AWS-Certified-Solutions-Architect-Professional Free Practice Test

- (Exam Topic 2)
A company has developed a hybrid solution between its data center and AWS. The company uses Amazon VPC and Amazon EC2 instances that send application togs to Amazon CloudWatch. The EC2 instances read data from multiple relational databases that are hosted on premises.
The company wants to monitor which EC2 instances are connected to the databases in near-real time. The company already has a monitoring solution that uses Splunk on premises. A solutions architect needs to determine how to send networking traffic to Splunk.
How should the solutions architect meet these requirements?

1. A. Enable VPC flows logs, and send them to CloudWatc
2. B. Create an AWS Lambda function to periodically export the CloudWatch logs to an Amazon S3 bucket by using the pre-defined export functio
3. C. Generate ACCESS_KEY and SECRET_KEY AWS credential
4. D. Configure Splunk to pull the logs from the S3 bucket by using those credentials.
5. E. Create an Amazon Kinesis Data Firehose delivery stream with Splunk as the destinatio
6. F. Configure a pre-processing AWS Lambda function with a Kinesis Data Firehose stream processor that extracts individual log events from records sent by CloudWatch Logs subscription filter
7. G. Enable VPC flows logs, and send them to CloudWatc
8. H. Create a CloudWatch Logs subscription that sends log events to the Kinesis Data Firehose delivery stream.
9. I. Ask the company to log every request that is made to the databases along with the EC2 instance IP addres
10. J. Export the CloudWatch logs to an Amazon S3 bucke
11. K. Use Amazon Athena to query the logs grouped by database nam
12. L. Export Athena results to another S3 bucke
13. M. Invoke an AWS Lambdafunction to automatically send any new file that is put in the S3 bucket to Splunk.
14. N. Send the CloudWatch logs to an Amazon Kinesis data stream with Amazon Kinesis Data Analytics for SOL Application
15. O. Configure a 1 -minute sliding window to collect the event
16. P. Create a SQL query that uses the anomaly detection template to monitor any networking traffic anomalies in near-real tim
17. Q. Send the result to an Amazon Kinesis Data Firehose delivery stream with Splunk as the destination.

Correct Answer: B
https://docs.aws.amazon.com/firehose/latest/dev/creating-the-stream-to-splunk.html

- (Exam Topic 1)
A company runs a serverless application in a single AWS Region. The application accesses external URLs and extracts metadata from those sites. The company uses an Amazon Simple Notification Service (Amazon SNS) topic to publish URLs to an Amazon Simple Queue Service (Amazon SQS) queue An AWS Lambda function uses the queue as an event source and processes the URLs from the queue Results are saved to an Amazon S3 bucket
The company wants to process each URL other Regions to compare possible differences in site localization URLs must be published from the existing Region. Results must be written to the existing S3 bucket in the current Region.
Which combination of changes will produce multi-Region deployment that meets these requirements? (Select TWO.)

1. A. Deploy the SOS queue with the Lambda function to other Regions.
2. B. Subscribe the SNS topic in each Region to the SQS queue.
3. C. Subscribe the SQS queue in each Region to the SNS topics in each Region.
4. D. Configure the SQS queue to publish URLs to SNS topics in each Region.
5. E. Deploy the SNS topic and the Lambda function to other Regions.

Correct Answer: AC
https://docs.aws.amazon.com/sns/latest/dg/sns-cross-region-delivery.html

- (Exam Topic 1)
An international delivery company hosts a delivery management system on AWS. Drivers use the system to upload confirmation of delivery. Confirmation includes the recipient's signature or a photo of the package with the recipient. The driver's handheld device uploads signatures and photos through FTP to a single Amazon EC2 instance. Each handheld device saves a file in a directory based on the signed-in user, and the file name matches the delivery number. The EC2 instance then adds metadata to the file after querying a central database to pull delivery information. The file is then placed in Amazon S3 for archiving.
As the company expands, drivers report that the system is rejecting connections. The FTP server is having problems because of dropped connections and memory issues. In response to these problems, a system engineer schedules a cron task to reboot the EC2 instance every 30 minutes. The billing team reports that files are not always in the archive and that the central system is not always updated.
A solutions architect needs to design a solution that maximizes scalability to ensure that the archive always receives the files and that systems are always updated. The handheld devices cannot be modified, so the company cannot deploy a new application.
Which solution will meet these requirements?

