Free AWS-CERTIFIED-SOLUTIONS-ARCHITECT-PROFESSIONAL-SAP-C02 Amazon AWS-CERTIFIED-SOLUTIONS-ARCHITECT-PROFESSIONAL-SAP-C02 Practice Test Question - Page 17

Question 49 (Topic 1)

A solutions architect is creating an AWS CloudFormation template from an existing manually created non-production AWS environment. The CloudFormation template can be destroyed and recreated as needed. The environment contains an Amazon EC2 instance. The EC2 instance has an instance profile that the EC2 instance uses to assume a role in a parent account. The solutions architect recreates the role in a CloudFormation template and uses the same role name. When the CloudFormation template is launched in the child account, the EC2 instance can no longer assume the role in the parent account because of insufficient permissions What should the solutions architect do to resolve this issue?

Select an option, then click Submit answer.

○ In the parent account, edit the trust policy for the role that the EC2 instance needs to assume. Ensure that the target role ARN in the existing statement that allows the sts:AssumeRole action is correct. Save the trust policy.
○ In the parent account, edit the trust policy for the role that the EC2 instance needs to assume. Add a statement that allows the sts:AssumeRole action for the root principal of the child account. Save the trust policy.
○ Update the CloudFormation stack again. Specify only the CAPABILITY_NAMED_IAM capability.
○ Update the CloudFormation stack again. Specify the CAPABILITY_IAM capability and the CAPABILITY_NAMED_IAM capability.

Reference / correct answer:

In the parent account, edit the trust policy for the role that the EC2 instance needs to assume. Ensure that the target role ARN in the existing statement that allows the sts:AssumeRole action is correct. Save the trust policy.

Most accepted answer: A. In the parent account, edit the trust policy for the role that the EC2 instance needs to assume. Ensure that the target role ARN in the existing statement that allows the sts:AssumeRole action is correct. Save the trust policy.

Community votes: A=5, B=4, C=1

Answer is A . The error occurs because the trust relationship in the parent account that allows the EC2 instance to assume a role may have been broken or misconfigured. This can happen when a role is recreated with a different ARN but the same role name. The trust policy must be updated to reflect the correct ARN. Option A addresses this by ensuring that the trust policy in the parent account contains the correct ARN for the role in the child account, allowing the sts:AssumeRole action. Option B, which allows the root principal to assume the role, is risky and should be avoided due to security implications. upvoted 8 times hobokabobo 3 months, 4 weeks ago complete nonensense! a policy gets attached to as many roles as one deems usefull. policy does not hold a ref to the policy. using root principal ensures that noone else but root can assume the role which is as mimimal permissions as it gets. upvoted 8 times: realy?! upvoted 1 times ...

complete nonensense! a policy gets attached to as many roles as one deems usefull. policy does not hold a ref to the policy. using root principal ensures that noone else but root can assume the role which is as mimimal permissions as it gets. upvoted 8 times: realy?! upvoted 1 times

Selected Answer: A It is A. B is incorrect because specifying the root principal opens access up to all principals in the child account that are allowed to use sts. upvoted 6 times

Selected Answer: B There is no role ARN in the statement of a trust policy (only principal), so A is not correct. upvoted 2 times

Selected Answer: A A is correct. There is a statement in the question: "The EC2 instance has an instance profile that the EC2 instance uses to assume a role in a parent account." Therefore: Option A is the most accurate solution to address the issue of the EC2 instance not being able to assume the role in the parent account. upvoted 1 times

Question 50 (Topic 1)

A solutions architect is importing a VM from an on-premises environment by using the Amazon EC2 VM Import feature of AWS Import/Export. The solutions architect has created an AMI and has provisioned an Amazon EC2 instance that is based on that AMI. The EC2 instance runs inside a public subnet in a VPC and has a public IP address assigned. The EC2 instance does not appear as a managed instance in the AWS Systems Manager console. Which combination of steps should the solutions architect take to troubleshoot this issue? (Choose two.)

Select an option, then click Submit answer.

○ Verify that Systems Manager Agent is installed on the instance and is running.
○ Verify that the instance is assigned an appropriate IAM role for Systems Manager.
○ Verify the existence of a VPC endpoint on the VPC.
○ Verity that the AWS Application Discovery Agent is configured.
○ Verify the correct configuration of service-linked roles for Systems Manager.

Reference / correct answer:

Verify that Systems Manager Agent is installed on the instance and is running.

Most accepted answer: A. Verify that Systems Manager Agent is installed on the instance and is running.

