2022 Updated Verified AWS-Solutions-Architect-Professional dumps Q&As - Pass Guarantee or Full Refund
AWS-Solutions-Architect-Professional PDF Questions and Testing Engine With 320 Questions
NEW QUESTION 56
An organization, which has the AWS account ID as 999988887777, has created 50 IAM users. All the
users are added to the same group examkiller. If the organization has enabled that each IAM user can
login with the AWS console, which AWS login URL will the IAM users use??
- A. https://examkiller.signin.aws.amazon.com/999988887777/console/
- B. https://999988887777.aws.amazon.com/examkiller/
- C. https://signin.aws.amazon.com/examkiller/
- D. https://999988887777.signin.aws.amazon.com/console/
Answer: D
Explanation:
AWS Identity and Access Management is a web service which allows organizations to manage users and
user permissions for various AWS services. Once the organization has created the IAM users, they will
have a separate AWS console URL to login to the AWS console. The console login URL for the IAM user
will be https:// AWS_Account_ID.signin.aws.amazon.com/console/. It uses only the AWS account ID
and does not depend on the group or user ID.
Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/AccountAlias.html
NEW QUESTION 57
When I/O performance is more important than fault tolerance, which of the following configurations should be used?
- A. RAID 1
- B. SPAN 10
- C. NFS 1
- D. RAID 0
Answer: D
Explanation:
When I/O performance is more important than fault tolerance, the RAID 0 configuration must be used; for example, as in a heavily used database (where data replication is already set up separately).
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/raid-config.html
NEW QUESTION 58
A company has created a VPC with multiple private subnets in multiple Availability Zones (AZs) and one public subnet in one of the AZs. The public subnet is used to launch a NAT gateway. There are instances in the private subnets that use a NAT gateway to connect to the internet. In case of an AZ failure, the company wants to ensure that the instances are not all experiencing internet connectivity issues and that there is a backup plan ready.
Which solution should a solutions architect recommend that is MOST highly available?
- A. Create an Amazon EC2 NAT instance in a new public subnet. Distribute the traffic between the NAT gateway and the NAT instance.
- B. Create an Amazon EC2 NAT instance in the same public subnet. Replace the NAT gateway with the NAT instance and associate the instance with an Auto Scaling group with an appropriate scaling policy.
- C. Create a new public subnet with a NAT gateway in the same AZ. Distribute the traffic between the two NAT gateways.
- D. Create public subnets in each AZ and launch a NAT gateway in each subnet. Configure the traffic from the private subnets in each AZ to the respective NAT gateway.
Answer: D
NEW QUESTION 59
A company uses AWS Organizations to manage more than 1.000 AWS accounts. The company has created a new developer organization. There are 540 developer member accounts that must be moved to the new developer organization All accounts are set up with all the required Information so mat each account can be operated as a standalone account Which combination of steps should a solutions architect take to move all of the developer accounts to the new developer organization? (Select THREE )
- A. From the management account remove each developer account from the old organization using the RemoveAccountFromOrganization operation in the Organizations API
- B. Call the MoveAccount operation In the Organizations API from the old organization's management account to migrate the developer accounts to the new developer organization
- C. From each developer account, remove the account from the old organization using the RemoveAccounrFromOrganization operation in the Organizations API
- D. Call the InviteAccountToOrganzation operation in the Organizations API from the new developer organization's management account to send invitations to the developer accounts.
- E. Sign in to the new developer organization's management account and create a placeholder member account that acts as a target for the developer account migration
- F. Have each developer sign in to their account and confirm to join the new developer organization.
Answer: A,D,E
NEW QUESTION 60
A company wants to host a web application on AWS that will communicate to a database within a VPC. The application should be highly available.
What should a solutions architect recommend?
- A. Create two Amazon EC2 instances to host the web servers behind a load balancer, and then deploy the database on a large instance.
- B. Deploy a load balancer in multiple Availability Zones with an Auto Scaling group for the web servers, and then deploy Amazon RDS in multiple Availability Zones.
- C. Deploy two web servers with an Auto Scaling group, configure a domain that points to the two web servers, and then deploy a database architecture in multiple Availability Zones.
- D. Deploy a load balancer in the public subnet with an Auto Scaling group for the web servers, and then deploy the database on an Amazon EC2 instance in the private subnet.
Answer: B
NEW QUESTION 61
An organization is having an application which can start and stop an EC2 instance as per schedule. The organization needs the MAC address of the instance to be registered with its software. The instance is launched in EC2-CLASSIC.
How can the organization update the MAC registration every time an instance is booted?
- A. The organization should provide a MAC address as a part of the user data. Thus, whenever the instance is booted the script assigns the fixed MAC address to that instance.
- B. The organization should write a boot strapping script which will get the MAC address from the instance metadata and use that script to register with the application.
- C. The instance MAC address never changes. Thus, it is not required to register the MAC address every time.
- D. AWS never provides a MAC address to an instance; instead the instance ID is used for identifying the instance for any software registration.
Answer: B
Explanation:
Explanation
AWS provides an on demand, scalable infrastructure. AWS EC2 allows the user to launch On- Demand instances. AWS does not provide a fixed MAC address to the instances launched in EC2-CLASSIC. If the instance is launched as a part of EC2-VPC, it can have an ENI which can have a fixed MAC. However, with EC2-CLASSIC, every time the instance is started or stopped it will have a new MAC address. To get this MAC, the organization can run a script on boot which can fetch the instance metadata and get the MAC address from that instance metadata. Once the MAC is received, the organization can register that MAC with the software.
References:
NEW QUESTION 62
The following are AWS Storage services? Choose 2 Answers
- A. AWS Import/Export
- B. AWS Glacier
- C. AWS Relational Database Service (AWS RDS)
- D. AWS ElastiCache
Answer: B,C
NEW QUESTION 63
A Solutions Architect is designing an application on AWS that uses persistent block storage. Data must be
encrypted at rest.
Which solution meets the requirement?
- A. Encrypt Amazon EC2 Instance Storage.
- B. Enable server-side encryption on Amazon S3.
- C. Encrypt Amazon EBS volumes on Amazon EC2 instances.
- D. Enable SSL on Amazon EC2 instances.
Answer: C
Explanation:
Explanation/Reference:
Reference https://aws.amazon.com/blogs/aws/protect-your-data-with-new-ebs-encryption/
NEW QUESTION 64
A Solutions Architect must establish a patching plan for a large mixed fleet of Windows and Linux servers.
The patching plan must be implemented securely, be audit ready, and comply with the company's business requirements.
Which option will meet these requirements with MINIMAL effort?
- A. Migrate all applications to AWS OpsWorks and use OpsWorks automatic patching support to keep the OS up-to-date following the initial installation. Use AWS Config to provide audit and compliance reporting.
- B. Use AWS Systems Manager on all instances to manage patching. Test patches outside of production and then deploy during a maintenance window with the appropriate approval.
- C. Install and use an OS-native patching service to manage the update frequency and release approval for all instances. Use AWS Config to verify the OS state on each instance and report on any patch compliance issues.
- D. Use AWS OpsWorks for Chef Automate to run a set of scripts that will iterate through all instances of a given type. Issue the appropriate OS command to get and install updates on each instance, including any required restarts during the maintenance window.
Answer: B
NEW QUESTION 65
An enterprise company's data science team wants to provide a safe, cost-effective way to provide easy access to Amazon SageMaker. The data scientists have limited AWS knowledge and need to be able to launch a Jupyter notebook instance. The notebook instance needs to have a preconfigured AWS KMS key to encrypt data at rest on the machine learning storage volume without exposing the complex setup requirements.
Which approach will allow the company to set up a self-service mechanism for the data scientists to launch Jupyter notebooks in its AWS accounts with the LEAST amount of operational overhead?
- A. Create a serverless front end using a static Amazon S3 website to allow the data scientists to request a Jupyter notebook instance by filling out a form. Use Amazon API Gateway to receive requests from the S3 website and trigger a central AWS Lambda function to make an API call to Amazon SageMaker that launch a notebook instance with a preconfigured KMS key for the data scientists. Then call back to the front-end website to display the URL to the notebook instance.
