SAA-C02 : AWS Certified Solutions Architect – Associate SAA-C02 : Part 02

SAA-C02 : AWS Certified Solutions Architect – Associate SAA-C02 : Part 02

1. A company’s web application uses an Amazon RDS PostgreSQL DB instance to store its application data. During the financial closing period at the start of every month, Accountants run large queries that impact the database’s performance due to high usage. The company wants to minimize the impact that the reporting activity has on the web application.

   What should a solutions architect do to reduce the impact on the database with the LEAST amount of effort?

   • Create a read replica and direct reporting traffic to the replica.
   • Create a Multi-AZ database and direct reporting traffic to the standby.
   • Create a cross-Region read replica and direct reporting traffic to the replica.
   • Create an Amazon Redshift database and direct reporting traffic to the Amazon Redshift database.
   Explanation:
   Amazon RDS uses the MariaDB, MySQL, Oracle, PostgreSQL, and Microsoft SQL Server DB engines’ built-in replication functionality to create a special type of DB instance called a read replica from a source DB instance. Updates made to the source DB instance are asynchronously copied to the read replica. You can reduce the load on your source DB instance by routing read queries from your applications to the read replica.

   When you create a read replica, you first specify an existing DB instance as the source. Then Amazon RDS takes a snapshot of the source instance and creates a read-only instance from the snapshot. Amazon RDS then uses the asynchronous replication method for the DB engine to update the read replica whenever there is a change to the source DB instance. The read replica operates as a DB instance that allows only read-only connections. Applications connect to a read replica the same way they do to any DB instance. Amazon RDS replicates all databases in the source DB instance.

2. A company wants to migrate a high performance computing (HPC) application and data from on-premises to the AWS Cloud. The company uses tiered storage on premises with hot high-performance parallel storage to support the application during periodic runs of the application, and more economical cold storage to hold the data when the application is not actively running.

   Which combination of solutions should a solutions architect recommend to support the storage needs of the application? (Choose two.)

   • Amazon S3 for cold data storage
   • Amazon Elastic File System (Amazon EFS) for cold data storage
   • Amazon S3 for high-performance parallel storage
   • Amazon FSx for Lustre for high-performance parallel storage
   • Amazon FSx for Windows for high-performance parallel storage

3. A company’s application is running on Amazon EC2 instances in a single Region. In the event of a disaster, a solutions architect needs to ensure that the resources can also be deployed to a second Region.

   Which combination of actions should the solutions architect take to accomplish this? (Choose two.)

   • Detach a volume on an EC2 instance and copy it to Amazon S3.
   • Launch a new EC2 instance from an Amazon Machine Image (AMI) in a new Region.
   • Launch a new EC2 instance in a new Region and copy a volume from Amazon S3 to the new instance.
   • Copy an Amazon Machine Image (AMI) of an EC2 instance and specify a different Region for the destination.
   • Copy an Amazon Elastic Block Store (Amazon EBS) volume from Amazon S3 and launch an EC2 instance in the destination Region using that EBS volume.
   Explanation:
   Cross Region EC2 AMI Copy

   We know that you want to build applications that span AWS Regions and we’re working to provide you with the services and features needed to do so. We started out by launching the EBS Snapshot Copy feature late last year. This feature gave you the ability to copy a snapshot from Region to Region with just a couple of clicks. In addition, last month we made a significant reduction (26% to 83%) in the cost of transferring data between AWS Regions, making it less expensive to operate in more than one AWS region.

   Today we are introducing a new feature: Amazon Machine Image (AMI) Copy. AMI Copy enables you to easily copy your Amazon Machine Images between AWS Regions. AMI Copy helps enable several key scenarios including:

   Simple and Consistent Multi-Region Deployment – You can copy an AMI from one region to another, enabling you to easily launch consistent instances based on the same AMI into different regions.

   Scalability – You can more easily design and build world-scale applications that meet the needs of your users, regardless of their location.

   Performance – You can increase performance by distributing your application and locating critical components of your application in closer proximity to your users. You can also take advantage of region-specific features such as instance types or other AWS services.

   Even Higher Availability – You can design and deploy applications across AWS regions, to increase availability.

   Once the new AMI is in an Available state the copy is complete.

4. A solutions architect needs to ensure that API calls to Amazon DynamoDB from Amazon EC2 instances in a VPC do not traverse the internet.

   What should the solutions architect do to accomplish this? (Choose two.)

