AWS-Solution-Architect-Associate Practice Questions

A.  

Use AWS Key Management Service (AWS KMS) certificates on the ALB to encrypt data in transit. Use AWS Certificate Manager (ACM) to encrypt the EBS volumes and Aurora database storage at rest.

B.  

Use the AWS root account to log in to the AWS Management Console. Upload the company’s encryption certificates. While in the root account, select the option to turn on encryption for all data at rest and in transit for the account.

C.  

Use a AWS Key Management Service (AWS KMS) to encrypt the EBS volumes and Aurora database storage at rest. Attach an AWS Certificate Manager (ACM) certificate to the ALB to encrypt data in transit.

D.  

Use BitLocker to encrypt all data at rest. Import the company’s TLS certificate keys to AWS key Management Service (AWS KMS). Attach the KMS keys to the ALB to encrypt data in transit.

A.  

Create a network ACL for the public subnet Add a rule to deny outbound traffic to 0 0 0 0/0 on port 3306

B.  

Create a security group for the DB instance Add a rule to allow traffic from the public subnet CIDR block on port 3306

C.  

Create a security group for the web servers in the public subnet Add a rule to allow traffic from 0 0 0 O'O on port 443

D.  

Create a security group for the DB instance Add a rule to allow traffic from the web servers' security group on port 3306

E.  

Create a security group for the DB instance Add a rule to deny all traffic except traffic from the web servers' security group on port 3306

A.  

Use Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 worker nodes for compute and MongoDB on EC2 for data storage.

B.  

Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate for compute and Amazon DynamoDB for data storage.

C.  

Use Amazon Elastic Kubernetes Service (Amazon EKS) with Amazon EC2 worker nodes for compute and Amazon DynamoDB for data storage.

D.  

Use Amazon Elastic Kubernetes Service (Amazon EKS) with AWS Fargate for compute and Amazon DocumentDB (with MongoDB compatibility) for data storage.

A.  

Create a private hosted zone by using Amazon Route 53

B.  

Set up a gateway VPC endpoint for Amazon S3 in the VPC

C.  

Configure the EC2 instances to use a NAT gateway to access the S3 bucket

D.  

Establish an AWS Site-to-Site VPN connection between the VPC and the S3 bucket

A.  

Create a proxy in RDS Proxy Configure the users' applications to use the DB instance through RDS Proxy

B.  

Deploy Amazon ElastCache for Memcached between the users' application and the DB instance

C.  

Migrate the DB instance to a different instance class that has higher I/O capacity. Configure the users' applications to use the new DB instance.

D.  

Configure Multi-AZ for the DB instance Configure the users' application to switch between the DB instances.

A.  

Take snapshots of Amazon Elastic Block Store (Amazon EBS) volumes of the EC2 instances and database every 2 hours to meet the RPO

B.  

Configure a snapshot lifecycle policy to take Amazon Elastic Block Store (Amazon EBS) snapshots Enable automated backups in Amazon RDS to meet the RPO

C.  

Retain the latest Amazon Machine Images (AMIs) of the web and application tiers Enable automated backups in Amazon RDS and use point-in-time recovery to meet the RPO

D.  

Take snapshots of Amazon Elastic Block Store (Amazon EBS) volumes of the EC2 instances every 2 hours Enable automated backups in Amazon RDS and use point-in-time recovery to meet the RPO

A.  

Configure the security group tor the web servers lo allow inbound traffic on port 443 from 0.0.0. 0/0) Configure the security group for the DB instance to allow inbound traffic on port 3306 from the security group of the web servers

B.  

Configure the security group for the web servers to allow inbound traffic on port 443 from the IP addresses of the customers Configure the security group for the DB instance lo allow inbound traffic on port 3306 from the security group of the web servers

C.  

Configure the security group for the web servers to allow inbound traffic on port 443 from the IP addresses of the customers Configure the security group for the DB instance to allow inbound traffic on port 3306 from the IP addresses of the customers

D.  

Configure the security group for the web servers to allow inbound traffic on port 443 from 0.0.0.0.0 Configure the security group for the DB instance to allow inbound traffic on port 3306 from 0.0.0.0/0)

A.  

Modify the DB instance from a Single-AZ DB instance to a Multi-AZ deployment.

B.  

Take a snapshot of the current DB instance. Restore the snapshot to a new RDS deployment in another Availability Zone.

C.  

Create a read replica of the DB instance in a different Availability Zone. Point All requests for reports to the read replica.

D.  

Migrate the database to RDS Custom.

E.  

Use RDS Proxy to limit reporting requests to the maintenance window.

A.  

Create a security group with a rule to allow TCP port 443 from source 0.0.0.0/0.

B.  

Create a security group with a rule to allow TCP port 443 to destination 0.0.0.0/0.

C.  

Update the network ACL to allow TCP port 443 from source 0.0.0.0/0.

D.  

Update the network ACL to allow inbound/outbound TCP port 443 from source 0.0.0.0/0 and to destination 0.0.0.0/0.

E.  

Update the network ACL to allow inbound TCP port 443 from source 0.0.0.0/0 and outbound TCP port 32768-65535 to destination 0.0.0.0/0.

A.  

Update the bucket policy to deny if the PutObject does not have an s3 x-amz-acl header set

B.  

Update the bucket policy to deny if the PutObject does not have an s3:x-amz-aci header set to private.

C.  

Update the bucket policy to deny if the PutObject does not have an aws SecureTransport header set to true

D.  

Update the bucket policy to deny if the PutObject does not have an x-amz-server-side-encryption header set.