- B. Create an AWS CloudFormation template to launch a Jupyter notebook instance using the AWS::SaqeMaker::Notebooklnstance resource type with a preconfigured KMS key. Add a user-friendly name to the CloudFormation template. Display the URL to the notebook using the Outputs section. Distribute the CloudFormation template to the data scientists using a shared Amazon S3 bucket.
- C. Create an AWS CloudFormation template to launch a Jupyter notebook instance using the AWS::SageMaker::Notebooklnstance resource type with a preconfigured KMS key. Simplify the parameter names, such as the instance size, by mapping them to Small, Large, and X-Large using the Mappings section in CloudFormation. Display the URL to the notebook using the Outputs section, then upload the template into an AWS Service Catalog product in the data scientist's portfolio, and share it with the data scientist's IAM role.
- D. Create an AWS CLI script that the data scientists can run locally. Provide step-by-step instructions about the parameters to be provided while executing the AWS CLI script to launch a Jupyter notebook with a preconfigured KMS key. Distribute the CLI script to the data scientists using a shared Amazon S3 bucket.
Answer: B
NEW QUESTION 66
A company has a policy that all Amazon EC2 instances that are running a database must exist within the same subnets in a shared VPC Administrators must follow security compliance requirements and are not allowed to directly log in to the shared account All company accounts are members of the same organization in AWS Organizations. The number of accounts will rapidly increase as the company grows.
A solutions architect uses AWS Resource Access Manager to create a resource share in the shared account What is the MOST operationally efficient configuration to meet these requirements?
- A. Add all subnets within the VPC to the resource share. Add the account IDs as principals
- B. Add the VPC to the resource share. Add the account IDs as principals
- C. Add the VPC to the resource share. Add the organization as a principal
- D. Add all subnets within the VPC to the resource share. Add the organization as a principal.
Answer: A
NEW QUESTION 67
The following are AWS Storage services? Choose 2 Answers
- A. AWS Glacier
- B. AWS Import/Export
- C. AWS Relational Database Service (AWS RDS)
- D. AWS ElastiCache
Answer: B,D
NEW QUESTION 68
A client has set up an Auto Scaling group associated with a load balancer. The client has noticed that
instances launched by the Auto Scaling group are reported unhealthy as the result of an Elastic Load
Balancing (ELB) health check, but these unhealthy instances are not being terminated.
What can a Solutions Architect do to ensure that the instances marked unhealthy will be terminated and
replaced?
- A. Increase the value for the health check interval set on the ELB load balancer.
- B. Change the health check type to ELB for the Auto Scaling group.
- C. Change the thresholds set on the Auto Scaling group health check.
- D. Change the health check set on the ELB load balancer to use TCP rather than HTTP checks.
Answer: C
Explanation:
Explanation/Reference:
Reference http://docs.aws.amazon.com/AutoScaling/latest/DeveloperGuide/as-add-elb-healthcheck.html
NEW QUESTION 69
To serve Web traffic for a popular product, your chief financial officer and IT director have purchased 10 m1.large heavy utilization Reserved Instances (RIs), evenly spread across two availability zones; Route 53 is used to deliver the traffic to an Elastic Load Balancer (ELB). After several months, the product grows even more popular and you need additional capacity. As a result, your company purchases two c3.2xlarge medium utilization RIs.
You register the two c3.2xlarge instances with your ELB and quickly find that the m1.large instances are at 100% of capacity and the c3.2xlarge instances have significant capacity that's unused. Which option is the most cost effective and uses EC2 capacity most effectively?
- A. Configure ELB with two c3.2xlarge instances and use on-demand Autoscaling group for up to two additional c3.2xlarge instances. Shut off m1.large instances.
- B. Use a separate ELB for each instance type and distribute load to ELBs with Route 53 weighted round robin.
- C. Configure Autoscaling group and Launch Configuration with ELB to add up to 10 more on- demand m1.large instances when triggered by Cloudwatch. Shut off c3.2xlarge instances.
- D. Route traffic to EC2 m1.large and c3.2xlarge instances directly using Route 53 latency based routing and health checks. Shut off ELB.
Answer: B
Explanation:
http://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html
NEW QUESTION 70
A company has a VPC with two domain controllers running Active Directory in the default configuration. The VPC DHCP options set is configured to use the IP addresses of the two domain controllers. There is a VPC interface endpoint defined; but instances within the VPC are not able to resolve the private endpoint addresses.
