AWS-Certified-Solutions-Architect-Professional Free Practice Test

- (Exam Topic 1)
A company has deployed an application on AWS Elastic Beanstalk. The application uses Amazon Aurora for the database layer. An Amazon CloudFront distribution serves web requests and includes the Elastic Beanstalk domain name as the origin server. The distribution is configured with an alternate domain name that visitors use when they access the application.
Each week, the company takes the application out of service for routine maintenance. During the time that the application is unavailable, the company wants visitors to receive an informational message instead of a
CloudFront error message.
A solutions architect creates an Amazon S3 bucket as the first step in the process.
Which combination of steps should the solutions architect take next to meet the requirements? (Choose three.)

1. A. Upload static informational content to the S3 bucket.
2. B. Create a new CloudFront distributio
3. C. Set the S3 bucket as the origin.
4. D. Set the S3 bucket as a second origin in the original CloudFront distributio
5. E. Configure the distribution and the S3 bucket to use an origin access identity (OAI).
6. F. During the weekly maintenance, edit the default cache behavior to use the S3 origi
7. G. Revert the change when the maintenance is complete.
8. H. During the weekly maintenance, create a cache behavior for the S3 origin on the new distributio
9. I. Set the path pattern to \ Set the precedence to 0. Delete the cache behavior when the maintenance is complete.
10. J. During the weekly maintenance, configure Elastic Beanstalk to serve traffic from the S3 bucket.

Correct Answer: ACD
The company wants to serve static content from an S3 bucket during the maintenance period. To do this, the following steps are required:
Upload static informational content to the S3 bucket. This will provide the source of the content that will be served to the visitors.
Set the S3 bucket as a second origin in the original CloudFront distribution. Configure the distribution and the S3 bucket to use an origin access identity (OAI). This will allow CloudFront to access the S3 bucket securely and prevent public access to the bucket.
During the weekly maintenance, edit the default cache behavior to use the S3 origin. Revert the change when the maintenance is complete. This will redirect all web requests to the S3 bucket instead of the Elastic Beanstalk domain name.
The other options are not correct because:
Creating a new CloudFront distribution is not necessary and would require changing the alternate domain name configuration.
Creating a cache behavior for the S3 origin on a new distribution would not work because the visitors would still access the original distribution using the alternate domain name.
Configuring Elastic Beanstalk to serve traffic from the S3 bucket is not possible and would not achieve the desired result.
References:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.

- (Exam Topic 1)
A company is running applications on AWS in a multi-account environment. The company's sales team and marketing team use separate AWS accounts in AWS Organizations.
The sales team stores petabytes of data in an Amazon S3 bucket. The marketing team uses Amazon QuickSight for data visualizations. The marketing team needs access to data that the sates team stores in the S3 bucket. The company has encrypted the S3 bucket with an AWS Key Management Service (AWS KMS) key. The marketing team has already created the IAM service role for QuickSight to provide QuickSight access in the marketing AWS account. The company needs a solution that will provide secure access to the data in the S3 bucket across AWS accounts.
Which solution will meet these requirements with the LEAST operational overhead?

1. A. Create a new S3 bucket in the marketing accoun
2. B. Create an S3 replication rule in the sales account to copy the objects to the new S3 bucket in the marketing accoun
3. C. Update the QuickSight permissions in the marketing account to grant access to the new S3 bucket.
4. D. Create an SCP to grant access to the S3 bucket to the marketing accoun
5. E. Use AWS Resource Access Manager (AWS RAM) to share the KMS key from the sates account with the marketing accoun
6. F. Update the QuickSight permissions in the marketing account to grant access to the S3 bucket.
7. G. Update the S3 bucket policy in the marketing account to grant access to the QuickSight rol
8. H. Create a KMS grant for the encryption key that is used in the S3 bucke
9. I. Grant decrypt access to the QuickSight rol
10. J. Update the QuickSight permissions in the marketing account to grant access to the S3 bucket.
11. K. Create an IAM role in the sales account and grant access to the S3 bucke
12. L. From the marketing account, assume the IAM role in the sales account to access the S3 bucke
13. M. Update the QuickSight rote, to create a trust relationship with the new IAM role in the sales account.

Correct Answer: D
Create an IAM role in the sales account and grant access to the S3 bucket. From the marketing account, assume the IAM role in the sales account to access the S3 bucket. Update the QuickSight role, to create a trust relationship with the new IAM role in the sales account.
This approach is the most secure way to grant cross-account access to the data in the S3 bucket while minimizing operational overhead. By creating an IAM role in the sales account, the marketing team can assume the role in their own account, and have access to the S3 bucket. And updating the QuickSight role, to create a trust relationship with the new IAM role in the sales account will grant the marketing team to access the data in the S3 bucket and use it for data visualization using QuickSight.
AWS Resource Access Manager (AWS RAM) also allows sharing of resources between accounts, but it would require additional management and configuration to set up the sharing, which would increase operational overhead.
Using S3 replication would also replicate the data to the marketing account, but it would not provide the marketing team access to the original data, and also it would increase operational overhead with managing the replication process.
IAM roles and policies, KMS grants and trust relationships are a powerful combination for managing
cross-account access in a secure and efficient manner. References:
AWS IAM Roles
AWS KMS - Key Grants
AWS RAM

- (Exam Topic 3)
A software as a service (SaaS) company uses AWS to host a service that is powered by AWS PrivateLink. The service consists of proprietary software that runs on three Amazon EC2 instances behind a Network Load Balancer (NL B). The instances are in private subnets in multiple Availability Zones in the eu-west-2 Region. All the company's customers are in eu-west-2.
However, the company now acquires a new customer in the us-east-I Region. The company creates a new VPC and new subnets in us-east-I. The company establishes
inter-Region VPC peering between the VPCs in the two Regions.
The company wants to give the new customer access to the SaaS service, but the company does not want to immediately deploy new EC2 resources in us-east-I
Which solution will meet these requirements?

