements is that it must be able to process vast amounts of data easily. Which AWS Service would be very helpful in processing all this data?

  • AAmazon S3.
  • BAWS Data Pipeline.
  • CAWS Direct Connect.
  • DAmazon EMR.
  Show answer
• #131

  A user needs to run a batch process which runs for 10 minutes. This will only be run once, or at maximum twice, in the next month, so the processes will be temporary only. The process needs 15 X-Large instances. The process downloads the code from S3 on each instance when it is launched, and then generates a temporary log file. Once the instance is terminated, all the data will be lost. Which of the below mentioned pricing models should the user choose in this case?

  • ASpot instance.
  • BReserved instance.
  • COn-demand instance.
  • DEBS optimized instance.
  Show answer
• #132

  A friend wants you to set up a small BitTorrent storage area for him on Amazon S3. You tell him it is highly unlikely that AWS would allow such a thing in their infrastructure. However you decide to investigate. Which of the following statements best describes using BitTorrent with Amazon S3?

  • AAmazon S3 does not support the BitTorrent protocol because it is used for pirated software.
  • BYou can use the BitTorrent protocol but only for objects that are less than 100 GB in size.
  • CYou can use the BitTorrent protocol but you need to ask AWS for specific permissions first.
  • DYou can use the BitTorrent protocol but only for objects that are less than 5 GB in size.
  Show answer
• #133

  A user has launched one EC2 instance in the US East region and one in the US West region. The user has launched an RDS instance in the US East region. How can the user configure access from both the EC2 instances to RDS?

  • AIt is not possible to access RDS of the US East region from the US West region.
  • BConfigure the US West region's security group to allow a request from the US East region's instance and configure the RDS security group's ingress rule for the US East EC2 group.
  • CConfigure the security group of the US East region to allow traffic from the US West region's instance and configure the RDS security group's ingress rule for the US East EC2 group.
  • DConfigure the security group of both instances in the ingress rule of the RDS security group.
  Show answer
• #134

  What does the following policy for Amazon EC2 do? { 'Statement':[{ 'Effect': 'Allow', 'Action':'ec2: Describe', 'Resource':'' }] }

  • AAllow users to use actions that start with 'Describe' over all the EC2 resources.
  • BShare an AMI with a partner.
  • CShare an AMI within the account.
  • DAllow a group to only be able to describe, run, stop, start, and terminate instances.
  Show answer
• #135

  You are developing a new mobile application and are considering storing user preferences in AWS. This would provide a more uniform cross-device experience to users using multiple mobile devices to access the application. The preference data for each user is estimated to be 50KB in size. Additionally, 5 million customers are expected to use the application on a regular basis. The solution needs to be cost-effective, highly available, scalable and secure. How would you design a solution to meet the above requirements?

  • ASetup an RDS MySQL instance in 2 Availability Zones to store the user preference data. Deploy a public facing application on a server in front of the database to manage security and access credentials.
  • BSetup a DynamoDB table with an item for each user having the necessary attributes to hold the user preferences. The mobile application will query the user preferences directly from the DynamoDB table. Utilize STS, Web Identity Federation, and DynamoDB Fine Grained Access Control to authenticate and authorize access.
  • CSetup an RDS MySQL instance with multiple read replicas in 2 Availability Zones to store the user preference data. The mobile application will query the user preferences from the read replicas. Leverage the MySQL user management and access privilege system to manage security and access credentials.
  • DStore the user preference data in S3. Setup a DynamoDB table with an item for each user and an item attribute pointing to the user's S3 object. The mobile application will retrieve the S3 URL from DynamoDB and then access the S3 object directly. Utilize STS, Web identity Federation, and S3 ACLs to authenticate and authorize access.
  Show answer
• #136

  An EC2 instance is connected to an ENI (Elastic Network Interface) in one subnet. What happens to the data on an instance if the instance reboots (intentionally or unintentionally)?

  • AData will be lost.
  • BData persists.
  Show answer
• #137

  While launching an RDS DB instance, on which page I can select the Availability Zone?

  • AREVIEW.
  • BDB INSTANCE DETAILS.
  • CMANAGEMENT OPTIONS.
  • DADDITIONAL CONFIGURATION.
  Show answer
• #138

  SQL Server [...] store log ins and passwords in the master database.

  • Acan be configured to but by default does not.
  • Bdoesn't.
  • Cdoes.
  Show answer
• #139Choose 3

  Your company policies require encryption of sensitive data at rest. You are considering the possible options for protecting data while storing it at rest on an EBS data volume, attached to an EC2 instance. Which of these options would allow you to encrypt your data at rest? (Choose 3 answers)

  • AImplement third party volume encryption tools.
  • BDo nothing as EBS volumes are encrypted by default.
  • CEncrypt data inside your applications before storing it on EBS.
  • DEncrypt data using native data encryption drivers at the file system level.
  • EImplement SSL/TLS for all services running on the server.
  Show answer
• #140

  A client of yours has a huge amount of data stored on Amazon S3, but is concerned about someone stealing it while it is in transit. You know that all data is encrypted in transit on AWS, but which of the following is wrong when describing server-side encryption on AWS?

  • AAmazon S3 server-side encryption employs strong multi-factor encryption.
  • BAmazon S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256), to encrypt your data.
  • CIn server-side encryption, you manage encryption/decryption of your data, the encryption keys, and related tools.
  • DServer-side encryption is about data encryption at rest―that is, Amazon S3 encrypts your data as it writes it to disks.
  Show answer

Want to track your score, take timed mock exams and get AI explanations? Create a free account