AWS-Certified-Solutions-Architect-Professional Free Practice Test

- (Exam Topic 2)
A company is in the process of implementing AWS Organizations to constrain its developers to use only Amazon EC2. Amazon S3 and Amazon DynamoDB. The developers account resides In a dedicated organizational unit (OU). The solutions architect has implemented the following SCP on the developers account:

When this policy is deployed, IAM users in the developers account are still able to use AWS services that are not listed in the policy. What should the solutions architect do to eliminate the developers' ability to use services outside the scope of this policy?

1. A. Create an explicit deny statement for each AWS service that should be constrained
2. B. Remove the Full AWS Access SCP from the developer account's OU
3. C. Modify the Full AWS Access SCP to explicitly deny all services
4. D. Add an explicit deny statement using a wildcard to the end of the SCP

Correct Answer: B

- (Exam Topic 1)
A company requires that all internal application connectivity use private IP addresses. To facilitate this policy, a solutions architect has created interface endpoints to connect to AWS public services. Upon testing, the solutions architect notices that the service names are resolving to public IP addresses, and that internal services cannot connect to the interface endpoints.
Which step should the solutions architect take to resolve this issue?

1. A. Update the subnet route table with a route to the interface endpoint.
2. B. Enable the private DNS option on the VPC attributes.
3. C. Configure the security group on the interface endpoint to allow connectivity to the AWS services.
4. D. Configure an Amazon Route 53 private hosted zone with a conditional forwarder for the internal application.

Correct Answer: C
https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html

- (Exam Topic 2)
A company is migrating some of its applications to AWS. The company wants to migrate and modernize the applications quickly after it finalizes networking and security strategies. The company has set up an AWS Direct Connection connection in a central network account.
The company expects to have hundreds of AWS accounts and VPCs in the near future. The corporate network must be able to access the resources on AWS seamlessly and also must be able to communicate with all the VPCs. The company also wants to route its cloud resources to the internet through its on-premises data center.
Which combination of steps will meet these requirements? (Choose three.)

1. A. Create a Direct Connect gateway in the central accoun
2. B. In each of the accounts, create an association proposal by using the Direct Connect gateway and the account ID for every virtual private gateway.
3. C. Create a Direct Connect gateway and a transit gateway in the central network accoun
4. D. Attach the transit gateway to the Direct Connect gateway by using a transit VIF.
5. E. Provision an internet gatewa
6. F. Attach the internet gateway to subnet
7. G. Allow internet traffic through the gateway.
8. H. Share the transit gateway with other account
9. I. Attach VPCs to the transit gateway.
10. J. Provision VPC peering as necessary.
11. K. Provision only private subnet
12. L. Open the necessary route on the transit gateway and customer gateway to allow outbound internet traffic from AWS to flow through NAT services that run in the data center.

Correct Answer: BDF

- (Exam Topic 2)
A new startup is running a serverless application using AWS Lambda as the primary source of compute New versions of the application must be made available to a subset of users before deploying changes to all users Developers should also have the ability to stop the deployment and have access to an easy rollback mechanism A solutions architect decides to use AWS CodeDeploy to deploy changes when a new version is available.
Which CodeDeploy configuration should the solutions architect use?

1. A. A blue/green deployment
2. B. A linear deployment
3. C. A canary deployment
4. D. An all-at-once deployment

Correct Answer: C

- (Exam Topic 1)
A company wants to host a new global website that consists of static content. A solutions architect is working on a solution that uses Amazon CloudFront with an origin access identity During testing, the solutions architect receives 404 errors from the S3 bucket. Error messages appear only for attempts to access paths that end with a forward slash. such as example.com/path/. These requests should return the existing S3 object path/index.html. Any potential solution must not prevent CloudFront from caching the content.
What should the solutions architect do to resolve this problem?

1. A. Change the CloudFront origin to an Amazon API Gateway proxy endpoin
2. B. Rewrite the S3 request URL by using an AWS Lambda function.
3. C. Change the CloudFront origin to an Amazon API Gateway endpoin
4. D. Rewrite the S3 request URL in an AWS service integration.
5. E. Change the CloudFront configuration to use an AWS Lambda@Edge function that is invoked by a viewer request event to rewrite the S3 request URL.
6. F. Change the CloudFront configuration to use an AWS Lambda@Edge function that is invoked by an origin request event to rewrite the S3 request URL.

Correct Answer: C