SAP-C02 practice questions 361–370

1. Question 361 · 527 in bank

   A company is planning to migrate an on-premises data center to AWS. The company currently hosts the data center on Linux-based VMware VMs. A solutions architect must collect information about network dependencies between the VMs. The information must be in the form of a diagram that details host IP addresses, hostnames, and network connection information. Which solution will meet these requirements?

   • AUse AWS Application Discovery Service. Select an AWS Migration Hub home AWS Region. Install the AWS Application Discovery Agent on the on-premises servers for data collection. Grant permissions to Application Discovery Service to use the Migration Hub network diagrams.
   • BUse the AWS Application Discovery Service Agentless Collector for server data collection. Export the network diagrams from the AWS Migration Hub in .png format.
   • CInstall the AWS Application Migration Service agent on the on-premises servers for data collection. Use AWS Migration Hub data in Workload Discovery on AWS to generate network diagrams.
   • DInstall the AWS Application Migration Service agent on the on-premises servers for data collection. Export data from AWS Migration Hub in .csv format into an Amazon CloudWatch dashboard to generate network diagrams.

   Show answer

   Answer: A

   Explanation

   "AWS Application Discovery Service Discovery Agent must be running on all of the on-premises servers that you want mapped in the diagram."

   Source: Adapted from community discussion — titi_r

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 362 · 527 in bank

   A company runs a software-as-a-service (SaaS) application on AWS. The application consists of AWS Lambda functions and an Amazon RDS for MySQL Multi-AZ database. During market events, the application has a much higher workload than normal. Users notice slow response times during the peak periods because of many database connections. The company needs to improve the scalable performance and availability of the database. Which solution meets these requirements?

   • ACreate an Amazon CloudWatch alarm action that triggers a Lambda function to add an Amazon RDS for MySQL read replica when resource utilization hits a threshold.
   • BMigrate the database to Amazon Aurora, and add a read replica. Add a database connection pool outside of the Lambda handler function.
   • CMigrate the database to Amazon Aurora, and add a read replica. Use Amazon Route 53 weighted records.
   • DMigrate the database to Amazon Aurora, and add an Aurora Replica. Configure Amazon RDS Proxy to manage database connection pools.

   Show answer

   Answer: D

   Explanation

   Moving database connection settings outside of the Lambda handler function may allow Lambda to reuse the connection, but RDS Proxy is better.

   Source: Adapted from community discussion — VerRi

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 363 · 527 in bank

   A company is planning to migrate an application from on premises to the AWS Cloud. The company will begin the migration by moving the application’s underlying data storage to AWS. The application data is stored on a shared file system on premises, and the application servers connect to the shared file system through SMB. A solutions architect must implement a solution that uses an Amazon S3 bucket for shared storage. Until the application is fully migrated and code is rewritten to use native Amazon S3 APIs, the application must continue to have access to the data through SMB. The solutions architect must migrate the application data to AWS to its new location while still allowing the on-premises application to access the data. Which solution will meet these requirements?

   • ACreate a new Amazon FSx for Windows File Server file system. Configure AWS DataSync with one location for the on-premises file share and one location for the new Amazon FSx file system. Create a new DataSync task to copy the data from the on-premises file share location to the Amazon FSx file system.
   • BCreate an S3 bucket for the application. Copy the data from the on-premises storage to the S3 bucket.
   • CDeploy an AWS Server Migration Service (AWS SMS) VM to the on-premises environment. Use AWS SMS to migrate the file storage server from on premises to an Amazon EC2 instance.
   • DCreate an S3 bucket for the application. Deploy a new AWS Storage Gateway file gateway on an on-premises VM. Create a new file share that stores data in the S3 bucket and is associated with the file gateway. Copy the data from the on-premises storage to the new file gateway endpoint.

   Show answer

   Answer: D

   Explanation

   Option D meets all the requirements: • Create an S3 bucket for the application: This provides a shared storage location for the application's data. • Deploy a new AWS Storage Gateway file gateway on an on-premises VM: The file gateway is used to enable SMB access to the S3 bucket, allowing the on-premises application to continue accessing the data through SMB. • Create a new file share that stores data in the S3 bucket and is associated with the file gateway: This creates a bridge between the on-premises file system and the S3 bucket, allowing data to be copied from one location to another. • Copy the data from the on-premises storage to the new file gateway endpoint: This ensures that all application data is migrated to the new shared storage location.

   Source: Adapted from community discussion — AzureDP900

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 364 · 527 in bank

   A global company has a mobile app that displays ticket barcodes. Customers use the tickets on the mobile app to attend live events. Event scanners read the ticket barcodes and call a backend API to validate the barcode data against data in a database. After the barcode is scanned, the backend logic writes to the database's single table to mark the barcode as used. The company needs to deploy the app on AWS with a DNS name of api.example.com. The company will host the database in three AWS Regions around the world. Which solution will meet these requirements with the LOWEST latency?

   • AHost the database on Amazon Aurora global database clusters. Host the backend on three Amazon Elastic Container Service (Amazon ECS) clusters that are in the same Regions as the database. Create an accelerator in AWS Global Accelerator to route requests to the nearest ECS cluster. Create an Amazon Route 53 record that maps api.example.com to the accelerator endpoint
   • BHost the database on Amazon Aurora global database clusters. Host the backend on three Amazon Elastic Kubernetes Service (Amazon EKS) clusters that are in the same Regions as the database. Create an Amazon CloudFront distribution with the three clusters as origins. Route requests to the nearest EKS cluster. Create an Amazon Route 53 record that maps api.example.com to the CloudFront distribution.
   • CHost the database on Amazon DynamoDB global tables. Create an Amazon CloudFront distribution. Associate the CloudFront distribution with a CloudFront function that contains the backend logic to validate the barcodes. Create an Amazon Route 53 record that maps api.example.com to the CloudFront distribution.
   • DHost the database on Amazon DynamoDB global tables. Create an Amazon CloudFront distribution. Associate the CloudFront distribution with a Lambda@Edge function that contains the backend logic to validate the barcodes. Create an Amazon Route 53 record that maps api.example.com to the CloudFront distribution.

   Show answer

   Answer: D

   Explanation

   D withoud any doubt. For this simple data, a DynamoDB Table is enought; so global table is perfect. For check logic, cloudfront function is not enought because it is only for manipulate HTTP header or something very very light (code, metadata etc.). So for calling some backend layer (querying DynamoDB in this case) we need a Lambda@Edge function, which is much complete.

   Source: Adapted from community discussion — red_panda

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 365 · 527 in bank

   A medical company is running a REST API on a set of Amazon EC2 instances. The EC2 instances run in an Auto Scaling group behind an Application Load Balancer (ALB). The ALB runs in three public subnets, and the EC2 instances run in three private subnets. The company has deployed an Amazon CloudFront distribution that has the ALB as the only origin. Which solution should a solutions architect recommend to enhance the origin security?

   • AStore a random string in AWS Secrets Manager. Create an AWS Lambda function for automatic secret rotation. Configure CloudFront to inject the random string as a custom HTTP header for the origin request. Create an AWS WAF web ACL rule with a string match rule for the custom header. Associate the web ACL with the ALB.
   • BCreate an AWS WAF web ACL rule with an IP match condition of the CloudFront service IP address ranges. Associate the web ACL with the ALMove the ALB into the three private subnets.
   • CStore a random string in AWS Systems Manager Parameter Store. Configure Parameter Store automatic rotation for the string. Configure CloudFront to inject the random string as a custom HTTP header for the origin request. Inspect the value of the custom HTTP header, and block access in the ALB.
   • DConfigure AWS Shield Advanced Create a security group policy to allow connections from CloudFront service IP address ranges. Add the policy to AWS Shield Advanced, and attach the policy to the ALB.

   Show answer

   Answer: A

   Explanation

   In this blog post, you’ll see how to use CloudFront custom headers, AWS WAF, and AWS Secrets Manager to restrict viewer requests from accessing your CloudFront origin resources directly. https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/

   Source: Adapted from community discussion — kejam

   References

   • AWS documentation

   Next question

6. Question 366 · 527 in bank

   To abide by industry regulations, a solutions architect must design a solution that will store a company's critical data in multiple public AWS Regions, including in the United States, where the company's headquarters is located. The solutions architect is required to provide access to the data stored in AWS to the company’s global WAN network. The security team mandates that no traffic accessing this data should traverse the public internet. How should the solutions architect design a highly available solution that meets the requirements and is cost-effective?

   • AEstablish AWS Direct Connect connections from the company headquarters to all AWS Regions in use. Use the company WAN to send traffic over to the headquarters and then to the respective DX connection to access the data.
   • BEstablish two AWS Direct Connect connections from the company headquarters to an AWS Region. Use the company WAN to send traffic over a DX connection. Use inter-region VPC peering to access the data in other AWS Regions.
   • CEstablish two AWS Direct Connect connections from the company headquarters to an AWS Region. Use the company WAN to send traffic over a DX connection. Use an AWS transit VPC solution to access data in other AWS Regions.
   • DEstablish two AWS Direct Connect connections from the company headquarters to an AWS Region. Use the company WAN to send traffic over a DX connection. Use Direct Connect Gateway to access data in other AWS Regions.

