saa-c02-part-03

Question 1

A financial services company has a web application that serves users in the United States and Europe. The application consists of a database tier and a web server tier. The database tier consists of a MySQL database hosted in us-east-1. Amazon Route 53 geoproximity routing is used to direct traffic to instances in the closest Region. A performance review of the system reveals that European users are not receiving the same level of query performance as those in the United States.

Which changes should be made to the database tier to improve performance?

1. Migrate the database to Amazon RDS for MySQL. Configure Multi-AZ in one of the European Regions.
2. Migrate the database to Amazon DynamoDB. Use DynamoDB global tables to enable replication to additional Regions.
3. Deploy MySQL instances in each Region. Deploy an Application Load Balancer in front of MySQL to reduce the load on the primary instance.
4. Migrate the database to an Amazon Aurora global database in MySQL compatibility mode. Configure read replicas in one of the European Regions.

Answer 1

4. Migrate the database to an Amazon Aurora global database in MySQL compatibility mode. Configure read replicas in one of the European Regions.

performance / query performance = read replicas

Question 2

A company hosts a static website on-premises and wants to migrate the website to AWS. The website should load as quickly as possible for users around the world. The company also wants the most cost-effective solution.

What should a solutions architect do to accomplish this?

1. Copy the website content to an Amazon S3 bucket. Configure the bucket to serve static webpage content. Replicate the S3 bucket to multiple AWS Regions.
2. Copy the website content to an Amazon S3 bucket. Configure the bucket to serve static webpage content. Configure Amazon CloudFront with the S3 bucket as the origin.
3. Copy the website content to an Amazon EBS-backed Amazon EC2 instance running Apache HTTP Server. Configure Amazon Route 53 geolocation routing policies to select the closest origin.
4. Copy the website content to multiple Amazon EBS-backed Amazon EC2 instances running Apache HTTP Server in multiple AWS Regions. Configure Amazon CloudFront geolocation routing policies to select the closest origin.

Answer 2

2. Copy the website content to an Amazon S3 bucket. Configure the bucket to serve static webpage content. Configure Amazon CloudFront with the S3 bucket as the origin.

static website = S3

users around the world = CloudFront + origin

Question 3

A solutions architect is designing storage for a high performance computing (HPC) environment based on Amazon Linux. The workload stores and processes a large amount of engineering drawings that require shared storage and heavy computing.

Which storage option would be the optimal solution?

1. Amazon Elastic File System (Amazon EFS)
2. Amazon FSx for Lustre
3. Amazon EC2 instance store
4. Amazon Elastic Block Store (Amazon EBS) Provisioned IOPS SSD (io1)

Answer 3

2. Amazon FSx for Lustre

HPC + Linux = FSx for Lustre

Lustre = Linux and cluster

FSx supports 4 file systems, but Windows File Server and Lustre are most common

Question 4

A company is performing an AWS Well-Architected Framework review of an existing workload deployed on AWS. The review identified a public-facing website running on the same Amazon EC2 instance as a Microsoft Active Directory domain controller that was install recently to support other AWS services. A solutions architect needs to recommend a new design that would improve the security of the architecture and minimize the administrative demand on IT staff.

What should the solutions architect recommend?

1. Use AWS Directory Service to create a managed Active Directory. Uninstall Active Directory on the current EC2 instance.
2. Create another EC2 instance in the same subnet and reinstall Active Directory on it. Uninstall Active Directory.
3. Use AWS Directory Service to create an Active Directory connector. Proxy Active Directory requests to the Active domain controller running on the current EC2 instance.
4. Enable AWS Single Sign-On (AWS SSO) with Security Assertion Markup Language (SAML) 2.0 federation with the current Active Directory controller. Modify the EC2 instance’s security group to deny public access to Active Directory.

Answer 4

1. Use AWS Directory Service to create a managed Active Directory. Uninstall Active Directory on the current EC2 instance.

Look for duplicate answer keywords: AWS Directory Service shows up twice.

Answer 1 is more secure than keeping AD running on same instance.

Question 5

A company hosts a static website within an Amazon S3 bucket. A solutions architect needs to ensure that data can be recovered in case of accidental deletion.

Which action will accomplish this?

1. Enable Amazon S3 versioning.
2. Enable Amazon S3 Intelligent-Tiering.
3. Enable an Amazon S3 lifecycle policy.
4. Enable Amazon S3 cross-Region replication.

Answer 5

1. Enable Amazon S3 versioning.

S3 data recovery = S3 versioning

Question 6

A company’s production application runs online transaction processing (OLTP) transactions on an Amazon RDS MySQL DB instance. The company is launching a new reporting tool that will access the same data. The reporting tool must be highly available and not impact the performance of the production application.

How can this be achieved?

1. Create hourly snapshots of the production RDS DB instance.
2. Create a Multi-AZ RDS Read Replica of the production RDS DB instance.
3. Create multiple RDS Read Replicas of the production RDS DB instance. Place the Read Replicas in an Auto Scaling group.
4. Create a Single-AZ RDS Read Replica of the production RDS DB instance. Create a second Single-AZ RDS Read Replica from the replica.

Answer 6

2. Create a Multi-AZ RDS Read Replica of the production RDS DB instance.

reporting = queries = read replicas

highly available = multi AZ

Question 7

A company runs an application in a branch office within a small data closet with no virtualized compute resources. The application data is stored on an NFS volume. Compliance standards require a daily offsite backup of the NFS volume.

Which solution meets these requirements?

1. Install an AWS Storage Gateway file gateway on premises to replicate the data to Amazon S3.
2. Install an AWS Storage Gateway file gateway hardware appliance on premises to replicate the data to Amazon S3.
3. Install an AWS Storage Gateway volume gateway with stored volumes on premises to replicate the data to Amazon S3.
4. Install an AWS Storage Gateway volume gateway with cached volumes on premises to replicate the data to Amazon S3.

Answer 7

2. Install an AWS Storage Gateway file gateway hardware appliance on premises to replicate the data to Amazon S3.

no virtualized compute resources = storage gateway hardware appliance

https://aws.amazon.com/blogs/aws/new-aws-storage-gateway-hardware-appliance/ https://aws.amazon.com/storagegateway/file/

Question 8

A company’s web application is using multiple Linux Amazon EC2 instances and storing data on Amazon Elastic Block Store (Amazon EBS) volumes. The company is looking for a solution to increase the resiliency of the application in case of a failure and to provide storage that complies with atomicity, consistency, isolation, and durability (ACID).

What should a solutions architect do to meet these requirements?

1. Launch the application on EC2 instances in each Availability Zone. Attach EBS volumes to each EC2 instance.
2. Create an Application Load Balancer with Auto Scaling groups across multiple Availability Zones. Mount an instance store on each EC2 instance.
3. Create an Application Load Balancer with Auto Scaling groups across multiple Availability Zones. Store data on Amazon Elastic File System (Amazon EFS) and mount a target on each instance.
4. Create an Application Load Balancer with Auto Scaling groups across multiple Availability Zones. Store data using Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA).

Answer 8

3. Create an Application Load Balancer with Auto Scaling groups across multiple Availability Zones. Store data on Amazon Elastic File System (Amazon EFS) and mount a target on each instance.

Look for multiple answers: ALB with ASG in multiple AZ is common.

EBS = 1 AZ (what we start with is not HA)

EFS = HA + DR + multi AZ

Question 9

A security team to limit access to specific services or actions in all of the team’s AWS accounts. All accounts belong to a large organization in AWS Organizations. The solution must be scalable and there must be a single point where permissions can be maintained.

What should a solutions architect do to accomplish this?

1. Create an ACL to provide access to the services or actions.
2. Create a security group to allow accounts and attach it to user groups.
3. Create cross-account roles in each account to deny access to the services or actions.
4. Create a service control policy in the root organizational unit to deny access to the services or actions.

Answer 9

4. Create a service control policy in the root organizational unit to deny access to the services or actions.

Organizations + single point = root parent applies policies to all children

AWS Organizations automatically creates a root

Question 10

A data science team requires storage for nightly log processing. The size and number of logs is unknown and will persist for 24 hours only.
What is the MOST cost-effective solution?

1. Amazon S3 Glacier
2. Amazon S3 Standard
3. Amazon S3 Intelligent-Tiering
4. Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)

Answer 10

3. Amazon S3 Intelligent-Tiering

unknown = Intelligent-Tiering

24 hours = looking for services that have no min duration of 30 days = Intelligent-Tiering or Standard

cost-effective = Intelligent-Tiering

S3 Intelligent-Tiering is the only cloud storage class that delivers automatic storage cost savings when data access patterns change, without performance impact or operational overhead.

https://aws.amazon.com/about-aws/whats-new/2021/09/amazon-s3-intelligent-tiering-automates-storage-savings/

Question 11

A company is hosting a web application on AWS using a single Amazon EC2 instance that stores user-uploaded documents in an Amazon Elastic Block Store (Amazon EBS) volume. For better scalability and availability, the company duplicated the architecture and created a second EC2 instance and EBS volume in another Availability Zone, placing both behind an Application Load Balancer. After completing this change, users reported that each time they refreshed the website, they could see one subset of their documents or the other, but never all of the documents at the same time.

What should a solutions architect propose to ensure users see all of their documents at once?

1. Copy the data so both EBS volumes contain all the documents.
2. Configure the Application Load Balancer to direct a user to the server with the documents.
3. Copy the data from both EBS volumes to Amazon Elastic File System (Amazon EFS). Modify the application to save new documents to Amazon Elastic File System (Amazon EFS).
4. Configure the Application Load Balancer to send the request to both servers. Return each document from the correct server.

Answer 11

3. Copy the data from both EBS volumes to Amazon Elastic File System (Amazon EFS). Modify the application to save new documents to Amazon Elastic File System (Amazon EFS).

EBS = 1 AZ (started with no multi AZ support)

another Availability Zone = EFS = HA multi AZ (only 3 has EFS)

Question 12

A company is planning to use Amazon S3 to store images uploaded by its users. The images must be encrypted at rest in Amazon S3. The company does not want to spend time managing and rotating the keys, but it does want to control who can access those keys.

What should a solutions architect use to accomplish this?

1. Server-Side Encryption with keys stored in an S3 bucket
2. Server-Side Encryption with Customer-Provided Keys (SSE-C)
3. Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)
4. Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)

Answer 12

4. Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)

not want to spend time managing and rotating the keys = managed data key = SSE

does want to control who can access those keys = KMS

SSE-S3: AWS manages both data key and master key

SSE-KMS: AWS manages data key and you manage master key

SSE-C: You manage both data key and master key

Question 13

A company is running an ecommerce application on Amazon EC2. The application consists of a stateless web tier that requires a minimum of 10 instances, and a peak of 250 instances to support the application’s usage. The application requires 50 instances 80% of the time.

Which solution should be used to minimize costs?

1. Purchase Reserved Instances to cover 250 instances.
2. Purchase Reserved Instances to cover 80 instances. Use Spot Instances to cover the remaining instances.
3. Purchase On-Demand Instances to cover 40 instances. Use Spot Instances to cover the remaining instances.
4. Purchase Reserved Instances to cover 50 instances. Use On-Demand and Spot Instances to cover the remaining instances.

Answer 13

4. Purchase Reserved Instances to cover 50 instances. Use On-Demand and Spot Instances to cover the remaining instances.

Reserved Instances to cover 50 instances = discounted hourly rate = minimize costs

Question 14

A company has deployed an API in a VPC behind an internet-facing Application Load Balancer (ALB). An application that consumes the API as a client is deployed in a second account in private subnets behind a NAT gateway. When requests to the client application increase, the NAT gateway costs are higher than expected. A solutions architect has configured the ALB to be internal.
Which combination of architectural changes will reduce the NAT gateway costs? (Choose two.)

1. Configure a VPC peering connection between the two VPCs. Access the API using the private address.
2. Configure an AWS Direct Connect connection between the two VPCs. Access the API using the private address.
3. Configure a ClassicLink connection for the API into the client VPC. Access the API using the ClassicLink address.
4. Configure a PrivateLink connection for the API into the client VPC. Access the API using the PrivateLink address.
5. Configure an AWS Resource Access Manager connection between the two accounts. Access the API using the private address.

Answer 14

1. Configure a VPC peering connection between the two VPCs. Access the API using the private address.
2. Configure a PrivateLink connection for the API into the client VPC. Access the API using the PrivateLink address.

shared API = not RAM

API in a VPC = VPC peering or PrivateLink

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-peer-region-example.html

https://aws.amazon.com/about-aws/whats-new/2018/10/aws-privatelink-now-supports-access-over-inter-region-vpc-peering/

Question 15

A solutions architect is tasked with transferring 750 TB of data from an on-premises network-attached file system located at a branch office Amazon S3 Glacier. The migration must not saturate the on-premises 1 Mbps internet connection.

Which solution will meet these requirements?

1. Create an AWS site-to-site VPN tunnel to an Amazon S3 bucket and transfer the files directly. Transfer the files directly by using the AWS CLI.
2. Order 10 AWS Snowball Edge Storage Optimized devices, and select an S3 Glacier vault as the destination.
3. Mount the network-attached file system to an S3 bucket, and copy the files directly. Create a lifecycle policy to transition the S3 objects to Amazon S3 Glacier.
4. Order 10 AWS Snowball Edge Storage Optimized devices, and select an Amazon S3 bucket as the destination. Create a lifecycle policy to transition the S3 objects to Amazon S3 Glacier.

