Question 1

A solutions architect at a large company needs to set up network security tor outbound traffic to the internet

from all AWS accounts within an organization in AWS Organizations. The organization has more than 100

AWS accounts, and the accounts route to each other by using a centralized AWS Transit Gateway. Each

account has both an internet gateway and a NAT gateway tor outbound traffic to the internet The company

deploys resources only into a single AWS Region.

The company needs the ability to add centrally managed rule-based filtering on all outbound traffic to the

internet for all AWS accounts in the organization. The peak load of outbound traffic will not exceed 25 Gbps

in each Availability Zone.

Which solution meets these requirements?

Options :

A :

Create a new VPC for outbound traffic to the internet. Connect the existing transit gateway to the new VPC. Configure a new NAT gateway. Create an Auto Scaling group of Amazon EC2 instances that run an open-source internet proxy for rule-based filtering across all Availability Zones in the Region. Modify all default routes to point to the proxy-s Auto Scaling group.

B : Create a new VPC for outbound traffic to the internet. Connect the existing transit gateway to the new

VPC. Configure a new NAT gateway. Use an AWS

Network Firewall firewall for rule-based filtering. Create Network Firewall endpoints in each

Availability Zone. Modify all default routes to point to the Network Firewall endpoints.

C :

Create an AWS Network Firewall firewall for rule-based filtering in each AWS account. Modify all default routes to point to the Network Firewall firewalls in each account.

D :

In each AWS account, create an Auto Scaling group of network-optimized Amazon EC2 instances that run an open-source internet proxy for rule-based filtering. Modify all default routes to point to the proxy-s Auto Scaling group.

Answer: B

Question 2

A company runs a suite of web applications in AWS. The application is hosted in an Auto Scaling group of On-Demand Amazon EC2 instances behind an Application Load Balancer that handles traffic from multiple web domains. The solutions architect is responsible for securing the system by allowing multiple domains to serve SSL traffic without the need to re-authenticate and re-provision a new certificate whenever a new domain name is added. This change of architecture from HTTP to HTTPS will help improve the SEO and Google search ranking of the web application.

Which of the following options are valid solutions to meet the above requirements? (Select TWO.)

Options :

A : Add a Subject Alternative Name (SAN) for each additional domain to your certificate.

B : Create a new CloudFront web distribution and configure it to serve HTTPS requests using dedicated IP addresses in order to associate your alternate domain names with a dedicated IP address in each CloudFront edge location.

C : Use a Classic Load Balancer instead of an Application Load Balancer. Upload all SSL certificates of the domains and use Server Name Indication (SNI).

D : Use a wildcard certificate to handle multiple sub-domains and different domains.

E : Upload all SSL certificates of the domains in the ALB using the console and bind multiple certificates to the same secure listener on your load balancer. ALB will automatically choose the optimal TLS certificate for each client using Server Name Indication (SNI).

Answer: A,B

Question 3

A company runs an application in a fleet of Amazon EC2 instances in the us-east-2 region. A database server is hosted on the on-premises data center which complies with the BASE (Basically Available, Soft state, Eventual consistency) model rather than the ACID (Atomicity, Consistency, Isolation, Durability) consistency model. The on-premises network has a 10 GB AWS Direct Connect connection to the Amazon VPC in us-east-2. The application relies on this database for normal operations. Whenever there are lots of database write requests, the application behavior becomes erratic.

Which of the following options should the solutions architect implement to improve the performance of the application in a cost-effective way?

Options :

A : Create an Amazon SQS queue and develop a consumer process to flush the queue to the on-premises database server. Update the application to enable writing to the SQS queue.

B : Update the application to write to an Amazon DynamoDB table. Feed the table to an Amazon EMR cluster and create a map function that will update the on-premises database for every table update.

C : Create a Hadoop cluster using Amazon Elastic Map Reduce (EMR) and use the S3DistCp tool to synchronize data between the on-premises database and the Hadoop cluster.

D : Create an Amazon RDS multi-AZ instance that will synchronize with the on-premises database server using Amazon EventBridge. Redirect the write operations of the application to the Amazon RDS endpoint via the Amazon Elastic Transcoder service.

Answer: A

Question 4

A medical firm uses an image analysis application that extracts data from multiple images. The input stream analyzes a batch of images and for each file, it writes the result data to an output stream of files. The number of input files per day grows and peaks for a few hours in a day. The application is hosted on an Amazon EC2 instance with a large EBS volume that hosts the input data, but the results still take almost 20 hours per day to be processed.

Which of the following solutions can be implemented to reduce the processing time and improve the availability of the application?

Options :

A : Store I/O files in an EBS Provisioned IOPS volume, and use SNS to facilitate a group of hosts working in parallel. Include the hosts in an auto scaling group that scales accordingly to the number of SNS notifications.

B : Store I/O files in an EBS Provisioned IOPS volume, and use SNS to facilitate a group of hosts working in parallel. Include the hosts in an auto scaling group that scales accordingly to the length of your SQS queue.

C : Store I/O files in S3 instead and use SQS to facilitate a group of hosts working in parallel. Include the hosts in an auto scaling group that scales accordingly to the number of SNS notifications.

D : Store I/O files in S3 instead and use SQS to facilitate a group of hosts working in parallel. Include the hosts in an auto scaling group that scales accordingly to the length of your SQS queue.

Answer: D

Question 5

A company is in the process of implementing AWS Organizations to constrain its developers to use only

Amazon EC2, Amazon S3, and Amazon DynamoDB. The developers account resides in a dedicated

organizational unit (OU). The solutions architect has implemented the following SCP on the developers

account:

When this policy is deployed, IAM users in the developers account are still able to use AWS services that are

not listed in the policy.

What should the solutions architect do to eliminate the developers’ ability to use services outside the scope of

this policy?

Options :

A : Create an explicit deny statement for each AWS service that should be constrained.

B : Remove the FullAWSAccess SCP from the Developer account-s OU.

C : Modify the FullAWSAccess SCP to explicitly deny all services.

D : Add an explicit deny statement using a wildcard to the end of the SCP.

Answer: B

Free SAP-C02 Mock Exam – Practice Online Confidently

Buying Options: