Exam Code: aws certified solutions architect professional exam dumps (Practice Exam Latest Test Questions VCE PDF)
Exam Name: AWS-Certified-Solutions-Architect-Professional
Certification Provider: Amazon
Free Today! Guaranteed Training- Pass aws certified solutions architect professional dumps Exam.

Q41. An ERP application is deployed across multiple AZs in a single region. In the event of failure, the Recovery Time Objective (RTO) must be less than 3 hours, and the Recovery Point Objective (RPO) must be 15 minutes. The customer realizes that data corruption occurred roughly 1.5 hours ago. What DR strategy could be used to achieve this RTO and RPO in the event of this kind of failure? 

A. Take 15 minute DB backups stored in Glacier with transaction logs stored in S3 every 5 minutes. 

B. Use synchronous database master-slave replication between two availability zones. 

C. Take hourly DB backups to EC2 instance store volumes with transaction logs stored In S3 every 5 minutes. 

D. Take hourly DB backups to S3, with transaction logs stored in S3 every 5 minutes. 

Answer: C 


Q42. Your fortune 500 company has under taken a TCO analysis evaluating the use of Amazon S3 versus acquiring more hardware. The outcome was that all employees would be granted access to use Amazon S3 for storage of their personal documents. Which of the following will you need to consider so you can set up a solution that incorporates single sign-on from your corporate AD or LDAP directory and restricts access for each user to a designated user folder in a bucket? Choose 3 answers 

A. Using AWS Security Token Service to generate temporary tokens. 

B. Setting up a matching IAM user for every user in your corporate directory that needs access to a folder in the bucket. 

C. Tagging each folder in the bucket. 

D. Configuring an IAM role. 

E. Setting up a federation proxy or identity provider. 

Answer: A, C, E 


Q43. An AWS customer is deploying an application that is composed of an AutoScaling group of EC2 instances. The customers security policy requires that every outbound connection from these instances to any other service within the customers Virtual Private Cloud must be authenticated using a unique X.509 certificate that contains the specific Instance-id. In addition, all X.509 certificates must be signed by the customer's key management service in order to be trusted for authentication. Which of the following configurations will support these requirements: 

A. Configure an IAM Role that grants access to an Amazon S3 object containing a signed certificate and configure the Auto Scaling group to launch instances with this role. Have the instances bootstrap get the certificate from Amazon S3 upon first boot. 

B. Configure the Auto Scaling group to send an SNS notification of the launch of a new instance to the trusted key management service. Have the key management service generate a signed certificate and send it directly to the newly launched instance. 

C. Embed a certificate into the Amazon Machine Image that is used by the Auto Scaling group. Have the launched instances generate a certificate signature request with the Instance's assigned instance-id to the key management service for signature. 

D. Configure the launched instances to generate a new certificate upon first boot. Have the key management service poll the AutoScaling group for associated instances and send new instances a certificate signature that contains the specific Instance-id. 

Answer: A 


Q44. You are designing a connectivity solution between on-premises infrastructure and Amazon VPC. Your servers on-premises will be communicating with your VPC instances. You will be establishing IPsec tunnels over the Internet You will be using VPN gateways, and terminating the IPsec tunnels on AWS supported customer gateways. Which of the following objectives would you achieve by implementing an IPsec tunnel as outlined above? Choose 4 answers 

A. Peer identity authentication between VPN gateway and customer gateway. 

B. End-to-end identity authentication. 

C. Data integrity protection across the Internet. 

D. End-to-end protection of data in transit. 

E. Data encryption across the Internet. 

F. Protection of data in transit over the Internet. 

Answer: A, C, E, F 


Q45. Your application is using an ELB in front of an Auto Scaling group of web/application servers deployed across two AZs and a Multi-AZ RDS Instance for data persistence. The database CPU is often above 80% usage and 90% of I/O operations on the database are reads. To improve performance you recently added a single-node Memcached ElastiCache Cluster to cache frequent DB query results. In the next weeks the overall workload is expected to grow by 30%. Do you need to change anything in the architecture to maintain the high availability of the application with the anticipated additional load? Why? 

A. Yes, you should deploy two Memcached ElastiCache Clusters in different AZs because the RDS instance will not be able to handle the load if the cache node fails. 

B. No, if the cache node fails you can always get the same data from the DB without having any availability impact. 

C. No, if the cache node fails the automated ElastiCache node recovery feature will prevent any availability impact. 

D. Yes, you should deploy the Memcached ElastiCache Cluster with two nodes in the same AZ as the RDS DB master instance to handle the load if one cache node fails. 

Answer: C 


Q46. Your system recently experienced down time. During the troubleshooting process you found that a new administrator mistakenly terminated several production EC2 instances. Which of the following strategies will help prevent a similar situation in the future? The administrator still must be able to: 

-launch, start, stop, and terminate development resources, 

-launch and start production instances. 

A. Leverage EC2 termination protection and multi-factor authentication, which together require users to authenticate before terminating EC2 instances. 

B. Leverage resource based tagging, along with an IAM user which can prevent specific users from terminating production EC2 resources. 

C. Create an IAM user which is not allowed to terminate instances by leveraging production EC2 termination protection. 

D. Create an IAM user and apply an IAM role which prevents users from terminating production EC2 instances. 

Answer: D 


Q47. A company is storing data on Amazon Simple Storage Service (S3). The company's security policy

mandates that data is encrypted at rest. Which of the following methods can achieve this?

Choose 3 answers

A. Use Amazon S3 server-side encryption with AWS Key Management Service managed keys.

B. Use Amazon S3 server-side encryption with customer-provided keys.

C. Use Amazon S3 server-side encryption with EC2 key pair.

D. Use Amazon S3 bucket policies to restrict access to the data at rest.

E. Encrypt the data on the client-side before ingesting to Amazon S3 using their own master key.

F. Use SSL to encrypt the data while in transit to Amazon S3.

Answer: A, B, E 


Q48. You are designing an intrusion detection/prevention (IDS/IPS) solution for a customer web application in a single VPC. You are considering the options for Implementing IDS/IPS protection for traffic coming from the Internet. Which of the following options would you consider? Choose 2 answers 

A. Implement IDS/IPS agents on each instance running in VPC. 

B. Implement Elastic Load Balancing with SSL listeners in front of the web applications. 

C. Implement a reverse proxy layer in front of web servers, and configure IDS/IPS agents on each reverse proxy server. 

D. Configure an instance in each subnet to switch its network interface card to promiscuous mode and analyze network traffic. 

Answer: B, C