SAP-C02 practice questions 321–330

1. Question 321 · 527 in bank

   A company is developing a web application that runs on Amazon EC2 instances in an Auto Scaling group behind a public-facing Application Load Balancer (ALB). Only users from a specific country are allowed to access the application. The company needs the ability to log the access requests that have been blocked. The solution should require the least possible maintenance. Which solution meets these requirements?

   • ACreate an IPSet containing a list of IP ranges that belong to the specified country. Create an AWS WAF web ACL. Configure a rule to block any requests that do not originate from an IP range in the IPSet. Associate the rule with the web ACL. Associate the web ACL with the ALB.
   • BCreate an AWS WAF web ACL. Configure a rule to block any requests that do not originate from the specified country. Associate the rule with the web ACL. Associate the web ACL with the ALB.
   • CConfigure AWS Shield to block any requests that do not originate from the specified country. Associate AWS Shield with the ALB.
   • DCreate a security group rule that allows ports 80 and 443 from IP ranges that belong to the specified country. Associate the security group with the ALB.

   Show answer

   Answer: B

   Explanation

   Answer: B AWS WAF supports geo-matching rules, allowing you to easily block requests based on country of origin. This eliminates the need to manually manage IP ranges. Option C - Shield primarily defends against DDoS attacks and does not offer granular geo-blocking capabilities.

   Source: Adapted from community discussion — vibzr2023

   References

   • AWS documentation

   Next question

2. Question 322 · 527 in bank

   A company is migrating an application from on-premises infrastructure to the AWS Cloud. During migration design meetings, the company expressed concerns about the availability and recovery options for its legacy Windows file server. The file server contains sensitive business-critical data that cannot be recreated in the event of data corruption or data loss. According to compliance requirements, the data must not travel across the public internet. The company wants to move to AWS managed services where possible. The company decides to store the data in an Amazon FSx for Windows File Server file system. A solutions architect must design a solution that copies the data to another AWS Region for disaster recovery (DR) purposes. Which solution will meet these requirements?

   • ACreate a destination Amazon S3 bucket in the DR Region. Establish connectivity between the FSx for Windows File Server file system in the primary Region and the S3 bucket in the DR Region by using Amazon FSx File Gateway. Configure the S3 bucket as a continuous backup source in FSx File Gateway.
   • BCreate an FSx for Windows File Server file system in the DR Region. Establish connectivity between the VPC the primary Region and the VPC in the DR Region by using AWS Site-to-Site VPN. Configure AWS DataSync to communicate by using VPN endpoints.
   • CCreate an FSx for Windows File Server file system in the DR Region. Establish connectivity between the VPC in the primary Region and the VPC in the DR Region by using VPC peering. Configure AWS DataSync to communicate by using interface VPC endpoints with AWS PrivateLink.
   • DCreate an FSx for Windows File Server file system in the DR Region. Establish connectivity between the VPC in the primary Region and the VPC in the DR Region by using AWS Transit Gateway in each Region. Use AWS Transfer Family to copy files between the FSx for Windows File Server file system in the primary Region and the FSx for Windows File Server file system in the DR Region over the private AWS backbone network.

   Show answer

   Answer: C

   Explanation

   A - for S3, data will traverse via internet B- Site to Site VPN is not required for 2 VPC within AWS C -VPC Peering is the best option for connecting 2 VPCs in different regions D - Transit Gateway not required as the connection is only between 2 VPC, Peering is more cost effective.

   Source: Adapted from community discussion — SeemaDataReader

   References

   • AWS documentation

   Next question

3. Question 323 · 527 in bank

   Select 3

   A company wants to migrate its workloads from on premises to AWS. The workloads run on Linux and Windows. The company has a large on-premises infrastructure that consists of physical machines and VMs that host numerous applications. The company must capture details about the system configuration, system performance, running processes, and network connections of its on-premises workloads. The company also must divide the on-premises applications into groups for AWS migrations. The company needs recommendations for Amazon EC2 instance types so that the company can run its workloads on AWS in the most cost-effective manner. Which combination of steps should a solutions architect take to meet these requirements? (Choose three.)

   • AAssess the existing applications by installing AWS Application Discovery Agent on the physical machines and VMs.
   • BAssess the existing applications by installing AWS Systems Manager Agent on the physical machines and VMs.
   • CGroup servers into applications for migration by using AWS Systems Manager Application Manager.
   • DGroup servers into applications for migration by using AWS Migration Hub.
   • EGenerate recommended instance types and associated costs by using AWS Migration Hub.
   • FImport data about server sizes into AWS Trusted Advisor. Follow the recommendations for cost optimization.

