Amazon
SAP-C01 Exam
Questions

AWS Certified Solutions Architect - Professional SAP-C01

Amazon (SAP-C01) Exam Questions And Answers page 27

How can a company ensure high availability connectivity to a vendor's API in their AWS VPC?

Single Choice

A company that runs applications on AWS recently subscribed to a new software-as-a-service (SaaS) data vendor. The vendor provides the data by way of a REST API that the vendor hosts in its AWS environment. The vendor offers multiple options for connectivity to the API and is working with the company to find the best way to connect.

The company s AWS account does not allow outbound internet access from its AWS environment. The vendor s services run on AWS in the same Region as the company s applications.

A solutions architect must implement connectivity to the vendor s API so that the API is highly available in the company s VPC.

Which solution will meet these requirements?

Connect to the vendor s public API address for the data service

Connect to the vendor by way of a VPC peering connection between the vendor s VPC and the company s VPC

Connect to the vendor by way of a VPC endpoint service that uses AWS PrivateLink

Connect to a public bastion host that the vendor provides. Tunnel the API traffic

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing for security and compliance

How can a solutions architect ensure secure storage and scalability for medical device sensor data in AWS?

Single Choice

A company that tracks medical devices in hospitals wants to migrate its existing storage solution to the AWS Cloud. The company equips all of its devices with sensors that collect location and usage information. This sensor data is sent in unpredictable patterns with large spikes. The data is stored in a MySQL database running on premises at each hospital. The company wants the cloud storage solution to scale with usage.

The company s analytics team uses the sensor data to calculate usage by device type and hospital. The team needs to keep analysis tools running locally while fetching data from the cloud. The team also needs to use existing Java application and SQL queries with as few changes as possible.

How should a solutions architect meet these requirements while ensuring the sensor data is secure?

Store the data in an Amazon Aurora Serverless database. Serve the data through a Network Load Balancer (NLB). Authenticate users using the NLB with credentials stored in AWS Secrets Manager.

Store the data in an Amazon S3 bucket. Serve the data through Amazon QuickSight using an IAM user authorized with AWS Identity and Access Management (IAM) with the S3 bucket as the data source.

Store the data in an Amazon Aurora Serverless database. Serve the data through the Aurora Data API using an IAM user authorized with AWS Identity and Access Management (IAM) and the AWS Secrets Manager ARN.

Store the data in an Amazon S3 bucket. Serve the data through Amazon Athena using AWS PrivateLink to secure the data in transit.

Designing enterprise-wide scalable operations on AWS Designing for security and compliance

How can the company resolve buffering and timeout issues for users with a cost-efficient and scalable deployment?

Single Choice

A company used Amazon EC2 instances to deploy a web fleet to host a blog site. The EC2 instances are behind an Application Load Balancer (ALB) and are configured in an Auto Scaling group. The web application stores all blog content on an Amazon EFS volume.

The company recently added a feature for bloggers to add video to their posts, attracting 10 times the previous user traffic. At peak times of day, users report buffering and timeout issues while attempting to reach the site or watch videos.

Which is the MOST cost-efficient and scalable deployment that will resolve the issues for users?

Reconfigure Amazon EFS to enable maximum I/O.

Update the blog site to use instance store volumes for storage. Copy the site contents to the volumes at launch and to Amazon S3 at shutdown.

Configure an Amazon CloudFront distribution. Point the distribution to an S3 bucket, and migrate the videos from EFS to Amazon S3.

Set up an Amazon CloudFront distribution for all site contents, and point the distribution at the ALB.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing enterprise-wide scalable operations on AWS

How can the Solutions Architect enhance the security of the company's platform using separate AWS accounts?

Single Choice

A company uses Amazon S3 to host a web application. Currently, the company uses a continuous integration tool running on an Amazon EC2 instance that builds and deploys the application by uploading it to an S3 bucket. A Solutions Architect needs to enhance the security of the company s platform with the following requirements:

• A build process should be run in a separate account from the account hosting the web application.
• A build process should have minimal access in the account it operates in.
• Long-lived credentials should not be used.

As a start, the Development team created two AWS accounts: one for the application named web account process; other is a named build account.

Which solution should the Solutions Architect use to meet the security requirements?

In the build account, create a new IAM role, which can be assumed by Amazon EC2 only. Attach the role to the EC2 instance running the continuous integration process. Create an IAM policy to allow s3: PutObject calls on the S3 bucket in the web account. In the web account, create an S3 bucket policy attached to the S3 bucket that allows the build account to use s3:PutObject calls.

In the build account, create a new IAM user. Store the access key and secret access key in AWS Secrets Manager. Modify the continuous integration process to perform a lookup of the IAM user credentials from Secrets Manager. Create an IAM policy to allow s3: PutObject calls on the S3 bucket in the web account, and attack it to the user. In the web account, create an S3 bucket policy attached to the S3 bucket that allows the newly created IAM user to use s3:PutObject calls.