Community votes: A=2, B=2

Answer:AB SSM Agent - must for communication between EC2 instances and Systems Manager Appropriate IAM role allows the instance to interact with Systems Manager services upvoted 9 times toma 2 years, 1 month ago correct. upvoted 2 times ...

correct. upvoted 2 times

A & B are right options. The EC2 instance not appearing as a managed instance in the AWS Systems Manager console suggests that the Systems Manager Agent is not running or is not properly configured. By verifying that the Systems Manager Agent is installed and running on the instance, the solutions architect can ensure that the agent is collecting metrics and data from the instance. Assigning an appropriate IAM role to the instance for Systems Manager ensures that the agent has the necessary permissions to collect data and perform management tasks. upvoted 1 times

I will go with A and B because with SSM agent it has to be installed on the VM and there has to be a role for it that allows it to interact with systems manager upvoted 1 times

Selected Answer: AB https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-instance-permissions.html upvoted 2 times

Question 51 (Topic 1)

An entertainment company hosts a ticketing service on a fleet of Linux Amazon EC2 instances that are in an Auto Scaling group. The ticketing service uses a pricing file. The pricing file is stored in an Amazon S3 bucket that has S3 Standard storage. A central pricing solution that is hosted by a third party updates the pricing file. The pricing file is updated every 1-15 minutes and has several thousand line items. The pricing file is downloaded to each EC2 instance when the instance launches. The EC2 instances occasionally use outdated pricing information that can result in incorrect charges for customers. Which solution will resolve this problem MOST cost-effectively?

Select an option, then click Submit answer.

○ Create an AWS Lambda function to update an Amazon DynamoDB table with new prices each time the pricing file is updated. Update the ticketing service to use DynramoDB to look up pricing
○ Create an AWS Lambda function to update an Amazon Elastic File System (Amazon EFS) file share with the pricing file each time the file is updated. Update the ticketing service to use Amazon EFS to access the pricing file.
○ Load Mountpoint for Amazon S3 onto the AMI of the EC2 instances. Configure Mountpoint for Amazon S3 to mount the S3 bucket that contains the pricing file. Update the ticketing service to point to the mount point and path to access the $3 object,
○ Create an Amazon Elastic Block Store (Amazon EBS) volume. Use EBS Multi-Attach to attach the volume to every EC2 instance. When a new EC2 instance launches, configure the new instance to update the pricing file on the EBS volume. Update the ticketing service to point to the new local source.

Reference / correct answer:

Load Mountpoint for Amazon S3 onto the AMI of the EC2 instances. Configure Mountpoint for Amazon S3 to mount the S3 bucket that contains the pricing file. Update the ticketing service to point to the mount point and path to access the $3 object,

Most accepted answer: C. Load Mountpoint for Amazon S3 onto the AMI of the EC2 instances. Configure Mountpoint for Amazon S3 to mount the S3 bucket that contains the pricing file. Update the ticketing service to point to the mount point and path to access the $3 object,

Community votes: A=4, C=7

Selected Answer: C Mountpoint for Amazon S3: This solution allows the EC2 instances to directly access the S3 bucket as if it were a local file system. This ensures that the instances always access the latest version of the pricing file without having to download it each time. Cost-Effective: This approach avoids the need to constantly download and store the file on each instance, which can save on both S3 GET requests and local storage costs. Simplicity: By mounting the S3 bucket, you ensure that all instances are using the most current file without additional logic or processes to manage file updates. upvoted 9 times

Selected Answer: A DynamoDB in this scenario looks cheaper than EFS. Answer A upvoted 7 times

Selected Answer: A Only A; S3 service is not a file share system by design. In reality it wont work as good as other solutions. You all were misled. upvoted 2 times

Selected Answer: C Option C (Mountpoint for S3) (best solution): Mountpoint for Amazon S3 allows the EC2 instances to directly access the latest version of the pricing file stored in S3 without repeatedly downloading it. Each EC2 instance will always read the most up-to-date file directly from S3, eliminating the risk of outdated information. This solution is cost-effective as it involves minimal overhead, does not incur unnecessary data transfer or operational complexity, and requires minimal application modification. upvoted 2 times

Selected Answer: C "Mountpoint for Amazon S3 is available only for Linux operating systems. You can use Mountpoint to access S3 objects in all storage classes except S3 Glacier Flexible Retrieval, S3 Glacier Deep Archive, S3 Intelligent-Tiering Archive Access Tier, and S3 Intelligent-Tiering Deep Archive Access Tier." https://docs.aws.amazon.com/AmazonS3/latest/userguide/mountpoint.html upvoted 3 times

Free AWS-CERTIFIED-SOLUTIONS-ARCHITECT-PROFESSIONAL-SAP-C02 – Amazon AWS-CERTIFIED-SOLUTIONS-ARCHITECT-PROFESSIONAL-SAP-C02 Practice Test Question