Answer 15

2. Order 10 AWS Snowball Edge Storage Optimized devices, and select an S3 Glacier vault as the destination.

80TB per snowball + cheaper than snowmobile

Question 16

A company has a two-tier application architecture that runs in public and private subnets. Amazon EC2 instances running the web application are in the public subnet and a database runs on the private subnet. The web application instances and the database are running in a single Availability Zone (AZ).

Which combination of steps should a solutions architect take to provide high availability for this architecture? (Choose two.)

1. Create new public and private subnets in the same AZ for high availability.
2. Create an Amazon EC2 Auto Scaling group and Application Load Balancer spanning multiple AZs.
3. Add the existing web application instances to an Auto Scaling group behind an Application Load Balancer.
4. Create new public and private subnets in a new AZ. Create a database using Amazon EC2 in one AZ.
5. Create new public and private subnets in the same VPC, each in a new AZ. Migrate the database to an Amazon RDS multi-AZ deployment.

Answer 16

2. Create an Amazon EC2 Auto Scaling group and Application Load Balancer spanning multiple AZs.
3. Create new public and private subnets in the same VPC, each in a new AZ. Migrate the database to an Amazon RDS multi-AZ deployment.

HA = multiple AZs

Question 17

A solutions architect is implementing a document review application using an Amazon S3 bucket for storage. The solution must prevent an accidental deletion of the documents and ensure that all versions of the documents are available. Users must be able to download, modify, and upload documents.

Which combination of actions should be taken to meet these requirements? (Choose two.)

1. Enable a read-only bucket ACL.
2. Enable versioning on the bucket.
3. Attach an IAM policy to the bucket.
4. Enable MFA Delete on the bucket.
5. Encrypt the bucket using AWS KMS.

Answer 17

2. Enable versioning on the bucket.
3. Enable MFA Delete on the bucket

versions = versioning

prevent an accidental deletion = MFA Delete (IAM policy would block all deletes)

Question 18

An application hosted on AWS is experiencing performance problems, and the application vendor wants to perform an analysis of the log file to troubleshoot further. The log file is stored on Amazon S3 and is 10 GB in size. The application owner will make the log file available to the vendor for a limited time.

What is the MOST secure way to do this?

1. Enable public read on the S3 object and provide the link to the vendor.
2. Upload the file to Amazon WorkDocs and share the public link with the vendor.
3. Generate a presigned URL and have the vendor download the log file before it expires.
4. Create an IAM user for the vendor to provide access to the S3 bucket and the application. Enforce multi-factor authentication.

Answer 18

3. Generate a presigned URL and have the vendor download the log file before it expires.

S3 available for a limited time = presigned URL

Question 19

A solutions architect is designing a two-tier web application. The application consists of a public-facing web tier hosted on Amazon EC2 in public subnets. The database tier consists of Microsoft SQL Server running on Amazon EC2 in a private subnet. Security is a high priority for the company.
How should security groups be configured in this situation? (Choose two.)

1. Configure the security group for the web tier to allow inbound traffic on port 443 from 0.0.0.0/0.
2. Configure the security group for the web tier to allow outbound traffic on port 443 from 0.0.0.0/0.
3. Configure the security group for the database tier to allow inbound traffic on port 1433 from the security group for the web tier.
4. Configure the security group for the database tier to allow outbound traffic on ports 443 and 1433 to the security group for the web tier.
5. Configure the security group for the database tier to allow inbound traffic on ports 443 and 1433 from the security group for the web tier.

Answer 19

1. Configure the security group for the web tier to allow inbound traffic on port 443 from 0.0.0.0/0.
2. Configure the security group for the database tier to allow inbound traffic on port 1433 from the security group for the web tier.

SQL Server = port 1433 default

Question 20

A company allows its developers to attach existing IAM policies to existing IAM roles to enable faster experimentation and agility. However, the security operations team is concerned that the developers could attach the existing administrator policy, which would allow the developers to circumvent any other security policies.
How should a solutions architect address this issue?

1. Create an Amazon SNS topic to send an alert every time a developer creates a new policy.
2. Use service control policies to disable IAM activity across all account in the organizational unit.
3. Prevent the developers from attaching any policies and assign all IAM duties to the security operations team.
4. Set an IAM permissions boundary on the developer IAM role that explicitly denies attaching the administrator policy.

Answer 20

4. Set an IAM permissions boundary on the developer IAM role that explicitly denies attaching the administrator policy

1 does not stop the problem

2 and 3 would block the developers experimentation activities