In the build account, modify the continuous integration process to perform a lookup of the IAM user credentials from AWS Secrets Manager. In the web account, create a new IAM user. Store the access key and secret access key in Secrets Manager. Attach the PowerUserAccess IAM policy to the IAM user.

Designing for security and compliance

How can Amazon S3 be secured to prevent unauthorized access from an EC2 instance in a different VPC?

Single Choice

A company uses Amazon S3 to store documents that may only be accessible to an Amazon EC2 instance in a certain virtual private cloud (VPC). The company fears that a malicious insider with access to this instance could also set up an EC2 instance in another VPC to access these documents.

Which of the following solutions will provide the required protection?

Use an S3 VPC endpoint and an S3 bucket policy to limit access to this VPC endpoint.

Use EC2 instance profiles and an S3 bucket policy to limit access to the role attached to the instance profile.

Use S3 client-side encryption and store the key in the instance metadata.

Use S3 server-side encryption and protect the key with an encryption context.

Designing for security and compliance

How can costs related to increasing compute needs be reduced in an Amazon EMR cluster?

Single Choice

A company uses an Amazon EMR cluster to process data once a day. The raw data comes from Amazon S3, and the resulting processed data is also stored in Amazon S3. The processing must complete within 4 hours; currently, it only takes 3 hours. However, the processing time is taking 5 to 10 minutes longer each week due to an increasing volume of raw data.

The team is also concerned about rising costs as the compute capacity increases. The EMR cluster is currently running on three m3.xlarge instances (one master and two core nodes).

Which of the following solutions will reduce costs related to the increasing compute needs?

Add additional task nodes, but have the team purchase an all-upfront convertible Reserved Instance for each additional node to offset the costs.

Add additional task nodes, but use instance fleets with the master node in on-Demand mode and a mix of On-Demand and Spot Instances for the core and task nodes. Purchase a scheduled Reserved Instance for the master node.

Add additional task nodes, but use instance fleets with the master node in Spot mode and a mix of On-Demand and Spot Instances for the core and task nodes. Purchase enough scheduled Reserved Instances to offset the cost of running any On-Demand instances.

Add additional task nodes, but use instance fleets with the master node in On-Demand mode and a mix of On-Demand and Spot Instances for the core and task nodes. Purchase a standard all-upfront Reserved Instance for the master node.

Implementing cost control strategies

What is the most efficient setup for automatically applying security configurations to new AWS department accounts?

Single Choice

A company uses AWS Organizations. The company has an organization that has a central management account. The company plans to provision multiple AWS accounts for different departments. All department accounts must be a member of the company s organization.

Compliance requirements state that each account must have only one VPC. Additionally, each VPC must have an identical network security configuration that includes fully configured subnets, gateways, network ACLs, and security groups.

The company wants this security setup to be automatically applied when a new department account is created. The company wants to use the central management account for all security operations, but the central management account should not have the security setup.

Which approach meets these requirements with the LEAST amount of setup?

Create an OU within the company s organization. Add department accounts to the OU. From the central management account, create an AWS CloudFormation template that includes the VPC and the network security configurations. Create a CloudFormation stack set by using this template file with automated deployment enabled. Apply the CloudFormation stack set to the OU.

Create a new organization with the central management account. Invite all AWS department accounts into the new organization. From the central management account, create an AWS CloudFormation template that includes the VPC and the network security configurations. Create a CloudFormation stack that is based on this template. Apply the CloudFormation stack to the newly created organization.

Invite department accounts to the company s organization. From the central management account, create an AWS CloudFormation template that includes the VPC and the network security configurations. Create an AWS CodePipeline pipeline that will deploy the network security setup to the newly created account. Specify the creation of an account as an event hook. Apply the event hook to the pipeline.

Invite department accounts to the company s organization. From the central management account, create an AWS CloudFormation template that includes the VPC and the network security configurations. Create an AWS Lambda function that will deploy the VPC and the network security setup to the newly created account. Create an event that watches for account creation. Configure the event to invoke the pipeline.

Designing for security and compliance

What is the operationally efficient solution for consolidating AWS CloudTrail logs into the parent account while preserving existing logs in member accounts?

Single Choice

A company uses AWS Organizations to manage one parent account and nine member accounts. The number of member accounts is expected to grow as the business grows. A security engineer has requested consolidation of AWS CloudTrail logs into the parent account for compliance purposes. Existing logs currently stored in Amazon S3 buckets in each individual member account should not be lost. Future member accounts should comply with the logging strategy.

Which operationally efficient solution meets these requirements?

Create an AWS Lambda function in each member account with a cross-account role. Trigger the Lambda functions when new CloudTrail logs are created and copy the CloudTrail logs to a centralized S3 bucket. Set up an Amazon CloudWatch alarm to alert if CloudTrail is not configured properly.

Configure CloudTrail in each member account to deliver log events to a central S3 bucket. Ensure the central S3 bucket policy allows PutObject access from the member accounts. Migrate existing logs to the central S3 bucket. Set up an Amazon CloudWatch alarm to alert if CloudTrail is not configured properly.

