SAP-C02 practice questions 411–420

1. Question 411 · 527 in bank

   A company is building a serverless application that runs on an AWS Lambda function that is attached to a VPC. The company needs to integrate the application with a new service from an external provider. The external provider supports only requests that come from public IPv4 addresses that are in an allow list. The company must provide a single public IP address to the external provider before the application can start using the new service. Which solution will give the application the ability to access the new service?

   • ADeploy a NAT gateway. Associate an Elastic IP address with the NAT gateway. Configure the VPC to use the NAT gateway.
   • BDeploy an egress-only internet gateway. Associate an Elastic IP address with the egress-only internet gateway. Configure the elastic network interface on the Lambda function to use the egress-only internet gateway.
   • CDeploy an internet gateway. Associate an Elastic IP address with the internet gateway. Configure the Lambda function to use the internet gateway.
   • DDeploy an internet gateway. Associate an Elastic IP address with the internet gateway. Configure the default route in the public VPC route table to use the internet gateway.

   Show answer

   Answer: A

   Explanation

   A. Deploy a NAT gateway. Associate an Elastic IP address with the NAT gateway. Configure the VPC to use the NAT gateway. This solution will give the Lambda function access to the internet by routing its outbound traffic through the NAT gateway, which has a public Elastic IP address. This will allow the external provider to whitelist the single public IP address associated with the NAT gateway, and enable the application to access the new service.

   Source: Adapted from community discussion — masetromain

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 412 · 527 in bank

   A company wants to use Amazon WorkSpaces in combination with thin client devices to replace aging desktops. Employees use the desktops to access applications that work with Clinical trial data. Corporate security policy states that access to the applications must be restricted to only company branch office locations. The company is considering adding an additional branch office in the next 6 months. Which solution meets these requirements with the MOST operational efficiency?

   • ACreate an IP access control group rule with the list of public addresses from the branch offices. Associate the IP access control group with the WorkSpaces directory.
   • BUse AWS Firewall Manager to create a web ACL rule with an IPSet with the list of public addresses from the branch office locations. Associate the web ACL with the WorkSpaces directory.
   • CUse AWS Certificate Manager (ACM) to issue trusted device certificates to the machines deployed in the branch office locations. Enable restricted access on the WorkSpaces directory.
   • DCreate a custom WorkSpace image with Windows Firewall configured to restrict access to the public addresses of the branch offices. Use the image to deploy the WorkSpaces.

   Show answer

   Answer: A

   Explanation

   A is correct. B is incorrect because WAF web ACLs don't work with Amazon Workspaces. A web access control list (web ACL) gives you fine-grained control over all of the HTTP(S) web requests that your protected resource responds to. You can protect Amazon CloudFront, Amazon API Gateway, Application Load Balancer, AWS AppSync, Amazon Cognito, AWS App Runner, and AWS Verified Access resources. https://docs.aws.amazon.com/waf/latest/developerguide/web-acl.html

   Source: Adapted from community discussion — backbencher2022

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 413 · 527 in bank

   Select 3

   A company uses AWS Organizations. The company runs two firewall appliances in a centralized networking account. Each firewall appliance runs on a manually configured highly available Amazon EC2 instance. A transit gateway connects the VPC from the centralized networking account to VPCs of member accounts. Each firewall appliance uses a static private IP address that is then used to route traffic from the member accounts to the internet. During a recent incident, a badly configured script initiated the termination of both firewall appliances. During the rebuild of the firewall appliances, the company wrote a new script to configure the firewall appliances at startup. The company wants to modernize the deployment of the firewall appliances. The firewall appliances need the ability to scale horizontally to handle increased traffic when the network expands. The company must continue to use the firewall appliances to comply with company policy. The provider of the firewall appliances has confirmed that the latest version of the firewall code will work with all AWS services. Which combination of steps should the solutions architect recommend to meet these requirements MOST cost-effectively? (Choose three.)

   • ADeploy a Gateway Load Balancer in the centralized networking account. Set up an endpoint service that uses AWS PrivateLink.
   • BDeploy a Network Load Balancer in the centralized networking account. Set up an endpoint service that uses AWS PrivateLink.
   • CCreate an Auto Scaling group and a launch template that uses the new script as user data to configure the firewall appliances. Create a target group that uses the instance target type.
   • DCreate an Auto Scaling group. Configure an AWS Launch Wizard deployment that uses the new script as user data to configure the firewall appliances. Create a target group that uses the IP target type.
   • ECreate VPC endpoints in each member account. Update the route tables to point to the VPC endpoints.
   • FCreate VPC endpoints in the centralized networking account. Update the route tables in each member account to point to the VPC endpoints.