Which strategies would resolve this issue? (Select TWO)
- A. Update the DNS service on the Active Directory servers to forward all non-authoritative queries to the VPC Resolver
- B. Update the DNS service on the client instances to split DNS queries between the Active Directory servers and the VPC Resolver
- C. Define an outbound Amazon Route 53 Resolver. Set a conditional forward rule for the Active Directory domain to the Active Directory servers. Update the VPC DHCP options set to AmazonProvidedDNS.
- D. Define an inbound Amazon Route 53 Resolver Set a conditional forward rule for the Active Directory domain to the Active Directory servers Update the VPC DHCP options set to AmazonProvidedDNS.
- E. Update the DNS service on the Active Directory servers to forward all queries lo the VPC Resolver.
Answer: D,E
NEW QUESTION 71
You need a persistent and durable storage to trace call activity of an IVR (Interactive Voice Response) system. Call duration is mostly in the 2-3 minutes timeframe. Each traced call can be either active or terminated. An external application needs to know each minute the list of currently active calls. Usually there are a few calls/second, but once per month there is a periodic peak up to 1000 calls/second for a few hours. The system is open 24/7 and any downtime should be avoided. Historical data is periodically archived to files. Cost saving is a priority for this project.
What database implementation would better fit this scenario, keeping costs as low as possible?
- A. Use DynamoDB with a "Calls" table and a Global Secondary Index on a "State" attribute that can equal to "active" or "terminated".
In this way the Global Secondary Index can be used for all items in the table. - B. Use RDS Multi-AZ with a "CALLS" table and an indexed "STATE" field that can be equal to
"ACTIVE" or 'TERMINATED".
In this way the SQL query is optimized by the use of the Index. - C. Use DynamoDB with a "Calls" table and a Global Secondary Index on a "IsActive" attribute that is present for active calls only.
In this way the Global Secondary Index is sparse and more effective. - D. Use RDS Multi-AZ with two tables, one for "ACTIVE_CALLS" and one for
"TERMINATED_CALLS".
In this way the "ACTIVE_CALLS" table is always small and effective to access.
Answer: C
Explanation:
https://aws.amazon.com/dynamodb/faqs/
Q: Can a global secondary index key be defined on non-unique attributes?
Yes. Unlike the primary key on a table, a GSI index does not require the indexed attributes to be unique.
Q: Are GSI key attributes required in all items of a DynamoDB table?
No. GSIs are sparse indexes. Unlike the requirement of having a primary key, an item in a DynamoDB table does not have to contain any of the GSI keys. If a GSI key has both hash and range elements, and a table item omits either of them, then that item will not be indexed by the corresponding GSI. In such cases, a GSI can be very useful in efficiently locating items that have an uncommon attribute.
NEW QUESTION 72
A user is trying to create a PIOPS EBS volume with 3 GB size and 90 IOPS. Will AWS create the volume?
- A. Yes, since the ratio between EBS and IOPS is less than 30
- B. Yes, since PIOPS is higher than 100
- C. No, since the PIOPS and EBS size ratio is less than 30
- D. No, the EBS size is less than 4GB
Answer: D
Explanation:
Explanation
A Provisioned IOPS (SSD) volume can range in size from 4 GiB to 16 TiB and you can provision up to 20,000 IOPS per volume.
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSVolumeTypes.html#EBSVolumeTypes_piops
NEW QUESTION 73
A company has a data center that must be migrated to AWS as quickly as possible. The data center has a 500 Mbps AWS Direct Connect link and a separate, fully available 1 Gbps ISP connection. A Solutions Architect must transfer 20 TB of data from the data center to an Amazon S3 bucket.
What is the FASTEST way transfer the data?
- A. Send the data to AWS using the AWS Import/Export service.
- B. Upload the data to the S3 bucket using the existing DX link.
- C. Upload the data using an 80 TB AWS Snowball device.
- D. Upload the data to the S3 bucket using S3 Transfer Acceleration.
