Amazon
SAP-C01 Exam
Questions

AWS Certified Solutions Architect - Professional SAP-C01

Amazon (SAP-C01) Exam Questions And Answers page 34

What approach will enable secure and scalable data sharing across multiple AWS accounts?

Single Choice

A large company has many business units. Each business unit has multiple AWS accounts for different purposes. The CIO of the company sees that each business unit has data that would be useful to share with other parts of the company. In total, there are about 10 PB of data that needs to be shared with users in 1,000 AWS accounts. The data is proprietary, so some of it should only be available to users with specific job types. Some of the data is used for throughput of intensive workloads, such as simulations. The number of accounts changes frequently because of new initiatives, acquisitions, and divestitures.

A Solutions Architect has been asked to design a system that will allow for sharing data for use in AWS with all of the employees in the company.

Which approach will allow for secure data sharing in scalable way?

Store the data in a single Amazon S3 bucket. Create an IAM role for every combination of job type and business unit that allows for appropriate read/write access based on object prefixes in the S3 bucket. The roles should have trust policies that allow the business unit s AWS accounts to assume their roles. Use IAM in each business unit s AWS account to prevent them from assuming roles for a different job type. Users get credentials to access the data by using AssumeRole from their business unit s AWS account. Users can then use those credentials with an S3 client.

Store the data in a single Amazon S3 bucket. Write a bucket policy that uses conditions to grant read and write access where appropriate, based on each user s business unit and job type. Determine the business unit with the AWS account accessing the bucket and the job type with a prefix in the IAM user s name. Users can access data by using IAM credentials from their business unit s AWS account with an S3 client.

Store the data in a series of Amazon S3 buckets. Create an application running in Amazon EC2 that is integrated with the company s identity provider (IdP) that authenticates users and allows them to download or upload data through the application. The application uses the business unit and job type information in the IdP to control what users can upload and download through the application. The users can access the data through the application s API.

Store the data in a series of Amazon S3 buckets. Create an AWS STS token vending machine that is integrated with the company s identity provider (IdP). When a user logs in, have the token vending machine attach an IAM policy that assumes the role that limits the user s access and/or upload only the data the user is authorized to access. Users can get credentials by authenticating to the token vending machine s website or API and then use those credentials with an S3 client.

Designing enterprise-wide scalable operations on AWS Designing for security and compliance

How can a solutions architect restrict developer access to AWS European Regions with minimal management overhead?

Single Choice

A large company in Europe plans to migrate its applications to the AWS Cloud. The company uses multiple AWS accounts for various business groups. A data privacy law requires the company to restrict developers access to AWS European Regions only.

What should the solutions architect do to meet this requirement with the LEAST amount of management overhead?

Create IAM users and IAM groups in each account. Create IAM policies to limit access to non-European Regions. Attach the IAM policies to the IAM groups.

Enable AWS Organizations, attach the AWS accounts, and create OUs for European Regions and non-European Regions. Create SCPs to limit access to non-European Regions and attach the policies to the OUs.

Set up AWS Single Sign-On and attach AWS accounts. Create permission sets with policies to restrict access to non-European Regions. Create IAM users and IAM groups in each account.

Enable AWS Organizations, attach the AWS accounts, and create OUs for European Regions and non-European Regions. Create permission sets with policies to restrict access to non-European Regions. Create IAM users and IAM groups in the primary account.

Migrating complex, multi-tier applications on AWS Designing for security and compliance

What options meet the company's needs for centralized payment and IAM control with minimal effort?

Multiple Choice

A large company is migrating its entire IT portfolio to AWS. Each business unit in the company has a standalone AWS account that supports both development and test environments. New accounts to support production workloads will be needed soon.

The Finance department requires a centralized method for payment but must maintain visibility into each group s spending to allocate costs.

The Security team requires a centralized mechanism to control IAM usage in all the company s accounts.

What combination of the following options meet the company s needs with the LEAST effort? (Choose two.)

Use a collection of parameterized AWS CloudFormation templates defining common IAM permissions that are launched into each account. Require all new and existing accounts to launch the appropriate stacks to enforce the least privilege model.

Use AWS Organizations to create a new organization from a chosen payer account and define an organizational unit hierarchy. Invite the existing accounts to join the organization and create new accounts using Organizations.

Require each business unit to use its own AWS accounts. Tag each AWS account appropriately and enable Cost Explorer to administer chargebacks.

Enable all features of AWS Organizations and establish appropriate service control policies that filter IAM permissions for sub-accounts.

Consolidate all of the company s AWS accounts into a single AWS account. Use tags for billing purposes and IAM s Access Advisor feature to enforce the least privilege model.

Designing enterprise-wide scalable operations on AWS Designing for security and compliance

How can a solutions architect troubleshoot the issue by gaining access to an EC2 instance?

