Amazon
SAP-C01 Exam
Questions

AWS Certified Solutions Architect - Professional SAP-C01

Amazon (SAP-C01) Exam Questions And Answers page 30

What solution should be implemented to provide preventive and detective controls for policy deviations?

Single Choice

A company with multiple accounts is currently using a configuration that does not meet the following security governance policies:

• Prevent ingress from port 22 to any Amazon EC2 instance.
• Require billing and application tags for resources.
• Encrypt all Amazon EBS volumes.

A solutions architect wants to provide preventive and detective controls, including notifications about a specific resource, if there are policy deviations.

Which solution should the solutions architect implement?

Create an AWS CodeCommit repository containing policy-compliant AWS CloudFormation templates. Create an AWS Service Catalog portfolio. Import the CloudFormation templates by attaching the CodeCommit repository to the portfolio. Restrict users across all accounts to items from the AWS Service Catalog portfolio. Use AWS Config managed rules to detect deviations from the policies. Configure an Amazon CloudWatch Events rule for deviations, and associate a CloudWatch alarm to send notifications when the TriggeredRules metric is greater than zero.

Use AWS Service Catalog to build a portfolio with products that are in compliance with the governance policies in a central account. Restrict users across all accounts to AWS Service Catalog products. Share a compliant portfolio to other accounts. Use AWS Config managed rules to detect deviations from the policies. Configure an Amazon CloudWatch Events rule to send a notification when a deviation occurs.

Implement policy-compliant AWS CloudFormation templates for each account, and ensure that all provisioning is completed by CloudFormation. Configure Amazon Inspector to perform regular checks against resources. Perform policy validation and write the assessment output to Amazon CloudWatch Logs. Create a CloudWatch Logs metric filter to increment a metric when a deviation occurs. Configure a CloudWatch alarm to send notifications when the configured metric is greater than zero.

Restrict users and enforce least privilege access using AWS IAM. Consolidate all AWS CloudTrail logs into a single account. Send the CloudTrail logs to Amazon Elasticsearch Service (Amazon ES). Implement monitoring, alerting, and reporting using the Kibana dashboard in Amazon ES and with Amazon SNS.

Designing for security and compliance

How can an Administrator address the issue of developers not being able to create Amazon S3 buckets in an AWS account with an attached SCP?

Single Choice

A company with several AWS accounts is using AWS Organizations and service control policies (SCPs). An Administrator created the following SCP and has attached it to an organizational unit (OU) that contains AWS account 1111-1111-1111:

Developers working in account 1111-1111-1111 complain that they cannot create Amazon S3 buckets. How should the Administrator address this problem?

Add s3:CreateBucket with Allow effect to the SCP.

Remove the account from the OU, and attach the SCP directly to account 1111-1111-1111.

Instruct the Developers to add Amazon S3 permissions to their IAM entities.

Remove the SCP from account 1111-1111-1111.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing for security and compliance

How can performance be improved in a serverless application using Amazon API Gateway, AWS Lambda, and Amazon DynamoDB?

Multiple Choice

A company would like to implement a serverless application by using Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. They deployed a proof of concept and stated that the average response time is greater than what their upstream services can accept. Amazon CloudWatch metrics did not indicate any issues with DynamoDB but showed that some Lambda functions were hitting their timeout.

Which of the following actions should the Solutions Architect consider to improve performance? (Choose two.)

Configure the AWS Lambda function to reuse containers to avoid unnecessary startup time.

Increase the amount of memory and adjust the timeout on the Lambda function. Complete performance testing to identify the ideal memory and timeout configuration for the Lambda function.

Create an Amazon ElastiCache cluster running Memcached, and configure the Lambda function for VPC integration with access to the Amazon ElastiCache cluster.

Enable API cache on the appropriate stage in Amazon API Gateway, and override the TTL for individual methods that require a lower TTL than the entire stage.

Increase the amount of CPU, and adjust the timeout on the Lambda function. Complete performance testing to identify the ideal CPU and timeout configuration for the Lambda function.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing for security and compliance

How can the objectives of authenticating against an on-premises LDAP server and restricting S3 access be achieved?

Multiple Choice

A corporate web application is deployed within an Amazon Virtual Private Cloud (VPC) and is connected to the corporate data center via an IPSec VPN. The application must authenticate against the on-premises LDAP server. After authentication, each logged-in user can only access an Amazon Simple Storage Space (S3) keyspace specific to that user.

Which two approaches can satisfy these objectives? (Choose two.)

