AWS Certified Solutions Architect – Professional practice questions

1. Question 1 of 25

   A company needs to architect a hybrid DNS solution. This solution will use an Amazon Route 53 private hosted zone for the domain cloud.example.com for the resources stored within VPCs. The company has the following DNS resolution requirements: On-premises systems should be able to resolve and connect to cloud.example.com. All VPCs should be able to resolve cloud.example.com. There is already an AWS Direct Connect connection between the on-premises corporate network and AWS Transit Gateway. Which architecture should the company use to meet these requirements with the HIGHEST performance?

   • AAssociate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver.
   • BAssociate the private hosted zone to all the VPCs. Deploy an Amazon EC2 conditional forwarder in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the conditional forwarder.
   • CAssociate the private hosted zone to the shared services VPCreate a Route 53 outbound resolver in the shared services VPAttach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the outbound resolver.
   • DAssociate the private hosted zone to the shared services VPC. Create a Route 53 inbound resolver in the shared services VPC. Attach the shared services VPC to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver.

   Show answer

   Correct answer: A

   How others answered

   • A77%
   • D23%

   Explanation

   A. Correct answer. Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/ NOT B. EC2 conditional forwarder will not meet Highest performance requirement. NOT C. Missing: Need to associate private hosted zone to all VPC. "All VPC’s will need to associate their private hosted zones to all other VPC’s if required to." Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/ NOT D. Missing: Need to associate private hosted zone to all VPC. "All VPC’s will need to associate their private hosted zones to all other VPC’s if required to." Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/

   Adapted from community discussion by robertohyena · 2024-09-23 · 56 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

   1. R

      robertohyena

      2024-09-23

      56 upvotes

      A. Correct answer. Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/ NOT B. EC2 conditional forwarder will not meet Highest performance requirement. NOT C. Missing: Need to associate private hosted zone to all VPC. "All VPC’s will need to associate their private hosted zones to all other VPC’s if required to." Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/ NOT D. Missing: Need to associate private hosted zone to all VPC. "All VPC’s will need to associate their private hosted zones to all other VPC’s if required to." Source: https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/

   2. Z

      zhangyu20000

      2022-12-09

      10 upvotes

      A because it requires all VPC can resolve the example.com. All VPCs must be associated with private hosted zone

   3. A

      atirado

      2024-09-23

      Selected A3 upvotes

      All options mention a Shared Services VPC that is not in the question. This is used for Route 53 for cloud.example.com. Option A - Associating all VPCs with the private hosted zone allows resolution of cloud.example.com; an inbound resolves allows on-premise resource to resolve to cloud.example.com; the final bit of connectivity allows on-premise to connect and resolve to cloud.example.com Option B - An Amazon EC2 Conditional Forwarder does not apply in this situation because an Active Directory is not in play in this situation Option C - Would not work because it is relying on an Outbound resolver (from cloud to on-premise) Option D - Would not work because the other VPCs are not connected to the private zone. Moreover, connectivity is not complete because only the Shared Services VPC is connected to the Transit Gateway

   4. N

      ninomfr64

      2023-12-09

      Selected A1 upvote

      Not B. "EC2 conditional forwarder in the shared services VPC" as conditional forward is not needed in this scenario and also I am not aware of EC2 conditional forward (but I am not an expert) Not C. "private hosted zone to the shared services VPC" we need to have it attached to all VPCs and "Route 53 outbound resolver" is not needed as we do not need to resolve on-preme from VPCs in this scenario Not D. "private hosted zone to the shared services VPC" we need to have it attached to all VPCs, ref to https://docs.aws.amazon.com/whitepapers/latest/hybrid-cloud-dns-options-for-vpc/route-53-resolver-endpoints-and-forwarding-rules.html#:~:text=AWS%20Glossary-,Route%C2%A053%20Resolver%20endpoints%20and%20forwarding%20rules,-PDF (this is not super clear as diagrams do not include VPCs and steps do not refer to VPCs consistently) Thus A. is correct as we have all the key pieces needed listed there

2. Question 2 of 25

   Select 2

   A company has many AWS accounts and uses AWS Organizations to manage all of them. A solutions architect must implement a solution that the company can use to share a common network across multiple accounts. The company’s infrastructure team has a dedicated infrastructure account that has a VPC. The infrastructure team must use this account to manage the network. Individual accounts cannot have the ability to manage their own networks. However, individual accounts must be able to create AWS resources within subnets. Which combination of actions should the solutions architect perform to meet these requirements? (Choose two.)

   • ACreate a transit gateway in the infrastructure account.
   • BEnable resource sharing from the AWS Organizations management account.
   • CCreate VPCs in each AWS account within the organization in AWS Organizations. Configure the VPCs to share the same CIDR range and subnets as the VPC in the infrastructure account. Peer the VPCs in each individual account with the VPC in the infrastructure account.
   • DCreate a resource share in AWS Resource Access Manager in the infrastructure account. Select the specific AWS Organizations OU that will use the shared network. Select each subnet to associate with the resource share.
   • ECreate a resource share in AWS Resource Access Manager in the infrastructure account. Select the specific AWS Organizations OU that will use the shared network. Select each prefix list to associate with the resource share.

   Show answer

   Correct answer: B, D

   How others answered

   • BD85%

   Explanation

   Step B is needed because it enables the organization to share resources across accounts. Step D is needed because it allows the infrastructure account to share specific subnets with the other accounts in the organization, so that the other accounts can create resources within those subnets without having to manage their own networks.

   Adapted from community discussion by masetromain · 2023-01-13 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

   1. M

      masetromain

      2023-01-13

      13 upvotes

      Step B is needed because it enables the organization to share resources across accounts. Step D is needed because it allows the infrastructure account to share specific subnets with the other accounts in the organization, so that the other accounts can create resources within those subnets without having to manage their own networks.

   2. R

      razguru

      2022-12-21

      11 upvotes

      A - Doesn't seem correct as the question didnt state multiple VPs, so transit gateway is not relevant. I will go with B & D

   3. S

      sreed77

      2024-09-23

      Selected B, D4 upvotes

      Option B allows the infrastructure team to manage the network in the infrastructure account. It also allows individual accounts to create AWS resources within subnets. This is done by creating a resource share in AWS Resource Access Manager (RAM) in the infrastructure account. The resource share is then associated with the specific AWS Organizations OU that will use the shared network. The subnets are then associated with the resource share. Option D is also necessary because it allows the infrastructure team to control who has access to the shared network. This is done by assigning permissions to the resource share. Here are the steps involved in implementing this solution: Create a resource share in RAM in the infrastructure account. Select the specific AWS Organizations OU that will use the shared network. Select each subnet to associate with the resource share. Assign permissions to the resource share.

   4. A

      atirado

      2024-09-23

      Selected B, D4 upvotes

      Option A - Does not assist with allowing OUs to create resources in the subnets Option B - Allows sharing resources across the entire organization Option C - This option does not work as a way to share subnets because it creates multiple VPCs and subnets in the accounts rather than allowing managing resources in shared subnets Option D - Directly shares the subnets Option E - Does not assist because it only shares pre-built CIDR blocks rather than subnets

3. Question 3 of 25

   A company wants to deploy an AWS WAF solution to manage AWS WAF rules across multiple AWS accounts. The accounts are managed under different OUs in AWS Organizations. Administrators must be able to add or remove accounts or OUs from managed AWS WAF rule sets as needed. Administrators also must have the ability to automatically update and remediate noncompliant AWS WAF rules in all accounts. Which solution meets these requirements with the LEAST amount of operational overhead?

   • AUse AWS Firewall Manager to manage AWS WAF rules across accounts in the organization. Use an AWS Systems Manager Parameter Store parameter to store account numbers and OUs to manage. Update the parameter as needed to add or remove accounts or OUs. Use an Amazon EventBridge rule to identify any changes to the parameter and to invoke an AWS Lambda function to update the security policy in the Firewall Manager administrative account.
   • BDeploy an organization-wide AWS Config rule that requires all resources in the selected OUs to associate the AWS WAF rules. Deploy automated remediation actions by using AWS Lambda to fix noncompliant resources. Deploy AWS WAF rules by using an AWS CloudFormation stack set to target the same OUs where the AWS Config rule is applied.
   • CCreate AWS WAF rules in the management account of the organization. Use AWS Lambda environment variables to store account numbers and OUs to manage. Update environment variables as needed to add or remove accounts or OUs. Create cross-account IAM roles in member accounts. Assume the roles by using AWS Security Token Service (AWS STS) in the Lambda function to create and update AWS WAF rules in the member accounts.
   • DUse AWS Control Tower to manage AWS WAF rules across accounts in the organization. Use AWS Key Management Service (AWS KMS) to store account numbers and OUs to manage. Update AWS KMS as needed to add or remove accounts or OUs. Create IAM users in member accounts. Allow AWS Control Tower in the management account to use the access key and secret access key to create and update AWS WAF rules in the member accounts.

   Show answer

   Correct answer: A

   How others answered

   • A96%

   Explanation

   The correct answer is A. In this solution, AWS Firewall Manager is used to manage AWS WAF rules across accounts in the organization. An AWS Systems Manager Parameter Store parameter is used to store account numbers and OUs to manage. This parameter can be updated as needed to add or remove accounts or OUs. An Amazon EventBridge rule is used to identify any changes to the parameter and to invoke an AWS Lambda function to update the security policy in the Firewall Manager administrative account. This solution allows for easy management of AWS WAF rules across multiple accounts with minimal operational overhead.

   Adapted from community discussion by masetromain · 2023-01-15 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

   1. M

      masetromain

      2023-01-15

      Selected A20 upvotes

      The correct answer is A. In this solution, AWS Firewall Manager is used to manage AWS WAF rules across accounts in the organization. An AWS Systems Manager Parameter Store parameter is used to store account numbers and OUs to manage. This parameter can be updated as needed to add or remove accounts or OUs. An Amazon EventBridge rule is used to identify any changes to the parameter and to invoke an AWS Lambda function to update the security policy in the Firewall Manager administrative account. This solution allows for easy management of AWS WAF rules across multiple accounts with minimal operational overhead.

   2. V

      venvig

      2023-09-01

      Selected A5 upvotes

      AWS Firewall Manager is a security management service which allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organizations Firewall Manager supports wide variety of services, including: ● AWS WAF ● VPC Security Groups ● AWS Network Firewall ● Route53 DNS Firewall ● AWS Shield Advanced ● Palo Alto Cloud Next-generation firewalls The Prerequisites are: AWS Organizations + AWS Config.

   3. U

      Untamables

      2023-01-25

      Selected A6 upvotes

      https://aws.amazon.com/solutions/implementations/automations-for-aws-firewall-manager/

   4. R

      rbm2023

      2023-05-13

      Selected A3 upvotes

      This is a complex question. But I voted A because the Firewall manager seems to be the correct way to centralize the rules across accounts. Below are some interesting references I could find https://catalog.us-east-1.prod.workshops.aws/workshops/4cbaea3b-ceba-48e3-bd56-eca138f7a66c/en-US https://aws.amazon.com/blogs/security/use-aws-firewall-manager-vpc-security-groups-to-protect-applications-hosted-on-ec2-instances/ https://aws.amazon.com/blogs/security/automatically-updating-aws-waf-rule-in-real-time-using-amazon-eventbridge/

4. Question 4 of 25

   Select 3

   A company is developing and hosting several projects in the AWS Cloud. The projects are developed across multiple AWS accounts under the same organization in AWS Organizations. The company requires the cost for cloud infrastructure to be allocated to the owning project. The team responsible for all of the AWS accounts has discovered that several Amazon EC2 instances are lacking the Project tag used for cost allocation. Which actions should a solutions architect lake to resolve the problem and prevent it from happening in the future? (Choose three.)

