Free AWS-CERTIFIED-SOLUTIONS-ARCHITECT-PROFESSIONAL-SAP-C02 – Amazon AWS-CERTIFIED-SOLUTIONS-ARCHITECT-PROFESSIONAL-SAP-C02 Practice Test Question

Loading demo links...

Showing 4–6 of 53 questions

Question 4 (Topic 1)

A company is planning to store a large number of archived documents and make the documents available to employees through the corporate intranet. Employees will access the system by connecting through a client VPN service that is attached to a VPC. The data must not be accessible to the public. The documents that the company is storing are copies of data that is held on physical media elsewhere. The number of requests will be low. Availability and speed of retrieval are not concerns of the company. Which solution will meet these requirements at the LOWEST cost?

Select an option, then click Submit answer.

○ Create an Amazon S3 bucket. Configure the S3 bucket to use the S3 One Zone-Infrequent Access (S3 One Zone-IA) storage class as default. Configure the S3 bucket for website hosting. Create an S3 interface endpoint. Configure the S3 bucket to allow access only through that endpoint.
○ Launch an Amazon EC2 instance that runs a web server. Attach an Amazon Elastic File System (Amazon EFS) file system to store the archived data in the EFS One Zone-Infrequent Access (EFS One Zone-IA) storage class Configure the instance security groups to allow access only from private networks.
○ Launch an Amazon EC2 instance that runs a web server Attach an Amazon Elastic Block Store (Amazon EBS) volume to store the archived data. Use the Cold HDD (sc1) volume type. Configure the instance security groups to allow access only from private networks.
○ Create an Amazon S3 bucket. Configure the S3 bucket to use the S3 Glacier Deep Archive storage class as default. Configure the S3 bucket for website hosting. Create an S3 interface endpoint. Configure the S3 bucket to allow access only through that endpoint.

Reference / correct answer:

Create an Amazon S3 bucket. Configure the S3 bucket to use the S3 Glacier Deep Archive storage class as default. Configure the S3 bucket for website hosting. Create an S3 interface endpoint. Configure the S3 bucket to allow access only through that endpoint.

Most accepted answer: D. Create an Amazon S3 bucket. Configure the S3 bucket to use the S3 Glacier Deep Archive storage class as default. Configure the S3 bucket for website hosting. Create an S3 interface endpoint. Configure the S3 bucket to allow access only through that endpoint.

Community votes: A=5, C=1, D=9

A - Glacier Deep Archive can't be used for web hosting, regardless if the company says retrieval time is no concern. upvoted 46 times tman22 3 years, 7 months ago Nevermind, I go for D. It should be technically possible - and mostly dependent on the intranet web application logic - It could present users with the ability to start file retrieval, for then to later access the data. upvoted 18 times sferenc 3 months, 2 weeks ago Answer A. You cannot host a website from glacier: Glacier needs an other bucket to restore the requested objects, and a lifetime. You cannot achieve this with the static s3 hosting (initiate restore). Yes, it will be the cheapest solution, but does not work. upvoted 1 times ... ...

Nevermind, I go for D. It should be technically possible - and mostly dependent on the intranet web application logic - It could present users with the ability to start file retrieval, for then to later access the data. upvoted 18 times sferenc 3 months, 2 weeks ago Answer A. You cannot host a website from glacier: Glacier needs an other bucket to restore the requested objects, and a lifetime. You cannot achieve this with the static s3 hosting (initiate restore). Yes, it will be the cheapest solution, but does not work. upvoted 1 times ...