The application authenticates against IAM Security Token Service using the LDAP credentials the application uses those temporary AWS security credentials to access the appropriate S3 bucket.

Develop an identity broker that authenticates against IAM security Token service to assume a IAM role in order to get temporary AWS security credentials The application calls the identity broker to get AWS temporary security credentials with access to the appropriate S3 bucket.

The application authenticates against LDAP and retrieves the name of an IAM role associated with the user. The application then calls the IAM Security Token Service to assume that IAM role. The application can use the temporary credentials to access the appropriate S3 bucket.

Develop an identity broker that authenticates against LDAP and then calls IAM Security Token Service to get IAM federated user credentials. The application calls the identity broker to get IAM federated user credentials with access to the appropriate S3 bucket.

The application authenticates against LDAP the application then calls the AWS identity and Access Management (IAM) Security service to log in to IAM using the LDAP credentials the application can use the IAM temporary credentials to access the appropriate S3 bucket.

Designing enterprise-wide scalable operations on AWS Designing for security and compliance

Correct Answers:

The application authenticates against LDAP and retrieves the name of an IAM role associated with the user. The application then calls the IAM Security Token Service to assume that IAM role. The application can use the temporary credentials to access the appropriate S3 bucket.
Develop an identity broker that authenticates against LDAP and then calls IAM Security Token Service to get IAM federated user credentials. The application calls the identity broker to get IAM federated user credentials with access to the appropriate S3 bucket.

Explanation:

Imagine that in your organization, you want to provide a way for users to copy data from their computers to a backup folder. You build an application that users can run on their computers. On the back end, the application reads and writes objects in an S3 bucket. Users don t have direct access to AWS. Instead, the application communicates with an identity provider (IdP) to authenticate the user. The IdP gets the user information from your organization s identity store (such as an LDAP directory) and then generates a SAML assertion that includes authentication and authorization information about that user. The application then uses that assertion to make a call to the AssumeRoleWithSAML API to get temporary security credentials. The app can then use those credentials to access a folder in the S3 bucket that s specific to the user.

References:

http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html

How can the load on an on-premises database be reduced in a cost-effective manner?

Single Choice

A customer has a 10 GB AWS Direct Connect connection to an AWS region where they have a web application hosted on Amazon Elastic Computer Cloud (EC2). The application has dependencies on an on-premises mainframe database that uses a BASE (Basic Available, Soft state, Eventual consistency) rather than an ACID (Atomicity, Consistency, Isolation, Durability) consistency model. The application is exhibiting undesirable behavior because the database is not able to handle the volume of writes.

How can you reduce the load on your on-premises database resources in the most cost-effective way?

Use an Amazon Elastic Map Reduce (EMR) S3DistCp as a synchronization mechanism between the on-premises database and a Hadoop cluster on AWS.

Modify the application to write to an Amazon SQS queue and develop a worker process to flush the queue to the on-premises database.

Modify the application to use DynamoDB to feed an EMR cluster which uses a map function to write to the on-premises database.

Provision an RDS read-replica database on AWS to handle the writes and synchronize the two databases using Data Pipeline.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing for security and compliance

Which solution is cost-effective and improves website performance during peak load periods?

Single Choice

A customer has a website which shows all the deals available across the market. The site experiences a load of 5 large EC2 instances generally.
However, a week before Thanksgiving vacation they encounter a load of almost 20 large instances. The load during that period varies over the day based on the office timings.

Which of the below mentioned solutions is cost effective as well as help the website achieve better performance?

Setup to run 10 instances during the pre-vacation period and only scale up during the office time by launching 10 more instances using the AutoScaling schedule.

Keep only 10 instances running and manually launch 10 instances every day during office hours.

During the pre-vacation period setup 20 instances to run continuously.

During the pre-vacation period setup a scenario where the organization has 15 instances running and 5 instances to scale up and down using Auto Scaling based on the network I/O policy.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing enterprise-wide scalable operations on AWS

How to resolve connectivity issues between EC2 instances and datacenter servers in AWS?

Multiple Choice

A customer has established an AWS Direct Connect connection to AWS. The link is up and routes are being advertised from the customer's end, however the customer is unable to connect from EC2 instances inside its VPC to servers residing in its datacenter.

Which of the following options provide a viable solution to remedy this situation? (Choose two.)

Add a route to the route table with an iPsec VPN connection as the target.

Enable route propagation to the virtual pinnate gateway (VGW).

Enable route propagation to the customer gateway (CGW).

Modify the route table of all Instances using the 'route' command.

