← Back to exam page

Free AWS-CERTIFIED-SOLUTIONS-ARCHITECT-PROFESSIONAL-SAP-C02 – Amazon AWS-CERTIFIED-SOLUTIONS-ARCHITECT-PROFESSIONAL-SAP-C02 Practice Test Question

Loading demo links...

Showing 16–18 of 53 questions

Question 16 (Topic 1)

A company is planning to migrate an application to AWS. The application runs as a Docker container and uses an NFS version 4 file share. A solutions architect must design a secure and scalable containerized solution that does not require provisioning or management of the underlying infrastructure. Which solution will meet these requirements?

Select an option, then click Submit answer.

  • ○ Deploy the application containers by using Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type. Use Amazon Elastic File System (Amazon EFS) for shared storage. Reference the EFS file system ID, container mount point, and EFS authorization IAM role in the ECS task definition.
  • ○ Deploy the application containers by using Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type. Use Amazon FSx for Lustre for shared storage. Reference the FSx for Lustre file system ID, container mount point, and FSx for Lustre authorization IAM role in the ECS task definition.
  • ○ Deploy the application containers by using Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type and auto scaling turned on. Use Amazon Elastic File System (Amazon EFS) for shared storage. Mount the EFS file system on the ECS container instances. Add the EFS authorization IAM role to the EC2 instance profile.
  • ○ Deploy the application containers by using Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type and auto scaling turned on. Use Amazon Elastic Block Store (Amazon EBS) volumes with Multi-Attach enabled for shared storage. Attach the EBS volumes to ECS container instances. Add the EBS authorization IAM role to an EC2 instance profile.
Question 17 (Topic 1)

A company is building a hybrid environment that includes servers in an on-premises data center and in the AWS Cloud. The company has deployed Amazon EC2 instances in three VPCs. Each VPC is in a different AWS Region. The company has established an AWS Direct. Connect connection to the data center from the Region that is closest to the data center. The company needs the servers in the on-premises data center to have access to the EC2 instances in all three VPCs. The servers in the on-premises data center also must have access to AWS public services. Which combination of steps will meet these requirements with the LEAST cost? (Choose two.)

Select an option, then click Submit answer.

  • ○ Create a Direct Connect gateway in the Region that is closest to the data center. Attach the Direct Connect connection to the Direct Connect gateway. Use the Direct Connect gateway to connect the VPCs in the other two Regions.
  • ○ Set up additional Direct Connect connections from the on-premises data center to the other two Regions.
  • ○ Create a private VIF. Establish an AWS Site-to-Site VPN connection over the private VIF to the VPCs in the other two Regions.
  • ○ Create a public VIF. Establish an AWS Site-to-Site VPN connection over the public VIF to the VPCs in the other two Regions.
  • ○ Use VPC peering to establish a connection between the VPCs across the Regions Create a private VIF with the existing Direct Connect connection to connect to the peered VPCs.
Question 18 (Topic 1)

A solutions architect has implemented a SAML 2.0 federated identity solution with their company's on-premises identity provider (IdP) to authenticate users' access to the AWS environment. When the solutions architect tests authentication through the federated identity web portal, access to the AWS environment is granted. However, when test users attempt to authenticate through the federated identity web portal, they are not able to access the AWS environment. Which items should the solutions architect check to ensure identity federation is properly configured? (Choose three.)

Select an option, then click Submit answer.

  • ○ The IAM user's permissions policy has allowed the use of SAML federation for that user.
  • ○ The IAM roles created for the federated users' or federated groups' trust policy have set the SAML provider as the principal. B. Test users are not in the AWSFederatedUsers group in the company's IdP.
  • ○ The web portal calls the AWS STS AssumeRoleWithSAML API with the ARN of the SAML provider, the ARN of the IAM role, and the SAML assertion from IdP.
  • ○ The on-premises IdP's DNS hostname is reachable from the AWS environment VPCs.
  • ○ The company's IdP defines SAML assertions that properly map users or groups. In the company to IAM roles with appropriate permissions.