   Show answer

   Answer: ACF

   Explanation

   A - Gateway Load Balancer is LB type used to redirect traffic to traffic inspection devices like firewalls, this is done via GENEVE network protocol. (correct) B - NLB could not be used, NLB does not support GENEVE protocol. (incorrect) C - ASG is the way to go for this scenario, in addition could be add Autoscaling policies to add more instances during traffic spikes and reduce when no traffic spikes (correct) D - Launch wizard work directly with resource EC2 and EBS, I didn't see any integration with ASG (incorrect) E - Works but it's not cost effective, VPCE have a price of 0.01$/hour/az each, so if you have GWLB in multi-az you would pay (1VPCE * number of AZs * number of member account) (incorrect - not cost effective) F - Since transit gateway is used, all traffic could be routed to the centralized networking account, and in there 0.0.0.0/0 traffic would go to the GWLB endpoints, so instead of multiple vpc endpoints you would only have 1VPCE * number of AZs (correct)

   Source: Adapted from community discussion — blackname

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 414 · 527 in bank

   Select 2

   A solutions architect must implement a multi-Region architecture for an Amazon RDS for PostgreSQL database that supports a web application. The database launches from an AWS CloudFormation template that includes AWS services and features that are present in both the primary and secondary Regions. The database is configured for automated backups, and it has an RTO of 15 minutes and an RPO of 2 hours. The web application is configured to use an Amazon Route 53 record to route traffic to the database. Which combination of steps will result in a highly available architecture that meets all the requirements? (Choose two.)

   • ACreate a cross-Region read replica of the database in the secondary Region. Configure an AWS Lambda function in the secondary Region to promote the read replica during a failover event.
   • BIn the primary Region, create a health check on the database that will invoke an AWS Lambda function when a failure is detected. Program the Lambda function to recreate the database from the latest database snapshot in the secondary Region and update the Route 53 host records for the database.
   • CCreate an AWS Lambda function to copy the latest automated backup to the secondary Region every 2 hours.
   • DCreate a failover routing policy in Route 53 for the database DNS record. Set the primary and secondary endpoints to the endpoints in each Region.
   • ECreate a hot standby database in the secondary Region. Use an AWS Lambda function to restore the secondary database to the latest RDS automatic backup in the event that the primary database fails.

   Show answer

   Answer: AD

   Explanation

   A is required to meet the RTO as well as the RPO. B will not meet the RTO. C meets the RPO but doesn't handle failover D handles failover E is incomplete and says nothing of how backups arrive in the secondary region and will most likely not meet the RTO.

   Source: Adapted from community discussion — Dgix

   Next question

5. Question 415 · 527 in bank

   An ecommerce company runs an application on AWS. The application has an Amazon API Gateway API that invokes an AWS Lambda function. The data is stored in an Amazon RDS for PostgreSQL DB instance. During the company’s most recent flash sale, a sudden increase in API calls negatively affected the application's performance. A solutions architect reviewed the Amazon CloudWatch metrics during that time and noticed a significant increase in Lambda invocations and database connections. The CPU utilization also was high on the DB instance. What should the solutions architect recommend to optimize the application's performance?

   • AIncrease the memory of the Lambda function. Modify the Lambda function to close the database connections when the data is retrieved.
   • BAdd an Amazon ElastiCache for Redis cluster to store the frequently accessed data from the RDS database.
   • CCreate an RDS proxy by using the Lambda console. Modify the Lambda function to use the proxy endpoint.
   • DModify the Lambda function to connect to the database outside of the function's handler. Check for an existing database connection before creating a new connection.

   Show answer

   Answer: C

   Explanation

   Some guys got confused whether it's possible to create a DB proxy from the Lambda console Yes, you CAN create a proxy from within the Lambda console: open a function -> Configuration -> RDS databases -> Add Proxy, then select a radio button with two options: - Create a new database proxy - Choose an existing database proxy Said that, "C" is correct.

