Filters
Question type
Study Flashcards

A company is building an AWS landing zone and has asked a Solutions Architect to design a multi-account access strategy that will allow hundreds of users to use corporate credentials to access the AWS Console. The company is running a Microsoft Active Directory, and users will use an AWS Direct Connect connection to connect to AWS. The company also wants to be able to federate to third-party services and providers, including custom applications. Which solution meets the requirements by using the LEAST amount of management overhead?


A) Connect the Active Directory to AWS by using single sign-on and an Active Directory Federation Services (AD FS) with SAML 2.0, and then configure the Identity Provider (IdP) system to use form-based authentication. Build the AD FS portal page with corporate branding, and integrate third-party applications that support SAML 2.0 as required.
B) Create a two-way Forest trust relationship between the on-premises Active Directory and the AWS Directory Service. Set up AWS Single Sign-On with AWS Organizations. Use single sign-on integrations for connections with third-party applications.
C) Configure single sign-on by connecting the on-premises Active Directory using the AWS Directory Service AD Connector. Enable federation to the AWS services and accounts by using the IAM applications and services linking function. Leverage third-party single sign-on as needed.
D) Connect the company's Active Directory to AWS by using AD FS and SAML 2.0. Configure the AD FS claim rule to leverage Regex and a common Active Directory naming convention for the security group to allow federation of all AWS accounts. Leverage third-party single sign-on as needed, and add it to the AD FS server.

E) A) and D)
F) A) and B)

Correct Answer

verifed

verified

Which of the following components of AWS Data Pipeline specifies the business logic of your data management?


A) Task Runner
B) Pipeline definition
C) AWS Direct Connect
D) Amazon Simple Storage Service 9Amazon S3)

E) C) and D)
F) B) and D)

Correct Answer

verifed

verified

A company wants to launch an online shopping website in multiple countries and must ensure that customers are protected against potential "man-in-the-middle" attacks. Which architecture will provide the MOST secure site access?


A) Use Amazon Route 53 for domain registration and DNS services. Enable DNSSEC for all Route 53 requests. Use AWS Certificate Manager (ACM) to register TLS/SSL certificates for the shopping website, and use Application Load Balancers configured with those TLS/SSL certificates for the site. Use the Server Name Identification extension in all client requests to the site.
B) Register 2048-bit encryption keys from a third-party certificate service. Use a third-party DNS provider that uses the customer managed keys for DNSSec. Upload the keys to ACM, and use ACM to automatically deploy the certificates for secure web services to an EC2 front-end web server fleet by using NGINX. Use the Server Name Identification extension in all client requests to the site.
C) Use Route 53 for domain registration. Register 2048-bit encryption keys from a third-party certificate service. Use a third-party DNS service that supports DNSSEC for DNS requests that use the customer managed keys. Import the customer managed keys to ACM to deploy the certificates to Classic Load Balancers configured with those TLS/SSL certificates for the site. Use the Server Name Identification extension in all clients requests to the site.
D) Use Route 53 for domain registration, and host the company DNS root servers on Amazon EC2 instances running Bind . Enable DNSSEC for DNS requests. Use ACM to register TLS/SSL certificates for the shopping website, and use Application Load Balancers configured with those TLS/SSL certificates for the site. Use the Server Name Identification extension in all client requests to the site. Use Route 53 for domain registration, and host the company DNS root servers on Amazon EC2 instances running Bind . Enable DNSSEC for DNS requests. Use ACM to register TLS/SSL certificates for the shopping website, and use Application Load Balancers configured with those TLS/SSL certificates for the site. Use the Server Name Identification extension in all client requests to the site.

E) A) and C)
F) B) and C)

Correct Answer

verifed

verified

In Amazon Elastic Compute Cloud, you can specify storage volumes in addition to the root device volume when you create an AMI or when launching a new instance using______.


A) block device mapping
B) object mapping
C) batch storage mapping
D) datacenter mapping

E) B) and D)
F) B) and C)

Correct Answer

verifed

verified

An enterprise company is using a multi-account AWS strategy. There are separate accounts for development staging and production workloads. To control costs and improve governance the following requirements have been defined: The company must be able to calculate the AWS costs for each project. The company must be able to calculate the AWS costs for each environment development staging and production. Commonly deployed IT services must be centrally managed. Business units can deploy pre-approved IT services only. Usage of AWS resources in the development account must be limited. Which combination of actions should be taken to meet these requirements? (Choose three.)