   • ACreate an AWS Config rule in each account to find resources with missing tags.
   • BCreate an SCP in the organization with a deny action for ec2:RunInstances if the Project tag is missing.
   • CUse Amazon Inspector in the organization to find resources with missing tags.
   • DCreate an IAM policy in each account with a deny action for ec2:RunInstances if the Project tag is missing.
   • ECreate an AWS Config aggregator for the organization to collect a list of EC2 instances with the missing Project tag.
   • FUse AWS Security Hub to aggregate a list of EC2 instances with the missing Project tag.

   Show answer

   Correct answer: A, B, E

   How others answered

   • ABE81%

   Explanation

   A and E are correct. But the below is the best way to deploy config rules accross accounts. https://docs.aws.amazon.com/config/latest/developerguide/config-rule-multi-account-deployment.html https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html B is correct. https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_tagging.html

   Adapted from community discussion by Untamables · 2023-01-25 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

   1. O

      OCHT

      2023-04-07

      7 upvotes

      E. Create an AWS Config aggregator for the organization to collect a list of EC2 instances with the missing Project tag. By creating an AWS Config aggregator, you can collect a list of EC2 instances across multiple accounts in the organization that are missing the required Project tag. This can help you identify instances that need to be tagged properly for cost allocation. Here is the AWS Config documentation for creating aggregators: https://docs.aws.amazon.com/config/latest/developerguide/config-aggregator.html

   2. G

      God_Is_Love

      2023-03-07

      Selected A, B, E7 upvotes

      If config rule is added (A) it can be seen in AWS Config aggregator (E) Using SCP in as aws organization is used here in question. So, A,B,E

   3. O

      OCHT

      2023-04-07

      Selected A, B, E5 upvotes

      A. Create an AWS Config rule in each account to find resources with missing tags. By creating an AWS Config rule in each account, you can check if resources are missing tags or have tags that are not conforming to your organization's standards. You can also use AWS Config to automatically remediate non-compliant resources by applying tags. This can help ensure that resources are properly tagged for cost allocation purposes. Here is the AWS Config documentation for creating rules: https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html

   4. Y

      youngmanaws

      2023-04-23

      3 upvotes

      A. AWS Config allows you to remediate noncompliant resources that are evaluated by AWS Config Rules. AWS Config applies remediation using AWS Systems Manager Automation documents. These documents define the actions to be performed on noncompliant AWS resources evaluated by AWS Config Rules. You can associate SSM documents by using AWS Management Console or by using APIs. AWS Config provides a set of managed automation documents with remediation actions. You can also create and associate custom automation documents with AWS Config rules. To apply remediation on noncompliant resources, you can either choose the remediation action you want to associate from a prepopulated list or create your own custom remediation actions using SSM documents. AWS Config provides a recommended list of remediation action in the AWS Management Console. In the AWS Management Console, you can either choose to manually or automatically remediate noncompliant resources by associating remediation actions with AWS Config rules. With all remediation actions, you can either choose manual or automatic remediation.

5. Question 5 of 25

   A retail company has an on-premises data center in Europe. The company also has a multi-Region AWS presence that includes the eu-west-1 and us-east-1 Regions. The company wants to be able to route network traffic from its on-premises infrastructure into VPCs in either of those Regions. The company also needs to support traffic that is routed directly between VPCs in those Regions. No single points of failure can exist on the network. The company already has created two 1 Gbps AWS Direct Connect connections from its on-premises data center. Each connection goes into a separate Direct Connect location in Europe for high availability. These two locations are named DX-A and DX-B, respectively. Each Region has a single AWS Transit Gateway that is configured to route all inter-VPC traffic within that Region. Which solution will meet these requirements?

   • ACreate a private VIF from the DX-A connection into a Direct Connect gateway. Create a private VIF from the DX-B connection into the same Direct Connect gateway for high availability. Associate both the eu-west-1 and us-east-1 transit gateways with the Direct Connect gateway. Peer the transit gateways with each other to support cross-Region routing.
   • BCreate a transit VIF from the DX-A connection into a Direct Connect gateway. Associate the eu-west-1 transit gateway with this Direct Connect gateway. Create a transit VIF from the DX-8 connection into a separate Direct Connect gateway. Associate the us-east-1 transit gateway with this separate Direct Connect gateway. Peer the Direct Connect gateways with each other to support high availability and cross-Region routing.
   • CCreate a transit VIF from the DX-A connection into a Direct Connect gateway. Create a transit VIF from the DX-B connection into the same Direct Connect gateway for high availability. Associate both the eu-west-1 and us-east-1 transit gateways with this Direct Connect gateway. Configure the Direct Connect gateway to route traffic between the transit gateways.
   • DCreate a transit VIF from the DX-A connection into a Direct Connect gateway. Create a transit VIF from the DX-B connection into the same Direct Connect gateway for high availability. Associate both the eu-west-1 and us-east-1 transit gateways with this Direct Connect gateway. Peer the transit gateways with each other to support cross-Region routing.

   Show answer

   Correct answer: D

   How others answered

   • D91%

   Explanation

   https://docs.aws.amazon.com/images/whitepapers/latest/hybrid-connectivity/images/dx-dxgw-transit-gateway-multi-region-public-vif.png B is wrong as it says, two DX Gateways contradictory C is wrong as it says to configure DXG to route traffic. infact Transit gateway peering need to be done between two transit gateways of each reigon. A is wrong because Private VIF is not apt in mentioned config of the question. Public VIF is correct (Transit public VIF) If you are using a single DX Gateway

   Adapted from community discussion by God_Is_Love · 2023-03-07 · 16 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

   1. G

      God_Is_Love

      2023-03-07

      Selected D16 upvotes

      https://docs.aws.amazon.com/images/whitepapers/latest/hybrid-connectivity/images/dx-dxgw-transit-gateway-multi-region-public-vif.png B is wrong as it says, two DX Gateways contradictory C is wrong as it says to configure DXG to route traffic. infact Transit gateway peering need to be done between two transit gateways of each reigon. A is wrong because Private VIF is not apt in mentioned config of the question. Public VIF is correct (Transit public VIF) If you are using a single DX Gateway

   2. R

      rbm2023

      2023-05-17

      Selected D4 upvotes

      I agree with option D Refer to the diagram below which explains in detail the use of Transit VIF and Public VIF. Also demonstrates the necessity for peering the transit gateways to allow the cross-region routing. https://docs.aws.amazon.com/images/whitepapers/latest/hybrid-connectivity/images/dx-dxgw-transit-gateway-multi-region-public-vif.png The only options that are using the cross-region routing are A and D. Option A mentions the use of Private VIF and not the Transit VIF. Hence A is incorrect.

   3. M

      masetromain

      2023-01-15

      Selected D2 upvotes

      https://www.examtopics.com/discussions/amazon/view/91771-exam-aws-certified-solutions-architect-professional-topic-1/ The correct answer is D. In this solution, two transit VIFs are created - one from the DX-A connection and one from the DX-B connection - into the same Direct Connect gateway for high availability. Both the eu-west-1 and us-east-1 transit gateways are then associated with this Direct Connect gateway. The transit gateways are then peered with each other to support cross-Region routing. This solution meets the requirements of the company by creating a highly available connection between the on-premises data center and the VPCs in both the eu-west-1 and us-east-1 regions, and by enabling direct traffic routing between VPCs in those regions.

   4. M

      masetromain

      2023-01-15

      4 upvotes

      Option A is incorrect because a private VIF does not support inter-VPC traffic and cross-Region routing. Option B is incorrect because it separates the two Direct Connect connections into separate Direct Connect gateways, which would not provide high availability. Option C is incorrect because it does not mention how to peer the transit gateways to support cross-Region routing.

6. Question 6 of 25

   A company has an on-premises website application that provides real estate information for potential renters and buyers. The website uses a Java backend and a NoSQL MongoDB database to store subscriber data. The company needs to migrate the entire application to AWS with a similar structure. The application must be deployed for high availability, and the company cannot make changes to the application. Which solution will meet these requirements?

   • AUse an Amazon Aurora DB cluster as the database for the subscriber data. Deploy Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones for the Java backend application.
   • BUse MongoDB on Amazon EC2 instances as the database for the subscriber data. Deploy EC2 instances in an Auto Scaling group in a single Availability Zone for the Java backend application.
   • CConfigure Amazon DocumentDB (with MongoDB compatibility) with appropriately sized instances in multiple Availability Zones as the database for the subscriber data. Deploy Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones for the Java backend application.
   • DConfigure Amazon DocumentDB (with MongoDB compatibility) in on-demand capacity mode in multiple Availability Zones as the database for the subscriber data. Deploy Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones for the Java backend application.

   Show answer

   Correct answer: C

   How others answered

   • C86%

   Explanation

   A = Aurora supports MySQL and PostgreSQL, not MongoDB. App changes are not allowed B = This could work but DocumentDB provides managed MongoDB instance that is preferable C = correct D = there isn't on-demand capacity mode, in 2022 launched MondoDB Elastic Cluster that eliminates the need to choose, manage or upgrade instances and allows to scale up to 4PiB storage whereas instance based scales up to 128TiB. I thing this question is pre elastic cluster as this is ambiguous between C and D

   Adapted from community discussion by ninomfr64 · 2024-01-22 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

   1. U

      uC6rW1aB

      2023-09-09

      Selected C12 upvotes

      C correct DocumentDB only have on-demand instance but not on-demand capacity mode, the mode is for DynamoDB

   2. N

      ninomfr64

      2024-01-22

      Selected C5 upvotes

      A = Aurora supports MySQL and PostgreSQL, not MongoDB. App changes are not allowed B = This could work but DocumentDB provides managed MongoDB instance that is preferable C = correct D = there isn't on-demand capacity mode, in 2022 launched MondoDB Elastic Cluster that eliminates the need to choose, manage or upgrade instances and allows to scale up to 4PiB storage whereas instance based scales up to 128TiB. I thing this question is pre elastic cluster as this is ambiguous between C and D

   3. F

      F_Eldin

      2023-05-20

      Selected C3 upvotes

      DocumentDB does indeed support on-demand capacity mode (Contrary to what other users say here) https://aws.amazon.com/blogs/database/running-spiky-workloads-and-optimizing-costs-by-more-than-90-using-amazon-dynamodb-on-demand-capacity-mode/ but this mode is good for spikey workloads and does not address the high availablity requirement

   4. L

      lunt

      2023-02-16

      Selected C3 upvotes

      There is no on-demand capacity mode. FAQ itself states capacity is reference to CPU and not Storage. C is right in my eyes.

7. Question 7 of 25

   A company wants to use AWS to create a business continuity solution in case the company's main on-premises application fails. The application runs on physical servers that also run other applications. The on-premises application that the company is planning to migrate uses a MySQL database as a data store. All the company's on-premises applications use operating systems that are compatible with Amazon EC2. Which solution will achieve the company's goal with the LEAST operational overhead?

