Amazon
SAP-C01 Exam
Questions

AWS Certified Solutions Architect - Professional SAP-C01

Amazon (SAP-C01) Exam Questions And Answers page 32

What actions are needed to create a multi-account structure that meets the company's requirements?

Multiple Choice

A financial services company is moving to AWS and wants to enable developers to experiment and innovate while preventing access to production applications. The company has the following requirements:

• Production workloads cannot be directly connected to the internet.
• All workloads must be restricted to the us-west-2 and eu-central-1 Regions.
• Notification should be sent when developer sandboxes exceed $500 in AWS spending monthly.

Which combination of actions needs to be taken to create a multi-account structure that meets the company's requirements? (Choose three.)

Create accounts for each production workload within an organization in AWS Organizations. Place the production accounts within an organizational unit (OU). For each account, delete the default VPC. Create an SCP with a Deny rule for the attach an internet gateway and create a default VPC actions. Attach the SCP to the OU for the production accounts.

Create accounts for each production workload within an organization in AWS Organizations. Place the production accounts within an organizational unit (OU). Create an SCP with a Deny rule on the attach an internet gateway action. Create an SCP with a Deny rule to prevent use of the default VPC. Attach the SCPs to the OU for the production accounts.

Create a SCP containing a Deny Effect for cloudfront:*, iam:*, route53:*, and support:* with a StringNotEquals condition on an aws:RequestedRegion condition key with us-west-2 and eu-central-1 values. Attach the SCP to the organization's root.

Create an IAM permission boundary containing a Deny Effect for cloudfront:*, iam:*, route53:*, and support:* with a StringNotEquals condition on an aws:RequestedRegion condition key with us-west-2 and eu-central-1 values. Attach the permission boundary to an IAM group containing the development and production users.

Create accounts for each development workload within an organization in AWS Organizations. Place the development accounts within an organizational unit (OU). Create a custom AWS Config rule to deactivate all IAM users when an account's monthly bill exceeds $500.

Create accounts for each development workload within an organization in AWS Organizations. Place the development accounts within an organizational unit (OU). Create a budget within AWS Budgets for each development account to monitor and report on monthly spending exceeding $500.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Implementing cost control strategies

How to use on-premises HSMs to generate CMK material for encrypting log files in Amazon S3?

Single Choice

A financial services company logs personally identifiable information to its application logs stored in Amazon S3. Due to regulatory compliance requirements, the log files must be encrypted at rest. The security team has mandated that the company s on-premises hardware security modules (HSMs) be used to generate the CMK material.

Which steps should the solutions architect take to meet these requirements?

Create an AWS CloudHSM cluster. Create a new CMK in AWS KMS using AWS_CloudHSM as the source for the key material and an origin of AWS_CLOUDHSM. Enable automatic key rotation on the CMK with a duration of 1 year. Configure a bucket policy on the logging bucket that disallows uploads of unencrypted data and requires that the encryption source be AWS KMS.

Provision an AWS Direct Connect connection, ensuring there is no overlap of the RFC 1918 address space between on-premises hardware and the VPCs. Configure an AWS bucket policy on the logging bucket that requires all objects to be encrypted. Configure the logging application to query the on-premises HSMs from the AWS environment for the encryption key material, and create a unique CMK for each logging event.

Create a CMK in AWS KMS with no key material and an origin of EXTERNAL. Import the key material generated from the on-premises HSMs into the CMK using the public key and import token provided by AWS. Configure a bucket policy on the logging bucket that disallows uploads of non-encrypted data and requires that the encryption source be AWS KMS.

Create a new CMK in AWS KMS with AWS-provided key material and an origin of AWS_KMS. Disable this CMK, and overwrite the key material with the key material from the on-premises HSM using the public key and import token provided by AWS. Re-enable the CMK. Enable automatic key rotation on the CMK with a duration of 1 year. Configure a bucket policy on the logging bucket that disallows uploads of non-encrypted data and requires that the encryption source be AWS KMS.

Designing for security and compliance

What solutions can be used to automatically mask and transform sensitive credit card data in an Amazon S3 bucket?

Single Choice

A financial services company receives a regular data feed from its credit card servicing partner. Approximately 5,000 records are sent every 15 minutes in plaintext, delivered over HTTPS directly into an Amazon S3 bucket with server-side encryption. This feed contains sensitive credit card primary account number (PAN) data. The company needs to automatically mask the PAN before sending the data to another S3 bucket for additional internal processing. The company also needs to remove and merge specific fields, and then transform the record into JSON format. Additionally, extra feeds are likely to be added in the future, so any design needs to be easily expandable.