Answer: D
Explanation:
Explanation
https://aws.amazon.com/s3/faqs/
Import/Export supports importing and exporting data into and out of Amazon S3 buckets. For significant data sets, AWS Import/Export is often faster than Internet transfer and more cost effective than upgrading your connectivity.
NEW QUESTION 74
In Amazon CloudWatch, you can publish your own metrics with the put-metric-data command. When you create a new metric using the put-metric-data command, it can take up to two minutes before you can retrieve statistics on the new metric using the get-metric-statistics command.
How long does it take before the new metric appears in the list of metrics retrieved using the list- metrics command?
- A. Up to 15 minutes
- B. After 2 minutes
- C. More than an hour
- D. Within a minute
Answer: A
Explanation:
Explanation
You can publish your own metrics to CloudWatch with the put-metric-data command (or its Query API equivalent PutMetricData). When you create a new metric using the put-metric-data command, it can take up to two minutes before you can retrieve statistics on the new metric using the get-metric-statistics command.
However, it can take up to fifteen minutes before the new metric appears in the list of metrics retrieved using the list-metrics command.
http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/publishingMetrics.html
NEW QUESTION 75
A company has an application that posts messages to Amazon SQS. Another application polls the queue and processes the messages in an I/O-intensive operation. The company has a service level agreement (SLA) that specifies the maximum amount of time that can elapse between receiving the messages and responding to the users. Due to an increase in the number of messages, the company has difficulty meeting its SLA consistently.
What should a solutions architect do to help improve the application's processing time and ensure it can handle the load at any level?
- A. Create an Amazon Machine Image (AMI) from the instance used for processing. Terminate the instance and replace it with a larger size.
- B. Create an Amazon Machine Image (AMI) from the instance used for processing. Terminate the instance and replace it with an Amazon EC2 Dedicated Instance.
- C. Create an Amazon Machine image (AMI) from the instance used for processing. Create an Auto Scaling group using this image in its launch configuration. Configure the group with a target tracking policy to keep its aggregate CPU utilization below 70%.
- D. Create an Amazon Machine Image (AMI) from the instance used for processing. Create an Auto Scaling group using this image in its launch configuration. Configure the group with a target tracking policy based on the age of the oldest message in the SQS queue.
Answer: D
NEW QUESTION 76
A company is migrating its three-tier web application from on-premises to the AWS Cloud. The company has the following requirements for the migration process:
* Ingest machine images from the on-premises environment.
* Synchronize changes from the on-premises environment to the AWS environment until the production cutover.
* Minimize downtime when executing the production cutover.
* Migrate the virtual machines' root volumes and data volumes.
Which solution will satisfy these requirements with minimal operational overhead?
- A. Use AWS Server Migration Service (SMS) to create and launch a replication job for each tier of the application. Launch instances from the AMIs created by AWS SMS. After initial testing, perform a final replication and create new instances from the updated AMIs.
- B. Use AWS Application Discovery Service and AWS Migration Hub to group the virtual machines as an application. Use the AWS CLI VM Import/Export script to import the virtual machines as AMIs.Schedule the script to run incrementally to maintain changes in the application. Launch instances from the AMIs. After initial testing, perform a final virtual machine import and launch new instances from the AMIs.
- C. Use AWS Server Migration Service (SMS) to upload the operating system volumes. Use the AWS CLI import-snaps hot command 'or the data volumes. Launch instances from the AMIs created by AWS SMS and attach the data volumes to the instances. After initial testing, perform a final replication, launch new instances from the replicated AMIs. and attach the data volumes to the instances.
- D. Create an AWS CLIVM Import/Export script to migrate each virtual machine. Schedule the script to run incrementally to maintain changes in the application. Launch instances from the AMIs created by VM Import/Export. Once testing is done, rerun the script to do a final import and launch the instances from the AMIs.
Answer: D
NEW QUESTION 77
A corporate web application is deployed within an Amazon Virtual Private Cloud (VPC) and is connected to the corporate data center via an IPSec VPN. The application must authenticate against the on-premises LDAP server.
After authentication, each logged-in user can only access an Amazon Simple Storage Space (S3) keyspace specific to that user.
Which two approaches can satisfy these objectives? (Choose 2)
- A. The application authenticates against LDAP and retrieves the name of an IAM role associated with the user. The application then calls the IAM Security Token Service to assume that IAM role. The application can use the temporary credentials to access the appropriate S3 bucket.