Configure an organization-level CloudTrail in the parent account to deliver log events to a central S3 bucket. Migrate the existing CloudTrail logs from each member account to the central S3 bucket. Delete the existing CloudTrail and logs in the member accounts.

Configure an organization-level CloudTrail in the parent account to deliver log events to a central S3 bucket. Configure CloudTrail in each member account to deliver log events to the central S3 bucket.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing for security and compliance

How can administrators in an AWS organization make changes to AWS Config rules without introducing long-term maintenance?

Single Choice

A company uses AWS Organizations with a single OU named Production to manage multiple accounts. All accounts are members of the Production OU. Administrators use deny list SCPs in the root of the organization to manage access to restricted services.

The company recently acquired a new business unit and invited the new unit s existing AWS account to the organization. Once onboarded, the administrators of the new business unit discovered that they are not able to update existing AWS Config rules to meet the company s policies.

Which option will allow administrators to make changes and continue to enforce the current policies without introducing additional long-term maintenance?

Remove the organization s root SCPs that limit access to AWS Config. Create AWS Service Catalog products for the company s standard AWS Config rules and deploy them throughout the organization, including the new account.

Create a temporary OU named Onboarding for the new account. Apply an SCP to the Onboarding OU to allow AWS Config actions. Move the new account to the Production OU when adjustments to AWS Config are complete.

Convert the organization s root SCPs from deny list SCPs to allow list SCPs to allow the required services only. Temporally apply an SCP to the organization s root that allows AWS Config actions for principals only in the new account.

Create a temporary OU named Onboarding for the new account. Apply an SCP to the Onboarding OU to allow AWS Config actions. Move the organization s root SCP to the Production OU. Move the new account to the Production OU when adjustments to AWS Config are complete.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing for security and compliance

What AWS design meets the requirements for secure SQL queries on customer records by the Marketing team?

Single Choice

A company wants to allow its Marketing team to perform SQL queries on customer records to identify market segments. The data is spread across hundreds of files. The records must be encrypted in transit and at rest. The Team Manager must have the ability to manage users and groups, but no team members should have access to services or resources not required for the SQL queries. Additionally, Administrators need to audit the queries made and receive notifications when a query violates rules defined by the Security team.

AWS Organizations has been used to create a new account and an AWS IAM user with administrator permissions for the Team Manager.

Which design meets these requirements?

Apply a service control policy (SCP) that allows access to IAM, Amazon RDS, and AWS CloudTrail. Load customer records in Amazon RDS MySQL and train users to execute queries using the AWS CLI. Stream the query logs to Amazon CloudWatch Logs from the RDS database instance. Use a subscription filter with AWS Lambda functions to audit and alarm on queries against personal data.

Apply a service control policy (SCP) that denies access to all services except IAM, Amazon Athena, Amazon S3, and AWS CloudTrail. Store customer record files in Amazon S3 and train users to execute queries using the CLI via Athena. Analyze CloudTrail events to audit and alarm on queries against personal data.

Apply a service control policy (SCP) that denies access to all services except IAM, Amazon DynamoDB, and AWS CloudTrail. Store customer records in DynamoDB and train users to execute queries using the AWS CLI. Enable DynamoDB streams to track the queries that are issued and use an AWS Lambda function for real-time monitoring and alerting.

Apply a service control policy (SCP) that allows access to IAM, Amazon Athena, Amazon S3, and AWS CloudTrail. Store customer records as files in Amazon S3 and train users to leverage the Amazon S3 Select feature and execute queries using the AWS CLI. Enable S3 object-level logging and analyze CloudTrail events to audit and alarm on queries against personal data.

Designing for security and compliance

Previous Questions

Next Questions

Amazon (SAP-C01) Exam Questions And Answers page 27

How can a company ensure high availability connectivity to a vendor's API in their AWS VPC?

Correct Answer:

References:

Comments

How can a solutions architect ensure secure storage and scalability for medical device sensor data in AWS?

Comments

How can the company resolve buffering and timeout issues for users with a cost-efficient and scalable deployment?

Correct Answer:

References:

Comments

How can the Solutions Architect enhance the security of the company's platform using separate AWS accounts?

Comments

How can Amazon S3 be secured to prevent unauthorized access from an EC2 instance in a different VPC?

Comments

How can costs related to increasing compute needs be reduced in an Amazon EMR cluster?

Comments

What is the most efficient setup for automatically applying security configurations to new AWS department accounts?

Correct Answer:

References:

Comments

What is the operationally efficient solution for consolidating AWS CloudTrail logs into the parent account while preserving existing logs in member accounts?

Correct Answer:

References:

Comments

How can administrators in an AWS organization make changes to AWS Config rules without introducing long-term maintenance?

Comments

What AWS design meets the requirements for secure SQL queries on customer records by the Marketing team?

Comments

{{ exam.shortName }}

{{ exam.longName }}