Which solutions will meet these requirements?

Trigger an AWS Lambda function on file delivery that extracts each record and writes it to an Amazon SQS queue. Trigger another Lambda function when new messages arrive in the SQS queue to process the records, writing the results to a temporary location in Amazon S3. Trigger a final Lambda function once the SQS queue is empty to transform the records into JSON format and send the results to another S3 bucket for internal processing.

Trigger an AWS Lambda function on file delivery that extracts each record and writes it to an Amazon SQS queue. Configure an AWS Fargate container application to automatically scale to a single instance when the SQS queue contains messages. Have the application process each record, and transform the record into JSON format. When the queue is empty, send the results to another S3 bucket for internal processing and scale down the AWS Fargate instance.

Create an AWS Glue crawler and custom classifier based on the data feed formats and build a table definition to match. Trigger an AWS Lambda function on file delivery to start an AWS Glue ETL job to transform the entire record according to the processing and transformation requirements. Define the output format as JSON. Once complete, have the ETL job send the results to another S3 bucket for internal processing.

Create an AWS Glue crawler and custom classifier based upon the data feed formats and build a table definition to match. Perform an Amazon Athena query on file delivery to start an Amazon EMR ETL job to transform the entire record according to the processing and transformation requirements. Define the output format as JSON. Once complete, send the results to another S3 bucket for internal processing and scale down the EMR cluster.

Designing for security and compliance

What is the solution with the least operational overhead to meet regulatory compliance for a financial services company selling a SaaS platform on AWS?

Single Choice

A financial services company sells its software-as-a-service (SaaS) platform for application compliance to large global banks. The SaaS platform runs on AWS and uses multiple AWS accounts that are managed in an organization in AWS Organizations. The SaaS platform uses many AWS resources globally.

For regulatory compliance, all API calls to AWS resources must be audited, tracked for changes, and stored in a durable and secure data store.

Which solution will meet these requirements with the LEAST operational overhead?

Create a new AWS CloudTrail trail. Use an existing Amazon S3 bucket in the organization s management account to store the logs. Deploy the trail to all AWS Regions. Enable MFA delete and encryption on the S3 bucket.

Create a new AWS CloudTrail trail in each member account of the organization. Create new Amazon S3 buckets to store the logs. Deploy the trail to all AWS Regions. Enable MFA delete and encryption on the S3 buckets.

Create a new AWS CloudTrail trail in the organization s management account. Create a new Amazon S3 bucket with versioning turned on to store the logs. Deploy the trail for all accounts in the organization. Enable MFA delete and encryption on the S3 bucket.

Create a new AWS CloudTrail trail in the organization s management account. Create a new Amazon S3 bucket to store the logs. Configure Amazon Simple Notification Service (Amazon SNS) to send log-file delivery notifications to an external management system that will track the logs. Enable MFA delete and encryption on the S3 bucket.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing for security and compliance

How Should a Fitness Tracker Company Design a Resilient, Read-Heavy Infrastructure?

Multiple Choice

A fitness tracking company serves users around the world, with its primary markets in North America and Asia. The company needs to design an infrastructure for its read-heavy user authorization application with the following requirements:

• Be resilient to problem with the application in any Region.
• Write to a database in a single Region.
• Read from multiple Regions.
• Support resiliency across application tiers in each Region.
• Support the relational database semantics reflected in the application.

Which combination of steps should a solutions architect take? (Choose two.)

Use an Amazon Route 53 geoproximity routing policy combined with a multivalue answer routing policy.

Deploy web, application, and MySQL database servers to Amazon EC2 instance in each Region. Set up the application so that reads and writes are local to the Region. Create snapshots of the web, application, and database servers and store the snapshots in an Amazon S3 bucket in both Regions. Set up cross-Region replication for the database layer.

Use an Amazon Route 53 geolocation routing policy combined with a failover routing policy.

Set up web, application, and Amazon RDS for MySQL instances in each Region. Set up the application so that reads are local and writes are partitioned based on the user. Set up a Multi-AZ failover for the web, application, and database servers. Set up cross-Region replication for the database layer.

Set up active-active web and application servers in each Region. Deploy an Amazon Aurora global database with clusters in each Region. Set up the application to use the in-Region Aurora database endpoints. Create snapshots of the web application servers and store them in an Amazon S3 bucket in both Regions.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing enterprise-wide scalable operations on AWS

What could be causing consistent 400 errors when updating an Amazon DynamoDB table from an Amazon ECS fleet?