- B. Develop an identity broker that authenticates against IAM security Token service to assume a IAM role in order to get temporary AWS security credentials The application calls the identity broker to get AWS temporary security credentials with access to the appropriate S3 bucket.
- C. The application authenticates against IAM Security Token Service using the LDAP credentials the application uses those temporary AWS security credentials to access the appropriate S3 bucket.
- D. Develop an identity broker that authenticates against LDAP and then calls IAM Security Token Service to get IAM federated user credentials. The application calls the identity broker to get IAM federated user credentials with access to the appropriate S3 bucket.
- E. The application authenticates against LDAP the application then calls the AWS identity and Access Management (IAM) Security service to log in to IAM using the LDAP credentials the application can use the IAM temporary credentials to access the appropriate S3 bucket.
Answer: A,D
Explanation:
Explanation
Imagine that in your organization, you want to provide a way for users to copy data from their computers to a backup folder. You build an application that users can run on their computers. On the back end, the application reads and writes objects in an S3 bucket. Users don't have direct access to AWS. Instead, the application communicates with an identity provider (IdP) to authenticate the user. The IdP gets the user information from your organization's identity store (such as an LDAP directory) and then generates a SAML assertion that includes authentication and authorization information about that user. The application then uses that assertion to make a call to the AssumeRoleWithSAML API to get temporary security credentials. The app can then use those credentials to access a folder in the S3 bucket that's specific to the user.
http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html
NEW QUESTION 78
A solutions architect is designing a solution to connect a company's on-premises network with all the company's current and future VPCs on AWS The company is running VPCs in five different AWS Regions and has at least 15 VPCs in each Region.
The company's AWS usage is constantly increasing and will continue to grow Additionally, all the VPCs throughout all five Regions must be able to communicate with each other The solution must maximize scalability and ease of management Which solution meets these requirements'?
- A. Set up a transit gateway in each Region Establish a redundant AWS Site-to-Site VPN connection between the on-premises firewalls and the transit gateway in the Region that is closest to the on-premises network Peer all the transit gateways with each other Connect all the VPCs to the transit gateway in their Region
- B. Set up a transit gateway in each Region Establish a redundant AWS Site-to-Site VPN connection between the on-premises firewalls and each transit gateway Route traffic between the different Regions through the company's on-premises firewalls Connect all the VPCs to the transit gateway in their Region
- C. Create an AWS CloudFormation template for a redundant AWS Site-to-Site VPN tunnel to the on-premises network Deploy the CloudFormation template for each VPC Set up VPC peering between all the VPCs for VPC-to-VPC communication
- D. Create an AWS CloudFormation template for a redundant AWS Site-to-Site VPN tunnel to the on-premises network Deploy the CloudFormation template for each VPC Route traffic between the different Regions through the company's on-premises firewalls
Answer: A
NEW QUESTION 79
An application runs on Amazon EC2 instances in an Auto Scaling group. When instances are terminated,
the Systems Operations team cannot determine the route cause, because the logs reside on the
terminated instances and are lost.
How can the root cause be determined?
- A. Use an Amazon CloudWatch agent to push the logs to Amazon CloudWatch Logs.
- B. Use ephemeral volumes to store the log files.
- C. Use AWS CloudTrail to pull the logs from the Amazon EC2 instances.
- D. Use a scheduled Amazon CloudWatch Event to take regular Amazon EBS snapshots.
Answer: A
NEW QUESTION 80
In DynamoDB, which of the following allows you to set alarms when you reach a specified threshold for a metric?
- A. Alarm Signal
- B. DynamoDBALARM
- C. CloudWatch
- D. DynamoDB Analyzer
Answer: C
Explanation:
Explanation
CloudWatch allows you to set alarms when you reach a specified threshold for a metric.
http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/MonitoringDynamoDB.html
NEW QUESTION 81
......
Exam Engine for AWS-Solutions-Architect-Professional Exam Free Demo & 365 Day Updates: https://whizlabs.actual4dump.com/Amazon/AWS-Solutions-Architect-Professional-actualtests-dumps.html