1. A. Configure a PrivateLink endpoint service in us-east-I to use the existing NL B that is in eu-west-2. Grant specific AWS accounts access to connect to the SaaS service.
2. B. Create an NL B in us-east-I . Create an IP target group that uses the IP addresses of the company's instances in eu-west-2 that host the SaaS servic
3. C. Configure a PrivateLink endpoint service that uses the NLB that is in us-east-I . Grant specific AWS accounts access to connect to the SaaS service.
4. D. Create an Application Load Balancer (ALB) in front of the EC2 instances in eu-west-2. Create an NLB in us-east-I . Associate the NLB that is in us-east-I with an ALB target group that uses the ALB that is in eu-west-2. Configure a PrivateLink endpoint service that uses the NLB that is in us-east-I . Grant specific AWS accounts access to connect to the SaaS service.
5. E. Use AWS Resource Access Manager (AWS RAM) to share the EC2 instances that are in eu-west-2. Inus-east-I , create an NLB and an instance target group that includes the shared EC2 instances from eu-west-2. Configure a PrivateLink endpoint service that uses the NL B that is in us-east-
6. F. Grant specific AWS accounts access to connect to the SaaS service.

Correct Answer: B

- (Exam Topic 2)
A company has a website that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The ALB is associated with an AWS WAF web ACL.
The website often encounters attacks in the application layer. The attacks produce sudden and significant increases in traffic on the application server. The access logs show that each attack originates from different IP addresses. A solutions architect needs to implement a solution to mitigate these attacks.
Which solution will meet these requirements with the LEAST operational overhead?

1. A. Create an Amazon CloudWatch alarm that monitors server acces
2. B. Set a threshold based on access by IP addres
3. C. Configure an alarm action that adds the IP address to the web ACL’s deny list.
4. D. Deploy AWS Shield Advanced in addition to AWS WA
5. E. Add the ALB as a protected resource.
6. F. Create an Amazon CloudWatch alarm that monitors user IP addresse
7. G. Set a threshold based on access by IP addres
8. H. Configure the alarm to invoke an AWS Lambda function to add a deny rule in the application server’s subnet route table for any IP addresses that activate the alarm.
9. I. Inspect access logs to find a pattern of IP addresses that launched the attack
10. J. Use an Amazon Route 53 geolocation routing policy to deny traffic from the countries that host those IP addresses.

Correct Answer: C
"The AWS WAF API supports security automation such as blacklisting IP addresses that exceed request limits, which can be useful for mitigating HTTP flood attacks." >
https://aws.amazon.com/blogs/security/how-to-protect-dynamic-web-applications-against-ddos-attacks-by-using

- (Exam Topic 3)
A company is migrating an on-premises application and a MySQL database to AWS. The application processes highly sensitive data, and new data is constantly updated in the database. The data must not be transferred over the internet. The company also must encrypt the data in transit and at rest.
The database is 5 TB in size. The company already has created the database schema in an Amazon RDS for MySQL DB instance. The company has set up a 1 Gbps AWS Direct Connect connection to AWS. The company also has set up a public VIF and a private VIF. A solutions architect needs to design a solution that will migrate the data to AWS with the least possible downtime.
Which solution will meet these requirements?

1. A. Perform a database backu
2. B. Copy the backup files to an AWS Snowball Edge Storage Optimized device.Import the backup to Amazon S3. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) for encryption at res
3. C. Use TLS for encryption in transi
4. D. Import the data from Amazon S3 to the DB instance.
5. E. Use AWS Database Migration Service (AWS DMS) to migrate the data to AW
6. F. Create a DMS replication instance in a private subne
7. G. Create VPC endpoints for AWS DM
8. H. Configure a DMS task to copy data from the on-premises database to the DB instance by using full load plus change data capture(CDC). Use the AWS Key Management Service (AWS KMS) default key for encryption at res
9. I. Use TLS for encryption in transit.
10. J. Perform a database backu
11. K. Use AWS DataSync to transfer the backup files to Amazon S3. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) for encryption at res
12. L. Use TLS for encryption in transi
13. M. Import the data from Amazon S3 to the DB instance.
14. N. Use Amazon S3 File Gatewa
15. O. Set up a private connection to Amazon S3 by using AWS PrivateLink.Perform a database backu
16. P. Copy the backup files to Amazon S3. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) for encryption at res
17. Q. Use TLS for encryption in transi
18. R. Import the data from Amazon S3 to the DB instance.

Correct Answer: B
The best solution is to use AWS Database Migration Service (AWS DMS) to migrate the data to AWS. AWS DMS is a web service that can migrate data from various sources to various targets, including MySQL databases. AWS DMS can perform full load and change data capture (CDC) migrations, which means that it can copy the existing data and also capture the ongoing changes to keep the source and target databases in sync. This minimizes the downtime during the migration process. AWS DMS also supports encryption at rest and in transit by using AWS Key Management Service (AWS KMS) and TLS, respectively. This ensures that the data is protected during the migration. AWS DMS can also leverage AWS Direct Connect to transfer the data over a private connection, avoiding the internet. This solution meets all the requirements of the company. References: AWS Database Migration Service Documentation, Migrating Data to Amazon RDS MySQL or MariaDB, Using SSL to Encrypt a Connection to a DB Instance