Pass Your SAP-C02 Exam with Practice Tests 2024 Updated, AWS Certified Solutions Architect - Professional

Question #1

A company is hosting a single-page web application in the AWS Cloud. The company is using Amazon CloudFront to reach its goal audience. The CloudFront distribution has an Amazon S3 bucket that is configured as its origin. The static files for the web application are stored in this S3 bucket. The company has used a simple routing policy to configure an Amazon Route 53 A record The record points to the CloudFront distribution The company wants to use a canary deployment release strategy for new versions of th

A. Create a second CloudFront distribution for the new version of the applicatio

B. Update the Route 53 record to use a weighted routing policy

C. Create a Lambda@Edge functio

D. Configure the function to implement a weighting algorithm and rewrite the URL to direct users to a new version of the application

E. Create a second S3 bucket and a second CloudFront origin for the new S3 bucket Create a CloudFrontorigin group that contains both origins Configure origin weighting for the origin group

F. Create two Lambda@Edge function G

View answer

Correct Answer: B

Question #2

A company is hosting a critical application on a single Amazon EC2 instance. The application uses an Amazon ElastiCache for Redis single-node cluster for an in- memory data store. The application uses an Amazon RDS for MariaDB DB instance for a relational database. For the application to function, each piece of the infrastructure must be healthy and must be in an active state. A solutions architect needs to improve the application's architecture so that the infrastructure can automatically recover from fail

A. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instance

B. Ensure that the EC2 instances are part of an Auto Scaling group that has a minimum capacity of two instances

C. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances Ensure that the EC2 instances are configured in unlimited mode

D. Modify the DB instance to create a read replica in the same Availability Zon

E. Promote the read replica to be the primary DB instance in failure scenarios

F. Modify the DB instance to create a Multi-AZ deployment that extends across two Availability Zones

View answer

Correct Answer: D

Question #3

A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization. The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company's on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently,

A. Set up an Amazon Simple Notification Service (Amazon SNS) topic in the security team's AWS accoun

B. Deploy an AWS Lambda function in each AWS accoun

C. Configure the Lambda function to run every time an SNS topic receives a messag

D. Configure the Lambda function to take an IP address as input and add it to a list of security groups in the accoun

E. Instruct the security team to distribute changes by publishing messages to its SNS topic

F. Create new customer-managed prefix lists in each AWS account within the organizatio G

View answer

Correct Answer: B

Question #4

A company runs a Java application that has complex dependencies on VMs that are in the company's data center. The application is stable. but the company wants to modernize the technology stack. The company wants to migrate the application to AWS and minimize the administrative overhead to maintain the servers. Which solution will meet these requirements with the LEAST code changes?

A. Migrate the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate by using AWS App2Containe

B. Store container images in Amazon Elastic Container Registry (Amazon ECR)

C. Configure Amazon ECS to use an Application Load Balancer (ALB)

D. Migrate the application code to a container that runs in AWS Lambd

E. Build an Amazon API Gateway REST API with Lambda integratio

F. Use API Gateway to interact with the application

View answer

Correct Answer: B

Question #5

A company has purchased appliances from different vendors. The appliances all have loT sensors. The sensors send status information in the vendors' proprietary formats to a legacy application that parses the information into JSON. The parsing is simple, but each vendor has a unique format. Once daily, the application parses all the JSON records and stores the records in a relational database for analysis. The company needs to design a new data analysis solution that can deliver faster and optimize costs. Wh

A. Connect the loT sensors to AWS loT Cor

B. Set a rule to invoke an AWS Lambda function to parse the information and save a

C. Use Amazon Athena and Amazon OuickSight for analysis

D. Migrate the application server to AWS Fargate, which will receive the information from loT sensors and parse the information into a relational forma

E. Save the parsed information to Amazon Redshift for analysis

F. Create an AWS Transfer for SFTP serve G

View answer

Correct Answer: D

Question #6

A company is building a solution in the AWS Cloud. Thousands or devices will connect to the solution and send data. Each device needs to be able to send and receive data in real time over the MQTT protocol. Each device must authenticate by using a unique X.509 certificate. Which solution will meet these requirements with the LEAST operational overhead?

A. Set up AWS loT Cor

B. For each device, create a corresponding Amazon MQ queue and provision a certificat

C. Connect each device to Amazon MQ

D. Create a Network Load Balancer (NLB) and configure it with an AWS Lambda authorize

E. Run an MQTT broker on Amazon EC2 instances in an Auto Scaling grou

F. Set the Auto Scaling group as the target for the NL G

View answer

Correct Answer: AE

Question #7

A financial company is building a system to generate monthly, immutable bank account statements for its users. Statements are stored in Amazon S3. Users should have immediate access to their monthly statements for up to 2 years. Some users access their statements frequently, whereas others rarely access their statements. The company's security and compliance policy requires that the statements be retained for at least 7 years. What is the MOST cost-effective solution to meet the company's needs?

