SAP-C02 practice questions 331–340

1. Question 331 · 527 in bank

   Select 3

   A company needs to store and process image data that will be uploaded from mobile devices using a custom mobile app. Usage peaks between 8 AM and 5 PM on weekdays, with thousands of uploads per minute. The app is rarely used at any other time. A user is notified when image processing is complete. Which combination of actions should a solutions architect take to ensure image processing can scale to handle the load? (Choose three.)

   • AUpload files from the mobile software directly to Amazon S3. Use S3 event notifications to create a message in an Amazon MQ queue.
   • BUpload files from the mobile software directly to Amazon S3. Use S3 event notifications to create a message in an Amazon Simple Queue Service (Amazon SQS) standard queue.
   • CInvoke an AWS Lambda function to perform image processing when a message is available in the queue.
   • DInvoke an S3 Batch Operations job to perform image processing when a message is available in the queue.
   • ESend a push notification to the mobile app by using Amazon Simple Notification Service (Amazon SNS) when processing is complete.
   • FSend a push notification to the mobile app by using Amazon Simple Email Service (Amazon SES) when processing is complete.

   Show answer

   Answer: BCE

   Explanation

   BCE... other options incorrect A. Amazon MQ: While viable for durable messaging, it's less scalable and cost-effective compared to SQS for this use case. D. S3 Batch Operations: Designed for batch processing of large datasets, not real-time processing of individual image uploads. F. Amazon SES: Primarily for email delivery, not push notifications to mobile apps.

   Source: Adapted from community discussion — vibzr2023

   Next question

2. Question 332 · 527 in bank

   A company is building an application on AWS. The application sends logs to an Amazon OpenSearch Service cluster for analysis. All data must be stored within a VPC. Some of the company’s developers work from home. Other developers work from three different company office locations. The developers need to access OpenSearch Service to analyze and visualize logs directly from their local development machines. Which solution will meet these requirements?

   • AConfigure and set up an AWS Client VPN endpoint. Associate the Client VPN endpoint with a subnet in the VPC. Configure a Client VPN self-service portal. Instruct the developers to connect by using the client for Client VPN.
   • BCreate a transit gateway, and connect it to the VPC. Create an AWS Site-to-Site VPN. Create an attachment to the transit gateway. Instruct the developers to connect by using an OpenVPN client.
   • CCreate a transit gateway, and connect it to the VPOrder an AWS Direct Connect connection. Set up a public VIF on the Direct Connect connection. Associate the public VIF with the transit gateway. Instruct the developers to connect to the Direct Connect connection.
   • DCreate and configure a bastion host in a public subnet of the VPC. Configure the bastion host security group to allow SSH access from the company CIDR ranges. Instruct the developers to connect by using SSH.

   Show answer

   Answer: A

   Explanation

   A correct: Best choice to use Client VPN B. Site-to-Site VPN: Designed for connecting entire networks, not individual devices, and requires VPN hardware/software at each office location. C. Direct Connect: Primarily for high-bandwidth, low-latency connections between on-premises networks and AWS, not individual developer access. D. Bastion Host: While providing access, it introduces a potential security risk by exposing a public-facing host and requires developers to learn SSH.

   Source: Adapted from community discussion — vibzr2023

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 333 · 527 in bank

   Select 2

   A company wants to migrate its website from an on-premises data center onto AWS. At the same time, it wants to migrate the website to a containerized microservice-based architecture to improve the availability and cost efficiency. The company’s security policy states that privileges and network permissions must be configured according to best practice, using least privilege. A solutions architect must create a containerized architecture that meets the security requirements and has deployed the application to an Amazon ECS cluster. What steps are required after the deployment to meet the requirements? (Choose two.)

   • ACreate tasks using the bridge network mode.
   • BCreate tasks using the awsvpc network mode.
   • CApply security groups to Amazon EC2 instances, and use IAM roles for EC2 instances to access other resources.
   • DApply security groups to the tasks, and pass IAM credentials into the container at launch time to access other resources.
   • EApply security groups to the tasks, and use IAM roles for tasks to access other resources.