Answer A. You cannot host a website from glacier: Glacier needs an other bucket to restore the requested objects, and a lifetime. You cannot achieve this with the static s3 hosting (initiate restore). Yes, it will be the cheapest solution, but does not work. upvoted 1 times

A is correct. HA is not required here. D use Glacier deep archive that need hours to access that will cause time out for web upvoted 23 times

Selected Answer: D D. S3 Glacier Deep Archive + Interface Endpoint Glacier Deep Archive is the cheapest storage class in AWS for long-term archival. Retrieval is slow (hours), but that’s acceptable here. Private access via S3 interface endpoint ensures no public exposure. Website hosting is unnecessary but can be ignored if bucket policy restricts access. Cost: Lowest among all options → Correct choice. upvoted 1 times

Question 5 (Topic 1)

A company has an organization in AWS Organizations that has a large number of AWS accounts. One of the AWS accounts is designated as a transit account and has a transit gateway that is shared with all of the other AWS accounts. AWS Site-to-Site VPN connections are configured between all of the company’s global offices and the transit account. The company has AWS Config enabled on all of its accounts. The company’s networking team needs to centrally manage a list of internal IP address ranges that belong to the global offices. Developers will reference this list to gain access to their applications securely. Which solution meets these requirements with the LEAST amount of operational overhead?

Select an option, then click Submit answer.

○ Create a JSON file that is hosted in Amazon S3 and that lists all of the internal IP address ranges. Configure an Amazon Simple Notification Service (Amazon SNS) topic in each of the accounts that can be invoked when the JSON file is updated. Subscribe an AWS Lambda function to the SNS topic to update all relevant security group rules with the updated IP address ranges.
○ Create a new AWS Config managed rule that contains all of the internal IP address ranges. Use the rule to check the security groups in each of the accounts to ensure compliance with the list of IP address ranges. Configure the rule to automatically remediate any noncompliant security group that is detected.
○ In the transit account, create a VPC prefix list with all of the internal IP address ranges. Use AWS Resource Access Manager to share the prefix list with all of the other accounts. Use the shared prefix list to configure security group rules in the other accounts.
○ In the transit account, create a security group with all of the internal IP address ranges. Configure the security groups in the other accounts to reference the transit account’s security group by using a nested security group reference of “ /sg-1a2b3c4d”.

Reference / correct answer:

In the transit account, create a VPC prefix list with all of the internal IP address ranges. Use AWS Resource Access Manager to share the prefix list with all of the other accounts. Use the shared prefix list to configure security group rules in the other accounts.

Most accepted answer: C. In the transit account, create a VPC prefix list with all of the internal IP address ranges. Use AWS Resource Access Manager to share the prefix list with all of the other accounts. Use the shared prefix list to configure security group rules in the other accounts.

Community votes: C=10

Selected Answer: C The correct answer is option C. In this solution, a VPC prefix list is created in the transit account with all of the internal IP address ranges, and then shared to all of the other accounts using AWS Resource Access Manager. This allows for central management of the IP address ranges, and eliminates the need for manual updates to security group rules in each account. This solution also allows for compliance checks to be run using AWS Config and for any non-compliant security groups to be automatically remediated. Option A is not correct because it would require manual updates to the JSON file and would also require developers to manually update their security group rules, which would lead to operational overhead. Option B is not correct because it would require the creation of a new AWS Config managed rule and it would also require manual updates to the security group rules in each account. Option D is not correct because it would require manual updates to the security group in the transit account and it would also lead to operational overhead. upvoted 24 times jpa8300 2 years, 7 months ago I agree that option C is probable the best one, but B is also correct, there is no manual updates to the SG, the remediation is automated in ASW Config. In option C you also need to manual update the prefix list, no? Imagine a new CIDR appears in the offices. upvoted 1 times chicagobeef 2 years, 6 months ago I doubt all the security groups in the accounts will use the same CIDR ranges. They just need a way to centrally manage the CIDR prefixes. The question did not say that everyone has to comply and any non-compliant resources needs to be remdiated. upvoted 2 times ... ...

I agree that option C is probable the best one, but B is also correct, there is no manual updates to the SG, the remediation is automated in ASW Config. In option C you also need to manual update the prefix list, no? Imagine a new CIDR appears in the offices. upvoted 1 times chicagobeef 2 years, 6 months ago I doubt all the security groups in the accounts will use the same CIDR ranges. They just need a way to centrally manage the CIDR prefixes. The question did not say that everyone has to comply and any non-compliant resources needs to be remdiated. upvoted 2 times ...