A. Create an S3 bucket with Object Lock disable

B. Store statements in S3 Standar

C. Define an S3 Lifecycle policy to transition the data to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 day

D. Define another S3 Lifecycle policy to move the data to S3 Glacier Deep Archive after 2 year

E. Attach an S3 Glacier Vault Lock policy with deny delete permissions for archives less than 7 years old

F. Create an S3 bucket with versioning enable G

View answer

Correct Answer: A

Question #8

A company is using Amazon OpenSearch Service to analyze data. The company loads data into an OpenSearch Service cluster with 10 data nodes from an Amazon S3 bucket that uses S3 Standard storage. The data resides in the cluster for 1 month for read-only analysis. After 1 month, the company deletes the index that contains the data from the cluster. For compliance purposes, the company must retain a copy of all input data. The company is concerned about ongoing costs and asks a solutions architect to recommend

A. Replace all the data nodes with UltraWarm nodes to handle the expected capacit

B. Transition the input data from S3 Standard to S3 Glacier Deep Archive when the company loads the data into the cluster

C. Reduce the number of data nodes in the cluster to 2 Add UltraWarm nodes to handle the expected capacit

D. Configure the indexes to transition to UltraWarm when OpenSearch Service ingests the dat

E. Transition the input data to S3 Glacier Deep Archive after 1 month by using an S3 Lifecycle policy

F. Reduce the number of data nodes in the cluster to 2

View answer

Correct Answer: C

Question #9

A company is running a web application on Amazon EC2 instances in a production AWS account. The company requires all logs generated from the web application to be copied to a central AWS account (or analysis and archiving. The company's AWS accounts are currently managed independently. Logging agents are configured on the EC2 instances to upload the tog files to an Amazon S3 bucket in the central AWS account. A solutions architect needs to provide access for a solution that will allow the production account

A. Create a cross-account role in the central accoun

B. Assume the role from the production account when the logs are being copied

C. Create a policy on the S3 bucket with the production account ID as the principa

D. Allow S3 access from a delegated user

E. Create a policy on the S3 bucket with access from only the CIDR range of the EC2 instances in the production accoun

F. Use the production account ID as the principal

View answer

Correct Answer: B

Question #10

A company hosts a Git repository in an on-premises data center. The company uses webhooks to invoke functionality that runs in the AWS Cloud. The company hosts the webhook logic on a set of Amazon EC2 instances in an Auto Scaling group that the company set as a target for an Application Load Balancer (ALB). The Git server calls the ALB for the configured webhooks. The company wants to move the solution to a serverless architecture. Which solution will meet these requirements with the LEAST operational overh

A. For each webhook, create and configure an AWS Lambda function UR

B. Update the Git servers to call the individual Lambda function URLs

C. Create an Amazon API Gateway HTTP AP

D. Implement each webhook logic in a separate AWS Lambda functio

E. Update the Git servers to call the API Gateway endpoint

F. Deploy the webhook logic to AWS App Runne G

View answer

Correct Answer: A

Question #11

A company is serving files to Its customers through an SFTP server that is accessible over the internet The SFTP server is running on a single Amazon EC2 instance with an Elastic IP address attached Customers connect to the SFTP server through its Elastic IP address and use SSH (or authentication. The EC2 instance also has an attached security group that allows access from all customer IP addresses. A solutions architect must implement a solution to improve availability, minimize the complexity of infrastru

A. Disassociate the Elastic IP address from the EC2 instanc

B. Create an Amazon S3 bucket to be used for SFTP file hostin

C. Create an AWS Transfer Family server Configure the Transfer Family server with a publicly accessible endpoint Associate the SFTP Elastic IP address with the new endpoint Point the Transfer Family server to the S3 bucke

D. Sync all files from the SFTP server to the S3 bucket

E. Disassociate the Elastic IP address from the EC2 instanc

F. Create an Amazon S3 bucket to be used for SFTP file hostin G

View answer

Correct Answer: BD

Question #12

A company's AWS architecture currently uses access keys and secret access keys stored on each instance to access AWS services. Database credentials are hard-coded on each instance. SSH keys for command-tine remote access are stored in a secured Amazon S3 bucket. The company has asked its solutions architect to improve the security posture of the architecture without adding operational complexity. Which combination of steps should the solutions architect take to accomplish this? (Select THREE.)

A. Use Amazon EC2 instance profiles with an IAM role

B. Use AWS Secrets Manager to store access keys and secret access keys

C. Use AWS Systems Manager Parameter Store to store database credentials

D. Use a secure fleet of Amazon EC2 bastion hosts (or remote access

E. Use AWS KMS to store database credentials

F. Use AWS Systems Manager Session Manager tor remote access

View answer

Correct Answer: CDE

Question #13

A solutions architect wants to cost-optimize and appropriately size Amazon EC2 instances in a single AWS account. The solutions architect wants to ensure that the instances are optimized based on CPU, memory, and network metrics. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)

A. Purchase AWS Business Support or AWS Enterprise Support for the account

B. Turn on AWS Trusted Advisor and review any “Low Utilization Amazon EC2 Instances” recommendations

C. Install the Amazon CloudWatch agent and configure memory metric collection on the EC2 instances

D. Configure AWS Compute Optimizer in the AWS account to receive findings and optimization recommendations

E. Create an EC2 Instance Savings Plan for the AWS Regions, instance families, and operating systems of interest

View answer

Correct Answer: A

Question #14

A life sciences company is using a combination of open source tools to manage data analysis workflows and Docker containers running on servers in its on- premises data center to process genomics data Sequencing data is generated and stored on a local storage area network (SAN), and then the data is processed. The research and development teams are running into capacity issues and have decided to re-architect their genomics analysis platform on AWS to scale based on workload demands and reduce the turnaround