   Source: Adapted from community discussion — titi_r

   References

   • repost.aws documentation
   • AWS documentation

   Next question

6. Question 416 · 527 in bank

   A retail company wants to improve its application architecture. The company's applications register new orders, handle returns of merchandise, and provide analytics. The applications store retail data in a MySQL database and an Oracle OLAP analytics database. All the applications and databases are hosted on Amazon EC2 instances. Each application consists of several components that handle different parts of the order process. These components use incoming data from different sources. A separate ETL job runs every week and copies data from each application to the analytics database. A solutions architect must redesign the architecture into an event-driven solution that uses serverless services. The solution must provide updated analytics in near real time. Which solution will meet these requirements?

   • AMigrate the individual applications as microservices to Amazon Elastic Container Service (Amazon ECS) containers that use AWS Fargate. Keep the retail MySQL database on Amazon EC2. Move the analytics database to Amazon Neptune. Use Amazon Simple Queue Service (Amazon SQS) to send all the incoming data to the microservices and the analytics database.
   • BCreate an Auto Scaling group for each application. Specify the necessary number of EC2 instances in each Auto Scaling group. Migrate the retail MySQL database and the analytics database to Amazon Aurora MySQL. Use Amazon Simple Notification Service (Amazon SNS) to send all the incoming data to the correct EC2 instances and the analytics database.
   • CMigrate the individual applications as microservices to Amazon Elastic Kubernetes Service (Amazon EKS) containers that use AWS Fargate. Migrate the retail MySQL database to Amazon Aurora Serverless MySQL. Migrate the analytics database to Amazon Redshift Serverless. Use Amazon EventBridge to send all the incoming data to the microservices and the analytics database.
   • DMigrate the individual applications as microservices to Amazon AppStream 2.0. Migrate the retail MySQL database to Amazon Aurora MySQL. Migrate the analytics database to Amazon Redshift Serverless. Use AWS IoT Core to send all the incoming data to the microservices and the analytics database.

   Show answer

   Answer: C

   Explanation

   #A - SQS is not for near real time. MySQL on EC2 is not serverless #B is not serverless #D is incorrect - Appstream for desktop app streaming and IoT Core for IoT

   Source: Adapted from community discussion — CMMC

   Next question

7. Question 417 · 527 in bank

   A company is planning a migration from an on-premises data center to the AWS Cloud. The company plans to use multiple AWS accounts that are managed in an organization in AWS Organizations. The company will create a small number of accounts initially and will add accounts as needed. A solutions architect must design a solution that turns on AWS CloudTrail in all AWS accounts. What is the MOST operationally efficient solution that meets these requirements?

   • ACreate an AWS Lambda function that creates a new CloudTrail trail in all AWS accounts in the organization. Invoke the Lambda function daily by using a scheduled action in Amazon EventBridge.
   • BCreate a new CloudTrail trail in the organization's management account. Configure the trail to log all events for all AWS accounts in the organization.
   • CCreate a new CloudTrail trail in all AWS accounts in the organization. Create new trails whenever a new account is created. Define an SCP that prevents deletion or modification of trails. Apply the SCP to the root OU.
   • DCreate an AWS Systems Manager Automation runbook that creates a CloudTrail trail in all AWS accounts in the organization. Invoke the automation by using Systems Manager State Manager.

   Show answer

   Answer: B

   References

   • AWS documentation

   Next question

8. Question 418 · 527 in bank

   A software development company has multiple engineers who are working remotely. The company is running Active Directory Domain Services (AD DS) on an Amazon EC2 instance. The company's security policy states that all internal, nonpublic services that are deployed in a VPC must be accessible through a VPN. Multi-factor authentication (MFA) must be used for access to a VPN. What should a solutions architect do to meet these requirements?

   • ACreate an AWS Site-to-Site VPN connection. Configure integration between a VPN and AD DS. Use an Amazon WorkSpaces client with MFA support enabled to establish a VPN connection.
   • BCreate an AWS Client VPN endpoint. Create an AD Connector directory for integration with AD DS. Enable MFA for AD Connector. Use AWS Client VPN to establish a VPN connection.
   • CCreate multiple AWS Site-to-Site VPN connections by using AWS VPN CloudHub. Configure integration between AWS VPN CloudHub and AD DS. Use AWS Copilot to establish a VPN connection.
   • DCreate an Amazon WorkLink endpoint. Configure integration between Amazon WorkLink and AD DS. Enable MFA in Amazon WorkLink. Use AWS Client VPN to establish a VPN connection.