A) Apply environment, cost center, and application name tags to all taggable resources.
B) Configure custom budgets and define thresholds using Cost Explorer.
C) Configure AWS Trusted Advisor to obtain weekly emails with cost-saving estimates.
D) Create a portfolio for each business unit and add products to the portfolios using AWS CloudFormation in AWS Service Catalog.
E) Configure a billing alarm in Amazon CloudWatch.
F) Configure SCPs in AWS Organizations to allow services available using AWS.

G) B) and E)
H) All of the above

Correct Answer

verifed

verified

An organization has created 5 IAM users. The organization wants to give them the same login ID but different passwords. How can the organization achieve this?


A) The organization should create each user in a separate region so that they have their own URL to login
B) The organization should create a separate login ID but give the IAM users the same alias so that each one can login with their alias
C) It is not possible to have the same login ID for multiple IAM users of the same account
D) The organization should create various groups and add each user with the same login ID to different groups. The user can login with their own group ID

E) All of the above
F) C) and D)

Correct Answer

verifed

verified

A company maintains a restaurant review website. The website is a single-page application where files are stored in Amazon S3 and delivered using Amazon CloudFront. The company receives several fake postings every day that are manually removed. The security team has identified that most of the fake posts are from bots with IP addresses that have a bad reputation within the same global region. The team needs to create a solution to help restrict the bots from accessing the website. Which strategy should a solutions architect use?


A) Use AWS Firewall Manage to control the CloudFront distribution security settings. Create a geographical block rule and associate it with Firewall Manager.
B) Associate an AWS WAF web ACL with the CloudFront distribution. Select the managed Amazon IP reputation rule group for the web ACL with a deny action.
C) Use AWS Firewall Manager to control the CloudFront distribution security settings. Select the managed Amazon IP reputation rule group and associate it with Firewall Manager with a deny action.
D) Associate an AWS WAF web ACL with the CloudFront distribution. Create a rule group for the web ACL with a geographical match statement with a deny action.

E) None of the above
F) C) and D)

Correct Answer

verifed

verified

You are running a news website in the eu-west-1 region that updates every 15 minutes. The website has a world-wide audience. It uses an Auto Scaling group behind an Elastic Load Balancer and an Amazon RDS database. Static content resides on Amazon S3, and is distributed through Amazon CloudFront. Your Auto Scaling group is set to trigger a scale up event at 60% CPU utilization. You use an Amazon RDS extra large DB instance with 10.000 Provisioned IOPS, its CPU utilization is around 80%, while freeable memory is in the 2 GB range. Web analytics reports show that the average load time of your web pages is around 1.5 to 2 seconds, but your SEO consultant wants to bring down the average load time to under 0.5 seconds. How would you improve page load times for your users? (Choose 3 answers)


A) Lower the scale up trigger of your Auto Scaling group to 30% so it scales more aggressively.
B) Add an Amazon ElastiCache caching layer to your application for storing sessions and frequent DB queries
C) Configure Amazon CloudFront dynamic content support to enable caching of re-usable content from your site
D) Switch the Amazon RDS database to the high memory extra large Instance type
E) Set up a second installation in another region, and use the Amazon Route 53 latency-based routing feature to select the right region.

F) B) and C)
G) None of the above

Correct Answer

verifed

verified

In Amazon ElastiCache replication groups of Redis, for performance tuning reasons, you can change the roles of the cache nodes within the replication group, with the primary and one of the replicas exchanging roles.


A) True, however, you get lower performance.
B) false
C) true
D) False, you must recreate the replication group to improve performance tuning.

E) A) and B)
F) A) and D)

Correct Answer

verifed

verified

A company manages hundreds of AWS accounts centrally in an organization in AWS Organizations. The company recently started to allow product teams to create and manage their own S3 access points in their accounts. The S3 access points can be accessed only within VPCs, not on the Internet. What is the MOST operationally efficient way to enforce this requirement?


A) Set the S3 access point resource policy to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.
B) Create an SCP at the root level in the organization to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.
C) Use AWS CloudFormation StackSets to create a new IAM policy in each AWS account that allows the s3:CreateAccessPoint action only if the s3:AccessPointNetworkOrigin condition key evaluates to VPC.
D) Set the S3 bucket policy to deny the s3:CreateAccessPoint action unless the s3:AccessPointNetworkOrigin condition key evaluates to VPC.

E) None of the above
F) All of the above

Correct Answer

verifed

verified

Your company has recently extended its datacenter into a VPC on AVVS to add burst computing capacity as needed Members of your Network Operations Center need to be able to go to the AWS Management Console and administer Amazon EC2 instances as necessary You don't want to create new IAM users for each NOC member and make those users sign in again to the AWS Management Console. Which option below will meet the needs for your NOC members?


A) Use OAuth 2 0 to retrieve temporary AWS security credentials to enable your NOC members to sign in to the AWS Management Console.
B) Use web Identity Federation to retrieve AWS temporary security credentials to enable your NOC members to sign in to the AWS Management Console.
C) Use your on-premises SAML 2.0-compliant identity provider (IDP) to grant the NOC members federated access to the AWS Management Console via the AWS single sign-on (SSO) endpoint.
D) Use your on-premises SAML 2.0-compliam identity provider (IDP) to retrieve temporary security credentials to enable NOC members to sign in to the AWS Management Console.

E) C) and D)
F) A) and B)

Correct Answer

verifed

verified

Your startup wants to implement an order fulfillment process for selling a personalized gadget that needs an average of 3-4 days to produce with some orders taking up to 6 months you expect 10 orders per day on your first day. 1000 orders per day after 6 months and 10,000 orders after 12 months. Orders coming in are checked for consistency men dispatched to your manufacturing plant for production quality control packaging shipment and payment processing If the product does not meet the quality standards at any stage of the process employees may force the process to repeat a step Customers are notified via email about order status and any critical issues with their orders such as payment failure. Your base architecture includes AWS Elastic Beanstalk for your website with an RDS MySQL instance for customer data and orders. How can you implement the order fulfillment process while making sure that the emails are delivered reliably?


A) Add a business process management application to your Elastic Beanstalk app servers and re-use the ROS database for tracking order status use one of the Elastic Beanstalk instances to send emails to customers.
B) Use SWF with an Auto Scaling group of activity workers and a decider instance in another Auto Scaling group with min/max=1 Use the decider instance to send emails to customers.
C) Use SWF with an Auto Scaling group of activity workers and a decider instance in another Auto Scaling group with min/max=1 use SES to send emails to customers.
D) Use an SQS queue to manage all process tasks Use an Auto Scaling group of EC2 Instances that poll the tasks and execute them. Use SES to send emails to customers.

E) A) and B)
F) None of the above

Correct Answer

verifed

verified

An AWS partner company is building a service in AWS Organizations using its organization named org1. This service requires the partner company to have access to AWS resources in a customer account, which is in a separate organization named org2. The company must establish least privilege security access using an API or command line tool to the customer account. What is the MOST secure way to allow org1 to access resources in org2?


A) The customer should provide the partner company with their AWS account access keys to log in and perform the required tasks.
B) The customer should create an IAM user and assign the required permissions to the IAM user. The customer should then provide the credentials to the partner company to log in and perform the required tasks.
C) The customer should create an IAM role and assign the required permissions to the IAM role. The partner company should then use the IAM role's Amazon Resource Name (ARN) when requesting access to perform the required tasks.
D) The customer should create an IAM role and assign the required permissions to the IAM role. The partner company should then use the IAM role's Amazon Resource Name (ARN) , including the external ID in the IAM role's trust policy, when requesting access to perform the required tasks.

E) A) and D)
F) A) and B)

Correct Answer

verifed

verified

A company is building a voting system for a popular TV show, viewers win watch the performances then visit the show's website to vote for their favorite performer.  It is expected that in a short period of time after the show has finished the site will receive millions of visitors. The visitors will first login to the site using their Amazon.com credentials and then submit their vote.  After the voting is completed the page will display the vote totals.  The company needs to build the site such that can handle the rapid influx of traffic while maintaining good performance but also wants to keep costs to a minimum. Which of the design patterns below should they use?


A) Use CloudFront and an Elastic Load balancer in front of an auto-scaled set of web servers, the web servers will first call the Login With Amazon service to authenticate the user then process the users vote and store the result into a multi-AZ Relational Database Service instance.
B) Use CloudFront and the static website hosting feature of S3 with the Javascript SDK to call the Login With Amazon service to authenticate the user, use IAM Roles to gain permissions to a DynamoDB table to store the users vote.
C) Use CloudFront and an Elastic Load Balancer in front of an auto-scaled set of web servers, the web servers will first call the Login with Amazon service to authenticate the user, the web servers will process the users vote and store the result into a DynamoDB table using IAM Roles for EC2 instances to gain permissions to the DynamoDB table.
D) Use CloudFront and an Elastic Load Balancer in front of an auto-scaled set of web servers, the web servers will first call the Login With Amazon service to authenticate the user, the web servers win process the users vote and store the result into an SQS queue using IAM Roles for EC2 Instances to gain permissions to the SQS queue. A set of application servers will then retrieve the items from the queue and store the result into a DynamoDB table.