Single Choice

A fleet of Amazon ECS instances is used to poll an Amazon SQS queue and update items in an Amazon DynamoDB database. Items in the table are not being updated, and the SQS queue is filling up. Amazon CloudWatch Logs are showing consistent 400 errors when attempting to update the table. The provisioned write capacity units are appropriately configured, and no throttling is occurring.

What is the LIKELY cause of the failure?

The ECS service was deleted.

The ECS configuration does not contain an Auto Scaling group.

The ECS instance task execution IAM role was modified.

The ECS task role was modified.

Designing enterprise-wide scalable operations on AWS Designing for security and compliance

How to resolve the issue of unsuccessful outbound internet connection from a private subnet?

Single Choice

After launching an instance that you intend to serve as a NAT (Network Address Translation) device in a public subnet you modify your route tables to have the NAT device be the target of internet bound traffic of your private subnet. When you try and make an outbound connection to the internet from an instance in the private subnet, you are not successful.

Which of the following steps could resolve the issue?

Disabling the Source/Destination Check attribute on the NAT instance

Attaching an Elastic IP address to the instance in the private subnet

Attaching a second Elastic Network Interface (ENI) to the NAT instance, and placing it in the private subnet

Attaching a second Elastic Network Interface (ENI) to the instance in the private subnet, and placing it in the public subnet

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing enterprise-wide scalable operations on AWS

What is the best approach for integrating a client's health check system with AWS auto scaling and CloudWatch?

Single Choice

After moving an E-Commerce website for a client from a dedicated server to AWS you have also set up auto scaling to perform health checks on the instances in your group and replace instances that fail these checks. Your client has come to you with his own health check system that he wants you to use as it has proved to be very useful prior to his site running on AWS.

What do you think would be an appropriate response to this given all that you know about auto scaling and CloudWatch?

It is not possible to implement your own health check system due to compatibility issues.

It is not possible to implement your own health check system. You need to use AWSs health check system.

It is possible to implement your own health check system and then send the instance's health information directly from your system to CloudWatch but only in the US East (N. Virginia) region.

It is possible to implement your own health check system and then send the instance's health information directly from your system to CloudWatch.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing enterprise-wide scalable operations on AWS

What are the limitations of an AWS Direct Connect Virtual Interface after setting up an AWS Direct Connect?

Single Choice

After setting an AWS Direct Connect, which of the following cannot be done with an AWS Direct Connect Virtual Interface?

You can exchange traffic between the two ports in the same region connecting to different Virtual Private Gateways (VGWs) if you have more than one virtual interface.

You can change the region of your virtual interface.

You can delete a virtual interface; if its connection has no other virtual interfaces, you can delete the connection.

You can create a hosted virtual interface.

Designing highly available, cost-efficient, fault-tolerant, scalable systems

What AWS CLI command should be used to access metrics for a running Lambda function?

Single Choice

After your Lambda function has been running for some time, you need to look at some metrics to ascertain how your function is performing and decide to use the AWS CLI to do this.

Which of the following commands must be used to access these metrics using the AWS CLI?

mon-list-metrics and mon-get-stats

list-metrics and get-metric-statistics

ListMetrics and GetMetricStatistics

list-metrics and mon-get-stats

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing enterprise-wide scalable operations on AWS

Previous Questions

Next Questions

Amazon (SAP-C01) Exam Questions And Answers page 32

What actions are needed to create a multi-account structure that meets the company's requirements?

Comments

How to use on-premises HSMs to generate CMK material for encrypting log files in Amazon S3?

Comments

What solutions can be used to automatically mask and transform sensitive credit card data in an Amazon S3 bucket?

Comments

What is the solution with the least operational overhead to meet regulatory compliance for a financial services company selling a SaaS platform on AWS?

Correct Answer:

References:

Comments

How Should a Fitness Tracker Company Design a Resilient, Read-Heavy Infrastructure?

Comments

What could be causing consistent 400 errors when updating an Amazon DynamoDB table from an Amazon ECS fleet?

Comments

How to resolve the issue of unsuccessful outbound internet connection from a private subnet?

Correct Answer:

References:

Comments

What is the best approach for integrating a client's health check system with AWS auto scaling and CloudWatch?

Correct Answer:

Explanation:

References:

Comments

What are the limitations of an AWS Direct Connect Virtual Interface after setting up an AWS Direct Connect?

Correct Answer:

Explanation:

References:

Comments

What AWS CLI command should be used to access metrics for a running Lambda function?

Correct Answer:

Explanation:

References:

Comments

{{ exam.shortName }}

{{ exam.longName }}