   • AInstall the AWS Replication Agent on the source servers, including the MySQL servers. Set up replication for all servers. Launch test instances for regular drills. Cut over to the test instances to fail over the workload in the case of a failure event.
   • BInstall the AWS Replication Agent on the source servers, including the MySQL servers. Initialize AWS Elastic Disaster Recovery in the target AWS Region. Define the launch settings. Frequently perform failover and fallback from the most recent point in time.
   • CCreate AWS Database Migration Service (AWS DMS) replication servers and a target Amazon Aurora MySQL DB cluster to host the database. Create a DMS replication task to copy the existing data to the target DB cluster. Create a local AWS Schema Conversion Tool (AWS SCT) change data capture (CDC) task to keep the data synchronized. Install the rest of the software on EC2 instances by starting with a compatible base AMI.
   • DDeploy an AWS Storage Gateway Volume Gateway on premises. Mount volumes on all on-premises servers. Install the application and the MySQL database on the new volumes. Take regular snapshots. Install all the software on EC2 Instances by starting with a compatible base AMI. Launch a Volume Gateway on an EC2 instance. Restore the volumes from the latest snapshot. Mount the new volumes on the EC2 instances in the case of a failure event.

   Show answer

   Correct answer: B

   How others answered

   • B81%
   • C19%

   Explanation

   Tricky one. This is not an on premise migration use case which prompts for answer C. Its a current situation of on premise application which the company wants to continue its state in the requirement of using AWS as DR solution. https://docs.aws.amazon.com/images/drs/latest/userguide/images/drs-failback-arc.png https://docs.aws.amazon.com/drs/latest/userguide/what-is-drs.html

   Adapted from community discussion by God_Is_Love · 2023-09-11 · 27 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

   1. G

      God_Is_Love

      2023-09-11

      Selected B27 upvotes

      Tricky one. This is not an on premise migration use case which prompts for answer C. Its a current situation of on premise application which the company wants to continue its state in the requirement of using AWS as DR solution. https://docs.aws.amazon.com/images/drs/latest/userguide/images/drs-failback-arc.png https://docs.aws.amazon.com/drs/latest/userguide/what-is-drs.html

   2. U

      Untamables

      2023-07-28

      Selected B7 upvotes

      https://docs.aws.amazon.com/drs/latest/userguide/what-is-drs.html https://docs.aws.amazon.com/drs/latest/userguide/recovery-workflow-gs.html Option C is wrong. That just mentions the migration method. I think this question asks us the DR architecture between on-premises and AWS cloud.

   3. N

      ninomfr64

      2024-07-23

      Selected B4 upvotes

      A = to use AWS DRS you first need to set it up in each AWS Region in which you want to use it. installing AWS Replication agent is not enough B = correct (to me the sentence "Frequently perform failover and fallback from the most recent point in time" is ambiguous as this points to actual failover/failback and not to drills) C = SCT is not needed wwith same engine db migration. also, install the rest of the software is not enough for app DR D = Volume Gateway can be used in a Back and Restore DR scenario, but the option D is very confused. Anyway, Storage Gateway for DR requires more overhead with respect to AWS DRS

   4. B

      bititan

      2023-07-29

      Selected B4 upvotes

      this is asking about application and not data alone. So option B with DRS is good. C is concentrating only on DB migration.

8. Question 8 of 25

   A company has a latency-sensitive trading platform that uses Amazon DynamoDB as a storage backend. The company configured the DynamoDB table to use on-demand capacity mode. A solutions architect needs to design a solution to improve the performance of the trading platform. The new solution must ensure high availability for the trading platform. Which solution will meet these requirements with the LEAST latency?

   • ACreate a two-node DynamoDB Accelerator (DAX) cluster. Configure an application to read and write data by using DAX.
   • BCreate a three-node DynamoDB Accelerator (DAX) cluster. Configure an application to read data by using DAX and to write data directly to the DynamoDB table.
   • CCreate a three-node DynamoDB Accelerator (DAX) cluster. Configure an application to read data directly from the DynamoDB table and to write data by using DAX.
   • DCreate a single-node DynamoDB Accelerator (DAX) cluster. Configure an application to read data by using DAX and to write data directly to the DynamoDB table.

   Show answer

   Correct answer: B

   How others answered

   • B92%

   Explanation

   This is a poorly framed question with very little attention to how applications are architected in real life. Here's my reasoning: This being a trading platform, you have a high volume of writes and reads, and stale data is essentially worse than useless. This automatically eliminates all but A, because of the way DAX performs. DAX caches data from the first query, and subsequent queries will continue to receive that cached data regardless of whether it has been updated in DynamoDB. This behavior continues till cache eviction. The only way around it is to read and write data using DAX. Here's the curveball - the solution must be HA, which eliminates A and D, leaving only B & C. And between B & C, you really want to use DAX for reading and DynamoDB for writing. So final answer is B - if you want to get certified. Applying this solution in real world however will cause you a lot of pain and grief!

   Adapted from community discussion by Ganshank · 2023-08-24 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

   1. U

      Untamables

      2023-01-28

      Selected B19 upvotes

      3 nodes are required for a DAX cluster to be fault-tolerant. https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.concepts.cluster.html

   2. G

      Ganshank

      2023-08-24

      13 upvotes

      This is a poorly framed question with very little attention to how applications are architected in real life. Here's my reasoning: This being a trading platform, you have a high volume of writes and reads, and stale data is essentially worse than useless. This automatically eliminates all but A, because of the way DAX performs. DAX caches data from the first query, and subsequent queries will continue to receive that cached data regardless of whether it has been updated in DynamoDB. This behavior continues till cache eviction. The only way around it is to read and write data using DAX. Here's the curveball - the solution must be HA, which eliminates A and D, leaving only B & C. And between B & C, you really want to use DAX for reading and DynamoDB for writing. So final answer is B - if you want to get certified. Applying this solution in real world however will cause you a lot of pain and grief!

   3. S

      schalke04

      2023-01-28

      Selected B4 upvotes

      A DAX cluster can be deployed with one or two nodes for development or test workloads. One- and two-node clusters are not fault-tolerant, and we don't recommend using fewer than three nodes for production use. If a one- or two-node cluster encounters software or hardware errors, the cluster can become unavailable or lose cached data.A DAX cluster can be deployed with one or two nodes for development or test workloads. One- and two-node clusters are not fault-tolerant, and we don't recommend using fewer than three nodes for production use. If a one- or two-node cluster encounters software or hardware errors, the cluster can become unavailable or lose cached data.

   4. C

      c73bf38

      2023-02-22

      3 upvotes

      The write-through behavior of DAX is appropriate for many application patterns. However, there are some application patterns where a write-through model might not be appropriate. For applications that are sensitive to latency, writing through DAX incurs an extra network hop. So a write to DAX is a little slower than a write directly to DynamoDB. If your application is sensitive to write latency, you can reduce the latency by writing directly to DynamoDB instead. For more information, see Write-around. https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.consistency.html#DAX.consistency.strategies-for-writes.write-around

9. Question 9 of 25

   A telecommunications company is running an application on AWS. The company has set up an AWS Direct Connect connection between the company's on-premises data center and AWS. The company deployed the application on Amazon EC2 instances in multiple Availability Zones behind an internal Application Load Balancer (ALB). The company's clients connect from the on-premises network by using HTTPS. The TLS terminates in the ALB. The company has multiple target groups and uses path-based routing to forward requests based on the URL path. The company is planning to deploy an on-premises firewall appliance with an allow list that is based on IP address. A solutions architect must develop a solution to allow traffic flow to AWS from the on-premises network so that the clients can continue to access the application. Which solution will meet these requirements?

   • AConfigure the existing ALB to use static IP addresses. Assign IP addresses in multiple Availability Zones to the ALB. Add the ALB IP addresses to the firewall appliance.
   • BCreate a Network Load Balancer (NLB). Associate the NLB with one static IP addresses in multiple Availability Zones. Create an ALB-type target group for the NLB and add the existing ALAdd the NLB IP addresses to the firewall appliance. Update the clients to connect to the NLB.
   • CCreate a Network Load Balancer (NLB). Associate the LNB with one static IP addresses in multiple Availability Zones. Add the existing target groups to the NLB. Update the clients to connect to the NLB. Delete the ALB Add the NLB IP addresses to the firewall appliance.
   • DCreate a Gateway Load Balancer (GWLB). Assign static IP addresses to the GWLB in multiple Availability Zones. Create an ALB-type target group for the GWLB and add the existing ALB. Add the GWLB IP addresses to the firewall appliance. Update the clients to connect to the GWLB.

   Show answer

   Correct answer: B

   How others answered

   • B93%

   Explanation

   The background is the below. - The company is using ALB features and must keep them. - The new on-premise firewall needs a static IP address of the ALB as the next hop. - However, ALB cannot have a static IP address. So the point is how ALB can have a static IP address endpoint. Solution https://aws.amazon.com/premiumsupport/knowledge-center/alb-static-ip/

   Adapted from community discussion by Untamables · 2023-08-10 · 22 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • repost.aws documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

   1. U

      Untamables

      2023-08-10

      Selected B22 upvotes

      The background is the below. - The company is using ALB features and must keep them. - The new on-premise firewall needs a static IP address of the ALB as the next hop. - However, ALB cannot have a static IP address. So the point is how ALB can have a static IP address endpoint. Solution https://aws.amazon.com/premiumsupport/knowledge-center/alb-static-ip/

   2. S

      Sarutobi

      2023-09-04

      Selected B6 upvotes

      The question is confusing. If I understood this question correctly, I do this almost every day, and I don't use those terms. Basically, the solution is inserting an NLB in front of the existing ALB, so traffic is Client->FW->NLB->ALB->EC2. Another point is that fixing the public IP address makes a lot of sense, but not the private one, like in this case. Every time you create an ALB 2 or more ENI are created and you have the IP addresses there.

   3. J

      jojom19980

      2023-08-04

      Selected B6 upvotes

      it uses path-based routing to forward requests based on the URL path

   4. S

      saggy4

      2024-08-12

      Selected B5 upvotes

      A - Cannot assign static IP to ALB C - Cannot attach target group directly as path-based forwarding is not possible with NLB D - Gateway load balancer supports only Instance and IP as target B - This is correct since using NLB we can have a static IP assigned and also attach ALB as target to NLB

10. Question 10 of 25

    A company is migrating a document processing workload to AWS. The company has updated many applications to natively use the Amazon S3 API to store, retrieve, and modify documents that a processing server generates at a rate of approximately 5 documents every second. After the document processing is finished, customers can download the documents directly from Amazon S3. During the migration, the company discovered that it could not immediately update the processing server that generates many documents to support the S3 API. The server runs on Linux and requires fast local access to the files that the server generates and modifies. When the server finishes processing, the files must be available to the public for download within 30 minutes. Which solution will meet these requirements with the LEAST amount of effort?

    • AMigrate the application to an AWS Lambda function. Use the AWS SDK for Java to generate, modify, and access the files that the company stores directly in Amazon S3.
    • BSet up an Amazon S3 File Gateway and configure a file share that is linked to the document store. Mount the file share on an Amazon EC2 instance by using NFS. When changes occur in Amazon S3, initiate a RefreshCache API call to update the S3 File Gateway.
    • CConfigure Amazon FSx for Lustre with an import and export policy. Link the new file system to an S3 bucket. Install the Lustre client and mount the document store to an Amazon EC2 instance by using NFS.
    • DConfigure AWS DataSync to connect to an Amazon EC2 instance. Configure a task to synchronize the generated files to and from Amazon S3.