   Show answer

   Answer: BE

   Explanation

   BE , you can apply security group to the task using vpcmode, because in vpcmode the task will use ENI within the VPC and the ENI can use security groups

   Source: Adapted from community discussion — ahmadraufsyahputra

   Next question

4. Question 334 · 527 in bank

   A company is running a two-tier web-based application in an on-premises data center. The application layer consists of a single server running a stateful application. The application connects to a PostgreSQL database running on a separate server. The application’s user base is expected to grow significantly, so the company is migrating the application and database to AWS. The solution will use Amazon Aurora PostgreSQL, Amazon EC2 Auto Scaling, and Elastic Load Balancing. Which solution will provide a consistent user experience that will allow the application and database tiers to scale?

   • AEnable Aurora Auto Scaling for Aurora Replicas. Use a Network Load Balancer with the least outstanding requests routing algorithm and sticky sessions enabled.
   • BEnable Aurora Auto Scaling for Aurora writers. Use an Application Load Balancer with the round robin routing algorithm and sticky sessions enabled.
   • CEnable Aurora Auto Scaling for Aurora Replicas. Use an Application Load Balancer with the round robin routing and sticky sessions enabled.
   • DEnable Aurora Scaling for Aurora writers. Use a Network Load Balancer with the least outstanding requests routing algorithm and sticky sessions enabled.

   Show answer

   Answer: C

   Explanation

   C. - Aurora writers is a distractor. - Single master mode only has read replica - with Aurora replicas. - Multi master mode, not in the options - NLB does not support round robin and least outstanding algorithm https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Integrating.AutoScaling.html

   Source: Adapted from community discussion — robertohyena

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 335 · 527 in bank

   A company is hosting an image-processing service on AWS in a VPC. The VPC extends across two Availability Zones. Each Availability Zone contains one public subnet and one private subnet. The service runs on Amazon EC2 instances in the private subnets. An Application Load Balancer in the public subnets is in front of the service. The service needs to communicate with the internet and does so through two NAT gateways. The service uses Amazon S3 for image storage. The EC2 instances retrieve approximately 1 ТВ of data from an S3 bucket each day. The company has promoted the service as highly secure. A solutions architect must reduce cloud expenditures as much as possible without compromising the service’s security posture or increasing the time spent on ongoing operations. Which solution will meet these requirements?

   • AReplace the NAT gateways with NAT instances. In the VPC route table, create a route from the private subnets to the NAT instances.
   • BMove the EC2 instances to the public subnets. Remove the NAT gateways.
   • CSet up an S3 gateway VPC endpoint in the VPAttach an endpoint policy to the endpoint to allow the required actions on the S3 bucket.
   • DAttach an Amazon Elastic File System (Amazon EFS) volume to the EC2 instances. Host the images on the EFS volume.

   Show answer

   Answer: C

   Explanation

   C. Setting up an S3 gateway VPC endpoint in the VPC and attaching an endpoint policy to the endpoint will allow the EC2 instances to securely access the S3 bucket for image storage without the need for NAT gateways, reducing costs without compromising security or increasing ongoing operations. This option reduces the costs associated with the NAT gateways and allows for faster data retrieval from the S3 bucket as traffic does not have to go through the internet gateway.

   Source: Adapted from community discussion — masetromain

   References

   • AWS documentation

   Next question

6. Question 336 · 527 in bank

   Select 2

   A company is running a serverless application that consists of several AWS Lambda functions and Amazon DynamoDB tables. The company has created new functionality that requires the Lambda functions to access an Amazon Neptune DB cluster. The Neptune DB cluster is located in three subnets in a VPC. Which of the possible solutions will allow the Lambda functions to access the Neptune DB cluster and DynamoDB tables? (Choose two.)

   • ACreate three public subnets in the Neptune VPC, and route traffic through an internet gateway. Host the Lambda functions in the three new public subnets.
   • BCreate three private subnets in the Neptune VPC, and route internet traffic through a NAT gateway. Host the Lambda functions in the three new private subnets.
   • CHost the Lambda functions outside the VPUpdate the Neptune security group to allow access from the IP ranges of the Lambda functions.
   • DHost the Lambda functions outside the VPC. Create a VPC endpoint for the Neptune database, and have the Lambda functions access Neptune over the VPC endpoint.
   • ECreate three private subnets in the Neptune VPC. Host the Lambda functions in the three new isolated subnets. Create a VPC endpoint for DynamoDB, and route DynamoDB traffic to the VPC endpoint.