Modify the Instances VPC subnet route table by adding a route back to the customer's on-premises environment.

Designing enterprise-wide scalable operations on AWS Designing for security and compliance

How can a customer implement role separation between EC2 service administrators and security officers for an SSL enabled web application on AWS?

Single Choice

A customer is deploying an SSL enabled web application to AWS and would like to implement a separation of roles between the EC2 service administrators that are entitled to login to instances as well as making API calls and the security officers who will maintain and have exclusive access to the application s X.509 certificate that contains the private key.

Upload the certificate on an S3 bucket owned by the security officers and accessible only by EC2 Role of the web servers.

Configure the web servers to retrieve the certificate upon boot from an CloudHSM is managed by the security officers.

Configure system permissions on the web servers to restrict access to the certificate only to the authority security officers

Configure IAM policies authorizing access to the certificate store only to the security officers and terminate SSL on an ELB.

Implementing cost control strategies Designing for security and compliance

What is the most cost-effective solution to accommodate bursts of usage in an Amazon Redshift cluster?

Single Choice

A data analytics company has an Amazon Redshift cluster that consists of several reserved nodes. The cluster is experiencing unexpected bursts of usage because a team of employees is compiling a deep audit analysis report. The queries to generate the report are complex read queries and are CPU intensive.

Business requirements dictate that the cluster must be able to service read and write queries at all times. A solutions architect must devise a solution that accommodates the bursts of usage.

Which solution meets these requirements MOST cost-effectively?

Provision an Amazon EMR cluster. Offload the complex data processing tasks.

Deploy an AWS Lambda function to add capacity to the Amazon Redshift cluster by using a classic resize operation when the cluster s CPU metrics in Amazon CloudWatch reach 80%.

Deploy an AWS Lambda function to add capacity to the Amazon Redshift cluster by using an elastic resize operation when the cluster s CPU metrics in Amazon CloudWatch reach 80%

Turn on the Concurrency Scaling feature for the Amazon Redshift cluster.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing for security and compliance

How Can a Flight Tracker App Achieve Maximum Reliability on AWS?

Single Choice

A development team has created a new flight tracker application that provides near-real-time data to users. The application has a front end that consists of an Application Load Balancer (ALB) in front of two large Amazon EC2 instances in a single Availability Zone. Data is stored in a single Amazon RDS MySQL DB instance. An Amazon Route 53 DNS record points to the ALB.

Management wants the development team to improve the solution to achieve maximum reliability with the least amount of operational overhead.

Which set of actions should the team take?

Create RDS MySQL read replicas. Deploy the application to multiple AWS Regions. Use a Route 53 latency-based routing policy to route to the application.

Configure the DB instance as Multi-AZ. Deploy the application to two additional EC2 instances in different Availability Zones behind an ALB.

Replace the DB instance with Amazon DynamoDB global tables. Deploy the application in multiple AWS Regions. Use a Route 53 latency-based routing policy to route to the application.

Replace the DB instance with Amazon Aurora with Aurora Replicas. Deploy the application to multiple smaller EC2 instances across multiple Availability Zones in an Auto Scaling group behind an ALB.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing enterprise-wide scalable operations on AWS

Previous Questions

Next Questions

Amazon (SAP-C01) Exam Questions And Answers page 30

What solution should be implemented to provide preventive and detective controls for policy deviations?

Comments

How can an Administrator address the issue of developers not being able to create Amazon S3 buckets in an AWS account with an attached SCP?

Comments

How can performance be improved in a serverless application using Amazon API Gateway, AWS Lambda, and Amazon DynamoDB?

Correct Answers:

References:

Comments

How can the objectives of authenticating against an on-premises LDAP server and restricting S3 access be achieved?

Correct Answers:

Explanation:

References:

Comments

How can the load on an on-premises database be reduced in a cost-effective manner?

Correct Answer:

References:

Comments

Which solution is cost-effective and improves website performance during peak load periods?

Correct Answer:

Explanation:

Comments

How to resolve connectivity issues between EC2 instances and datacenter servers in AWS?

Comments

How can a customer implement role separation between EC2 service administrators and security officers for an SSL enabled web application on AWS?

Correct Answer:

Explanation:

Comments

What is the most cost-effective solution to accommodate bursts of usage in an Amazon Redshift cluster?

Comments

How Can a Flight Tracker App Achieve Maximum Reliability on AWS?

Correct Answer:

References:

Comments

{{ exam.shortName }}

{{ exam.longName }}