   Show answer

   Answer: D

   Explanation

   This solution meets the requirements and is cost-effective. Option D AWS Direct Connect: This service allows you to establish a dedicated network connection between your premises and an AWS Region, which bypasses the public internet. Two connections: Establishing two connections provides redundancy, ensuring that if one connection fails, the other can take over. This meets the requirement for high availability. Direct Connect Gateway: By using a Direct Connect Gateway, you can extend the connectivity to multiple AWS Regions, allowing your global WAN network to access data in those regions without traversing the public internet.

   Source: Adapted from community discussion — AzureDP900

   References

   • AWS documentation

   Next question

7. Question 367 · 527 in bank

   A company has developed an application that is running Windows Server on VMware vSphere VMs that the company hosts on premises. The application data is stored in a proprietary format that must be read through the application. The company manually provisioned the servers and the application. As part of its disaster recovery plan, the company wants the ability to host its application on AWS temporarily if the company's on-premises environment becomes unavailable. The company wants the application to return to on-premises hosting after a disaster recovery event is complete. The RPO is 5 minutes. Which solution meets these requirements with the LEAST amount of operational overhead?

   • AConfigure AWS DataSync. Replicate the data to Amazon Elastic Block Store (Amazon EBS) volumes. When the on-premises environment is unavailable, use AWS CloudFormation templates to provision Amazon EC2 instances and attach the EBS volumes.
   • BConfigure AWS Elastic Disaster Recovery. Replicate the data to replication Amazon EC2 instances that are attached to Amazon Elastic Block Store (Amazon EBS) volumes. When the on-premises environment is unavailable, use Elastic Disaster Recovery to launch EC2 instances that use the replicated volumes.
   • CProvision an AWS Storage Gateway file gateway. Replicate the data to an Amazon S3 bucket. When the on-premises environment is unavailable, use AWS Backup to restore the data to Amazon Elastic Block Store (Amazon EBS) volumes and launch Amazon EC2 instances from these EBS volumes.
   • DProvision an Amazon FSx for Windows File Server file system on AWS. Replicate the data to the file system. When the on-premises environment is unavailable, use AWS CloudFormation templates to provision Amazon EC2 instances and use AWS::CloudFormation::Init commands to mount the Amazon FSx file shares.

   Show answer

   Answer: B

   Explanation

   Correct answer is B - because only this option will provide LEAST amount of operational overhead. A - is out, because DataSync can't replicate data to EBS volumes C - is out, because AWS Backup can't restore not managed data from S3 to EBS D - is out, because it is not provide a way HOW we will replicate data from on-premise to FSx. Also, it is require additional amount of operational overhead

   Source: Adapted from community discussion — HunkyBunky

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 368 · 527 in bank

   A company is using Amazon OpenSearch Service to analyze data. The company loads data into an OpenSearch Service cluster with 10 data nodes from an Amazon S3 bucket that uses S3 Standard storage. The data resides in the cluster for 1 month for read-only analysis. After 1 month, the company deletes the index that contains the data from the cluster. For compliance purposes, the company must retain a copy of all input data. The company is concerned about ongoing costs and asks a solutions architect to recommend a new solution. Which solution will meet these requirements MOST cost-effectively?

   • AReplace all the data nodes with UltraWarm nodes to handle the expected capacity. Transition the input data from S3 Standard to S3 Glacier Deep Archive when the company loads the data into the cluster.
   • BReduce the number of data nodes in the cluster to 2 Add UltraWarm nodes to handle the expected capacity. Configure the indexes to transition to UltraWarm when OpenSearch Service ingests the data. Transition the input data to S3 Glacier Deep Archive after 1 month by using an S3 Lifecycle policy.
   • CReduce the number of data nodes in the cluster to 2. Add UltraWarm nodes to handle the expected capacity. Configure the indexes to transition to UltraWarm when OpenSearch Service ingests the data. Add cold storage nodes to the cluster Transition the indexes from UltraWarm to cold storage. Delete the input data from the S3 bucket after 1 month by using an S3 Lifecycle policy.
   • DReduce the number of data nodes in the cluster to 2. Add instance-backed data nodes to handle the expected capacity. Transition the input data from S3 Standard to S3 Glacier Deep Archive when the company loads the data into the cluster.

   Show answer

   Answer: B

   Explanation

   B is the most cost-effective solution as it reduces the number of data nodes in the cluster to 2 and adds UltraWarm nodes to handle the expected capacity. By configuring the indexes to transition to UltraWarm when OpenSearch Service ingests the data, the company can take advantage of the lower storage costs of UltraWarm. Additionally, by transitioning the input data to S3 Glacier Deep Archive after 1 month using an S3 Lifecycle policy, the company can further reduce costs by using the lower storage costs of S3 Glacier Deep Archive for long-term data retention.