1. A. Create an AMI of the existing EC2 instanc
2. B. Create an Auto Scaling group of EC2 instances behind an Application Load Balance
3. C. Configure the Auto Scaling group to have a minimum of three instances.
4. D. Use AWS Transfer Family to create an FTP server that places the files in Amazon Elastic File System (Amazon EFS). Mount the EFS volume to the existing EC2 instanc
5. E. Point the EC2 instance to the new path for file processing.
6. F. Use AWS Transfer Family to create an FTP server that places the files in Amazon S3. Use an S3 event notification through Amazon Simple Notification Service (Amazon SNS) to invoke an AWS Lambda functio
7. G. Configure the Lambda function to add the metadata and update the delivery system.
8. H. Update the handheld devices to place the files directly in Amazon S3. Use an S3 event notification through Amazon Simple Queue Service (Amazon SQS) to invoke an AWS Lambda functio
9. I. Configure the Lambda function to add the metadata and update the delivery system.

Correct Answer: C
Using AWS Transfer Family to create an FTP server that places the files in Amazon S3 and using S3 event notifications through Amazon Simple Notification Service (Amazon SNS) to invoke an AWS Lambda function will ensure that the archive always receives the files and that the central system is always updated. This solution maximizes scalability and eliminates the need for manual intervention, such as rebooting the EC2 instance.

- (Exam Topic 2)
A company has migrated a legacy application to the AWS Cloud. The application runs on three Amazon EC2 instances that are spread across three Availability Zones. One EC2 instance is in each Availability Zone. The EC2 instances are running in three private subnets of the VPC and are set up as targets for an Application Load Balancer (ALB) that is associated with three public subnets.
The application needs to communicate with on-premises systems. Only traffic from IP addresses in the company's IP address range are allowed to access the on-premises systems. The company's security team is bringing only one IP address from its internal IP address range to the cloud. The company has added this IP address to the allow list for the company firewall. The company also has created an Elastic IP address for this IP address.
A solutions architect needs to create a solution that gives the application the ability to communicate with the on-premises systems. The solution also must be able to mitigate failures automatically.
Which solution will meet these requirements?

1. A. Deploy three NAT gateways, one in each public subne
2. B. Assign the Elastic IP address to the NAT gateway
3. C. Turn on health checks for the NAT gateway
4. D. If a NAT gateway fails a health check, recreate the NAT gateway and assign the Elastic IP address to the new NAT gateway.
5. E. Replace the ALB with a Network Load Balancer (NLB). Assign the Elastic IP address to the NLB Turn on health checks for the NL
6. F. In the case of a failed health check, redeploy the NLB in different subnets.
7. G. Deploy a single NAT gateway in a public subne
8. H. Assign the Elastic IP address to the NAT gateway.Use Amazon CloudWatch with a custom metric tomonitor the NAT gatewa
9. I. If the NAT gateway is unhealthy, invoke an AWS Lambda function to create a new NAT gateway in a different subne
10. J. Assign the Elastic IP address to the new NAT gateway.
11. K. Assign the Elastic IP address to the AL
12. L. Create an Amazon Route 53 simple record with the Elastic IP address as the valu
13. M. Create a Route 53 health chec
14. N. In the case of a failed health check, recreate the ALB in different subnets.

Correct Answer: C
to connect out from the private subnet you need an NAT gateway and since only one Elastic IP whitelisted on firewall its one NATGateway at time and if AZ failure happens Lambda creates a new NATGATEWAY in a different AZ using the Same Elastic IP ,dont be tempted to select D since application that needs to connect is on a private subnet whose outbound connections use the NATGateway Elastic IP

- (Exam Topic 1)
A company is in the process of implementing AWS Organizations to constrain its developers to use only Amazon EC2. Amazon S3 and Amazon DynamoDB. The developers account resides In a dedicated organizational unit (OU). The solutions architect has implemented the following SCP on the developers account:

When this policy is deployed, IAM users in the developers account are still able to use AWS services that are not listed in the policy. What should the solutions architect do to eliminate the developers' ability to use services outside the scope of this policy?

1. A. Create an explicit deny statement for each AWS service that should be constrained
2. B. Remove the Full AWS Access SCP from the developer account's OU
3. C. Modify the Full AWS Access SCP to explicitly deny all services
4. D. Add an explicit deny statement using a wildcard to the end of the SCP

Correct Answer: B
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inheritance_auth.html