    Show answer

    Correct answer: B

    How others answered

    • B70%
    • C26%

    Only 70% agreed on this answer — treat it as contested rather than settled.

    Explanation

    B is correct imo C is incorrect, FSx for Luster doesn't support NFS protocol It actually support only POSIX protocol: Custom (POSIX-compliant) protocol optimized for performance

    Adapted from community discussion by dev112233xx · 2023-04-10 · 26 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • repost.aws documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. D

       dev112233xx

       2023-04-10

       Selected B26 upvotes

       B is correct imo C is incorrect, FSx for Luster doesn't support NFS protocol It actually support only POSIX protocol: Custom (POSIX-compliant) protocol optimized for performance

    2. R

       rbm2023

       2023-05-22

       9 upvotes

       I disagree with option C. This is an example of how to mount a Lustre from an EC2 Linux system. it does not use NFS sudo mount -t lustre @tcp:/ Amazon FSx for Lustre provides its own Lustre-specific mount command and protocol for mounting the file system on Linux instances. The lustre file system type in the mount command indicates that it is specifically for mounting Lustre-based file systems, such as Amazon FSx for Lustre. I would still go for option B

    3. N

       ninomfr64

       2024-01-26

       Selected B7 upvotes

       A = migrating to lambda requires a lot of work and doesn't solve the need to have fast access to files B = correct C = FSx for Lustre doesn't support NFS D = DataSynch can schedule transfer hourly, daily or weekly, cannot meet 30 minutes requirement

    4. G

       God_Is_Love

       2023-03-15

       5 upvotes

       Above may be wrong- Option C could be the solution that will meet the requirements with the least amount of effort. By linking the new file system to an S3 bucket, the company can store, retrieve, and modify documents with fast local access. The Lustre client can be installed on an Amazon EC2 instance, which will provide the processing server with the fast local access it requires. This solution requires minimal changes to the processing server and will enable the files to be available to the public for download within 30 minutes. Option B may not be a good solution because it involves setting up an S3 File Gateway and configuring a file share, which would require additional infrastructure and configuration. This solution also involves using NFS, which may not provide the level of performance required for the processing server.

11. Question 11 of 25

    A company is running a web application in a VPC. The web application runs on a group of Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is using AWS WAF. An external customer needs to connect to the web application. The company must provide IP addresses to all external customers. Which solution will meet these requirements with the LEAST operational overhead?

    • AReplace the ALB with a Network Load Balancer (NLB). Assign an Elastic IP address to the NLB.
    • BAllocate an Elastic IP address. Assign the Elastic IP address to the ALProvide the Elastic IP address to the customer.
    • CCreate an AWS Global Accelerator standard accelerator. Specify the ALB as the accelerator's endpoint. Provide the accelerator's IP addresses to the customer.
    • DConfigure an Amazon CloudFront distribution. Set the ALB as the origin. Ping the distribution's DNS name to determine the distribution's public IP address. Provide the IP address to the customer.

    Show answer

    Correct answer: C

    How others answered

    • C92%

    Explanation

    https://docs.aws.amazon.com/global-accelerator/latest/dg/about-accelerators.alb-accelerator.html Option A is wrong. AWS WAF does not support associating with NLB. https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html Option B is wrong. An ALB does not support an Elastic IP address. https://aws.amazon.com/elasticloadbalancing/features/

    Adapted from community discussion by Untamables · 2023-02-10 · 19 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. U

       Untamables

       2023-02-10

       Selected C19 upvotes

       https://docs.aws.amazon.com/global-accelerator/latest/dg/about-accelerators.alb-accelerator.html Option A is wrong. AWS WAF does not support associating with NLB. https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html Option B is wrong. An ALB does not support an Elastic IP address. https://aws.amazon.com/elasticloadbalancing/features/

    2. M

       masssa

       2023-02-04

       18 upvotes

       static IP can made below method. ・NLB (replace NLB from ALB) ・NLB + ALB ・global accelarator + ALB ・original load balancer (ex. made by EC2 + nginx)

    3. N

       ninomfr64

       2024-01-26

       Selected C5 upvotes

       A = NLB doe not integrates with WAF B = ALB cannot have Elastic IP attached, ALB cannot have static IP at all C = corect D = CloudFront distributions replies from many IPs, AWS manages a prefix list for this. Not easy to configure on customers side

    4. B

       bititan

       2023-02-02

       Selected C4 upvotes

       this option has the least admin effort. A has more admin effort, B is not possible, D will not give static IP address

12. Question 12 of 25

    A company needs to audit the security posture of a newly acquired AWS account. The company’s data security team requires a notification only when an Amazon S3 bucket becomes publicly exposed. The company has already established an Amazon Simple Notification Service (Amazon SNS) topic that has the data security team's email address subscribed. Which solution will meet these requirements?

    • ACreate an S3 event notification on all S3 buckets for the isPublic event. Select the SNS topic as the target for the event notifications.
    • BCreate an analyzer in AWS Identity and Access Management Access Analyzer. Create an Amazon EventBridge rule for the event type “Access Analyzer Finding” with a filter for “isPublic: true.” Select the SNS topic as the EventBridge rule target.
    • CCreate an Amazon EventBridge rule for the event type “Bucket-Level API Call via CloudTrail” with a filter for “PutBucketPolicy.” Select the SNS topic as the EventBridge rule target.
    • DActivate AWS Config and add the cloudtrail-s3-dataevents-enabled rule. Create an Amazon EventBridge rule for the event type “Config Rules Re-evaluation Status” with a filter for “NON_COMPLIANT.” Select the SNS topic as the EventBridge rule target.

    Show answer

    Correct answer: B

    How others answered

    • B95%

    Explanation

    A. No, because Amazon S3 can NOT currently publish notifications for isPublic events. https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventNotifications.html B. Yes, because IAM Access Analyzer for S3 alerts you to S3 buckets that are configured to allow access to anyone on the internet or other AWS accounts https://aws.amazon.com/blogs/security/how-to-prioritize-iam-access-analyzer-findings/ C. No, because PutBucketPolicy notifies us of an Amazon S3 bucket policy event to an Amazon S3 bucket, and we are looking for a SPECIFIC event to the bucket permissions, not ALL events. D. No, because cloudtrail-s3-dataevents-enabled checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets. https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-s3-dataevents-enabled.html

    Adapted from community discussion by dkx · 2024-01-03 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. D

       dkx

       2024-01-03

       13 upvotes

       A. No, because Amazon S3 can NOT currently publish notifications for isPublic events. https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventNotifications.html B. Yes, because IAM Access Analyzer for S3 alerts you to S3 buckets that are configured to allow access to anyone on the internet or other AWS accounts https://aws.amazon.com/blogs/security/how-to-prioritize-iam-access-analyzer-findings/ C. No, because PutBucketPolicy notifies us of an Amazon S3 bucket policy event to an Amazon S3 bucket, and we are looking for a SPECIFIC event to the bucket permissions, not ALL events. D. No, because cloudtrail-s3-dataevents-enabled checks if at least one AWS CloudTrail trail is logging Amazon Simple Storage Service (Amazon S3) data events for all S3 buckets. https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-s3-dataevents-enabled.html

    2. G

       God_Is_Love

       2023-09-17

       Selected B12 upvotes

       https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-analyzer.html

    3. G

       God_Is_Love

       2023-09-17

       8 upvotes

       Click on the "Create rule" button. Enter a name for the rule and a brief description, if desired. Under "Define pattern", select "Event pattern". Select "Custom pattern". In the "Event pattern" field, enter the following code: { "source": ["aws.securityhub"], "detail-type": ["Access Analyzer Finding"], "detail": { "findings": [ { "isPublic": [ true ] } ] } } This code will match all Access Analyzer Finding events where the "isPublic" field is set to "true".

    4. C

       c73bf38

       2023-08-20

       Selected B7 upvotes

       B is the correct solution because it uses AWS Identity and Access Management Access Analyzer to continuously monitor access control configurations and detect whether any S3 buckets have been configured to be publicly accessible. When a publicly accessible bucket is detected, an Amazon EventBridge rule is triggered, and the SNS topic is notified with the finding.

13. Question 13 of 25

    A solutions architect is designing a solution to process events. The solution must have the ability to scale in and out based on the number of events that the solution receives. If a processing error occurs, the event must move into a separate queue for review. Which solution will meet these requirements?

    • ASend event details to an Amazon Simple Notification Service (Amazon SNS) topic. Configure an AWS Lambda function as a subscriber to the SNS topic to process the events. Add an on-failure destination to the function. Set an Amazon Simple Queue Service (Amazon SQS) queue as the target.
    • BPublish events to an Amazon Simple Queue Service (Amazon SQS) queue. Create an Amazon EC2 Auto Scaling group. Configure the Auto Scaling group to scale in and out based on the ApproximateAgeOfOldestMessage metric of the queue. Configure the application to write failed messages to a dead-letter queue.
    • CWrite events to an Amazon DynamoDB table. Configure a DynamoDB stream for the table. Configure the stream to invoke an AWS Lambda function. Configure the Lambda function to process the events.
    • DPublish events to an Amazon EventBndge event bus. Create and run an application on an Amazon EC2 instance with an Auto Scaling group that is behind an Application Load Balancer (ALB). Set the ALB as the event bus target. Configure the event bus to retry events. Write messages to a dead-letter queue if the application cannot process the messages.

    Show answer

    Correct answer: A

    How others answered

    • A52%
    • B48%

    Only 52% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Configuring scaling based on the age of the oldest message is nowhere near as good as scaling based on size of the Queue for this use case. age of the oldest message will grow linearly based on time. If there is a dramatic spike in the Queue size due to increased traffic, like 100X increase in size. Then the queue will have grown a lot but the oldest message will only increase in age linearly, so the scaling will not be able to realize how much the workload has increased.

    Adapted from community discussion by SuperDuperPooperScooper · 2023-11-17 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • repost.aws documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. S

       SuperDuperPooperScooper

       2023-11-17

       Selected A11 upvotes

       Configuring scaling based on the age of the oldest message is nowhere near as good as scaling based on size of the Queue for this use case. age of the oldest message will grow linearly based on time. If there is a dramatic spike in the Queue size due to increased traffic, like 100X increase in size. Then the queue will have grown a lot but the oldest message will only increase in age linearly, so the scaling will not be able to realize how much the workload has increased.

    2. O

       OCHT

       2023-04-24

       Selected A5 upvotes

       The solution that will meet the requirements is Option A. Send event details to an Amazon Simple Notification Service (Amazon SNS) topic. Configure an AWS Lambda function as a subscriber to the SNS topic to process the events. Add an on-failure destination to the function. Set an Amazon Simple Queue Service (Amazon SQS) queue as the target. This solution allows for automatic scaling of the AWS Lambda function based on the number of events received. If a processing error occurs, the event will be moved to the specified SQS queue for review.