A. Use regularly scheduled AWS Snowball Edge devices to transfer the sequencing data into AWS When AWS receives the Snowball Edge device and the data is loaded into Amazon S3 use S3 events to trigger an AWS Lambda function to process the data

B. Use AWS Data Pipeline to transfer the sequencing data to Amazon S3 Use S3 events to trigger an Amazon EC2 Auto Scaling group to launch custom-AMI EC2 instances running the Docker containers to process the data

C. Use AWS DataSync to transfer the sequencing data to Amazon S3 Use S3 events to trigger an AWS Lambda function that starts an AWS Step Functions workflow Store the Docker images in Amazon Elastic Container Registry (Amazon ECR) and trigger AWS Batch to run the container and process the sequencing data

D. Use an AWS Storage Gateway file gateway to transfer the sequencing data to Amazon S3 Use S3 events to trigger an AWS Batch job that runs on Amazon EC2 instances running the Docker containers to process the data

View answer

Correct Answer: D

Question #15

A company has an organization in AWS Organizations. The company is using AWS Control Tower to deploy a landing zone for the organization. The company wants to implement governance and policy enforcement. The company must implement a policy that will detect Amazon RDS DB instances that are not encrypted at rest in the company’s production OU. Which solution will meet this requirement?

A. Turn on mandatory guardrails in AWS Control Towe

B. Apply the mandatory guardrails to the production OU

C. Enable the appropriate guardrail from the list of strongly recommended guardrails in AWS Control Towe

D. Apply the guardrail to the production OU

E. Use AWS Config to create a new mandatory guardrai

F. Apply the rule to all accounts in the production OU

View answer

Correct Answer: B

Question #16

An enterprise company wants to allow its developers to purchase third-party software through AWS Marketplace. The company uses an AWS Organizations account structure with full features enabled, and has a shared services account in each organizational unit (OU) that will be used by procurement managers. The procurement team's policy indicates that developers should be able to obtain third-party software from an approved list only and use Private Marketplace in AWS Marketplace to achieve this requirement . Th

A. Create an IAM role named procurement-manager-role in all AWS accounts in the organization Add the PowerUserAccess managed policy to the role Apply an inline policy to all IAM users and roles in every AWS account to deny permissions on the AWSPrivateMarketplaceAdminFullAccess managed policy

B. Create an IAM role named procurement-manager-role in all AWS accounts in the organization Add the AdministratorAccess managed policy to the role Define a permissions boundary with the AWSPrivateMarketplaceAdminFullAccess managed policy and attach it to all the developer roles

C. Create an IAM role named procurement-manager-role in all the shared services accounts in the organization Add the AWSPrivateMarketplaceAdminFullAccess managed policy to the role Create an organization root-level SCP to deny permissions to administer Private Marketplace to everyone exceptthe role named procurement-manager-role Create another organization root-level SCP to deny permissions to create an IAM role named procurement-manager-role to everyone in the organization

D. Create an IAM role named procurement-manager-role in all AWS accounts that will be used by developer

E. Add the AWSPrivateMarketplaceAdminFullAccess managed policy to the rol

F. Create an SCP in Organizations to deny permissions to administer Private Marketplace to everyone except the role named procurement-manager-rol G

View answer

Correct Answer: BDF

Question #17

A company is processing videos in the AWS Cloud by using Amazon EC2 instances in an Auto Scaling group. It takes 30 minutes to process a video. Several EC2 instances scale in and out depending on the number of videos in an Amazon Simple Queue Service (Amazon SQS) queue. The company has configured the SQS queue with a redrive policy that specifies a target dead-letter queue and a maxReceiveCount of 1. The company has set the visibility timeout for the SQS queue to 1 hour. The company has set up an Amazon Clo

A. Turn on termination protection for the EC2 instances

B. Update the visibility timeout for the SOS queue to 3 hours

C. Configure scale-in protection for the instances during processing

D. Update the redrive policy and set maxReceiveCount to 0

View answer

Correct Answer: C

Question #18

A company runs a Python script on an Amazon EC2 instance to process data. The script runs every 10 minutes. The script ingests files from an Amazon S3 bucket and processes the files. On average, the script takes approximately 5 minutes to process each file The script will not reprocess a file that the script has already processed. The company reviewed Amazon CloudWatch metrics and noticed that the EC2 instance is idle for approximately 40% of the time because of the file processing speed. The company wants

A. Migrate the data processing script to an AWS Lambda functio

B. Use an S3 event notification to invoke the Lambda function to process the objects when the company uploads the objects

C. Create an Amazon Simple Queue Service (Amazon SQS) queu

D. Configure Amazon S3 to send event notifications to the SQS queu

E. Create an EC2 Auto Scaling group with a minimum size of one instanc

F. Update the data processing script to poll the SQS queu G

View answer

Correct Answer: C

Question #19

A company has developed APIs that use Amazon API Gateway with Regional endpoints. The APIs call AWS Lambda functions that use API Gateway authentication mechanisms. After a design review, a solutions architect identifies a set of APIs that do not require public access. The solutions architect must design a solution to make the set of APIs accessible only from a VPC. All APIs need to be called with an authenticated user. Which solution will meet these requirements with the LEAST amount of effort?

