AWS-Solution-Architect-Associate Free Practice Test

- (Topic 2)
A medical records company is hosting an application on Amazon EC2 instances. The application processes customer data files that are stored on Amazon S3. The EC2 instances are hosted in public subnets. The EC2 instances access Amazon S3 over the internet, but they do not require any other network access.
A new requirement mandates that the network traffic for file transfers take a private route and not be sent over the internet.
Which change to the network architecture should a solutions architect recommend to meet this requirement?

1. A. Create a NAT gatewa
2. B. Configure the route table for the public subnets to send traffic to Amazon S3 through the NAT gateway.
3. C. Configure the security group for the EC2 instances to restrict outbound traffic so that only traffic to the S3 prefix list is permitted.
4. D. Move the EC2 instances to private subnet
5. E. Create a VPC endpoint for Amazon S3, and link the endpoint to the route table for the private subnets
6. F. Remove the internet gateway from the VP
7. G. Set up an AWS Direct Connect connection, and route traffic to Amazon S3 over the Direct Connect connection.

Correct Answer: C
To meet the new requirement of transferring files over a private route, the EC2 instances should be moved to private subnets, which do not have direct access to the internet. This ensures that the traffic for file transfers does not go over the internet. To enable the EC2 instances to access Amazon S3, a VPC endpoint for Amazon S3 can be created. VPC endpoints allow resources within a VPC to communicate with resources in other services without the traffic being sent over the internet. By linking the VPC endpoint to the route table for the private subnets, the EC2 instances can access Amazon S3 over a
private connection within the VPC.

- (Topic 1)
A company is planning to use an Amazon DynamoDB table for data storage. The company is concerned about cost optimization. The table will not be used on most mornings. In the evenings, the read and write traffic will often be unpredictable. When traffic spikes occur, they will happen very quickly.
What should a solutions architect recommend?

1. A. Create a DynamoDB table in on-demand capacity mode.
2. B. Create a DynamoDB table with a global secondary index.
3. C. Create a DynamoDB table with provisioned capacity and auto scaling.
4. D. Create a DynamoDB table in provisioned capacity mode, and configure it as a global table.

Correct Answer: A

- (Topic 3)
A company is launching an application on AWS. The application uses an Application Load (ALB) to direct traffic to at least two Amazon EC2 instances in a single target group.
The instances are in an Auto Scaling group for each environment. The company requires a development and a production environment. The production environment will have periods of high traffic.
Which solution will configure the development environment MOST cost-effectively?

1. A. Reconfigure the target group in the development environment to have one EC2 instance as a target.
2. B. Change the ALB balancing algorithm to least outstanding requests.
3. C. Reduce the size of the EC2 instances in both environments.
4. D. Reduce the maximum number of EC2 instances in the development environment’s Auto Scaling group

Correct Answer: D
This option will configure the development environment in the most cost- effective way as it reduces the number of instances running in the development environment and therefore reduces the cost of running the application. The development environment typically requires less resources than the production environment, and it is unlikely that the development environment will have periods of high traffic that would require a large number of instances. By reducing the maximum number of instances in the
development environment's Auto Scaling group, the company can save on costs while still maintaining a functional development environment.

- (Topic 3)
A company's application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. On the first day of every month at midnight. The application becomes much slower when the month-end financial calcualtion bath runs. This causes the CPU utilization of the EC2 instaces to immediately peak to 100%, which disrupts the application.
What should a solution architect recommend to ensure the application is able to handle the workload and avoid downtime?

1. A. Configure an Amazon CloudFront distribution in from of the ALB.
2. B. Configure an EC2 Auto Scaling simple scaling policy based on CPU utilization.
3. C. Configure an EC2 Auto Scaling scheduled scaling policy based on the monthly schedule.
4. D. Configure Amazon ElasticCache to remove some of the workload from tha EC2 instances.

Correct Answer: C
Configure an EC2 Auto Scaling scheduled scaling policy based on the monthly schedule is the best option because it allows for the proactive scaling of the EC2 instances before the monthly batch run begins. This will ensure that the application is able to handle the increased workload without experiencing downtime. The scheduled scaling policy can be configured to increase the number of instances in the Auto Scaling group a few hours before the batch run and then decrease the number of instances after the batch run is complete. This will ensure that the resources are available when needed and not wasted when not needed. The most appropriate solution to handle the increased workload during the monthly batch run and avoid downtime would be to configure an EC2 Auto Scaling scheduled scaling policy based on the monthly schedule. https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-scheduled- scaling.html

- (Topic 2)
A company needs to move data from an Amazon EC2 instance to an Amazon S3 bucket. The company must ensure that no API calls and no data are routed through public internet routes. Only the EC2 instance can have access to upload data to the S3 bucket.
Which solution will meet these requirements?

1. A. Create an interface VPC endpoint for Amazon S3 in the subnet where the EC2 instance is locate
2. B. Attach a resource policy to the S3 bucket to only allow the EC2 instance's IAM role for access.
3. C. Create a gateway VPC endpoint for Amazon S3 in the Availability Zone where the EC2 instance is locate
4. D. Attach appropriate security groups to the endpoin
5. E. Attach a resource policy lo the S3 bucket to only allow the EC2 instance's IAM role for access.
6. F. Run the nslookup tool from inside the EC2 instance to obtain the private IP address of the S3 bucket's service API endpoin
7. G. Create a route in the VPC route table to provide theEC2 instance with access to the S3 bucke
8. H. Attach a resource policy to the S3 bucket to only allow the EC2 instance's IAM role for access.
9. I. Use the AWS provided, publicly available ip-ranges.json tile to obtain the private IP address of the S3 bucket's service API endpoin
10. J. Create a route in the VPC route table to provide the EC2 instance with access to the S3 bucke
11. K. Attach a resource policy to the S3 bucket to only allow the EC2 instance's IAM role for access.

Correct Answer: A
(https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/)