    3. D

       dkx

       2023-07-03

       4 upvotes

       A. Yes, because this uses the concept of Lambda Destinations. Destinations gives you the ability to handle the Failure of function invocations along with their Success. When a function invocation fails, such as when retries are exhausted or the event age has been exceeded (hitting its TTL), Destinations routes the record to the destination resource for every failed invocation for further investigation or processing. https://aws.amazon.com/blogs/compute/introducing-aws-lambda-destinations/ B. No, because the Amazon SQS metric 'ApproximateAgeOfOldestMessage' is the approximate age of the oldest non-deleted message in the queue. Our requirement is to scale on the 'number of events' and not the 'age' of a message. C. No, because this option fails to clearly mention how to process errors D. No, because an ALB is not currently available as an EventBridge target. See: https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-targets.html

    4. D

       Dgix

       2024-03-07

       Selected A6 upvotes

       A fulfils all objectives. In B, ApproximateAgeOfOldestMessage doesn't translate to a reliable scaling pattern, and EC2s are implied. C does not implement a dead-letter queue D is overengineered.

14. Question 14 of 25

    A company has a web application that allows users to upload short videos. The videos are stored on Amazon EBS volumes and analyzed by custom recognition software for categorization. The website contains static content that has variable traffic with peaks in certain months. The architecture consists of Amazon EC2 instances running in an Auto Scaling group for the web application and EC2 instances running in an Auto Scaling group to process an Amazon SQS queue. The company wants to re-architect the application to reduce operational overhead using AWS managed services where possible and remove dependencies on third-party software. Which solution meets these requirements?

    • AUse Amazon ECS containers for the web application and Spot instances for the Auto Scaling group that processes the SQS queue. Replace the custom software with Amazon Rekognition to categorize the videos.
    • BStore the uploaded videos in Amazon EFS and mount the file system to the EC2 instances for the web application. Process the SQS queue with an AWS Lambda function that calls the Amazon Rekognition API to categorize the videos.
    • CHost the web application in Amazon S3. Store the uploaded videos in Amazon S3. Use S3 event notification to publish events to the SQS queue. Process the SQS queue with an AWS Lambda function that calls the Amazon Rekognition API to categorize the videos.
    • DUse AWS Elastic Beanstalk to launch EC2 instances in an Auto Scaling group for the web application and launch a worker environment to process the SQS queue. Replace the custom software with Amazon Rekognition to categorize the videos.

    Show answer

    Correct answer: C

    How others answered

    • C85%
    • D15%

    Explanation

    This solution meets the requirements by using multiple managed services offered by AWS which can reduce the operational overhead. Hosting the web application in Amazon S3 would make it highly available, scalable and can handle variable traffic. The uploaded videos can be stored in S3 and processed using S3 event notifications that trigger a Lambda function, which calls the Amazon Rekognition API to categorize the videos. SQS can be used to process the event notifications and also it is a managed service. This solution eliminates the need to manage EC2 instances, EBS volumes and the custom software. Additionally, using Lambda function in this case, eliminates the need for managing additional servers to process the SQS queue which will reduce operational overhead. By using this solution, the company can benefit from the scalability, reliability, and cost-effectiveness that these services offer, which can help to reduce operational overhead and improve the overall performance and security of the application.

    Adapted from community discussion by masetromain · 2024-09-23 · 32 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. M

       masetromain

       2024-09-23

       Selected C32 upvotes

       This solution meets the requirements by using multiple managed services offered by AWS which can reduce the operational overhead. Hosting the web application in Amazon S3 would make it highly available, scalable and can handle variable traffic. The uploaded videos can be stored in S3 and processed using S3 event notifications that trigger a Lambda function, which calls the Amazon Rekognition API to categorize the videos. SQS can be used to process the event notifications and also it is a managed service. This solution eliminates the need to manage EC2 instances, EBS volumes and the custom software. Additionally, using Lambda function in this case, eliminates the need for managing additional servers to process the SQS queue which will reduce operational overhead. By using this solution, the company can benefit from the scalability, reliability, and cost-effectiveness that these services offer, which can help to reduce operational overhead and improve the overall performance and security of the application.

    2. R

       RaghavendraPrakash

       2023-04-06

       12 upvotes

       D. Because, you cannot host web application in S3, only static web assets. ElasticBeanStalk provides an easy way to onboard autoscaling web apps with minimal operational overheads.

    3. S

       Six_Fingered_Jose

       2023-09-09

       10 upvotes

       They also do not mention the website has any dynamic content so there's that

    4. N

       nexus2020

       2023-04-08

       Selected C7 upvotes

       This solution eliminates the need for managing and scaling EC2 instances for the web application and the worker environment for processing the SQS queue.

15. Question 15 of 25

    A company runs a processing engine in the AWS Cloud. The engine processes environmental data from logistics centers to calculate a sustainability index. The company has millions of devices in logistics centers that are spread across Europe. The devices send information to the processing engine through a RESTful API. The API experiences unpredictable bursts of traffic. The company must implement a solution to process all data that the devices send to the processing engine. Data loss is unacceptable. Which solution will meet these requirements?

    • ACreate an Application Load Balancer (ALB) for the RESTful API. Create an Amazon Simple Queue Service (Amazon SQS) queue. Create a listener and a target group for the ALB Add the SQS queue as the target. Use a container that runs in Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type to process messages in the queue.
    • BCreate an Amazon API Gateway HTTP API that implements the RESTful API. Create an Amazon Simple Queue Service (Amazon SQS) queue. Create an API Gateway service integration with the SQS queue. Create an AWS Lambda function to process messages in the SQS queue.
    • CCreate an Amazon API Gateway REST API that implements the RESTful API. Create a fleet of Amazon EC2 instances in an Auto Scaling group. Create an API Gateway Auto Scaling group proxy integration. Use the EC2 instances to process incoming data.
    • DCreate an Amazon CloudFront distribution for the RESTful API. Create a data stream in Amazon Kinesis Data Streams. Set the data stream as the origin for the distribution. Create an AWS Lambda function to consume and process data in the data stream.

    Show answer

    Correct answer: B

    How others answered

    • B88%

    Explanation

    Option A is incorrect because Application Load Balancer (ALB) can't directly target an Amazon SQS queue. Option C is incorrect because while Amazon API Gateway and EC2 Auto Scaling can handle high loads, they don't provide a built-in mechanism to ensure that all messages are processed without loss. Option D is incorrect because Amazon CloudFront is a content delivery network (CDN), and it is not typically used to handle incoming API requests. It is primarily used to cache and deliver content to users.

    Adapted from community discussion by momo3321 · 2023-05-13 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • repost.aws documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. M

       momo3321

       2023-05-13

       Selected B20 upvotes

       Option A is incorrect because Application Load Balancer (ALB) can't directly target an Amazon SQS queue. Option C is incorrect because while Amazon API Gateway and EC2 Auto Scaling can handle high loads, they don't provide a built-in mechanism to ensure that all messages are processed without loss. Option D is incorrect because Amazon CloudFront is a content delivery network (CDN), and it is not typically used to handle incoming API requests. It is primarily used to cache and deliver content to users.

    2. B

       bjexamprep

       2023-12-14

       Selected B6 upvotes

       In real life, I wouldn't trust SQS to handle such large amount of data.

    3. L

       Littleboy95

       2023-04-24

       Selected B3 upvotes

       B is correct, you can integrate SQS with API Gateway HTTP. I have checked it in AWS API Gateway Console https://repost.aws/knowledge-center/api-gateway-rest-api-sqs-errors A is incorrect because you can not set SQS queue as the target of ALB C is incorrect because a fleet of EC2 instances and ASG can lead instances to terminated unexpectedly → data loss D is incorrect because Kinesis Data Streams is a provisioned service, It can not handle unpredictable bursts

    4. [

       [Removed]

       2023-04-23

       Selected B4 upvotes

       You can integrate API Gateway with an SQS queue using the AWS SDK, you can write code within your API Gateway implementation to send messages directly to an SQS queue.

16. Question 16 of 25

    A company is designing its network configuration in the AWS Cloud. The company uses AWS Organizations to manage a multi-account setup. The company has three OUs. Each OU contains more than 100 AWS accounts. Each account has a single VPC, and all the VPCs in each OU are in the same AWS Region. The CIDR ranges for all the AWS accounts do not overlap. The company needs to implement a solution in which VPCs in the same OU can communicate with each other but cannot communicate with VPCs in other OUs. Which solution will meet these requirements with the LEAST operational overhead?

    • ACreate an AWS CloudFormation stack set that establishes VPC peering between accounts in each OU. Provision the stack set in each OU.
    • BIn each OU, create a dedicated networking account that has a single VPC. Share this VPC with all the other accounts in the OU by using AWS Resource Access Manager (AWS RAM). Create a VPC peering connection between the networking account and each account in the OU.
    • CProvision a transit gateway in an account in each OU. Share the transit gateway across the organization by using AWS Resource Access Manager (AWS RAM). Create transit gateway VPC attachments for each VPC.
    • DIn each OU, create a dedicated networking account that has a single VPC. Establish a VPN connection between the networking account and the other accounts in the OU. Use third-party routing software to route transitive traffic between the VPCs.

    Show answer

    Correct answer: C

    How others answered

    • C78%

    Explanation

    C. Transit gateway and RAM is a regional service. AWS RAM is a Regional service, and a resource share is Regional. Therefore, a resource share can contain resources from the same AWS Region as the resource share, and any supported global resources. https://docs.aws.amazon.com/ram/latest/userguide/working-with-regional-vs-global.html https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs

    Adapted from community discussion by rlf · 2023-10-14 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. B

       bjexamprep

       2024-03-16

       Selected C5 upvotes

       The question is asking “a solution in which VPCs in the same OU can communicate with each other but cannot communicate with VPCs in other OUs”. A: it works. But it may create 2500+ VPC peering in each OU B: It works. But it may create 2500+ VPC peering in each OU C: This is wrong, cause it is sharing the transit gateway to all the account in the organization instead of sharing to all the account in that OU. D: That means 2500+ VPN connections in each OU and cost a lot of internet bandwidth. I guess the C was worded with mistake. It should be sharing the transit gateway to the accounts in each OU and create VPC attachment for each VPC in that OU.

    2. D

       dkx

       2023-07-02

       5 upvotes

       C. Yes, because, Transit Gateway is a managed service from AWS that acts as a hub interconnecting VPCs and VPN connections within a single region. It allows you to build more complex networks without the need for VPC peering. Similar to: https://aws.amazon.com/blogs/networking-and-content-delivery/automating-aws-transit-gateway-attachments-to-a-transit-gateway-in-a-central-account/ A,B. No, because a VPC peering connection has a limit of 125 Active VPC peering connections per VPC. In this case, each OU contains MORE THAN 100 AWS accounts -- this could mean 101 accounts or 10001 accounts. D. No, because this is not the answer choice with the LEAST operational overhead. Third-party routing software is not required to route transitive traffic between the VPCs.

    3. R

       rlf

       2023-10-14

       6 upvotes

       C. Transit gateway and RAM is a regional service. AWS RAM is a Regional service, and a resource share is Regional. Therefore, a resource share can contain resources from the same AWS Region as the resource share, and any supported global resources. https://docs.aws.amazon.com/ram/latest/userguide/working-with-regional-vs-global.html https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs

    4. O

       OCHT

       2023-04-24

       Selected C4 upvotes

       The solution that will meet the requirements with the least operational overhead is Option C. Provision a transit gateway in an account in each OU. Share the transit gateway across the organization by using AWS Resource Access Manager (AWS RAM). Create transit gateway VPC attachments for each VPC. This solution allows VPCs in the same OU to communicate with each other through the transit gateway while preventing communication with VPCs in other OUs. It also minimizes operational overhead by leveraging the transit gateway’s ability to route traffic between multiple VPCs and AWS RAM’s ability to share resources across accounts.