   Source: Adapted from community discussion — masetromain

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 369 · 527 in bank

   A company runs a highly available data collection application on Amazon EC2 in the eu-north-1 Region. The application collects data from end-user devices and writes records to an Amazon Kinesis data stream and a set of AWS Lambda functions that process the records. The company persists the output of the record processing to an Amazon S3 bucket in eu-north-1. The company uses the data in the S3 bucket as a data source for Amazon Athena. The company wants to increase its global presence. A solutions architect must launch the data collection capabilities in the sa-east-1 and ap-northeast-1 Regions. The solutions architect deploys the application, the Kinesis data stream, and the Lambda functions in the two new Regions. The solutions architect keeps the S3 bucket in eu-north-1 to meet a requirement to centralize the data analysis. During testing of the new setup, the solutions architect notices a significant lag on the arrival of data from the new Regions to the S3 bucket. Which solution will improve this lag time the MOST?

   • AIn each of the two new Regions, set up the Lambda functions to run in a VPC. Set up an S3 gateway endpoint in that VPC.
   • BTurn on S3 Transfer Acceleration on the S3 bucket in eu-north-1. Change the application to use the new S3 accelerated endpoint when the application uploads data to the S3 bucket.
   • CCreate an S3 bucket in each of the two new Regions. Set the application in each new Region to upload to its respective S3 bucket. Set up S3 Cross-Region Replication to replicate data to the S3 bucket in eu-north-1.
   • DIncrease the memory requirements of the Lambda functions to ensure that they have multiple cores available. Use the multipart upload feature when the application uploads data to Amazon S3 from Lambda.

   Show answer

   Answer: C

   Explanation

   S3 Transfer Acceleration achieves acceleration by AWS routing traffic to AWS cloudfront edge location and transfer aws network backbone. The key speed improvement is AWS network backbone. While, in this case, the application in the two new regions is the client to write the output to S3 in EU, which means the client is already on AWS, the data transportation is already on AWS network backbone. So S3 Transfer Acceleration is not helping at all. B is out. C is the best answer.

   Source: Adapted from community discussion — bjexamprep

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 370 · 527 in bank

    A company provides a centralized Amazon EC2 application hosted in a single shared VPC. The centralized application must be accessible from client applications running in the VPCs of other business units. The centralized application front end is configured with a Network Load Balancer (NLB) for scalability. Up to 10 business unit VPCs will need to be connected to the shared VPC. Some of the business unit VPC CIDR blocks overlap with the shared VPC, and some overlap with each other Network connectivity to the centralized application in the shared VPC should be allowed from authorized business unit VPCs only. Which network configuration should a solutions architect use to provide connectivity from the client applications in the business unit VPCs to the centralized application in the shared VPC?

    • ACreate an AWS Transit Gateway. Attach the shared VPC and the authorized business unit VPCs to the transit gateway. Create a single transit gateway route table and associate it with all of the attached VPCs. Allow automatic propagation of routes from the attachments into the route table. Configure VPC routing tables to send traffic to the transit gateway.
    • BCreate a VPC endpoint service using the centralized application NLB and enable the option to require endpoint acceptance. Create a VPC endpoint in each of the business unit VPCs using the service name of the endpoint service. Accept authorized endpoint requests from the endpoint service console.
    • CCreate a VPC peering connection from each business unit VPC to the shared VPAccept the VPC peering connections from the shared VPC console. Configure VPC routing tables to send traffic to the VPC peering connection.
    • DConfigure a virtual private gateway for the shared VPC and create customer gateways for each of the authorized business unit VPCs. Establish a Site-to-Site VPN connection from the business unit VPCs to the shared VPC. Configure VPC routing tables to send traffic to the VPN connection.

    Show answer

    Answer: B

    Explanation

    By using a VPC endpoint service with the "require endpoint acceptance" option, the company can securely and efficiently provide connectivity from the client applications in the business unit VPCs to the centralized application in the shared VPC, while addressing the requirements of overlapping CIDR blocks and controlled access. A. AWS Transit Gateway: While Transit Gateway can connect multiple VPCs, it does not provide a mechanism to control access or handle overlapping CIDR blocks between VPCs. C. VPC Peering: VPC peering does not support overlapping CIDR blocks between VPCs, which is a requirement in this scenario. Additionally, managing multiple VPC peering connections can become complex and difficult to maintain as the number of VPCs increases. D. Site-to-Site VPN: No

    Source: Adapted from community discussion — 0b43291

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 361. 527 questions available.