   Show answer

   Answer: BE

   Explanation

   B and E is the answer. Was really torn about option D.... D involves hosting Lambda functions outside the VPC and creating a VPC endpoint for the Neptune database. The key issue here is that while AWS supports VPC endpoints for several services, as of my last update in April 2023, Amazon Neptune does not support VPC endpoints. Without VPC endpoint support for Neptune, Lambda functions outside the VPC cannot access the Neptune DB cluster in this way. So it must be B and E !

   Source: Adapted from community discussion — heatblur

   References

   • AWS documentation

   Next question

7. Question 337 · 527 in bank

   A company wants to design a disaster recovery (DR) solution for an application that runs in the company’s data center. The application writes to an SMB file share and creates a copy on a second file share. Both file shares are in the data center. The application uses two types of files: metadata files and image files. The company wants to store the copy on AWS. The company needs the ability to use SMB to access the data from either the data center or AWS if a disaster occurs. The copy of the data is rarely accessed but must be available within 5 minutes.

   • ADeploy AWS Outposts with Amazon S3 storage. Configure a Windows Amazon EC2 instance on Outposts as a file server.
   • BDeploy an Amazon FSx File Gateway. Configure an Amazon FSx for Windows File Server Multi-AZ file system that uses SSD storage.
   • CDeploy an Amazon S3 File Gateway. Configure the S3 File Gateway to use Amazon S3 Standard-Infrequent Access (S3 Standard-IA) for the metadata files and to use S3 Glacier Deep Archive for the image files.
   • DDeploy an Amazon S3 File Gateway. Configure the S3 File Gateway to use Amazon S3 Standard-Infrequent Access (S3 Standard-IA) for the metadata files and image files.

   Show answer

   Answer: D

   Explanation

   Answer is D = S3 File Gateway. For those that have chosen B, they are right of course as FSx File Gateway will work as well. But if you read the requirements (The company wants to store the copy on AWS. The company needs the ability to use SMB to access the data from either the data center or AWS if a disaster occurs. The copy of the data is rarely accessed but must be available within 5 minutes.) it is only about storing the data with rare access. So why would you choose option B that has a Multi-AZ + SSD over a cheaper option for DR?

   Source: Adapted from community discussion — ayadmawla

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 338 · 527 in bank

   A company is creating a solution that can move 400 employees into a remote working environment in the event of an unexpected disaster. The user desktops have a mix of Windows and Linux operating systems. Multiple types of software, such as web browsers and mail clients, are installed on each desktop. A solutions architect needs to implement a solution that can be integrated with the company’s on-premises Active Directory to allow employees to use their existing identity credentials. The solution must provide multifactor authentication (MFA) and must replicate the user experience from the existing desktops. Which solution will meet these requirements?

   • AUse Amazon WorkSpaces for the cloud desktop service. Set up a VPN connection to the on-premises network. Create an AD Connector, and connect to the on-premises Active Directory. Activate MFA for Amazon WorkSpaces by using the AWS Management Console.
   • BUse Amazon AppStream 2.0 as an application streaming service. Configure Desktop View for the employees. Set up a VPN connection to the on-premises network. Set up Active Directory Federation Services (AD FS) on premises. Connect the VPC network to AD FS through the VPN connection.
   • CUse Amazon WorkSpaces for the cloud desktop service. Set up a VPN connection to the on-premises network. Create an AD Connector, and connect to the on-premises Active Directory. Configure a RADIUS server for MFA.
   • DUse Amazon AppStream 2.0 as an application streaming service. Set up Active Directory Federation Services on premises. Configure MFA to grant users access on AppStream 2.0.

   Show answer

   Answer: C

   Explanation

   C is the only way to implement MFA. "To enable MFA for AWS services such as Amazon WorkSpaces and QuickSight, a key requirement is an MFA solution that is a Remote Authentication Dial-In User Service (RADIUS) server or a plugin to a RADIUS server already implemented in your on-premises infrastructure. " https://aws.amazon.com/it/blogs/security/how-to-enable-multi-factor-authentication-for-amazon-workspaces-and-amazon-quicksight-by-using-microsoft-ad-and-on-premises-credentials/

   Source: Adapted from community discussion — PAUGURU

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 339 · 527 in bank

   A company has deployed an Amazon Connect contact center. Contact center agents are reporting large numbers of computer-generated calls. The company is concerned about the cost and productivity effects of these calls. The company wants a solution that will allow agents to flag the call as spam and automatically block the numbers from going to an agent in the future. What is the MOST operationally efficient solution to meet these requirements?

