Question 1

A medical company is running a REST API on a set of Amazon EC2 instances The EC2instances run in an Auto Scaling group behind an Application Load Balancer (ALB) TheALB runs in three public subnets, and the EC2 instances run in three private subnets Thecompany has deployed an Amazon CloudFront distribution that has the ALB as the only originWhich solution should a solutions architect recommend to enhance the origin security?

A. Store a random string in AWS Secrets Manager Create an AWS Lambda function forautomatic secret rotation Configure CloudFront to inject the random string as a customHTTP header for the origin request Create an AWS WAF web ACL rule with a string matchrule for the custom header Associate the web ACL with the ALB

B. Create an AWS WAF web ACL rule with an IP match condition of the CloudFront serviceIP address ranges Associate the web ACL with the ALB Move the ALB into the threeprivate subnets

C. Store a random string in AWS Systems Manager Parameter Store Configure ParameterStore automatic rotation for the string Configure CloudFront to inject the random string as acustom HTTP header for the origin request Inspect the value of the custom HTTP header,and block access in the ALB

D. Configure AWS Shield Advanced. Create a security group policy to allow connectionsfrom CloudFront service IP address ranges. Add the policy to AWS Shield Advanced, andattach the policy to the ALB

Answer: A

Question 2

A company is running its solution on AWS in a manually created VPC. The company isusing AWS CloudFormation to provision other parts of the infrastructure According to anew requirement the company must manage all infrastructure in an automatic wayWhat should the comp any do to meet this new requirement with the LEAST effort?

A. Create a new AWS Cloud Development Kit (AWS CDK) stack that strictly provisions theexisting VPC resources and configuration Use AWS CDK to import the VPC into the stackand to manage the VPC

B. Create a CloudFormation stack set that creates the VPC Use the stack set to import theVPC into the stack

C. Create a new CloudFormation template that strictly provisions the existing VPCresources and configuration From the CloudFormation console, create a new stack byimporting the existing resources

D. Create a new CloudFormation template that creates the VPC Use the AWS ServerlessApplication Model (AWS SAM) CLI to import the VPC

Answer: C

Question 3

A company is launching a new online game on Amazon EC2 instances. The game must beavailable globally. The company plans to run the game in three AWS Regions: us-east-1,eu-west-1, and ap-southeast-1. The game's leaderboards. player inventory, and eventstatus must be available across Regions.A solutions architect must design a solution that will give any Region the ability to scale tohandle the load of all Regions. Additionally, users must automatically connect to the Regionthat provides the least latency.Which solution will meet these requirements with the LEAST operational overhead?

A. Create an EC2 Spot Fleet. Attach the Spot Fleet to a Network Load Balancer (NLB) ineach Region. Create an AWS Global Accelerator IP address that points to the NLB. Createan Amazon Route 53 latency-based routing entry for the Global Accelerator IP address.Save the game metadata to an Amazon RDS for MySQL DB instance in each Region. Setup a read replica in the other Regions.

B. Create an Auto Scaling group for the EC2 instances. Attach the Auto Scaling group to aNetwork Load Balancer (NLB) in each Region. For each Region, create an Amazon Route53 entry that uses geoproximity routing and points to the NLB in that Region. Save thegame metadata to MySQL databases on EC2 instances in each Region. Save the gamemetadata to MySQL databases on EC2 instances in each Region. Set up replicationbetween the database EC2 instances in each Region.

C. Create an Auto Scaling group for the EC2 instances. Attach the Auto Scaling group to aNetwork Load Balancer (NLB) in each Region. For each Region, create an Amazon Route53 entry that uses latency-based routing and points to the NLB in that Region. Save thegame metadata to an Amazon DynamoDB global table.

D. Use EC2 Global View. Deploy the EC2 instances to each Region. Attach the instancesto a Network Load Balancer (NLB). Deploy a DNS server on an EC2 instance in eachRegion. Set up custom logic on each DNS server to redirect the user to the Region thatprovides the lowest latency. Save the game metadata to an Amazon Aurora globaldatabase.

Answer: C

Question 4

A company is planning to migrate an application from on premises to the AWS Cloud Thecompany will begin the migration by moving the application underlying data storage toAWS The application data is stored on a shared tile system on premises and theapplication servers connect to the shared file system through SMBA solutions architect must implement a solution that uses an Amazon S3 bucket for sharedstorage. Until the application is fully migrated and code is rewritten to use native AmazonS3 APIs the application must continue to have access to the data through SMB Thesolutions architect must migrate the application data to AWS (o its new location while stillallowing the on-premises application to access the dataWhich solution will meet these requirements?

A. Create a new Amazon FSx for Windows File Server file system Configure AWSDataSync with one location for the on-premises file share and one location for the newAmazon FSx file system Create a new DataSync task to copy the data from the onpremisesfile share location to the Amazon FSx file system

B. Create an S3 bucket for the application Copy the data from the on-premises storage to the S3 bucket

C. Deploy an AWS Server Migration Service (AWS SMS) VM to the on-premisesenvironment Use AWS SMS to migrate the file storage server from on premises to anAmazon EC2 instance

D. Create an S3 bucket for the application Deploy a new AWS Storage Gateway filegateway on an on-premises VM Create a new file share that stores data in the S3 bucketand is associated with the file gateway Copy the data from the on-premises storage to thenew file gateway endpoint

Answer: D

Question 5

A company has an application that analyzes and stores image data on premises Theapplication receives millions of new image files every day Files are an average of 1 MB insize The files are analyzed in batches of 1 GB When the application analyzes a batch theapplication zips the images together The application then archives the images as a singlefile in an on-premises NFS server for long-term storageThe company has a Microsoft Hyper-V environment on premises and has computecapacity available The company does not have storage capacity and wants to archive theimages on AWS The company needs the ability to retrieve archived data within t week of arequest.The company has a 10 Gbps AWS Direct Connect connection between its on-premisesdata center and AWS. The company needs to set bandwidth limits and schedule archivedimages to be copied to AWS dunng non-business hours.Which solution will meet these requirements MOST cost-effectively?

A. Deploy an AWS DataSync agent on a new GPU-based Amazon EC2 instance Configurethe DataSync agent to copy the batch of files from the NFS on-premises server to AmazonS3 Glacier Instant Retrieval After the successful copy delete the data from the on-premisesstorage

B. Deploy an AWS DataSync agent as a Hyper-V VM on premises Configure the DataSyncagent to copy the batch of files from the NFS on-premises server to Amazon S3 GlacierDeep Archive After the successful copy delete the data from the on-premises storage

C. Deploy an AWS DataSync agent on a new general purpose Amazon EC2 instanceConfigure the DataSync agent to copy the batch of files from the NFS on-premises serverto Amazon S3 Standard After the successful copy deletes the data from the on-premisesstorage Create an S3 Lifecycle rule to transition objects from S3 Standard to S3 GlacierDeep Archive after 1 day

D. Deploy an AWS Storage Gateway Tape Gateway on premises in the Hyper-Venvironment Connect the Tape Gateway to AWS Use automatic tape creation Specify anAmazon S3 Glacier Deep Archive pool Eject the tape after the batch of images is copied

Answer: B