AWS-Certified-Solutions-Architect-Professional Free Practice Test

- (Exam Topic 2)
A company that uses AWS Organizations is creating several new AWS accounts. The company is setting up controls to properly allocate AWS costs to business units. The company must Implement a solution to ensure that all resources include a tag that has a key of costcenter and a value from a predefined list of business units. The solution must send a notification each time a resource tag does not meet these criteria. The solution must not prevent the creation of resources.
Which solution will meet these requirements with the LEAST operational overhead?

1. A. Create an IAM policy for all actions that create AWS resource
2. B. Add a condition to the policy that aws:RequestTag/costcenter must exist and must contain a valid business unit valu
3. C. Create an Amazon EventBridge (Amazon CloudWatch Events) rule that monitors IAM service events and Amazon EC2 service events for noncompliant tag policie
4. D. Configure the rule to send notifications through Amazon Simple Notification Service (Amazon SNS).
5. E. Create an IAM policy for all actions that create AWS resource
6. F. Add a condition to the policy that awsResourceTag/costcenter must exist and must contain avalid business unit value Create an Amazon EventBridge (Amazon CloudWatch Events) rule that monitors IAM service events and Amazon EC2 service events for noncompliant tag policie
7. G. Configure the rule to send notifications through Amazon Simple Notification Service (Amazon SNS).
8. H. Create an organization tag policy that ensures that all resources have the costcenter tag with a valid business unit valu
9. I. Do not select the option to prevent operations when tags are noncomplian
10. J. Create an Amazon Event8ridge (Amazon CloudWatch Events) rule that monitors all events for noncompliant tag policie
11. K. Configure the rule to send notifications through Amazon Simple Notification Service (Amazon SNS).
12. L. Create an organization tag policy that ensures that all resources have the costcenter tag with a valid business unit valu
13. M. Select the option to prevent operations when tags are noncompliant Create an Amazon EventBridge (Amazon CloudWatch Events) rule that monitors all events for noncompliant tag policie
14. N. Configure the rule to send notifications through Amazon Simple Notification Service (Amazon SNS).

Correct Answer: B

- (Exam Topic 2)
During an audit, a security team discovered that a development team was putting IAM user secret access keys in their code and then committing it to an AWS CodeCommit repository . The security team wants to automatically find and remediate instances of this security vulnerability
Which solution will ensure that the credentials are appropriately secured automatically?

1. A. Run a script nightly using AWS Systems Manager Run Command to search for credentials on the development instances If found use AWS Secrets Manager to rotate the credentials.
2. B. Use a scheduled AWS Lambda function to download and scan the application code from CodeCommit If credentials are found, generate new credentials and store them in AWS KMS
3. C. Configure Amazon Macie to scan for credentials in CodeCommit repositories If credentials are found, trigger an AWS Lambda function to disable the credentials and notify the user
4. D. Configure a CodeCommit trigger to invoke an AWS Lambda function to scan new code submissions for credentials If credentials are found, disable them in AWS IAM and notify the user.

Correct Answer: A

- (Exam Topic 1)
A solution architect is designing an AWS account structure for a company that consists of multiple terms. All the team will work in the same AWS Region. The company needs a VPC that is connected to the on-premises network. The company expects less than 50 Mbps of total to and from the on-premises network.
Which combination of steps will meet these requirements MOST cost-effectively? (Select TWO)

1. A. Create an AWS CloudFormation template that provisions a VPC and the required subnet
2. B. Deploy the template to each AWS account
3. C. Create an AWS CloudFormabon template that provisions a VPC and the required subnet
4. D. Deploy the template to a shared services accoun
5. E. Share the subnets by using AWS Resource Access Manager
6. F. Use AWS Transit Gateway along with an AWS Site-to-Site VPN for connectivity to the on-premises networ
7. G. Share the transit gateway by using AWS Resource Access Manager
8. H. Use AWS Site-to-Site VPN for connectivity to the on-premises network
9. I. Use AWS Direct Connect for connectivity to the on-premises network.

Correct Answer: BD

- (Exam Topic 2)
A solutions architect is auditing the security setup of an AWS Lambda function for a company. The Lambda function retrieves the latest changes from an Amazon Aurora database. The Lambda function and the database run in the same VPC. Lambda environment variables are providing the database credentials to the Lambda function.
The Lambda function aggregates data and makes the data available in an Amazon S3 bucket that is configured for server-side encryption with AWS KMS managed encryption keys (SSE-KMS). The data must not travel across the internet. If any database credentials become compromised, the company needs a solution that minimizes the impact of the compromise.
What should the solutions architect recommend to meet these requirements?

1. A. Enable IAM database authentication on the Aurora DB cluste
2. B. Change the IAM role for the Lambda function to allow the function to access the database by using IAM database authenticatio
3. C. Deploy a gateway VPC endpoint for Amazon S3 in the VPC.
4. D. Enable IAM database authentication on the Aurora DB cluste
5. E. Change the IAM role for the Lambda function to allow the function to access the database by using IAM database authenticatio
6. F. Enforce HTTPS on the connection to Amazon S3 during data transfers.
7. G. Save the database credentials in AWS Systems Manager Parameter Stor
8. H. Set up password rotation on the credentials in Parameter Stor
9. I. Change the IAM role for the Lambda function to allow the function to access Parameter Stor
10. J. Modify the Lambda function to retrieve the credentials from Parameter Stor
11. K. Deploy a gateway VPC endpoint for Amazon S3 in the VPC.
12. L. Save the database credentials in AWS Secrets Manage
13. M. Set up password rotation on the credentials in Secrets Manage
14. N. Change the IAM role for the Lambda function to allow the function to access Secrets Manage
15. O. Modify the Lambda function to retrieve the credentials Om Secrets Manage
16. P. Enforce HTTPS on the connection to Amazon S3 during data transfers.

Correct Answer: A
https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.html

- (Exam Topic 2)
A company operates quick-service restaurants. The restaurants follow a predictable model with high sales traffic for -4 hours daily Sates traffic is lower outside of those peak hours.
The point of sale and management platform is deployed in the AWS Cloud and has a backend that is based or Amazon DynamoDB The database table uses provisioned throughput mode with 100.000 RCUs and 80.000 WCUs to match Known peak resource consumption.
The company wants to reduce its DynamoDB cost and minimize the operational overhead for the IT staff. Which solution meets these requirements MOST cost-effectively?

1. A. Reduce the provisioned RCUs and WCUs
2. B. Change the DynamoDB table to use on-demand capacity
3. C. Enable Dynamo DB auto seating for the table.
4. D. Purchase 1-year reserved capacity that is sufficient to cover the peak load for 4 hours each day.

Correct Answer: C