   Show answer

   Answer: B

   Explanation

   #A - workspaces client for remote desktop access and not for VPN #C - AWS VPN CloudHub for connecting multiple on-premises or offices, and not for individual VPN connection #D - WorkLink for secure access from mobile devices and not for VPN connection

   Source: Adapted from community discussion — CMMC

   References

   • AWS documentation

   Next question

9. Question 419 · 527 in bank

   Select 3

   A company is running a three-tier web application in an on-premises data center. The frontend is served by an Apache web server, the middle tier is a monolithic Java application, and the storage tier is a PostgreSQL database. During a recent marketing promotion, customers could not place orders through the application because the application crashed. An analysis showed that all three tiers were overloaded. The application became unresponsive, and the database reached its capacity limit because of read operations. The company already has several similar promotions scheduled in the near future. A solutions architect must develop a plan for migration to AWS to resolve these issues. The solution must maximize scalability and must minimize operational effort Which combination of steps will meet these requirements? (Choose three.)

   • ARefactor the frontend so that static assets can be hosted on Amazon S3. Use Amazon CloudFront to serve the frontend to customers. Connect the frontend to the Java application.
   • BRehost the Apache web server of the frontend on Amazon EC2 instances that are in an Auto Scaling group. Use a load balancer in front of the Auto Scaling group. Use Amazon Elastic File System (Amazon EFS) to host the static assets that the Apache web server needs.
   • CRehost the Java application in an AWS Elastic Beanstalk environment that includes auto scaling.
   • DRefactor the Java application, Develop a Docker container to run the Java application. Use AWS Fargate to host the container.
   • EUse AWS Database Migration Service (AWS DMS) to replatform the PostgreSQL database to an Amazon Aurora PostgreSQL database. Use Aurora Auto Scaling for read replicas.
   • FRehost the PostgreSQL database on an Amazon EC2 instance that has twice as much memory as the on-premises server.

   Show answer

   Answer: ACE

   Explanation

   A -> Correct. Frontend could be hosted on s3 so we don't need a EC2 B -> False. That's expensive, and requires operational effort (ex: patches, ...) C -> Correct. Elastic Beanstalk would reduce operational effort of patches and other stuff and also support native scaling D -> False. Would be a great answer if it mentioned "Service Autoscaling" for fargate. Since it does not mention, we have to assume that would be only 1 fargate task. E -> Correct. Aurora RDS would reduce operational effort and would also allow scaling read replicas. F -> False. Requires very operational effort to allow DB reads scaling F

   Source: Adapted from community discussion — blackname

   References

   • AWS documentation
   • repost.aws documentation

   Next question

10. Question 420 · 527 in bank

    A company is deploying a new application on AWS. The application consists of an Amazon Elastic Kubernetes Service (Amazon EKS) cluster and an Amazon Elastic Container Registry (Amazon ECR) repository. The EKS cluster has an AWS managed node group. The company's security guidelines state that all resources on AWS must be continuously scanned for security vulnerabilities. Which solution will meet this requirement with the LEAST operational overhead?

    • AActivate AWS Security Hub. Configure Security Hub to scan the EKS nodes and the ECR repository.
    • BActivate Amazon Inspector to scan the EKS nodes and the ECR repository.
    • CLaunch a new Amazon EC2 instance and install a vulnerability scanning tool from AWS Marketplace. Configure the EC2 instance to scan the EKS nodes. Configure Amazon ECR to perform a basic scan on push.
    • DInstall the Amazon CloudWatch agent on the EKS nodes. Configure the CloudWatch agent to scan continuously. Configure Amazon ECR to perform a basic scan on push.

    Show answer

    Answer: B

    Explanation

    Configuration and vulnerability analysis in Amazon EKS - You can use Amazon Inspector to check for unintended network accessibility of your nodes and for vulnerabilities on those Amazon EC2 instances. https://docs.aws.amazon.com/eks/latest/userguide/configuration-vulnerability-analysis.html Amazon Inspector automatically discovers and scans running Amazon EC2 instances, container images in Amazon Elastic Container Registry (Amazon ECR), and AWS Lambda functions for known software vulnerabilities and unintended network exposure. https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html So, answer is B.

    Source: Adapted from community discussion — Fu7ed

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 411. 527 questions available.