   Show answer

   Answer: ADE

   Explanation

   A vs B -> A because we need to use AWS Application Discovery and it provides its own agent https://docs.aws.amazon.com/application-discovery/latest/userguide/discovery-agent.html C vs D -> D because AWS Application Discovery is integrated with AWS Migration Hub and it can be used to group servers into applications https://aws.amazon.com/migration-hub/faqs/#:~:text=How%20do%20I%20group%20servers%20into%20an%20application%3F E vs. F -> E as AWS Migration Hub allows to generate recommendation for instance types https://docs.aws.amazon.com/migrationhub/latest/ug/ec2-recommendations.html

   Source: Adapted from community discussion — ninomfr64

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

4. Question 324 · 527 in bank

   A company is currently in the design phase of an application that will need an RPO of less than 5 minutes and an RTO of less than 10 minutes. The solutions architecture team is forecasting that the database will store approximately 10 TB of data. As part of the design, they are looking for a database solution that will provide the company with the ability to fail over to a secondary Region. Which solution will meet these business requirements at the LOWEST cost?

   • ADeploy an Amazon Aurora DB cluster and take snapshots of the cluster every 5 minutes. Once a snapshot is complete, copy the snapshot to a secondary Region to serve as a backup in the event of a failure.
   • BDeploy an Amazon RDS instance with a cross-Region read replica in a secondary Region. In the event of a failure, promote the read replica to become the primary.
   • CDeploy an Amazon Aurora DB cluster in the primary Region and another in a secondary Region. Use AWS DMS to keep the secondary Region in sync.
   • DDeploy an Amazon RDS instance with a read replica in the same Region. In the event of a failure, promote the read replica to become the primary.

   Show answer

   Answer: B

   Explanation

   Deploying a read replica in the same region as their existing DB will not provide any failover to a secondary region. They must use a cross region replica to achieve this.

   Source: Adapted from community discussion — heatblur

   Next question

5. Question 325 · 527 in bank

   A financial company needs to create a separate AWS account for a new digital wallet application. The company uses AWS Organizations to manage its accounts. A solutions architect uses the IAM user Support1 from the management account to create a new member account with finance1@example.com as the email address. What should the solutions architect do to create IAM users in the new member account?

   • ASign in to the AWS Management Console with AWS account root user credentials by using the 64-character password from the initial AWS Organizations email sent to finance1@example.com. Set up the IAM users as required.
   • BFrom the management account, switch roles to assume the OrganizationAccountAccessRole role with the account ID of the new member account. Set up the IAM users as required.
   • CGo to the AWS Management Console sign-in page. Choose “Sign in using root account credentials.” Sign in in by using the email address finance 1@example.com and the management account's root password. Set up the IAM users as required.
   • DGo to the AWS Management Console sign-in page. Sign in by using the account ID of the new member account and the Support1 IAM credentials. Set up the IAM users as required.

   Show answer

   Answer: B

   Explanation

   Option B correct: Key word - "OrganizationAccountAccessRole", By assuming the OrganizationAccountAccessRole, you gain temporary, controlled access to the member account without sharing root credentials or creating separate IAM users for cross-account access. This enhances security and reduces administrative overhead.

   Source: Adapted from community discussion — vibzr2023

   References

   • AWS documentation
   • repost.aws documentation

   Next question

6. Question 326 · 527 in bank

   A car rental company has built a serverless REST API to provide data to its mobile app. The app consists of an Amazon API Gateway API with a Regional endpoint, AWS Lambda functions, and an Amazon Aurora MySQL Serverless DB cluster. The company recently opened the API to mobile apps of partners. A significant increase in the number of requests resulted, causing sporadic database memory errors. Analysis of the API traffic indicates that clients are making multiple HTTP GET requests for the same queries in a short period of time. Traffic is concentrated during business hours, with spikes around holidays and other events. The company needs to improve its ability to support the additional usage while minimizing the increase in costs associated with the solution. Which strategy meets these requirements?