17. Question 17 of 25

    A large education company recently introduced Amazon Workspaces to provide access to internal applications across multiple universities. The company is storing user profiles on an Amazon FSx for Windows File Server file system. The file system is configured with a DNS alias and is connected to a self-managed Active Directory. As more users begin to use the Workspaces, login time increases to unacceptable levels. An investigation reveals a degradation in performance of the file system. The company created the file system on HDD storage with a throughput of 16 MBps. A solutions architect must improve the performance of the file system during a defined maintenance window. What should the solutions architect do to meet these requirements with the LEAST administrative effort?

    • AUse AWS Backup to create a point-in-time backup of the file system. Restore the backup to a new FSx for Windows File Server file system. Select SSD as the storage type. Select 32 MBps as the throughput capacity. When the backup and restore process is completed, adjust the DNS alias accordingly. Delete the original file system.
    • BDisconnect users from the file system. In the Amazon FSx console, update the throughput capacity to 32 MBps. Update the storage type to SSD. Reconnect users to the file system.
    • CDeploy an AWS DataSync agent onto a new Amazon EC2 instance. Create a task. Configure the existing file system as the source location. Configure a new FSx for Windows File Server file system with SSD storage and 32 MBps of throughput as the target location. Schedule the task. When the task is completed, adjust the DNS alias accordingly. Delete the original file system.
    • DEnable shadow copies on the existing file system by using a Windows PowerShell command. Schedule the shadow copy job to create a point-in-time backup of the file system. Choose to restore previous versions. Create a new FSx for Windows File Server file system with SSD storage and 32 MBps of throughput. When the copy job is completed, adjust the DNS alias. Delete the original file system.

    Show answer

    Correct answer: B

    How others answered

    • B56%
    • A44%

    Only 56% agreed on this answer — treat it as contested rather than settled.

    Explanation

    https://docs.aws.amazon.com/fsx/latest/WindowsGuide/managing-storage-type.html You can change your file system storage type from HDD to SSD at any time in the Amazon FSx console or Amazon FSx API. You can't change your file system storage type from SSD to HDD. Keep in mind that you can't make further changes to your file system configuration until 6 hours after the last update was requested, or until the storage optimization process has completed, whichever time is longer. Storage optimization can take from a few hours up to a few days to complete. To minimize the time it takes for storage optimization to complete, we recommend updating your storage type when there is minimal traffic on your file system.

    Adapted from community discussion by task_7 · 2023-09-28 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. A

       Andres123456

       2023-11-08

       Selected B9 upvotes

       Storage type can be modified https://docs.aws.amazon.com/fsx/latest/WindowsGuide/managing-storage-type.html

    2. T

       task_7

       2023-09-28

       Selected B4 upvotes

       https://docs.aws.amazon.com/fsx/latest/WindowsGuide/managing-storage-type.html You can change your file system storage type from HDD to SSD at any time in the Amazon FSx console or Amazon FSx API. You can't change your file system storage type from SSD to HDD. Keep in mind that you can't make further changes to your file system configuration until 6 hours after the last update was requested, or until the storage optimization process has completed, whichever time is longer. Storage optimization can take from a few hours up to a few days to complete. To minimize the time it takes for storage optimization to complete, we recommend updating your storage type when there is minimal traffic on your file system.

    3. M

       marszalekm

       2024-02-22

       4 upvotes

       I am confused: https://aws.amazon.com/fsx/windows/faqs/#:~:text=Q%3A%20Can%20I%20change%20the%20storage%20type%20(SSD/HDD)%20of%20my%20file%20system%3F "While you cannot change the storage type on your existing file system, you can take a backup and restore that backup to a new file system with a different storage type." but https://docs.aws.amazon.com/fsx/latest/WindowsGuide/managing-storage-type.html You can change your file system storage type from HDD to SSD using the Amazon FSx console or Amazon FSx API.

    4. T

       TonytheTiger

       2024-03-14

       Selected B3 upvotes

       Option B. Two important points. 1. Changing the storage type. 2. Must improve the performance of the file system during a defined maintenance window. Solution: 1. You can change your file system storage type from HDD to SSD using the Amazon FSx console or Amazon FSx API. You can't change your file system storage type from SSD to HDD. 2. AWS recommend updating your storage type when there is minimal traffic on your file system. https://docs.aws.amazon.com/fsx/latest/WindowsGuide/managing-storage-type.html

18. Question 18 of 25

    Select 3

    A company is storing sensitive data in an Amazon S3 bucket. The company must log all activities for objects in the S3 bucket and must keep the logs for 5 years. The company's security team also must receive an email notification every time there is an attempt to delete data in the S3 bucket. Which combination of steps will meet these requirements MOST cost-effectively? (Choose three.)

    • AConfigure AWS CloudTrail to log S3 data events.
    • BConfigure S3 server access logging for the S3 bucket.
    • CConfigure Amazon S3 to send object deletion events to Amazon Simple Email Service (Amazon SES).
    • DConfigure Amazon S3 to send object deletion events to an Amazon EventBridge event bus that publishes to an Amazon Simple Notification Service (Amazon SNS) topic.
    • EConfigure Amazon S3 to send the logs to Amazon Timestream with data storage tiering.
    • FConfigure a new S3 bucket to store the logs with an S3 Lifecycle policy.

    Show answer

    Correct answer: A, D, F

    How others answered

    • ADF60%
    • BDF38%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    B : Wrong. Server logging has limited features compared to cloudtrail https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html CloudTrail data events can be set for all the S3 buckets for the AWS account or just for some folder in S3 bucket. Whereas, S3 server access logs would be set at individual bucket level C: Wrong. You need Lambda to connect events to SES . SNS and eventbridge https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-event-types-and-destinations.html#supported-notification-event-types https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html https://medium.com/@anirsom2012/send-email-notification-on-aws-s3-events-186acd25a401 E: Wrong, Timestreams is an overkill.

    Adapted from community discussion by F_Eldin · 2023-05-30 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • repost.aws documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. C

       cmoreira

       2023-09-03

       Selected A, D, F12 upvotes

       ADF A or B work, but docs recomment cloud trail: https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html

    2. F

       F_Eldin

       2023-05-30

       Selected A, D, F4 upvotes

       B : Wrong. Server logging has limited features compared to cloudtrail https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html CloudTrail data events can be set for all the S3 buckets for the AWS account or just for some folder in S3 bucket. Whereas, S3 server access logs would be set at individual bucket level C: Wrong. You need Lambda to connect events to SES . SNS and eventbridge https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-event-types-and-destinations.html#supported-notification-event-types https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventBridge.html https://medium.com/@anirsom2012/send-email-notification-on-aws-s3-events-186acd25a401 E: Wrong, Timestreams is an overkill.

    3. S

       Soweetadad

       2023-08-30

       Selected A, D, F6 upvotes

       ADF. Please read this "We recommend that you use CloudTrail for logging bucket-level and object-level actions for your Amazon S3 resources." https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-S3.html

    4. L

       liquen14

       2024-03-07

       Selected A, D, F5 upvotes

       Probably B is cheaper but A is safer and more accurate and remember the "The company must log ALL activities for objects" According to this https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html#LogDeliveryBestEffort "The log record for a particular request might be delivered long after the request was actually processed, or it might not be delivered at all. " so for me is A not B

19. Question 19 of 25

    A company is planning to store a large number of archived documents and make the documents available to employees through the corporate intranet. Employees will access the system by connecting through a client VPN service that is attached to a VPC. The data must not be accessible to the public. The documents that the company is storing are copies of data that is held on physical media elsewhere. The number of requests will be low. Availability and speed of retrieval are not concerns of the company. Which solution will meet these requirements at the LOWEST cost?

    • ACreate an Amazon S3 bucket. Configure the S3 bucket to use the S3 One Zone-Infrequent Access (S3 One Zone-IA) storage class as default. Configure the S3 bucket for website hosting. Create an S3 interface endpoint. Configure the S3 bucket to allow access only through that endpoint.
    • BLaunch an Amazon EC2 instance that runs a web server. Attach an Amazon Elastic File System (Amazon EFS) file system to store the archived data in the EFS One Zone-Infrequent Access (EFS One Zone-IA) storage class Configure the instance security groups to allow access only from private networks.
    • CLaunch an Amazon EC2 instance that runs a web server Attach an Amazon Elastic Block Store (Amazon EBS) volume to store the archived data. Use the Cold HDD (sc1) volume type. Configure the instance security groups to allow access only from private networks.
    • DCreate an Amazon S3 bucket. Configure the S3 bucket to use the S3 Glacier Deep Archive storage class as default. Configure the S3 bucket for website hosting. Create an S3 interface endpoint. Configure the S3 bucket to allow access only through that endpoint.

    Show answer

    Correct answer: A

    How others answered

    • A64%
    • D34%

    Only 64% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A is correct. HA is not required here. D use Glacier deep archive that need hours to access that will cause time out for web

    Adapted from community discussion by zhangyu20000 · 2022-12-12 · 22 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • repost.aws documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. T

       tman22

       2022-12-20

       39 upvotes

       A - Glacier Deep Archive can't be used for web hosting, regardless if the company says retrieval time is no concern.

    2. Z

       zhangyu20000

       2022-12-12

       22 upvotes

       A is correct. HA is not required here. D use Glacier deep archive that need hours to access that will cause time out for web

    3. T

       tman22

       2022-12-20

       18 upvotes

       Nevermind, I go for D. It should be technically possible - and mostly dependent on the intranet web application logic - It could present users with the ability to start file retrieval, for then to later access the data.

    4. A

       a54b16f

       2024-09-23

       Selected A8 upvotes

       pay attention to "copies of data that is held on physical media elsewhere", this is hint for one zone. Using Glacier is possible in theory, but won't work out of box. Need to develop a whole new application to submit unarchive request when user request a file, wait for up to 48 hour, create the s3 link, notify the user and ask user to come back to view the file. This is ANOTHER application

20. Question 20 of 25

    A company has an application in the AWS Cloud. The application runs on a fleet of 20 Amazon EC2 instances. The EC2 instances are persistent and store data on multiple attached Amazon Elastic Block Store (Amazon EBS) volumes. The company must maintain backups in a separate AWS Region. The company must be able to recover the EC2 instances and their configuration within 1 business day, with loss of no more than 1 day's worth of data. The company has limited staff and needs a backup solution that optimizes operational efficiency and cost. The company already has created an AWS CloudFormation template that can deploy the required network configuration in a secondary Region. Which solution will meet these requirements?

    • ACreate a second CloudFormation template that can recreate the EC2 instances in the secondary Region. Run daily multivolume snapshots by using AWS Systems Manager Automation runbooks. Copy the snapshots to the secondary Region. In the event of a failure launch the CloudFormation templates, restore the EBS volumes from snapshots, and transfer usage to the secondary Region.
    • BUse Amazon Data Lifecycle Manager (Amazon DLM) to create daily multivolume snapshots of the EBS volumes. In the event of a failure, launch the CloudFormation template and use Amazon DLM to restore the EBS volumes and transfer usage to the secondary Region.
    • CUse AWS Backup to create a scheduled daily backup plan for the EC2 instances. Configure the backup task to copy the backups to a vault in the secondary Region. In the event of a failure, launch the CloudFormation template, restore the instance volumes and configurations from the backup vault, and transfer usage to the secondary Region.
    • DDeploy EC2 instances of the same size and configuration to the secondary Region. Configure AWS DataSync daily to copy data from the primary Region to the secondary Region. In the event of a failure, launch the CloudFormation template and transfer usage to the secondary Region.