Single Choice

A large company is running a popular web application. The application runs on several Amazon EC2 Linux instances in an Auto Scaling group in a private subnet. An Application Load Balancer is targeting the instances in the Auto Scaling group in the private subnet. AWS Systems Manager Session Manager is configured, and AWS Systems Manager Agent is running on all the EC2 instances.

The company recently released a new version of the application. Some EC2 instances are now being marked as unhealthy and are being terminated. As a result, the application is running at reduced capacity. A solutions architect tries to determine the root cause by analyzing Amazon CloudWatch logs that are collected from the application, but the logs are inconclusive.

How should the solutions architect gain access to an EC2 instance to troubleshoot the issue?

Suspend the Auto Scaling group s HealthCheck scaling process. Use Session Manager to log in to an instance that is marked as unhealthy.

Enable EC2 instance termination protection. Use Session Manager to log in to an instance that is marked as unhealthy.

Set the termination policy to OldestInstance on the Auto Scaling group. Use Session Manager to log in to an instance that is marked an unhealthy.

Suspend the Auto Scaling group s Terminate process. Use Session Manager to log in to an instance that is marked as unhealthy.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing for security and compliance

What strategy should be provided to increase visibility into AWS Billing and Cost Management delays?

Single Choice

A large company recently experienced an unexpected increase in Amazon RDS and Amazon DynamoDB costs. The company needs to increase visibility into delays of AWS Billing and Cost Management. There are various accounts associated with AWS Organizations, including many development and production accounts. There is no consistent tagging strategy across the organization, but there are guidelines in place that require all infrastructure to be deployed using AWS CloudFormation with consistent tagging. Management requires cost center numbers and project ID numbers for all existing and future DynamoDB tables and RDS distances.

Which strategy should the solutions architect provide to meet these requirements?

Use Tag Editor to tag existing resources. Create cost allocation tags to define the cost center and project ID and allow 24 hours for tags to propagate to existing resources.

Use an AWS Config rule to alert the finance team of untagged resources. Create a centralized AWS Lambda based solution to tag untagged RDS databases and DynamoDB resources every hour using a cross-account role.

Use Tag Editor to tag existing resources. Create cost allocation tags to define the cost center and project ID. Use SCPs to restrict resource creation that do not have the cost center and project ID on the resource.

Create cost allocation tags to define the cost center and project ID and allow 24 hours for tags to propagate to existing resources. Update existing federated roles to restrict privileges to provision resources that do not include the cost center and project ID on the resource.

Implementing cost control strategies Designing for security and compliance

What strategy should be provided to meet AWS Billing and Cost Management requirements for a company with multiple accounts and inconsistent tagging?

Single Choice

A large company recently experienced an unexpected increase in Amazon RDS and Amazon DynamoDB costs. The company needs to increase visibility into details of AWS Billing and Cost Management. There are various accounts associated with AWS Organizations, including many development and production accounts. There is no consistent tagging strategy across the organization, but there are guidelines in place that require all infrastructure to be deployed using AWS CloudFormation with consistent tagging. Management requires cost center numbers and project ID numbers for all existing and future DynamoDB tables and RDS instances.

Which strategy should the solutions architect provide to meet these requirements?

Use Tag Editor to tag existing resources. Create cost allocation tags to define the cost center and project ID and allow 24 hours for tags to propagate to existing resources.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Implementing cost control strategies

What additional steps are needed to implement a hub-and-spoke design with an egress VPC?

Single Choice

A large company runs workloads in VPCs that are deployed across hundreds of AWS accounts. Each VPC consists of public subnets and private subnets that span across multiple Availability Zones. NAT gateways are deployed in the public subnets and allow outbound connectivity to the internet from the private subnets.

A solutions architect is working on a hub-and-spoke design. All private subnets in the spoke VPCs must route traffic to the internet through an egress VPC. The solutions architect already has deployed a NAT gateway in an egress VPC in a central AWS account.

Which set of additional steps should the solutions architect take to meet these requirements?

Create peering connections between the egress VPC and the spoke VPCs. Configure the required routing to allow access to the internet.

Create a transit gateway, and share it with the existing AWS accounts. Attach existing VPCs to the transit gateway. Configure the required routing to allow access to the internet.

Create a transit gateway in every account. Attach the NAT gateway to the transit gateways. Configure the required routing to allow access to the internet.

Create an AWS PrivateLink connection between the egress VPC and the spoke VPCs. Configure the required routing to allow access to the internet.

Designing highly available, cost-efficient, fault-tolerant, scalable systems Designing for security and compliance

How can a large company enforce a new centralized process for purchasing Reserved Instances securely?