   • AConvert the API Gateway Regional endpoint to an edge-optimized endpoint. Enable caching in the production stage.
   • BImplement an Amazon ElastiCache for Redis cache to store the results of the database calls. Modify the Lambda functions to use the cache.
   • CModify the Aurora Serverless DB cluster configuration to increase the maximum amount of available memory.
   • DEnable throttling in the API Gateway production stage. Set the rate and burst values to limit the incoming calls.

   Show answer

   Answer: B

   Explanation

   Option A is correct While A and B do the job but the question says "minimizing the increase in costs associated with the solution".. I'll go with A coz Edge-optimized endpoints cache responses at edge locations closer to users, significantly reducing the number of requests reaching the database and Lambda functions.. While Option B -- While ElastiCache for Redis a good caching solution, it adds complexity and cost compared to edge caching.

   Source: Adapted from community discussion — vibzr2023

   References

   • AWS documentation

   Next question

7. Question 327 · 527 in bank

   A company is migrating an on-premises application and a MySQL database to AWS. The application processes highly sensitive data, and new data is constantly updated in the database. The data must not be transferred over the internet. The company also must encrypt the data in transit and at rest. The database is 5 TB in size. The company already has created the database schema in an Amazon RDS for MySQL DB instance. The company has set up a 1 Gbps AWS Direct Connect connection to AWS. The company also has set up a public VIF and a private VIF. A solutions architect needs to design a solution that will migrate the data to AWS with the least possible downtime. Which solution will meet these requirements?

   • APerform a database backup. Copy the backup files to an AWS Snowball Edge Storage Optimized device. Import the backup to Amazon S3. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) for encryption at rest. Use TLS for encryption in transit. Import the data from Amazon S3 to the DB instance.
   • BUse AWS Database Migration Service (AWS DMS) to migrate the data to AWS. Create a DMS replication instance in a private subnet. Create VPC endpoints for AWS DMS. Configure a DMS task to copy data from the on-premises database to the DB instance by using full load plus change data capture (CDC). Use the AWS Key Management Service (AWS KMS) default key for encryption at rest. Use TLS for encryption in transit.
   • CPerform a database backup. Use AWS DataSync to transfer the backup files to Amazon S3. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) for encryption at rest. Use TLS for encryption in transit. Import the data from Amazon S3 to the DB instance.
   • DUse Amazon S3 File Gateway. Set up a private connection to Amazon S3 by using AWS PrivateLink. Perform a database backup. Copy the backup files to Amazon S3. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) for encryption at rest. Use TLS for encryption in transit. Import the data from Amazon S3 to the DB instance.

   Show answer

   Answer: B

   Explanation

   Answer B - Company has created a DB schema on AWS. So next logical step is to use DMS for DB migration over the Private VIF. VPC Endpoint is also used for DMS.

   Source: Adapted from community discussion — shaaam80

   Next question

8. Question 328 · 527 in bank

   Accompany is deploying a new cluster for big data analytics on AWS. The cluster will run across many Linux Amazon EC2 instances that are spread across multiple Availability Zones. All of the nodes in the cluster must have read and write access to common underlying file storage. The file storage must be highly available, must be resilient, must be compatible with the Portable Operating System Interface (POSIX), and must accommodate high levels of throughput. Which storage solution will meet these requirements?

   • AProvision an AWS Storage Gateway file gateway NFS file share that is attached to an Amazon S3 bucket. Mount the NFS file share on each EC2 instance in the cluster.
   • BProvision a new Amazon Elastic File System (Amazon EFS) file system that uses General Purpose performance mode. Mount the EFS file system on each EC2 instance in the cluster.
   • CProvision a new Amazon Elastic Block Store (Amazon EBS) volume that uses the io2 volume type. Attach the EBS volume to all of the EC2 instances in the cluster.
   • DProvision a new Amazon Elastic File System (Amazon EFS) file system that uses Max I/O performance mode. Mount the EFS file system on each EC2 instance in the cluster.

   Show answer

   Answer: D

   Explanation

   - General purpose performance mode (default) Ideal for latency-sensitive use cases. - Max I/O mode Can scale to higher levels of aggregate throughput and operations per second with a tradeoff of slightly higher latencies for file operations.