E) A) and B)
F) A) and C)

Correct Answer

verifed

verified

A company has several Amazon EC2 instances to both public and private subnets within a VPC that is not connected to the corporate network. A security group associated with the EC2 instances allows the company to use the Windows remote desktop protocol (RDP) over the internet to access the instances. The security team has noticed connection attempts from unknown sources. The company wants to implement a more secure solution to access the EC2 instances. Which strategy should a solutions architect implement?


A) Deploy a Linux bastion host on the corporate network that has access to all instances in the VPC.
B) Deploy AWS Systems Manager Agent on the EC2 instances. Access the EC2 instances using Session Manager restricting access to users with permission.
C) Deploy a Linux bastion host with an Elastic IP address in the public subnet. Allow access to the bastion host from 0.0.0.0/0.
D) Establish a Site-to-Site VPN connecting the corporate network to the VPC. Update the security groups to allow access from the corporate network only.

E) A) and D)
F) None of the above

Correct Answer

verifed

verified

A user is running a batch process on EBS backed EC2 instances. The batch process launches few EC2 instances to process Hadoop Map reduce jobs which can run between 50 ?600 minutes or sometimes for even more time. The user wants a configuration that can terminate the instance only when the process is completed. How can the user configure this with CloudWatch?


A) Configure a job which terminates all instances after 600 minutes
B) It is not possible to terminate instances automatically
C) Configure the CloudWatch action to terminate the instance when the CPU utilization falls below 5%
D) Set up the CloudWatch with Auto Scaling to terminate all the instances

E) A) and D)
F) A) and B)

Correct Answer

verifed

verified

A user is configuring MySQL RDS with PIOPS. What should be the minimum PIOPS that the user should provision?


A) 1000
B) 200
C) 2000
D) 500

E) All of the above
F) None of the above

Correct Answer

verifed

verified

Which of the following are characteristics of Amazon VPC subnets? (Choose two.)


A) Each subnet spans at least 2 Availability Zones to provide a high-availability environment.
B) Each subnet maps to a single Availability Zone.
C) CIDR block mask of /25 is the smallest range supported.
D) By default, all subnets can route between each other, whether they are private or public.
E) Instances in a private subnet can communicate with the Internet only if they have an Elastic IP.

F) B) and D)
G) A) and B)

Correct Answer

verifed

verified

A user has launched a dedicated EBS backed instance with EC2. You are curious where the EBS volume for this instance will be created. Which statement is correct about the EBS volume's creation?


A) The EBS volume will not be created on the same tenant hardware assigned to the dedicated instance
B) AWS does not allow a dedicated EBS backed instance launch
C) The EBS volume will be created on the same tenant hardware assigned to the dedicated instance
D) The user can specify where the EBS will be created

E) C) and D)
F) A) and B)

Correct Answer

verifed

verified

A user has enabled detailed CloudWatch monitoring with the AWS Simple Notification Service. Which of the below mentioned statements helps the user understand detailed monitoring better?


A) SNS cannot provide data every minute
B) SNS will send data every minute after configuration
C) There is no need to enable since SNS provides data every minute
D) AWS CloudWatch does not support monitoring for SNS

E) A) and B)
F) None of the above

Correct Answer

verifed

verified

Showing 301 - 320 of 871

Related Exams

Exam 1

AWS Certified Advanced Networking - Specialty (ANS-C00)

397 Questions

Exam 2

AWS Certified Alexa Skill Builder - Specialty

68 Questions

Exam 3

AWS Certified Cloud Practitioner (CLF-C01)

803 Questions

Exam 4

AWS Certified Data Analytics - Specialty (DAS-C01)

135 Questions

Exam 5

AWS Certified Database - Specialty

156 Questions

Exam 6

AWS Certified Developer Associate (DVA-C01)

470 Questions

Exam 7

AWS Certified Machine Learning - Specialty (MLS-C01)

159 Questions

Exam 8

AWS Certified Security - Specialty (SCS-C01)

295 Questions

Exam 9

AWS Certified Solutions Architect - Associate SAA-C02

596 Questions

Exam 11

AWS Certified SysOps Administrator - Associate (SOA-C02)

54 Questions

Exam 12

AWS DevOps Engineer - Professional (DOP-C01)

610 Questions

Exam 13

AWS Certified SysOps Administrator (SOA-C01)

976 Questions

Show Answer