Free AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 Amazon AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 Practice Test Question - Page 7

Question 19 (Topic 1)

An application runs on an Amazon EC2 instance that has an Elastic IP address in VPC A. The application requires access to a database in VPC B. Both VPCs are in the same AWS account. Which solution will provide the required access MOST securely?

Select an option, then click Submit answer.

○ Create a DB instance security group that allows all traffic from the public IP address of the application server in VPC A.
○ Configure a VPC peering connection between VPC A and VPC B.
○ Make the DB instance publicly accessible. Assign a public IP address to the DB instance.
○ Launch an EC2 instance with an Elastic IP address into VPC B. Proxy all requests through the new EC2 instance.

Reference / correct answer:

Configure a VPC peering connection between VPC A and VPC B.

Most accepted answer: B. Configure a VPC peering connection between VPC A and VPC B.

Community votes: A=2, B=10

Selected Answer: B B. Configure a VPC peering connection between VPC A and VPC B. The most secure solution is to configure a VPC peering connection between the two VPCs. This allows private communication between the application server and the database, without exposing resources to the public internet. Option A exposes the database to the public internet by allowing inbound traffic from a public IP address. Option C makes the database instance itself public, which is insecure. Option D adds complexity with a proxy that is not needed when a VPC peering connection can enable private communication between VPCs. So option B is the most secure while allowing the necessary connectivity between the application server and the database in the separate VPCs. upvoted 14 times

A is correct. B will work but is not the most secure method, since it will allow everything in VPC A to talk to everything in VPC B and vice versa, not at all secure. A on the other hand will only allow the application (since you select it's IP address) to talk to the application server in VPC A - you are allowing only the required connectivity. See the link for this exact use case: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.RDSSecurityGroups.html upvoted 14 times mhmt4438 3 years, 6 months ago " allows all traffic from the public IP address" Nice bro niceee This is absolutely the most secure method at all. :))) upvoted 18 times datz 3 years, 3 months ago he must be the security engineer lolol :D "Jaybee" - Please dont ever say that traffic over the public internet is secure :D upvoted 5 times swakan 1 year, 8 months ago https://aws.amazon.com/vpc/faqs/ upvoted 1 times ... ... graveend 2 years, 11 months ago Both VPCs are in the "SAME AWS ACCOUNT" and the requirement specifies allowing traffic from the *PUBLIC IP of the APPLICATION SERVER*. In this case the traffic remains inside the AWS infrastructure or will it go through the public internet? upvoted 2 times pentium75 2 years, 7 months ago Answer A (not "the requirement") specifies "allowing traffic from the public IP", which is for sure NOT the "most secure" option. upvoted 2 times ... ... ...

" allows all traffic from the public IP address" Nice bro niceee This is absolutely the most secure method at all. :))) upvoted 18 times datz 3 years, 3 months ago he must be the security engineer lolol :D "Jaybee" - Please dont ever say that traffic over the public internet is secure :D upvoted 5 times swakan 1 year, 8 months ago https://aws.amazon.com/vpc/faqs/ upvoted 1 times ... ... graveend 2 years, 11 months ago Both VPCs are in the "SAME AWS ACCOUNT" and the requirement specifies allowing traffic from the *PUBLIC IP of the APPLICATION SERVER*. In this case the traffic remains inside the AWS infrastructure or will it go through the public internet? upvoted 2 times pentium75 2 years, 7 months ago Answer A (not "the requirement") specifies "allowing traffic from the public IP", which is for sure NOT the "most secure" option. upvoted 2 times ... ...

he must be the security engineer lolol :D "Jaybee" - Please dont ever say that traffic over the public internet is secure :D upvoted 5 times swakan 1 year, 8 months ago https://aws.amazon.com/vpc/faqs/ upvoted 1 times ...

https://aws.amazon.com/vpc/faqs/ upvoted 1 times

Question 20 (Topic 1)

An application running on an Amazon EC2 instance in VPC-A needs to access files in another EC2 instance in VPC-B. Both VPCs are in separate AWS accounts. The network administrator needs to design a solution to configure secure access to EC2 instance in VPC-B from VPC-A. The connectivity should not have a single point of failure or bandwidth concerns. Which solution will meet these requirements?

Select an option, then click Submit answer.

○ Set up a VPC peering connection between VPC-A and VPC-B.
○ Set up VPC gateway endpoints for the EC2 instance running in VPC-B.
○ Attach a virtual private gateway to VPC-B and set up routing from VPC-A.
○ Create a private virtual interface (VIF) for the EC2 instance running in VPC-B and add appropriate routes from VPC-A.

Reference / correct answer:

Set up a VPC peering connection between VPC-A and VPC-B.

Most accepted answer: A. Set up a VPC peering connection between VPC-A and VPC-B.

Community votes: A=12, B=1

Selected Answer: A A VPC peering connection allows secure communication between instances in different VPCs using private IP addresses without the need for internet gateways, VPN connections, or NAT devices. By setting it up, the application running in VPC-A can directly access the EC2 in VPC-B without going through the public internet or any single point of failure. B is incorrect because VPC gateway endpoints are used for accessing S3 or DynamoDB from a VPC without going over the internet. They are not designed for establishing connectivity between EC2 instances in different VPCs. C is incorrect because it would require configuring a VPN connection between the VPCs. This would introduce additional complexity and potential single points of failure. D is incorrect because creating a private VIF and adding routes would be applicable for establishing a direct connection between on-premises infrastructure and VPC-B using Direct Connect, but it is not suitable for the scenario of communication between EC2 instances in separate VPCs within different AWS accounts. upvoted 20 times

Selected Answer: A AWS uses the existing infrastructure of a VPC to create a VPC peering connection; it is neither a gateway nor a VPN connection, and does not rely on a separate piece of physical hardware. There is no single point of failure for communication or a bandwidth bottleneck. https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html upvoted 19 times

Selected Answer: A VPC peering is the most suitable here. upvoted 1 times

Selected Answer: A You can create a VPC peering connection between your own VPCs, or with a VPC in another AWS account. Peering within the same AZ is free of charge. upvoted 3 times

Selected Answer: A I get a little confused about B and A but, because, with a VPC endpoint in B it will work too access from A. upvoted 2 times GPFT 1 year, 10 months ago vpc gw endpoint just dynamo and s3 upvoted 2 times ...

Question 21 (Topic 1)

A medical research lab produces data that is related to a new study. The lab wants to make the data available with minimum latency to clinics across the country for their on-premises, file-based applications. The data files are stored in an Amazon S3 bucket that has read-only permissions for each clinic. What should a solutions architect recommend to meet these requirements?

Select an option, then click Submit answer.

○ Deploy an AWS Storage Gateway file gateway as a virtual machine (VM) on premises at each clinic
○ Migrate the files to each clinic’s on-premises applications by using AWS DataSync for processing.
○ Deploy an AWS Storage Gateway volume gateway as a virtual machine (VM) on premises at each clinic.
○ Attach an Amazon Elastic File System (Amazon EFS) file system to each clinic’s on-premises servers.

Reference / correct answer:

Deploy an AWS Storage Gateway file gateway as a virtual machine (VM) on premises at each clinic

Most accepted answer: A. Deploy an AWS Storage Gateway file gateway as a virtual machine (VM) on premises at each clinic

Community votes: A=12, C=1

Selected Answer: A A. Deploy an AWS Storage Gateway file gateway as a virtual machine (VM) on premises at each clinic AWS Storage Gateway is a service that connects an on-premises software appliance with cloud-based storage to provide seamless and secure integration between an organization's on-premises IT environment and AWS's storage infrastructure. By deploying a file gateway as a virtual machine on each clinic's premises, the medical research lab can provide low-latency access to the data stored in the S3 bucket while maintaining read-only permissions for each clinic. This solution allows the clinics to access the data files directly from their on-premises file-based applications without the need for data transfer or migration. upvoted 24 times

A. It allows the clinics to access the data files stored in the S3 bucket through a file interface. The file gateway caches frequently accessed data locally, reducing latency and providing fast access to the data. B. It involves transferring the data files from the Amazon S3 bucket to each clinic's on-premises applications using AWS DataSync. While this enables data migration, it may not provide real-time access and may introduce additional latency. C. It is suitable for block-level access to data rather than file-level access. It may not be the most efficient solution for file-based applications. D. It involves using Amazon EFS, which is a scalable file storage service, to provide file-level access to the data. However, it may introduce additional complexity and latency compared to using a file gateway solution. upvoted 8 times

Selected Answer: A AWS Storage File Gateway is the most suitable here. upvoted 1 times

Selected Answer: A A: does exactly that is required here B: "Migrate", as to MOVE the files out from S3, doesn't make sense C: Volume Gateway provides iSCSI volumes backed by an object in AWS-managed S3, it does not provide access to S3 objects D: You can do that but it would have high (not "minimum") latency, and the data is not in that EFS volume, it's in S3 upvoted 5 times

AWS Storage Gateway is a service that connects an on-premises software appliance with cloud-based storage to provide seamless and secure integration between an organization's on-premises IT environment and AWS's storage infrastructure. By deploying a file gateway as a virtual machine on each clinic's premises, the medical research lab can provide low-latency access to the data stored in the S3 bucket while maintaining read-only permissions for each clinic. This solution allows the clinics to access the data files directly from their on-premises file-based applications without the need for data transfer or migration. upvoted 2 times

Free AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 – Amazon AWS-CERTIFIED-SOLUTIONS-ARCHITECT-ASSOCIATE-SAA-C03 Practice Test Question