Question 1

A leading aerospace engineering company is experiencing high growth and demand on their highly available and fault-tolerant cloud services platform that is hosted in AWS. The technical lead of your team has asked you to virtually extend two existing on-premises data centers into AWS cloud to support an online flight-tracking service that is used by a lot of airline companies. The online service heavily depends on existing, on-premises resources located in multiple data centers and static content that is served from an S3 bucket. To meet the requirement, you launched a dual-tunnel VPN connection between your CGW and VGW.

In this scenario, which component of your cloud architecture represents a potential single point of failure, which you should consider changing to make the solution more highly available?

Options :

A : Set up a NAT Gateway in a different data center and set up another dual-tunnel VPN connection.

B : Create a second Virtual Gateway in a different AZ and a Customer Gateway in a different data center. Create another dual-tunnel connection to ensure high-availability and fault-tolerance.

C : Create another Virtual Gateway in a different AZ and create another dual-tunnel VPN connection.

D : Create another Customer Gateway in a different data center and set up another dual-tunnel VPN connection.

Answer: D

Question 2

A company needs to optimize the cost of backups for Amazon Elastic File System (Amazon EFS). A solutions architect has already configured a backup plan in AWS Backup for the EFS backups. The backup plan contains a rule with a lifecycle configuration to transition EFS backups to cold storage after 7 days and to keep the backups for an additional 90 days.

After I month, the company reviews its EFS storage costs and notices an increase in the EFS backup costs. The EFS backup cold storage produces almost double the cost of the EFS warm backup storage.

What should the solutions architect do to optimize the cost?

Options :

A : Modify the backup rule-s lifecycle configuration to move the EFS backups to cold storage after 1 day. Set the backup retention period to 30 days.

B : Modify the backup rule-s lifecycle configuration to move the EFS backups to cold storage after 8 days. Set the backup retention period to 30 days.

C : Modify the backup rule-s lifecycle configuration to move the EFS backups to cold storage after 1 day. Set the backup retention period to 90 days.

D : Modify the backup rule-s lifecycle configuration to move the EFS backups to cold storage after 8 days. Set the backup retention period to 98 days.

Answer: A

Question 3

A company is planning to migrate an application from on premises to AWS. The application currently uses an

Oracle database and the company can tolerate a brief downtime of 1 hour when performing the switch to the

new infrastructure As part of the migration. the database engine will be changed to MySQL. A solutions

architect needs to determine which AWS services can be used to perform the migration while minimizing the

amount of work and time required.

Which of the following will meet the requirements?

Options :

A :

Use AWS SCT to generate the schema scripts and apply them on the target prior to migration Use AWS

DMS to analyse the current schema and provide a recommendation for the optimal database engine

Then, use AWS DMS to migrate to the recommended engine Use AWS SCT to identify what embedded

SQL code in the application can be converted and what has to be done manually

B :

Use AWS SCT to generate the schema scripts and apply them on the target prior to migration. Use AWS

DMS to begin moving data from the on-premises database to AWS. After the initial copy continue to

use AWS DMS to keep the databases m sync until cutting over to the new database Use AWS SCT to

identify what embedded SOL code in the application can be converted and what has to be done

manually.

C :

Use AWS DMS lo help identify the best target deployment between installing the database engine on

Amazon EC2 directly or moving to Amazon RDS. Then, use AWS DMS to migrate to the platform. Use

AWS Application Discovery Service to identify what embedded SQL code in the application can be

converted and what has to be done manually.

D :

Use AWS DMS to begin moving data from the on-premises database to AWS After the initial copy,

continue to use AWS DMS to keep the databases in sync until cutting over to the new database use

AWS Application Discovery Service to identify what embedded SQL code m the application can be

convened and what has to be done manually

Answer: B

Question 4

A company is designing a new website that hosts static content. The website will give users the ability to upload and download large files. According to company requirements, all data must be encrypted in transit and at rest. A solutions architect is building the solution by using Amazon S3 and Amazon CloudFront.

Which combination of steps will meet the encryption requirements? (Select THREE.)

Options :

A : Turn on S3 server-side encryption for the S3 bucket that the web application uses.

B : Add a policy attribute of 'aws:SecureTransport': 'true' for read and write operations in the S3 ACLs.

C : Create a bucket policy that denies any unencrypted operations in the S3 bucket that the web application uses.

D : Configure encryption at rest on CloudFront by using server-side encryption with AWS KMS keys (SSE-KMS).

E : Configure redirection of HTTP requests to HTTPS requests in CloudFront.

F : Use the RequireSSL option in the creation of presigned URLs for the S3 bucket that the web application uses.

Answer: A,C,E

Question 5

A finance company hosts an online banking portal in AWS. The application is recently deployed in an Auto Scaling group of Amazon EC2 instances inside a VPC. However, after several days, the solutions architect found out that there is an unusually high amount of inbound HTTP traffic coming from a set of 15 specific IP addresses from a certain country where your company has absolutely no customers. The EC2 instances are flooded with incoming requests that the system administrators cannot even establish an SSH connection to the instances.

What should the Solutions Architect do to address this security vulnerability in the MOST cost-effective way?

Options :

A : Use AWS WAF to protect your VPC against web attacks. Place the online banking portal behind a CloudFront RTMP distribution.

B : Set up deny rules on your inbound Network Access control list associated with the web application tier subnet to block access to the group of attacking IP addresses.

C : Use AWS Shield Advanced to protect your VPC from common, most frequently occurring network and transport layer DDoS attacks.

D : Create inbound rules in the Security Group of your EC2 instances to block the attacking IP addresses.

Answer: B

Free SAP-C02 Mock Exam – Practice Online Confidently

Buying Options: