AWS-Certified-Solutions-Architect-Professional Free Practice Test

- (Exam Topic 2)
A company wants to use Amazon S3 to back up its on-premises file storage solution. The company s
on-premises file storage solution supports NFS and the company wants its new solution to support NFS The company wants to archive the backup Files after 5 days If the company needs archived files for disaster recovery, the company is willing to wait a few days for the retrieval of those Files.
Which solution meets these requirements MOST cost-effectively?

1. A. Deploy an AWS Storage Gateway file gateway that is associated with an S3 bucket Move the files from the on-premises file storage solution to the file gateway Create an S3 Lifecycle rule to move the files to S3 Standard-Infrequent Access (S3 Standard-IA) after 5 days
2. B. Deploy an AWS Storage Gateway volume gateway that is associated with an S3 bucket Move the files from the on-premises file storage solution to the volume gateway Create an S3 Lifecycle rule to move the files to S3 Glacier Deep Archive after 5 days
3. C. Deploy an AWS Storage Gateway tape gateway that is associated with an S3 bucket Move the files from the on-premises file storage solution to the tape gateway Create an S3 Lifecycle rule to move the files to S3 Standard-Infrequent Access (S3 Standard-IA) after 5 days
4. D. Deploy an AWS Storage Gateway file gateway that is associated with an S3 bucket Move the files from the on-premises file storage solution to the file gateway Create an S3 Lifecycle rule to move the files to S3 Glacier Deep Archive after 5 days

Correct Answer: D

- (Exam Topic 1)
A financial services company logs personally identifiable information 10 its application logs stored in Amazon S3. Due to regulatory compliance requirements, the log files must be encrypted at rest. The security team has mandated that the company's on-premises hardware security modules (HSMs) be used to generate the CMK material.
Which steps should the solutions architect take to meet these requirements?

1. A. Create an AWS CloudHSM cluste
2. B. Create a new CMK in AWS KMS using AWS_CloudHSM as the source (or the key material and an origin of AWS_CLOUDHS
3. C. Enable automatic key rotation on the CMK with a duration of 1 yea
4. D. Configure a bucket policy on the togging bucket thai disallows uploads of unencrypted data and requires that the encryption source be AWS KMS.
5. E. Provision an AWS Direct Connect connection, ensuring there is no overlap of the RFC 1918 address space between on-premises hardware and the VPC
6. F. Configure an AWS bucket policy on the logging bucket that requires all objects to be encrypte
7. G. Configure the logging application to query theon-premises HSMs from the AWS environment for the encryption key material, and create a unique CMK for each logging event.
8. H. Create a CMK in AWS KMS with no key material and an origin of EXTERNA
9. I. Import the key material generated from the on-premises HSMs into the CMK using the public key and import token provided by AW
10. J. Configure a bucket policy on the logging bucket that disallows uploads ofnon-encrypted data and requires that the encryption source be AWS KMS.
11. K. Create a new CMK in AWS KMS with AWS-provided key material and an origin of AWS_KMS.Disable this CM
12. L. and overwrite the key material with the key material from the on-premises HSM using the public key and import token provided by AW
13. M. Re-enable the CM
14. N. Enable automatic key rotation on the CMK with a duration of 1 yea
15. O. Configure a bucket policy on the logging bucket that disallows uploads of non-encrypted data and requires that the encryption source be AWS KMS.

Correct Answer: C
https://aws.amazon.com/blogs/security/how-to-byok-bring-your-own-key-to-aws-kms-for-less-than-15-00-a-yea https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-create-cmk.html

- (Exam Topic 2)
A software company is using three AWS accounts for each of its 1 0 development teams The company has developed an AWS CloudFormation standard VPC template that includes three NAT gateways The template is added to each account for each team The company is concerned that network costs will increase each time a new development team is added A solutions architect must maintain the reliability of the company's solutions and minimize operational complexity
What should the solutions architect do to reduce the network costs while meeting these requirements?

1. A. Create a single VPC with three NAT gateways in a shared services account Configure each account VPC with a default route through a transit gateway to the NAT gateway in the shared services account VPC Remove all NAT gateways from the standard VPC template
2. B. Create a single VPC with three NAT gateways in a shared services account Configure each account VPC with a default route through a VPC peering connection to the NAT gateway in the shared services account VPC Remove all NAT gateways from the standard VPC template
3. C. Remove two NAT gateways from the standard VPC template Rely on the NAT gateway SLA to cover reliability for the remaining NAT gateway.
4. D. Create a single VPC with three NAT gateways in a shared services account Configure a Site-to-Site VPN connection from each account to the shared services account Remove all NAT gateways from the standard VPC template

Correct Answer: A

- (Exam Topic 1)
A company has registered 10 new domain names. The company uses the domains for online marketing. The company needs a solution that will redirect online visitors to a specific URL for each domain. All domains and target URLs are defined in a JSON document. All DNS records are managed by Amazon Route 53.
A solutions architect must implement a redirect service that accepts HTTP and HTTPS requests.
Which combination of steps should the solutions architect take to meet these requirements with the LEAST amount of operational effort? (Choose three.)

1. A. Create a dynamic webpage that runs on an Amazon EC2 instanc
2. B. Configure the webpage to use the JSON document in combination with the event message to look up and respond with a redirect URL.
3. C. Create an Application Load Balancer that includes HTTP and HTTPS listeners.
4. D. Create an AWS Lambda function that uses the JSON document in combination with the event message to look up and respond with a redirect URL.
5. E. Use an Amazon API Gateway API with a custom domain to publish an AWS Lambda function.
6. F. Create an Amazon CloudFront distributio
7. G. Deploy a Lambda@Edge function.
8. H. Create an SSL certificate by using AWS Certificate Manager (ACM). Include the domains as Subject Alternative Names.

Correct Answer: CEF
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-how-it-works-tutorial.ht

- (Exam Topic 1)
A company is running a web application with On-Demand Amazon EC2 instances in Auto Scaling groups that scale dynamically based on custom metrics After extensive testing, the company determines that the m5.2xlarge instance size is optimal for the workload Application data is stored in db.r4.4xlarge Amazon RDS instances that are confirmed to be optimal. The traffic to the web application spikes randomly during the day.
What other cost-optimization methods should the company implement to further reduce costs without impacting the reliability of the application?

1. A. Double the instance count in the Auto Scaling groups and reduce the instance size to m5.large
2. B. Reserve capacity for the RDS database and the minimum number of EC2 instances that are constantly running.
3. C. Reduce the RDS instance size to db.r4.xlarge and add five equivalent^ sized read replicas to provide reliability.
4. D. Reserve capacity for all EC2 instances and leverage Spot Instance pricing for the RDS database.

Correct Answer: B
People are being confused by the term 'reserve capacity'. This is not the same as an on-demand capacity reservation. This article by AWS clearly states that by 'reserving capacity' you are reserving the instances and reducing your costs. See https://aws.amazon.com/aws-cost-management/aws-cost-optimization/reserved-instances/