    Show answer

    Correct answer: C

    How others answered

    • C84%

    Explanation

    Correct is C. For those voting with B, you missed the Instance configuration part. DLM will only backup the EBS volume not the instance settings also. AWS backup will backup ebs & instance settings. Option C, using AWS Backup, provides a centralized and cost-effective solution for managing backups across multiple services, including EC2 instances. By creating a scheduled daily backup plan for the EC2 instances, AWS Backup ensures regular backups are taken. The backups can be configured to be stored in a vault in the secondary Region, fulfilling the requirement of maintaining backups in a separate Region. The EC2 instance volumes and configurations can then be restored from the backup vault using AWS Backup's restore capabilities. This allows for the recovery of EC2 instances and their configurations within the required timeframe of 1 business day, with a maximum data loss of 1 day's worth.

    Adapted from community discussion by andreitugui · 2023-05-30 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. A

       andreitugui

       2023-05-30

       Selected C20 upvotes

       Correct is C. For those voting with B, you missed the Instance configuration part. DLM will only backup the EBS volume not the instance settings also. AWS backup will backup ebs & instance settings. Option C, using AWS Backup, provides a centralized and cost-effective solution for managing backups across multiple services, including EC2 instances. By creating a scheduled daily backup plan for the EC2 instances, AWS Backup ensures regular backups are taken. The backups can be configured to be stored in a vault in the secondary Region, fulfilling the requirement of maintaining backups in a separate Region. The EC2 instance volumes and configurations can then be restored from the backup vault using AWS Backup's restore capabilities. This allows for the recovery of EC2 instances and their configurations within the required timeframe of 1 business day, with a maximum data loss of 1 day's worth.

    2. R

       Roontha

       2023-05-28

       1 upvote

       @deegadaze1: Agreed with answer B https://aws.amazon.com/blogs/storage/automating-amazon-ebs-snapshot-and-ami-management-using-amazon-dlm/ In this blog post, we examine how you can use Amazon Data Lifecycle Manager (Amazon DLM) lifecycle policies to automate the creation, retention, and deletion of Amazon EBS snapshots. With Amazon DLM, the need for complicated and custom scripts to manage EBS snapshots is eliminated. Amazon DLM enables you to create, manage, and delete EBS snapshots in a simple, automated way based on resource tags for EBS volumes or Amazon EC2 instances. This reduces the operational complexity of managing EBS snapshots, thereby saving time and money. Also, let’s not forget the best part: Amazon DLM is free to use and is available in all AWS Regions.

    3. R

       Roontha

       2023-05-26

       3 upvotes

       Answer : C https://aws.amazon.com/getting-started/hands-on/amazon-ec2-backup-and-restore-using-aws-backup/ https://docs.aws.amazon.com/aws-backup/latest/devguide/integrate-cloudformation-with-aws-backup.html

    4. M

       Maria2023

       2023-06-24

       Selected C2 upvotes

       B says "Use Amazon DLM to restore the EBS volumes and transfer usage to the secondary Region" - just tested it and could not find any option for DLM to restore volumes, think the snapshots are managed the usual way.

21. Question 21 of 25

    A software-as-a-service (SaaS) provider exposes APIs through an Application Load Balancer (ALB). The ALB connects to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that is deployed in the us-east-1 Region. The exposed APIs contain usage of a few non-standard REST methods: LINK, UNLINK, LOCK, and UNLOCK. Users outside the United States are reporting long and inconsistent response times for these APIs. A solutions architect needs to resolve this problem with a solution that minimizes operational overhead. Which solution meets these requirements?

    • AAdd an Amazon CloudFront distribution. Configure the ALB as the origin.
    • BAdd an Amazon API Gateway edge-optimized API endpoint to expose the APIs. Configure the ALB as the target.
    • CAdd an accelerator in AWS Global Accelerator. Configure the ALB as the origin.
    • DDeploy the APIs to two additional AWS Regions: eu-west-1 and ap-southeast-2. Add latency-based routing records in Amazon Route 53.

    Show answer

    Correct answer: C

    How others answered

    • C72%
    • B23%

    Only 72% agreed on this answer — treat it as contested rather than settled.

    Explanation

    AWS Global Accelerator is a service that improves the availability and performance of applications for global users. By adding an accelerator in AWS Global Accelerator and configuring the ALB as the origin, the traffic from users outside the United States will be routed through the Global Accelerator network, which uses the AWS global network infrastructure to optimize the delivery of the application traffic.

    Adapted from community discussion by andreitugui · 2023-05-30 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. A

       andreitugui

       2023-05-30

       Selected C10 upvotes

       AWS Global Accelerator is a service that improves the availability and performance of applications for global users. By adding an accelerator in AWS Global Accelerator and configuring the ALB as the origin, the traffic from users outside the United States will be routed through the Global Accelerator network, which uses the AWS global network infrastructure to optimize the delivery of the application traffic.

    2. A

       ayadmawla

       2023-12-14

       Selected C5 upvotes

       imho answer is C. Here is my thinking: There are two issues that we need to consider: 1- Non US Users are reporting long and inconsistent response times for these APIs 2- The APIs are running in EKS and are exposed by the ALB (i.e., not the other way round) So the issue is about latency not API design.

    3. G

       gd1

       2023-06-16

       2 upvotes

       The solution that meets these requirements most effectively would be: A. Add an Amazon CloudFront distribution. Configure the ALB as the origin. CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds. By configuring CloudFront with your Application Load Balancer (ALB) as the origin, users can access your API through the CloudFront edge location that's closest to them, reducing latency. Option B, Amazon API Gateway, does not support non-standard REST methods. Option C, AWS Global Accelerator, is a networking service that improves your applications' availability and performance, but its benefits are more noticeable for TCP/UDP-based workloads rather than HTTP(S)-based APIs. Option D, deploying the APIs in multiple regions and using Amazon Route 53 latency-based routing, would require much more operational overhead compared to the recommended solution.

    4. M

       Maria2023

       2023-06-24

       Selected C4 upvotes

       I was also supporting answer B, however just tested API Gateway and it seems that it only supports GET, POST, PUT, PATCH, DELETE, HEAD, and OPTIONS methods. I personally couldn't find a way to create a custom method which is part of the requirement. Please share if you find a way

22. Question 22 of 25

    A company is using an on-premises Active Directory service for user authentication. The company wants to use the same authentication service to sign in to the company’s AWS accounts, which are using AWS Organizations. AWS Site-to-Site VPN connectivity already exists between the on-premises environment and all the company’s AWS accounts. The company’s security policy requires conditional access to the accounts based on user groups and roles. User identities must be managed in a single location. Which solution will meet these requirements?

    • AConfigure AWS IAM Identity Center (AWS Single Sign-On) to connect to Active Directory by using SAML 2.0. Enable automatic provisioning by using the System for Cross-domain Identity Management (SCIM) v2.0 protocol. Grant access to the AWS accounts by using attribute-based access controls (ABACs).
    • BConfigure AWS IAM Identity Center (AWS Single Sign-On) by using IAM Identity Center as an identity source. Enable automatic provisioning by using the System for Cross-domain Identity Management (SCIM) v2.0 protocol. Grant access to the AWS accounts by using IAM Identity Center permission sets.
    • CIn one of the company’s AWS accounts, configure AWS Identity and Access Management (IAM) to use a SAML 2.0 identity provider. Provision IAM users that are mapped to the federated users. Grant access that corresponds to appropriate groups in Active Directory. Grant access to the required AWS accounts by using cross-account IAM users.
    • DIn one of the company’s AWS accounts, configure AWS Identity and Access Management (IAM) to use an OpenID Connect (OIDC) identity provider. Provision IAM roles that grant access to the AWS account for the federated users that correspond to appropriate groups in Active Directory. Grant access to the required AWS accounts by using cross-account IAM roles.

    Show answer

    Correct answer: A

    How others answered

    • A80%

    Explanation

    https://www.examtopics.com/discussions/amazon/view/74174-exam-aws-certified-solutions-architect-professional-topic-1/ Both option C and option A are valid solutions that meet the requirements for the scenario. ABAC, or attribute-based access control, is a method of granting access to resources based on the attributes of the user, the resource, and the action. This allows for fine-grained access control, which can be useful for implementing a security policy that requires conditional access to the accounts based on user groups and roles. AWS IAM Identity Center (AWS SSO) allows you to connect to your on-premises Active Directory service using SAML 2.0. With this, you can enable automatic provisioning by using the System for Cross-domain Identity Management (SCIM) v2.0 protocol, which allows for the management of user identities in a single location.

    Adapted from community discussion by masetromain · 2023-01-13 · 30 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. M

       masetromain

       2023-01-13

       Selected A30 upvotes

       https://www.examtopics.com/discussions/amazon/view/74174-exam-aws-certified-solutions-architect-professional-topic-1/ Both option C and option A are valid solutions that meet the requirements for the scenario. ABAC, or attribute-based access control, is a method of granting access to resources based on the attributes of the user, the resource, and the action. This allows for fine-grained access control, which can be useful for implementing a security policy that requires conditional access to the accounts based on user groups and roles. AWS IAM Identity Center (AWS SSO) allows you to connect to your on-premises Active Directory service using SAML 2.0. With this, you can enable automatic provisioning by using the System for Cross-domain Identity Management (SCIM) v2.0 protocol, which allows for the management of user identities in a single location.

    2. B

       bititan

       2023-01-18

       Selected A14 upvotes

       A is has options for SAML and SCIM configuration with AD C is all about users and no roles are mentioned. AD User attributes cannot be mapped to IAM users direct D is openID based, MS AD would not support this so I go with A

    3. I

       imvb88

       2023-09-29

       Selected A3 upvotes

       A: combination SSO + SAML2.0 + AD sounds correct. Automatic provisioning with SCIM means creating users and groups that synced with AD. ABAC seems not too fit for this as the requirements is "requires conditional access to the accounts based on user groups and roles" but that already satisfied with SCIM. B: "use Identity Center as an identity source" -> not using on premise AD -> wrong D: use OIDC -> wrong as on premise AD does not support OIDC. Cannot find an exact source for this but ChatGpt says so.. C: creating users mapped to federated users sounds red flags. Could have been correct if it was "creating roles", the same way with the classic "creating roles for EC2 to access S3 instead of user..." Conclusion: A

    4. M

       masetromain

       2022-12-12

       Selected A5 upvotes

       I prefer to go to answer A for ABAC https://docs.aws.amazon.com/singlesignon/latest/userguide/scim-profile-saml.html https://docs.aws.amazon.com/singlesignon/latest/userguide/abac.html

23. Question 23 of 25

    A company has set up its entire infrastructure on AWS. The company uses Amazon EC2 instances to host its ecommerce website and uses Amazon S3 to store static data. Three engineers at the company handle the cloud administration and development through one AWS account. Occasionally, an engineer alters an EC2 security group configuration of another engineer and causes noncompliance issues in the environment. A solutions architect must set up a system that tracks changes that the engineers make. The system must send alerts when the engineers make noncompliant changes to the security settings for the EC2 instances. What is the FASTEST way for the solutions architect to meet these requirements?

