Free AWS-CERTIFIED-SOLUTIONS-ARCHITECT-PROFESSIONAL-SAP-C02 – Amazon AWS-CERTIFIED-SOLUTIONS-ARCHITECT-PROFESSIONAL-SAP-C02 Practice Test Question

Loading demo links...

Showing 40–42 of 53 questions

Question 40 (Topic 1)

A medical company is running a REST API on a set of Amazon EC2 instances. The EC2 instances run in an Auto Scaling group behind an Application Load Balancer (ALB). The ALB runs in three public subnets, and the EC2 instances run in three private subnets. The company has deployed an Amazon CloudFront distribution that has the ALB as the only origin. Which solution should a solutions architect recommend to enhance the origin security?

Select an option, then click Submit answer.

○ Store a random string in AWS Secrets Manager. Create an AWS Lambda function for automatic secret rotation. Configure CloudFront to inject the random string as a custom HTTP header for the origin request. Create an AWS WAF web ACL rule with a string match rule for the custom header. Associate the web ACL with the ALB.
○ Create an AWS WAF web ACL rule with an IP match condition of the CloudFront service IP address ranges. Associate the web ACL with the ALMove the ALB into the three private subnets.
○ Store a random string in AWS Systems Manager Parameter Store. Configure Parameter Store automatic rotation for the string. Configure CloudFront to inject the random string as a custom HTTP header for the origin request. Inspect the value of the custom HTTP header, and block access in the ALB.
○ Configure AWS Shield Advanced Create a security group policy to allow connections from CloudFront service IP address ranges. Add the policy to AWS Shield Advanced, and attach the policy to the ALB.

Reference / correct answer:

Store a random string in AWS Secrets Manager. Create an AWS Lambda function for automatic secret rotation. Configure CloudFront to inject the random string as a custom HTTP header for the origin request. Create an AWS WAF web ACL rule with a string match rule for the custom header. Associate the web ACL with the ALB.

Most accepted answer: A. Store a random string in AWS Secrets Manager. Create an AWS Lambda function for automatic secret rotation. Configure CloudFront to inject the random string as a custom HTTP header for the origin request. Create an AWS WAF web ACL rule with a string match rule for the custom header. Associate the web ACL with the ALB.

Community votes: A=4, B=1

Selected Answer: A In this blog post, you’ll see how to use CloudFront custom headers, AWS WAF, and AWS Secrets Manager to restrict viewer requests from accessing your CloudFront origin resources directly. https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/ upvoted 6 times

Selected Answer: B While secret manager can auto rotate the secrets why to use Lamda to rotate? The choice B is neater than A? upvoted 1 times GabrielShiao 1 year, 6 months ago B is not correct. Moving ALB to private subnets makes the Cloudfront traffic unreachable. upvoted 2 times ...

B is not correct. Moving ALB to private subnets makes the Cloudfront traffic unreachable. upvoted 2 times

Option A is right Store a random string in Secrets Manager: This provides a secure way to store sensitive data, such as a token or secret key. Create an AWS Lambda function for automatic secret rotation: This ensures that the secret is regularly rotated and updated to prevent unauthorized access. Configure CloudFront to inject the random string as a custom HTTP header for the origin request: This adds an additional layer of protection by requiring the ALB to verify the custom header before allowing access. Create an AWS WAF web ACL rule with a string match rule for the custom header: This checks that the custom header matches the expected value, preventing unauthorized access if it doesn't. Associate the web ACL with the ALB: This ensures that the security rules are enforced at the edge of the network, protecting against malicious traffic. The other options don't provide sufficient protection: upvoted 1 times

D is the correct Answer upvoted 1 times trungtd 2 years, 1 month ago you cannot directly add a security group to AWS Shield Advanced. BTW, what is security group policy? upvoted 1 times ...

Question 41 (Topic 1)

A company uses a mobile app on AWS to run online contests. The company selects a winner at random at the end of each contest. The contests run for variable lengths of time. The company does not need to retain any data from a contest after the contest is finished. The company uses custom code that is hosted on Amazon EC2 instances to process the contest data and select a winner. The EC2 instances run behind an Application Load Balancer and store contest entries on Amazon RDS DB instances. The company must design a new architecture to reduce the cost of running the contests. Which solution will meet these requirements MOST cost-effectively?

Select an option, then click Submit answer.