   • ACustomize the Contact Control Panel (CCP) by adding a flag call button that will invoke an AWS Lambda function that calls the UpdateContactAttributes API. Use an Amazon DynamoDB table to store the spam numbers. Modify the contact flows to look for the updated attribute and to use a Lambda function to read and write to the DynamoDB table.
   • BUse a Contact Lens for Amazon Connect rule that will look for spam calls. Use an Amazon DynamoDB table to store the spam numbers. Modify the contact flows to look for the rule and to invoke an AWS Lambda function to read and write to the DynamoDB table.
   • CUse an Amazon DynamoDB table to store the spam numbers. Create a quick connect that the agents can transfer the spam call to from the Contact Control Panel (CCP). Modify the quick connect contact flow to invoke an AWS Lambda function to write to the DynamoDB table.
   • DModify the initial contact flow to ask for caller input. If the agent does not receive input, the agent should mark the caller as spam. Use an Amazon DynamoDB table to store the spam numbers. Use an AWS Lambda function to read and write to the DynamoDB table.

   Show answer

   Answer: A

   Explanation

   The most operationally efficient solution to allow agents to flag calls as spam and automatically block these numbers from reaching agents in the future in an Amazon Connect contact center involves a combination of Amazon Connect's features, AWS Lambda, and Amazon DynamoDB. Let's evaluate the options: A. Customize CCP and Use Lambda with DynamoDB: Customizing the Contact Control Panel (CCP) by adding a 'flag call' button allows agents to easily mark calls as spam. The button can invoke an AWS Lambda function, which calls the UpdateContactAttributes API to flag the call. Using an Amazon DynamoDB table to store spam numbers is an effective way to maintain a blocklist. Modifying contact flows to check for the spam attribute and interact with the DynamoDB table via Lambda ensures that future calls from these numbers are blocked. This solution provides a seamless experience for agents and integrates efficiently with Amazon Connect and AWS services.

   Source: Adapted from community discussion — thala

   References

   • repost.aws documentation
   • AWS documentation

   Next question

10. Question 340 · 527 in bank

    A company has mounted sensors to collect information about environmental parameters such as humidity and light throughout all the company's factories. The company needs to stream and analyze the data in the AWS Cloud in real time. If any of the parameters fall out of acceptable ranges, the factory operations team must receive a notification immediately. Which solution will meet these requirements?

    • AStream the data to an Amazon Kinesis Data Firehose delivery stream. Use AWS Step Functions to consume and analyze the data in the Kinesis Data Firehose delivery stream. Use Amazon Simple Notification Service (Amazon SNS) to notify the operations team.
    • BStream the data to an Amazon Managed Streaming for Apache Kafka (Amazon MSK) cluster. Set up a trigger in Amazon MSK to invoke an AWS Fargate task to analyze the data. Use Amazon Simple Email Service (Amazon SES) to notify the operations team.
    • CStream the data to an Amazon Kinesis data stream. Create an AWS Lambda function to consume the Kinesis data stream and to analyze the data. Use Amazon Simple Notification Service (Amazon SNS) to notify the operations team.
    • DStream the data to an Amazon Kinesis Data Analytics application. Use an automatically scaled and containerized service in Amazon Elastic Container Service (Amazon ECS) to consume and analyze the data. Use Amazon Simple Email Service (Amazon SES) to notify the operations team.

    Show answer

    Answer: C

    Explanation

    Streaming data to an Amazon Kinesis data stream and using an AWS Lambda function for consuming and analyzing the data in real-time is a robust solution. AWS Lambda can process the data stream efficiently and trigger immediate actions. Using Amazon SNS for notifications ensures quick and effective communication with the operations team. This solution is likely to provide the real-time analysis and immediate notification required.

    Source: Adapted from community discussion — thala

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 331. 527 questions available.