I doubt all the security groups in the accounts will use the same CIDR ranges. They just need a way to centrally manage the CIDR prefixes. The question did not say that everyone has to comply and any non-compliant resources needs to be remdiated. upvoted 2 times

Selected Answer: C A VPC Prefix List is a reusable, user-defined resource in Amazon Virtual Private Cloud (VPC) that contains a collection of IP address ranges. These ranges can represent destinations or sources for traffic, and the prefix list can be referenced in various configurations like security groups, route tables, or network ACLs. upvoted 1 times

Selected Answer: C C: in the shared account create a VPC Prefix list, share it using RAM, then SGs can reference it upvoted 1 times

Question 6 (Topic 1)

A company consists or two separate business units. Each business unit has its own AWS account within a single organization in AWS Organizations. The business units regularly share sensitive documents with each other. To facilitate sharing, the company created an Amazon S3 bucket in each account and configured low-way replication between the S3 buckets. The S3 buckets have millions of objects. Recently, a security audit identified that neither S3 bucket has encryption at rest enabled. Company policy requires that all documents must be stored with encryption at rest. The company wants to implement server-side encryption with Amazon S3 managed encryption keys (SSE-S3). What is the MOST operationally efficient solution that meets these requirements?

Select an option, then click Submit answer.

○ Turn on SSE-S3 on both S3 buckets. Use S3 Batch Operations to copy and encrypt the objects in the same location.
○ Create an AWS Key Management Service (AWS KMS) key in each account. Turn on server-side encryption with AWS KMS keys (SSE-KMS) on each S3 bucket by using the corresponding KMS key in that AWS account. Encrypt the existing objects by using an S3 copy command in the AWS CLI.
○ Turn on SSE-S3 on both S3 buckets. Encrypt the existing objects by using an S3 copy command in the AWS CLI.
○ Create an AWS Key Management Service, (AWS KMS) key in each account. Turn on server-side encryption with AWS KMS keys (SSE-KMS) on each S3 bucket by using the corresponding KMS key in that AWS account. Use S3 Batch Operations to copy the objects into the same location.

Reference / correct answer:

Turn on SSE-S3 on both S3 buckets. Use S3 Batch Operations to copy and encrypt the objects in the same location.

Most accepted answer: A. Turn on SSE-S3 on both S3 buckets. Use S3 Batch Operations to copy and encrypt the objects in the same location.

Community votes: A=12, D=1

Selected Answer: A Answer is A Keyword is "The S3 buckets have millions of objects" If there are million of objects then you should use Batch operations. https://aws.amazon.com/blogs/storage/encrypting-objects-with-amazon-s3-batch-operations/ upvoted 29 times forceli 3 years, 4 months ago good point, changing my answer to A upvoted 1 times ...

good point, changing my answer to A upvoted 1 times

Selected Answer: A Current Setup: Two AWS accounts (1 per business unit), under a single AWS Organization. Each account has its own S3 bucket. Buckets replicate data between each other. Buckets have millions of objects. SSE is not enabled. New Requirement: Use SSE-S3 (Amazon S3-managed encryption keys, not SSE-KMS). Must encrypt existing objects as well (not just new ones). Needs to be operationally efficient. The most operationally efficient way to enable encryption at rest with SSE-S3 on existing S3 buckets containing millions of objects is to enable SSE-S3 on the buckets and use S3 Batch Operations to copy the objects in place, which triggers automatic encryption during the copy. upvoted 1 times

This is outdated now. "Amazon S3 now applies server-side encryption with Amazon S3 managed keys (SSE-S3) as the base level of encryption for every bucket in Amazon S3. Starting January 5, 2023, all new object uploads to Amazon S3 are automatically encrypted at no additional cost and with no impact on performance." https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html upvoted 1 times

Selected Answer: A S3 Batch Operations can be used to efficiently apply changes to a large number of objects in a bucket, including copying and encrypting them in place. This is ideal for retroactively encrypting millions of existing objects without needing to manually handle them one by one. upvoted 1 times

← Prev 1 2 3 4 5 6 7 8 9 10 Next →

Page 2 of 18

Sale Ends In

2h 0m 0s