A. Create an internal Application Load Balancer (ALB)

B. Select the Lambda function to cal

C. Use the ALB DNS name to call the API from the VPC

D. Remove the DNS entry that is associated with the API in API Gatewa

E. Create a hosted zone in Amazon Route 53

F. Update the API in API Gateway with the CNAME recor G

View answer

Correct Answer: CE

Question #20

A software as a service (SaaS) based company provides a case management solution to customers A3 part of the solution. The company uses a standalone Simple Mail Transfer Protocol (SMTP) server to send email messages from an application. The application also stores an email template for acknowledgement email messages that populate customer data before the application sends the email message to the customer. The company plans to migrate this messaging functionality to the AWS Cloud and needs to minimize opera

A. Set up an SMTP server on Amazon EC2 instances by using an AMI from the AWS Marketplac

B. Store the email template in an Amazon S3 bucke

C. Create an AWS Lambda function to retrieve the template from the S3 bucket and to merge the customer data from the application with the templat

D. Use an SDK in the Lambda function to send the email message

E. Set up Amazon Simple Email Service (Amazon SES) to send email message

F. Store the email template in an Amazon S3 bucke G

View answer

Correct Answer: A

Question #21

A publishing company's design team updates the icons and other static assets that an ecommerce web application uses. The company serves the icons and assets from an Amazon S3 bucket that is hosted in the company's production account. The company also uses a development account that members of the design team can access. After the design team tests the static assets in the development account, the design team needs to load the assets into the S3 bucket in the production account. A solutions architect must pr

A. In the production account, create a new IAM policy that allows read and write access to the S3 bucket

B. In the development account, create a new IAM policy that allows read and write access to the S3 bucket

C. In the production account, create a rol

D. Attach the new policy to the rol

E. Define the development account as a trusted entity

F. In the development account, create a rol G

View answer

Correct Answer: D

Question #22

A company uses AWS Organizations with a single OU named Production to manage multiple accounts All accounts are members of the Production OU Administrators use deny list SCPs in the root of the organization to manage access to restricted services. The company recently acquired a new business unit and invited the new unit's existing AWS account to the organization Once onboarded the administrators of the new business unit discovered that they are not able to update existing AWS Config rules to meet the compa

A. Remove the organization's root SCPs that limit access to AWS Config Create AWS Service Catalog products for the company's standard AWS Config rules and deploy them throughout the organization, including the new account

B. Create a temporary OU named Onboarding for the new account Apply an SCP to the Onboarding OU to allow AWS Config actions Move the new account to the Production OU when adjustments to AWS Config are complete

C. Convert the organization's root SCPs from deny list SCPs to allow list SCPs to allow the required services only Temporarily apply an SCP to the organization's root that allows AWS Config actions for principals only in the new account

D. Create a temporary OU named Onboarding for the new account Apply an SCP to the Onboarding OU to allow AWS Config action

E. Move the organization's root SCP to the Production O

F. Move the new account to the Production OU when adjustments to AWS Config are complete

View answer

Correct Answer: C

Question #23

A company recently completed the migration from an on-premises data center to the AWS Cloud by using a replatforming strategy. One of the migrated servers is running a legacy Simple Mail Transfer Protocol (SMTP) service that a critical application relies upon. The application sends outbound email messages to the company’s customers. The legacy SMTP server does not support TLS encryption and uses TCP port 25. The application can use SMTP only. The company decides to use Amazon Simple Email Service (Amazon SE

A. Configure the application to connect to Amazon SES by using TLS Wrappe

B. Create an IAM role that has ses:SendEmail and ses:SendRawEmail permission

C. Attach the IAM role to an Amazon EC2 instance

D. Configure the application to connect to Amazon SES by using STARTTL

E. Obtain Amazon SES SMTP credential

F. Use the credentials to authenticate with Amazon SES

View answer

Correct Answer: A

Question #24

A company is running an application on several Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The load on the application varies throughout the day, and EC2 instances are scaled in and out on a regular basis. Log files from the EC2 instances are copied to a central Amazon S3 bucket every 15 minutes. The security team discovers that log files are missing from some of the terminated EC2 instances. Which set of actions will ensure that log files are copied to the central S3

A. Create a script to copy log files to Amazon S3, and store the script in a file on the EC2 instanc

B. Create an Auto Scaling lifecycle hook and an Amazon EventBridge (Amazon CloudWatch Events) rule to detect lifecycle events from the Auto Scaling grou

C. Invoke an AWS Lambda function on the autoscaling:EC2_INSTANCE_TERMINATING transition to send ABANDON to the Auto Scaling group to prevent termination, run the script to copy the log files, and terminate the instance using the AWS SDK

D. Create an AWS Systems Manager document with a script to copy log files to Amazon S3

E. Invoke an AWS Lambda function on the autoscaling:EC2_INSTANCE_TERMINATING transition to call the AWS Systems Manager API SendCommand operation to run the document to copy the log files and send CONTINUE to the Auto Scaling group to terminate the instance

F. Change the log delivery rate to every 5 minute G

View answer

Correct Answer: B

Question #25

A company wants to use a third-party software-as-a-service (SaaS) application. The third-party SaaS application is consumed through several API calls. The third- party SaaS application also runs on AWS inside a VPC. The company will consume the third-party SaaS application from inside a VPC. The company has internal security policies that mandate the use of private connectivity that does not traverse the internet. No resources that run in the company VPC are allowed to be accessed from outside the company’s

A. Create an AWS PrivateLink interface VPC endpoin

B. Connect this endpoint to the endpoint service that the third-party SaaS application provide

C. Create a security group to limit the access to the endpoin

D. Associate the security group with the endpoint

E. Create an AWS Site-to-Site VPN connection between the third-party SaaS application and the company VP

F. Configure network ACLs to limit access across the VPN tunnels

View answer

Correct Answer: A

Question #26

A company has its cloud infrastructure on AWS A solutions architect needs to define the infrastructure as code. The infrastructure is currently deployed in one AWS Region. The company's business expansion plan includes deployments in multiple Regions across multiple AWS accounts What should the solutions architect do to meet these requirements?

A. Use AWS CloudFormation templates Add IAM policies to control the various accounts Deploy the templates across the multiple Regions

B. Use AWS Organizations Deploy AWS CloudFormation templates from the management account Use AWS Control Tower to manage deployments across accounts

C. Use AWS Organizations and AWS CloudFormation StackSets Deploy a CloudFormation template from an account that has the necessary IAM permissions

D. Use nested stacks with AWS CloudFormation templates Change the Region by using nested stacks

View answer

Correct Answer: D

Question #27

A company needs to implement a patching process for its servers. The on-premises servers and Amazon EC2 instances use a variety of tools to perform patching. Management requires a single report showing the patch status of all the servers and instances. Which set of actions should a solutions architect take to meet these requirements?

A. Use AWS Systems Manager to manage patches on the on-premises servers and EC2 instance

B. Use Systems Manager to generate patch compliance reports

C. Use AWS OpsWorks to manage patches on the on-premises servers and EC2 instance

D. Use Amazon OuickSight integration with OpsWorks to generate patch compliance reports

E. Use an Amazon EventBridge (Amazon CloudWatch Events) rule to apply patches by scheduling an AWS Systems Manager patch remediation jo

F. Use Amazon Inspector to generate patch compliance reports

View answer

Correct Answer: B

Question #28

A company is subject to regulatory audits of its financial information. External auditors who use a single AWS account need access to the company's AWS account. A solutions architect must provide the auditors with secure, read-only access to the company's AWS account. The solution must comply with AWS security best practices. Which solution will meet these requirements?

A. In the company's AWS account, create resource policies for all resources in the account to grant access to the auditors' AWS accoun

B. Assign a unique external ID to the resource policy

C. In the company's AWS account create an IAM role that trusts the auditors' AWS account Create an IAM policy that has the required permission

D. Attach the policy to the rol

E. Assign a unique external ID to the role's trust policy

F. In the company's AWS account, create an IAM use G

View answer

Correct Answer: B

Question #29

A company is using AWS Organizations lo manage multiple AWS accounts For security purposes, the company requires the creation of an Amazon Simple Notification Service (Amazon SNS) topic that enables integration with a third-party alerting system in all the Organizations member accounts A solutions architect used an AWS CloudFormation template to create the SNS topic and stack sets to automate the deployment of CloudFormation stacks Trusted access has been enabled in Organizations What should the solutions a

A. Create a stack set in the Organizations member account

B. Use service-managed permission

C. Set deployment options to deploy to an organizatio

D. Use CloudFormation StackSets drift detection

E. Create stacks in the Organizations member account

F. Use self-service permission G

View answer

Correct Answer: B

Question #30

A company is running applications on AWS in a multi-account environment. The company's sales team and marketing team use separate AWS accounts in AWS Organizations. The sales team stores petabytes of data in an Amazon S3 bucket. The marketing team uses Amazon QuickSight for data visualizations. The marketing team needs access to data that the sates team stores in the S3 bucket. The company has encrypted the S3 bucket with an AWS Key Management Service (AWS KMS) key. The marketing team has already created th

A. Create a new S3 bucket in the marketing accoun

B. Create an S3 replication rule in the sales account to copy the objects to the new S3 bucket in the marketing accoun

C. Update the QuickSight permissions in the marketing account to grant access to the new S3 bucket

D. Create an SCP to grant access to the S3 bucket to the marketing accoun

E. Use AWS Resource Access Manager (AWS RAM) to share the KMS key from the sates account with the marketing accoun

F. Update the QuickSight permissions in the marketing account to grant access to the S3 bucket

View answer

Correct Answer: D

Question #31

A company has a latency-sensitive trading platform that uses Amazon DynamoDB as a storage backend. The company configured the DynamoDB table to use on- demand capacity mode. A solutions architect needs to design a solution to improve the performance of the trading platform. The new solution must ensure high availability for the trading platform. Which solution will meet these requirements with the LEAST latency?