    • ASet up AWS Organizations for the company. Apply SCPs to govern and track noncompliant security group changes that are made to the AWS account.
    • BEnable AWS CloudTrail to capture the changes to EC2 security groups. Enable Amazon CloudWatch rules to provide alerts when noncompliant security settings are detected.
    • CEnable SCPs on the AWS account to provide alerts when noncompliant security group changes are made to the environment.
    • DEnable AWS Config on the EC2 security groups to track any noncompliant changes. Send the changes as alerts through an Amazon Simple Notification Service (Amazon SNS) topic.

    Show answer

    Correct answer: D

    How others answered

    • D83%
    • B17%

    Explanation

    B is ans https://aws.amazon.com/blogs/security/how-to-monitor-aws-account-configuration-changes-and-api-calls-to-amazon-ec2-security-groups/ Speed: Implementing CloudTrail and CloudWatch is faster than setting up AWS Organizations or using SCPs. You can do it in minutes without modifying the entire account structure or deploying additional resources. Granularity: CloudTrail and CloudWatch offer fine-grained control over monitoring and alerting, allowing you to define specific rules for noncompliant security settings. Flexibility: You can easily adapt the CloudWatch rules to different types of noncompliance and adjust the alerts to suit your notification needs. Existing infrastructure: If the company already uses CloudTrail for logging, setting up CloudWatch rules is a natural extension without requiring significant changes.

    Adapted from community discussion by duriselvan · 2023-12-16 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. S

       Soweetadad

       2023-08-31

       Selected D10 upvotes

       Both B and D work, except B has no notification set. https://aws.amazon.com/blogs/security/how-to-monitor-aws-account-configuration-changes-and-api-calls-to-amazon-ec2-security-groups/

    2. B

       bhanus

       2023-06-21

       Selected D6 upvotes

       I vote D. aws config changes can be sent to SNS topic https://docs.aws.amazon.com/config/latest/developerguide/notifications-for-AWS-Config.html

    3. S

       SkyZeroZx

       2023-06-25

       Selected D5 upvotes

       D reference link https://aws.amazon.com/es/blogs/industries/how-to-monitor-alert-and-remediate-non-compliant-hipaa-findings-on-aws/

    4. S

       SmileyCloud

       2023-06-22

       Selected D4 upvotes

       It's D. Check this link, something similar: https://aws.amazon.com/blogs/industries/how-to-monitor-alert-and-remediate-non-compliant-hipaa-findings-on-aws/

24. Question 24 of 25

    A solutions architect is planning to migrate critical Microsoft SQL Server databases to AWS. Because the databases are legacy systems, the solutions architect will move the databases to a modern data architecture. The solutions architect must migrate the databases with near-zero downtime. Which solution will meet these requirements?

    • AUse AWS Application Migration Service and the AWS Schema Conversion Tool (AWS SCT). Perform an in-place upgrade before the migration. Export the migrated data to Amazon Aurora Serverless after cutover. Repoint the applications to Amazon Aurora.
    • BUse AWS Database Migration Service (AWS DMS) to rehost the database. Set Amazon S3 as a target. Set up change data capture (CDC) replication. When the source and destination are fully synchronized, load the data from Amazon S3 into an Amazon RDS for Microsoft SQL Server DB instance.
    • CUse native database high availability tools. Connect the source system to an Amazon RDS for Microsoft SQL Server DB instance. Configure replication accordingly. When data replication is finished, transition the workload to an Amazon RDS for Microsoft SQL Server DB instance.
    • DUse AWS Application Migration Service. Rehost the database server on Amazon EC2. When data replication is finished, detach the database and move the database to an Amazon RDS for Microsoft SQL Server DB instance. Reattach the database and then cut over all networking.

    Show answer

    Correct answer: C

    How others answered

    • C55%
    • B42%

    Only 55% agreed on this answer — treat it as contested rather than settled.

    Explanation

    By using native database high availability tools and replication methods, you can achieve near-zero downtime during the migration process. The other options may not provide the same level of seamless data replication and minimal downtime as the native SQL Server replication tools. Option B: Use AWS Database Migration Service (AWS DMS) to rehost the database. Set Amazon S3 as a target. Set up change data capture (CDC) replication. When the source and destination are fully synchronized, load the data from Amazon S3 into an Amazon RDS for Microsoft SQL Server DB instance. While AWS DMS can be used for migrations, it introduces additional complexity compared to native SQL Server replication tools. Staging data in Amazon S3 and then loading into the target RDS instance can cause downtime during the final cutover. Native replication tools can directly replicate data to the target RDS instance without an intermediate storage solution.

    Adapted from community discussion by 0b43291 · 2024-11-20 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. S

       SmileyCloud

       2023-06-23

       Selected C17 upvotes

       C. The proper way is to use AWS DMS, but the answer here uses S3 (???) which will take forever. So the answer is C.

    2. G

       Ganshank

       2023-08-27

       12 upvotes

       C https://aws.amazon.com/blogs/database/part-3-migrating-to-amazon-rds-for-sql-server-using-transactional-replication-with-native-backup-and-restore/

    3. 0

       0b43291

       2024-11-20

       Selected C4 upvotes

       By using native database high availability tools and replication methods, you can achieve near-zero downtime during the migration process. The other options may not provide the same level of seamless data replication and minimal downtime as the native SQL Server replication tools. Option B: Use AWS Database Migration Service (AWS DMS) to rehost the database. Set Amazon S3 as a target. Set up change data capture (CDC) replication. When the source and destination are fully synchronized, load the data from Amazon S3 into an Amazon RDS for Microsoft SQL Server DB instance. While AWS DMS can be used for migrations, it introduces additional complexity compared to native SQL Server replication tools. Staging data in Amazon S3 and then loading into the target RDS instance can cause downtime during the final cutover. Native replication tools can directly replicate data to the target RDS instance without an intermediate storage solution.

    4. N

       nexus2020

       2023-06-22

       Selected C5 upvotes

       Native Database High Availability Tools: AWS provides native high availability tools for Microsoft SQL Server, such as database mirroring, Always On Availability Groups, and transactional replication. These tools are designed to minimize downtime during the migration process and ensure data consistency and integrity.

25. Question 25 of 25

    A company is running a data-intensive application on AWS. The application runs on a cluster of hundreds of Amazon EC2 instances. A shared file system also runs on several EC2 instances that store 200 TB of data. The application reads and modifies the data on the shared file system and generates a report. The job runs once monthly, reads a subset of the files from the shared file system, and takes about 72 hours to complete. The compute instances scale in an Auto Scaling group, but the instances that host the shared file system run continuously. The compute and storage instances are all in the same AWS Region. A solutions architect needs to reduce costs by replacing the shared file system instances. The file system must provide high performance access to the needed data for the duration of the 72-hour run. Which solution will provide the LARGEST overall cost reduction while meeting these requirements?

    • AMigrate the data from the existing shared file system to an Amazon S3 bucket that uses the S3 Intelligent-Tiering storage class. Before the job runs each month, use Amazon FSx for Lustre to create a new file system with the data from Amazon S3 by using lazy loading. Use the new file system as the shared storage for the duration of the job. Delete the file system when the job is complete.
    • BMigrate the data from the existing shared file system to a large Amazon Elastic Block Store (Amazon EBS) volume with Multi-Attach enabled. Attach the EBS volume to each of the instances by using a user data script in the Auto Scaling group launch template. Use the EBS volume as the shared storage for the duration of the job. Detach the EBS volume when the job is complete
    • CMigrate the data from the existing shared file system to an Amazon S3 bucket that uses the S3 Standard storage class. Before the job runs each month, use Amazon FSx for Lustre to create a new file system with the data from Amazon S3 by using batch loading. Use the new file system as the shared storage for the duration of the job. Delete the file system when the job is complete.
    • DMigrate the data from the existing shared file system to an Amazon S3 bucket. Before the job runs each month, use AWS Storage Gateway to create a file gateway with the data from Amazon S3. Use the file gateway as the shared storage for the job. Delete the file gateway when the job is complete.

    Show answer

    Correct answer: A

    How others answered

    • A85%
    • D15%

    Explanation

    A: Lazy loading is cost-effective because only a subset of data is used at every job B: There are hundreds of EC2 instances using the volume which is not possible (one EBS volume is limited to 16 nitro instances attached) C: Batching would load too much data D: storage gateway is used for on premises data access, I don't know is you can install a gateway in AWS, but Amazon would never advise this

    Adapted from community discussion by sambb · 2023-02-27 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SAP-C02 or CertExamHQ.

    1. S

       sambb

       2023-02-27

       Selected A20 upvotes

       A: Lazy loading is cost-effective because only a subset of data is used at every job B: There are hundreds of EC2 instances using the volume which is not possible (one EBS volume is limited to 16 nitro instances attached) C: Batching would load too much data D: storage gateway is used for on premises data access, I don't know is you can install a gateway in AWS, but Amazon would never advise this

    2. C

       chico2023

       2023-08-04

       15 upvotes

       Answer: D I think the main point here is to understand what they mean by "The file system must provide high performance access to the needed data" while "provide the LARGEST overall cost reduction"? For answer A, we have to remember that lazy load is SLOW for the first time you try to access the file (as it is being fetched from S3), BUT, as we are talking about hundreds of instances, then it might be OK. S3 Intelligent-Tiering, although doesn't seem to fit much, the part that says "The job runs once monthly, reads a subset of the files from the shared file system", indicates that at least part of the 200TB of data won't be accessed, which helps not going for answer C, for example. My only issue with answer D is that Storage Gateway can be slower than FSx for Lustre, HOWEVER, what is the cost X performance ratio they are seeking here? We can guess that costs trumps maximum performance here: "Which solution will provide the LARGEST overall cost reduction" and, as Storage Gateway is way cheaper than FSx for Lustre per TB, it's safe to say that D is the most correct answer.

    3. H

       hitesh24

       2023-06-01

       5 upvotes

       By migrating the data to an S3 bucket with the S3 Intelligent-Tiering storage class, you can take advantage of cost optimization. S3 Intelligent-Tiering automatically moves data between two access tiers: frequent access and infrequent access, based on usage patterns. This ensures that data is stored cost-effectively while providing high performance when needed. Using Amazon FSx for Lustre to create a new file system with the data from Amazon S3 using lazy loading allows for efficient access to the required subset of files during the monthly job. The file system is created on-demand and the data is loaded only when accessed, which helps reduce costs as you only pay for the storage and compute resources used during the job. Deleting the file system when the job is complete ensures that you are not incurring any additional costs for the shared storage when it is not needed. Therefore, option A provides the largest overall cost reduction while still meeting the performance requirements for the monthly job.

    4. M

       masetromain

       2023-01-13

       Selected A3 upvotes

       This solution would provide the largest overall cost reduction while meeting the requirements. By migrating the data to an S3 bucket using the S3 Intelligent-Tiering storage class, the company can take advantage of the automatic cost optimization provided by the storage class, which can result in significant cost savings. Additionally, by using Amazon FSx for Lustre to create a new file system with the data from Amazon S3, the company can take advantage of the high-performance access to the needed data for the duration of the 72-hour run. When the job is complete, the company can delete the file system, further reducing costs. Option B, C and D may provide some cost savings over the current solution, but the savings would be less significant than the option A, because of the cost of the storage, the cost of the data transfer, and the cost of the storage gateway, the solution using the S3 and FSx for Lustre is the most cost-effective while meeting the requirements.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 1 of 25