○ Migrate storage of the contest entries to Amazon DynamoDB. Create a DynamoDB Accelerator (DAX) cluster. Rewrite the code to run as Amazon Elastic Container Service (Amazon ECS) containers that use the Fargate launch type. At the end of the contest, delete the DynamoDB table.
○ Migrate the storage of the contest entries to Amazon Redshift. Rewrite the code as AWS Lambda functions. At the end of the contest, delete the Redshift cluster.
○ Add an Amazon ElastiCache for Redis cluster in front of the RDS DB instances to cache the contest entries. Rewrite the code to run as Amazon Elastic Container Service (Amazon ECS) containers that use the Fargate launch type. Set the ElastiCache TTL attribute on each entry to expire each entry at the end of the contest.
○ Migrate the storage of the contest entries to Amazon DynamoDB. Rewrite the code as AWS Lambda functions. Set the DynamoDB TTL attribute on each entry to expire each entry at the end of the contest.

Reference / correct answer:

Migrate the storage of the contest entries to Amazon DynamoDB. Rewrite the code as AWS Lambda functions. Set the DynamoDB TTL attribute on each entry to expire each entry at the end of the contest.

Most accepted answer: D. Migrate the storage of the contest entries to Amazon DynamoDB. Rewrite the code as AWS Lambda functions. Set the DynamoDB TTL attribute on each entry to expire each entry at the end of the contest.

Community votes: A=6, D=7

Selected Answer: D Lambda for choosing a winner (it's a short-term task) and TTL (known before the contest starts) make sense. upvoted 7 times

Selected Answer: D Every DB option should be eliminated, RDS, Reshift because static. Only left with DynamoDB,DAX over kill. So D upvoted 1 times

Selected Answer: A This is what I hate AWS keep using impractical examples or unclear assumptions on their exam, it just train a lot of people just know yelling: "lambda is cheap, lambda is efficiency". upvoted 2 times eboehm 7 months, 3 weeks ago its not even about that its that you dont need a container for this. This is a very simple function that runs once... perfect for Lambda... plus wtf do you need DAX for? A could of been a contender if it didnt needlessly mention DAX. upvoted 1 times eboehm 7 months, 3 weeks ago if the architecture was about users checking the winning results, then yes DAX would be usefull upvoted 1 times ... ...

its not even about that its that you dont need a container for this. This is a very simple function that runs once... perfect for Lambda... plus wtf do you need DAX for? A could of been a contender if it didnt needlessly mention DAX. upvoted 1 times eboehm 7 months, 3 weeks ago if the architecture was about users checking the winning results, then yes DAX would be usefull upvoted 1 times ...

if the architecture was about users checking the winning results, then yes DAX would be usefull upvoted 1 times

Question 42 (Topic 1)

A company wants to migrate an Amazon Aurora MySQL DB cluster from an existing AWS account to a new AWS account in the same AWS Region. Both accounts are members of the same organization in AWS Organizations. The company must minimize database service interruption before the company performs DNS cutover to the new database. Which migration strategy will meet this requirement? (Choose two.)

Select an option, then click Submit answer.

○ Take a snapshot of the existing Aurora database. Share the snapshot with the new AWS account. Create an Aurora DB cluster in the new account from the snapshot.
○ Create an Aurora DB cluster in the new AWS account. Use AWS Database Migration Service (AWS DMS) to migrate data between the two Aurora DB clusters.
○ Use AWS Backup to share an Aurora database backup from the existing AWS account to the new AWS account. Create an Aurora DB cluster in the new AWS account from the snapshot.
○ Create an Aurora DB cluster in the new AWS account. Use AWS Application Migration Service to migrate data between the two Aurora DB clusters.

Reference / correct answer:

Create an Aurora DB cluster in the new AWS account. Use AWS Database Migration Service (AWS DMS) to migrate data between the two Aurora DB clusters.

Most accepted answer: B. Create an Aurora DB cluster in the new AWS account. Use AWS Database Migration Service (AWS DMS) to migrate data between the two Aurora DB clusters.

Community votes: A=7, B=9

Selected Answer: AB I do not know why AWS writes its questions so badly. The question asks for a conjuntion answer and then they give us TOTALLY different answers that do not work together. For me, it's B without any doubts since AWS DMS allows us to migrate while reducing the interrumption on the source to be migrated and A could be an option as well but it obviously allows us to move certain amount of data until a certain point of time. upvoted 1 times

Selected Answer: AB The only correct answer is B, Selecting A is to meet the question. A is not right because it will lose a certain period of data. upvoted 2 times

Selected Answer: B A is unnecessary upvoted 2 times

Selected Answer: AB The question says to choose two alternatives - but it doesn't say that they must work in conjunction. I.e., separate answers that stand on their own. B is best, but A works too. Thus A+B. upvoted 2 times

Selected Answer: AB A and B both are valid options. upvoted 1 times

← Prev 9 10 11 12 13 14 15 16 17 18 Next →

Page 14 of 18

Sale Ends In

2h 0m 0s