A. Create a two-node DynamoDB Accelerator (DAX) cluster Configure an application to read and write data by using DAX

B. Create a three-node DynamoDB Accelerator (DAX) cluste

C. Configure an application to read data by using DAX and to write data directly to the DynamoDB table

D. Create a three-node DynamoDB Accelerator (DAX) cluste

E. Configure an application to read data directly from the DynamoDB table and to write data by using DAX

F. Create a single-node DynamoD8 Accelerator (DAX) cluste G

View answer

Correct Answer: C

Question #32

An application is using an Amazon RDS for MySQL Multi-AZ DB instance in the us-east-1 Region. After a failover test, the application lost the connections to the database and could not re-establish the connections. After a restart of the application, the application re-established the connections. A solutions architect must implement a solution so that the application can re-establish connections to the database without requiring a restart. Which solution will meet these requirements?

A. Create an Amazon Aurora MySQL Serverless v1 DB instanc

B. Migrate the RDS DB instance to the Aurora Serverless v1 DB instanc

C. Update the connection settings in the application to point to the Aurora reader endpoint

D. Create an RDS prox

E. Configure the existing RDS endpoint as a targe

F. Update the connection settings in the application to point to the RDS proxy endpoint

View answer

Correct Answer: B

Question #33

A company is migrating some of its applications to AWS. The company wants to migrate and modernize the applications quickly after it finalizes networking and security strategies. The company has set up an AWS Direct Connection connection in a central network account. The company expects to have hundreds of AWS accounts and VPCs in the near future. The corporate network must be able to access the resources on AWS seamlessly and also must be able to communicate with all the VPCs. The company also wants to rou

A. Create a Direct Connect gateway in the central accoun

B. In each of the accounts, create an association proposal by using the Direct Connect gateway and the account ID for every virtual private gateway

C. Create a Direct Connect gateway and a transit gateway in the central network accoun

D. Attach the transit gateway to the Direct Connect gateway by using a transit VIF

E. Provision an internet gatewa

F. Attach the internet gateway to subnet G

View answer

Correct Answer: D

Question #34

A company runs an loT platform on AWS loT sensors in various locations send data to the company's Node js API servers on Amazon EC2 instances running behind an Application Load Balancer The data is stored in an Amazon RDS MySQL DB instance that uses a 4 TB General Purpose SSD volume The number of sensors the company has deployed in the field has increased over time and is expected to grow significantly The API servers are consistently overloaded and RDS metrics show high write latency Which of the following

A. Resize the MySQL General Purpose SSD storage to 6 TB to improve the volume's IOPS

B. Re-architect the database tier to use Amazon Aurora instead of an RDS MySQL DB instance and add read replicas

C. Leverage Amazon Kinesis Data Streams and AWS Lambda to ingest and process the raw data

D. Use AWS X-Ray to analyze and debug application issues and add more API servers to match the load

E. Re-architect the database tier to use Amazon DynamoDB instead of an RDS MySQL DB instance

View answer

Correct Answer: CE

Question #35

A company has built a high performance computing (HPC) cluster in AWS tor a tightly coupled workload that generates a large number of shared files stored in Amazon EFS. The cluster was performing well when the number of Amazon EC2 instances in the cluster was 100. However, when the company increased the cluster size to 1,000 EC2 instances, overall performance was well below expectations. Which collection of design choices should a solutions architect make to achieve the maximum performance from the HPC clus

A. Ensure the HPC cluster Is launched within a single Availability Zone

B. Launch the EC2 instances and attach elastic network interfaces in multiples of four

C. Select EC2 Instance types with an Elastic Fabric Adapter (EFA) enabled

D. Ensure the cluster Is launched across multiple Availability Zones

E. Replace Amazon EFS with multiple Amazon EBS volumes in a RAID array

F. Replace Amazon EFS with Amazon FSx for Lustre

View answer

Correct Answer: A

Question #36

A company runs a processing engine in the AWS Cloud The engine processes environmental data from logistics centers to calculate a sustainability index The company has millions of devices in logistics centers that are spread across Europe The devices send information to the processing engine through a RESTful API The API experiences unpredictable bursts of traffic The company must implement a solution to process all data that the devices send to the processing engine Data loss is unacceptable Which solution

A. Create an Application Load Balancer (ALB) for the RESTful API Create an Amazon Simple Queue Service (Amazon SQS) queue Create a listener and a target group for the ALB Add the SQS queue as the target Use a container that runs in Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type to process messages in the queue

B. Create an Amazon API Gateway HTTP API that implements the RESTful API Create an Amazon Simple Queue Service (Amazon SQS) queue Create an API Gateway service integration with the SQS queue Create an AWS Lambda function to process messages in the SQS queue

C. Create an Amazon API Gateway REST API that implements the RESTful API Create a fleet of Amazon EC2 instances in an Auto Scaling group Create an API Gateway Auto Scaling group proxy integration Use the EC2 instances to process incoming data

D. Create an Amazon CloudFront distribution for the RESTful API Create a data stream in Amazon Kinesis Data Streams Set the data stream as the origin for the distribution Create an AWS Lambda function to consume and process data in the data stream

View answer

Correct Answer: B

Question #37

A company wants to use Amazon Workspaces in combination with thin client devices to replace aging desktops Employees use the desktops to access applications that work with clinical trial data Corporate security policy states that access to the applications must be restricted to only company branch office locations. The company is considering adding an additional branch office in the next 6 months. Which solution meets these requirements with the MOST operational efficiency?

A. Create an IP access control group rule with the list of public addresses from the branch offices Associate the IP access control group with the Workspaces directory

B. Use AWS Firewall Manager to create a web ACL rule with an IPSet with the list of public addresses from the branch office locations Associate the web ACL with the Workspaces directory

C. Use AWS Certificate Manager (ACM) to issue trusted device certificates to the machines deployed in the branch office locations Enable restricted access on the Workspaces directory

D. Create a custom Workspace image with Windows Firewall configured to restrict access to the public addresses of the branch offices Use the image to deploy the Workspaces

View answer

Correct Answer: ACF

Question #38

A company uses an on-premises data analytics platform. The system is highly available in a fully redundant configuration across 12 servers in the company's data center. The system runs scheduled jobs, both hourly and daily, in addition to one-time requests from users. Scheduled jobs can take between 20 minutes and 2 hours to finish running and have tight SLAs. The scheduled jobs account for 65% of the system usage. User jobs typically finish running in less than 5 minutes and have no SLA. The user jobs acco

A. Split the 12 instances across two Availability Zones in the chosen AWS Regio

B. Run two instances in each Availability Zone as On-Demand Instances with Capacity Reservation

C. Run four instances in each Availability Zone as Spot Instances

D. Split the 12 instances across three Availability Zones in the chosen AWS Regio

E. In one of the Availability Zones, run all four instances as On-Demand Instances with Capacity Reservation

F. Run the remaining instances as Spot Instances

View answer

Correct Answer: B

Question #39

A company has 10 accounts that are part of an organization in AWS Organizations AWS Config is configured in each account All accounts belong to either the Prod OU or the NonProd OU The company has set up an Amazon EventBridge rule in each AWS account to notify an Amazon Simple Notification Service (Amazon SNS) topic when an Amazon EC2 security group inbound rule is created with 0.0.0.0/0 as the source The company's security team is subscribed to the SNS topic For all accounts in the NonProd OU the security

A. Modify the EventBridge rule to invoke an AWS Lambda function to remove the security group inbound rule and to publish to the SNS topic Deploy the updated rule to the NonProd OU

B. Add the vpc-sg-open-only-to-authorized-ports AWS Config managed rule to the NonProd OU

C. Configure an SCP to allow the ec2 AulhonzeSecurityGrouplngress action when the value of the aws Sourcelp condition key is not 0

D. Configure an SCP to deny the ec2 AuthorizeSecurityGrouplngress action when the value of the aws Sourcelp condition key is 0

View answer

Correct Answer: D

Question #40

A company that runs applications on AWS recently subscribed to a new software-as-a-service (SaaS) data vendor. The vendor provides the data by way of a REST API that the vendor hosts in its AWS environment The vendor offers multiple options for connectivity to the API and Is working with the company to find the best way to connect. The company's AWS account does not allow outbound internet access from Its AWS environment The vendor's services run on AWS in the same AWS Region as the company's applications A

A. Connect to the vendor's public API address for the data service

B. Connect to the vendor by way of a VPC peering connection between the vendor's VPC and the company's VPC

C. Connect to the vendor by way of a VPC endpoint service that uses AWS PrivateLink

D. Connect to a public bastion host that the vendor provides Tunnel the API traffic

View answer

Correct Answer: B

Question #41

A company is running a web application in the AWS Cloud. The application consists of dynamic content that is created on a set of Amazon EC2 instances. The EC2 instances run in an Auto Scaling group that is configured as a target group for an Application Load Balancer (ALB). The company is using an Amazon CloudFront distribution to distribute the application globally. The CloudFront distribution uses the ALB as an origin. The company uses Amazon Route 53 for DNS and has created an A record of www.example.com

A. Provision a full, secondary application deployment in a different AWS Regio

B. Update the Route 53 A record to be a failover recor

C. Add both of the CloudFront distributions as value

D. Create Route 53 health checks

E. Provision an ALB, an Auto Scaling group, and EC2 instances in a different AWS Regio

F. Update the CloudFront distribution, and create a second origin for the new AL G

View answer

Correct Answer: A

Question #42

A company uses AWS Organizations for a multi-account setup in the AWS Cloud. The company's finance team has a data processing application that uses AWS Lambda and Amazon DynamoDB. The company's marketing team wants to access the data that is stored in the DynamoDB table. The DynamoDB table contains confidential data. The marketing team can have access to only specific attributes of data in the DynamoDB table. The fi-nance team and the marketing team have separate AWS accounts. What should a solutions archit

A. Create an SCP to grant the marketing team's AWS account access to the specific attributes of the DynamoDB tabl

B. Attach the SCP to the OU of the finance team

C. Create an IAM role in the finance team's account by using IAM policy conditions for specific DynamoDB attributes (fine-grained access con-trol)

D. In the mar-keting team's account, create an IAM role that has permissions to as-sume the IAM role in the finance team's account

E. Create a resource-based IAM policy that includes conditions for spe-cific DynamoDB attributes (fine-grained access control)

F. In the marketing team'saccount, create an IAM role that has permissions to access the DynamoDB table in the finance team's account

View answer

Correct Answer: B

Question #43

A company is planning to store a large number of archived documents and make the documents available to employees through the corporate intranet. Employees will access the system by connecting through a client VPN service that is attached to a VPC. The data must not be accessible to the public. The documents that the company is storing are copies of data that is held on physical media elsewhere. The number of requests will be low. Availability and speed of retrieval are not concerns of the company. Which so

A. Create an Amazon S3 bucke

B. Configure the S3 bucket to use the S3 One Zone-Infrequent Access (S3 One Zone-IA) storage class as defaul

C. Configure the S3 bucket for website hostin

D. Create an S3 interface endpoin

E. Configure the S3 bucket to allow access only through that endpoint

F. Launch an Amazon EC2 instance that runs a web serve G

View answer

Correct Answer: ADF

Question #44

A company developed a pilot application by using AWS Elastic Beanstalk and Java. To save costs during development, the company's development team deployed the application into a single-instance environment. Recent tests indicate that the application consumes more CPU than expected. CPU utilization is regularly greater than 85%, which causes some performance bottlenecks. A solutions architect must mitigate the performance issues before the company launches the application to production. Which solution will m

A. Create a new Elastic Beanstalk applicatio

B. Select a load-balanced environment typ

C. Select all Availability Zone

D. Add a scale-out rule that will run if the maximum CPU utilization is over 85% for 5 minutes

E. Create a second Elastic Beanstalk environmen

F. Apply the traffic-splitting deployment polic G

View answer

Correct Answer: ACE

Question #45

A company has deployed an application on AWS Elastic Beanstalk. The application uses Amazon Aurora for the database layer. An Amazon CloudFront distribution serves web requests and includes the Elastic Beanstalk domain name as the origin server. The distribution is configured with an alternate domain name that visitors use when they access the application. Each week, the company takes the application out of service for routine maintenance. During the time that the application is unavailable, the company wan

A. Upload static informational content to the S3 bucket

B. Create a new CloudFront distributio

C. Set the S3 bucket as the origin

D. Set the S3 bucket as a second origin in the original CloudFront distributio

E. Configure the distribution and the S3 bucket to use an origin access identity (OAI)

F. During the weekly maintenance, edit the default cache behavior to use the S3 origi G

View answer

Correct Answer: BDF

Question #46

A company stores sales transaction data in Amazon DynamoDB tables. To detect anomalous behaviors and respond quickly, all changes lo the items stored in the DynamoDB tables must be logged within 30 minutes. Which solution meets the requirements?

A. Copy the DynamoDB tables into Apache Hive tables on Amazon EMR every hour and analyze them (or anomalous behavior

B. Send Amazon SNS notifications when anomalous behaviors are detected

C. Use AWS CloudTrail to capture all the APIs that change the DynamoDB table

D. Send SNS notifications when anomalous behaviors are detected using CloudTrail event filtering

E. Use Amazon DynamoDB Streams to capture and send updates to AWS Lambd

F. Create a Lambda function to output records lo Amazon Kinesis Data Stream G

View answer

Correct Answer: C

Question #47

A company uses AWS Transit Gateway for a hub-and-spoke model to manage network traffic between many VPCs. The company is developing a new service that must be able to send data at 100 Gbps. The company needs a faster connection to other VPCs in the same AWS Region. Which solution will meet these requirements?

A. Establish VPC peering between the necessary VPC

B. Ensure that all route tables are updated as required

C. Attach an additional transit gateway to the VPC

D. Update the route tables accordingly

E. Create AWS Site-to-Site VPN connections that use equal-cost multi-path (ECMP) routing between the necessary VPCs

F. Create an additional attachment from the necessary VPCs to the existing transit gateway

View answer

Correct Answer: C

Question #48

A company is migrating its three-tier web application from on-premises to the AWS Cloud. The company has the following requirements for the migration process: ? Ingest machine images from the on-premises environment. ? Synchronize changes from the on-premises environment to the AWS environment until the production cutover. ? Minimize downtime when executing the production cutover. ? Migrate the virtual machines' root volumes and data volumes. Which solution will satisfy these requirements with minimal opera

A. Use AWS Server Migration Service (SMS) to create and launch a replication job for each tier of the applicatio

B. Launch instances from the AMIs created by AWS SM

C. After initial testing, perform a final replication and create new instances from the updated AMIs

D. Create an AWS CLIVM Import/Export script to migrate each virtual machin

E. Schedule the script to runincrementally to maintain changes in the applicatio

F. Launch instances from the AMIs created by VM Import/Expor G

View answer

Correct Answer: ACE

Question #49

A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application. How should a solutions architect configure the web ACLs to meet these requirements?

A. Set the action of the web ACL rules to Coun

B. Enable AWS WAF logging Analyze the requests for false positives Modify the rules to avoid any false positive Over time change the action of the web ACL rules from Count to Block

C. Use only rate-based rules in the web ACL

D. and set the throttle limit as high as possible Temporarily block all requests that exceed the limi

E. Define nested rules to narrow the scope of the rate tracking

F. Set the action o' the web ACL rules to Bloc G

View answer

Correct Answer: C

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now

Pass Your SAP-C02 Exam with Practice Tests 2024 Updated, AWS Certified Solutions Architect - Professional | SPOTO

View The Updated SAP-C02 Exam Questions

View The Updated AWS Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE! Get Now

Pass Your SAP-C02 Exam with Practice Tests 2024 Updated, AWS Certified Solutions Architect - Professional | SPOTO

View The Updated SAP-C02 Exam Questions

View The Updated AWS Exam Questions

View Answers after Submission

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now