Multiple Choice

A large company with hundreds of AWS accounts has a newly established centralized internal process for purchasing new or modifying existing Reserved Instances. This process requires all business units that want to purchase or modify Reserved Instances to submit requests to a dedicated team for procurement or execution. Previously, business units would directly purchase or modify Reserved Instances in their own respective AWS accounts autonomously.

Which combination of steps should be taken to proactively enforce the new process in the MOST secure way possible? (Choose two.)

Ensure all AWS accounts are part of an AWS Organizations structure operating in all features mode.

Use AWS Config to report on the attachment of an IAM policy that denies access to the ec2:PurchaseReservedInstancesOffering and ec2:ModifyReservedInstances actions.

In each AWS account, create an IAM policy with a DENY rule to the ec2:PurchaseReservedInstancesOffering and ec2:ModifyReservedInstances actions.

Create an SCP that contains a deny rule to the ec2:PurchaseReservedInstancesOffering and ec2:ModifyReservedInstances actions. Attach the SCP to each organizational unit (OU) of the AWS Organizations structure.

Ensure that all AWS accounts are part of an AWS Organizations structure operating in consolidated billing features mode.

Designing enterprise-wide scalable operations on AWS Implementing cost control strategies

How to modify the stack policy to prevent accidental removal or replacement of RDS instances in AWS CloudFormation?

Single Choice

A large financial company is deploying applications that consist of Amazon EC2 and Amazon RDS instances to the AWS Cloud using AWS CloudFormation.

The CloudFormation stack has the following stack policy:

The company wants to ensure that developers do not lose data by accidentally removing or replacing RDS instances when updating the CloudFormation stack. Developers also still need to be able to modify or remove EC2 instances as needed.

How should the company change the stack policy to meet these requirements?

Modify the statement to specify Effect : Deny , Action :[ Update:* ] for all logical RDS resources.

Modify the statement to specify Effect : Deny , Action :[ Update:Delete ] for all logical RDS resources.

Add a second statement that specifies Effect : Deny , Action :[ Update:Delete , Update:Replace ] for all logical RDS resources.

Add a second statement that specifies Effect : Deny , Action :[ Update:* ] for all logical RDS resources.

Designing enterprise-wide scalable operations on AWS Designing for security and compliance

How to migrate a stateless mission-critical application based on IBM WebSphere, MQ, and DB2 to AWS?

Single Choice

A large global company wants to migrate a stateless mission-critical application to AWS. The application is based on IBM WebSphere (application and integration middleware), IBM MQ (messaging middleware), and IBM DB2 (database software) on a z/OS operating system.

How should the Solutions Architect migrate the application to AWS?

Re-host WebSphere-based applications on Amazon EC2 behind a load balancer with Auto Scaling. Re-platform the IBM MQ to an Amazon EC2-based MQ. Re-platform the z/OS-based DB2 to Amazon RDS DB2.

Re-host WebSphere-based applications on Amazon EC2 behind a load balancer with Auto Scaling. Re-platform the IBM MQ to an Amazon MQ. Re-platform z/OS-based DB2 to Amazon EC2-based DB2.

Orchestrate and deploy the application by using AWS Elastic Beanstalk. Re-platform the IBM MQ to Amazon SQS. Re-platform z/OS-based DB2 to Amazon RDS DB2.

Use the AWS Server Migration Service to migrate the IBM WebSphere and IBM DB2 to an Amazon EC2-based solution. Re-platform the IBM MQ to an Amazon MQ.

Migrating complex, multi-tier applications on AWS Designing enterprise-wide scalable operations on AWS

Previous Questions

Next Questions

Amazon (SAP-C01) Exam Questions And Answers page 34

What approach will enable secure and scalable data sharing across multiple AWS accounts?

Comments

How can a solutions architect restrict developer access to AWS European Regions with minimal management overhead?

Comments

What options meet the company's needs for centralized payment and IAM control with minimal effort?

Correct Answers:

References:

Comments

How can a solutions architect troubleshoot the issue by gaining access to an EC2 instance?

Comments

What strategy should be provided to increase visibility into AWS Billing and Cost Management delays?

Comments

What strategy should be provided to meet AWS Billing and Cost Management requirements for a company with multiple accounts and inconsistent tagging?

Correct Answer:

References:

Comments

What additional steps are needed to implement a hub-and-spoke design with an egress VPC?

Correct Answer:

References:

Comments

How can a large company enforce a new centralized process for purchasing Reserved Instances securely?

Comments

How to modify the stack policy to prevent accidental removal or replacement of RDS instances in AWS CloudFormation?

Comments

How to migrate a stateless mission-critical application based on IBM WebSphere, MQ, and DB2 to AWS?

Correct Answer:

Explanation:

References:

Comments

{{ exam.shortName }}

{{ exam.longName }}