   Source: Adapted from community discussion — J0n102

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 329 · 527 in bank

   A company hosts a software as a service (SaaS) solution on AWS. The solution has an Amazon API Gateway API that serves an HTTPS endpoint. The API uses AWS Lambda functions for compute. The Lambda functions store data in an Amazon Aurora Serverless v1 database. The company used the AWS Serverless Application Model (AWS SAM) to deploy the solution. The solution extends across multiple Availability Zones and has no disaster recovery (DR) plan. A solutions architect must design a DR strategy that can recover the solution in another AWS Region. The solution has an RTO of 5 minutes and an RPO of 1 minute. What should the solutions architect do to meet these requirements?

   • ACreate a read replica of the Aurora Serverless v1 database in the target Region. Use AWS SAM to create a runbook to deploy the solution to the target Region. Promote the read replica to primary in case of disaster.
   • BChange the Aurora Serverless v1 database to a standard Aurora MySQL global database that extends across the source Region and the target Region. Use AWS SAM to create a runbook to deploy the solution to the target Region.
   • CCreate an Aurora Serverless v1 DB cluster that has multiple writer instances in the target Region. Launch the solution in the target Region. Configure the two Regional solutions to work in an active-passive configuration.
   • DChange the Aurora Serverless v1 database to a standard Aurora MySQL global database that extends across the source Region and the target Region. Launch the solution in the target Region. Configure the two Regional solutions to work in an active-passive configuration.

   Show answer

   Answer: D

   Explanation

   D is the answer. Convert the Aurora Serverless v1 database to a standard Aurora MySQL global database extending across the source and target regions, launch the solution in the target region, and configure the two regional solutions to work in an active-passive configuration. This approach provides the necessary speed for recovery and data replication to meet the strict RTO and RPO. Aurora Serverless v1 doesn't support read replicas, cross region replicas, or global databases. https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.html#aurora-serverless.limitations

   Source: Adapted from community discussion — heatblur

   References

   • AWS documentation

   Next question

10. Question 330 · 527 in bank

    A company owns a chain of travel agencies and is running an application in the AWS Cloud. Company employees use the application to search for information about travel destinations. Destination content is updated four times each year. Two fixed Amazon EC2 instances serve the application. The company uses an Amazon Route 53 public hosted zone with a multivalue record of travel.example.com that returns the Elastic IP addresses for the EC2 instances. The application uses Amazon DynamoDB as its primary data store. The company uses a self-hosted Redis instance as a caching solution. During content updates, the load on the EC2 instances and the caching solution increases drastically. This increased load has led to downtime on several occasions. A solutions architect must update the application so that the application is highly available and can handle the load that is generated by the content updates. Which solution will meet these requirements?

    • ASet up DynamoDB Accelerator (DAX) as in-memory cache. Update the application to use DAX. Create an Auto Scaling group for the EC2 instances. Create an Application Load Balancer (ALB). Set the Auto Scaling group as a target for the ALB. Update the Route 53 record to use a simple routing policy that targets the ALB's DNS alias. Configure scheduled scaling for the EC2 instances before the content updates.
    • BSet up Amazon ElastiCache for Redis. Update the application to use ElastiCache. Create an Auto Scaling group for the EC2 instances. Create an Amazon CloudFront distribution, and set the Auto Scaling group as an origin for the distribution. Update the Route 53 record to use a simple routing policy that targets the CloudFront distribution’s DNS alias. Manually scale up EC2 instances before the content updates.
    • CSet up Amazon ElastiCache for Memcached. Update the application to use ElastiCache. Create an Auto Scaling group for the EC2 instances. Create an Application Load Balancer (ALB). Set the Auto Scaling group as a target for the ALB. Update the Route 53 record to use a simple routing policy that targets the ALB's DNS alias. Configure scheduled scaling for the application before the content updates.
    • DSet up DynamoDB Accelerator (DAX) as in-memory cache. Update the application to use DAX. Create an Auto Scaling group for the EC2 instances. Create an Amazon CloudFront distribution, and set the Auto Scaling group as an origin for the distribution. Update the Route 53 record to use a simple routing policy that targets the CloudFront distribution's DNS alias. Manually scale up EC2 instances before the content updates.

    Show answer

    Answer: A

    Explanation

    Option A correct... other options B. ElastiCache for Redis: While a good caching solution, DAX is specifically optimized for DynamoDB, making it a better choice in this context. C. ElastiCache for Memcached: Memcached is not as feature-rich as Redis and lacks DAX's DynamoDB integration. D. CloudFront: While useful for content delivery, it's not the primary solution for handling database load and scaling EC2 instances.

    Source: Adapted from community discussion — vibzr2023

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 321. 527 questions available.