   • Create a route table entry for the endpoint.
   • Create a gateway endpoint for DynamoDB.
   • Create a new DynamoDB table that uses the endpoint.
   • Create an ENI for the endpoint in each of the subnets of the VPC.
   • Create a security group entry in the default security group to provide access.
   Explanation:
   A VPC endpoint enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by AWS PrivateLink without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC do not require public IP addresses to communicate with resources in the service. Traffic between your VPC and the other service does not leave the Amazon network.

   Gateway endpoints

   A gateway endpoint is a gateway that you specify as a target for a route in your route table for traffic destined to a supported AWS service. The following AWS services are supported:

   Amazon S3

   DynamoDB

5. A company’s legacy application is currently relying on a single-instance Amazon RDS MySQL database without encryption. Due to new compliance requirements, all existing and new data in this database must be encrypted.

   How should this be accomplished?

   • Create an Amazon S3 bucket with server-side encryption enabled. Move all the data to Amazon S3. Delete the RDS instance.
   • Enable RDS Multi-AZ mode with encryption at rest enabled. Perform a failover to the standby instance to delete the original instance.
   • Take a Snapshot of the RDS instance. Create an encrypted copy of the snapshot. Restore the RDS instance from the encrypted snapshot.
   • Create an RDS read replica with encryption at rest enabled. Promote the read replica to master and switch the application over to the new master. Delete the old RDS instance.
   Explanation:
   How do I encrypt Amazon RDS snapshots?

   The following steps are applicable to Amazon RDS for MySQL, Oracle, SQL Server, PostgreSQL, or MariaDB.

   Important: If you use Amazon Aurora, you can restore an unencrypted Aurora DB cluster snapshot to an encrypted Aurora DB cluster if you specify an AWS Key Management Service (AWS KMS) encryption key when you restore from the unencrypted DB cluster snapshot. For more information, see Limitations of Amazon RDS Encrypted DB Instances.

   Open the Amazon RDS console, and then choose Snapshots from the navigation pane.

   Select the snapshot that you want to encrypt.

   Under Snapshot Actions, choose Copy Snapshot.

   Choose your Destination Region, and then enter your New DB Snapshot Identifier.

   Change Enable Encryption to Yes.

   Select your Master Key from the list, and then choose Copy Snapshot.

   After the snapshot status is available, the Encrypted field will be True to indicate that the snapshot is encrypted.

   You now have an encrypted snapshot of your DB. You can use this encrypted DB snapshot to restore the DB instance from the DB snapshot.

6. A manufacturing company wants to implement predictive maintenance on its machinery equipment. The company will install thousands of IoT sensors that will send data to AWS in real time. A solutions architect is tasked with implementing a solution that will receive events in an ordered manner for each machinery asset and ensure that data is saved for further processing at a later time.

   Which solution would be MOST efficient?

   • Use Amazon Kinesis Data Streams for real-time events with a partition for each equipment asset. Use Amazon Kinesis Data Firehose to save data to Amazon S3.
   • Use Amazon Kinesis Data Streams for real-time events with a shard for each equipment asset. Use Amazon Kinesis Data Firehose to save data to Amazon Elastic Block Store (Amazon EBS).
   • Use an Amazon SQS FIFO queue for real-time events with one queue for each equipment asset. Trigger an AWS Lambda function for the SQS queue to save data to Amazon Elastic File System (Amazon EFS).
   • Use an Amazon SQS standard queue for real-time events with one queue for each equipment asset. Trigger an AWS Lambda function from the SQS queue to save data to Amazon S3.

7. A company’s website runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The website has a mix of dynamic and static content. Users around the globe are reporting that the website is slow.

   Which set of actions will improve website performance for users worldwide?

   • Create an Amazon CloudFront distribution and configure the ALB as an origin. Then update the Amazon Route 53 record to point to the CloudFront distribution.
   • Create a latency-based Amazon Route 53 record for the ALB. Then launch new EC2 instances with larger instance sizes and register the instances with the ALB.
   • Launch new EC2 instances hosting the same web application in different Regions closer to the users. Then register instances with the same ALB using cross-Region VPC peering.
   • Host the website in an Amazon S3 bucket in the Regions closest to the users and delete the ALB and EC2 instances. Then update an Amazon Route 53 record to point to the S3 buckets.

   Explanation:

   What Is Amazon CloudFront?

   Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users. CloudFront delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you’re serving with CloudFront, the user is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance.

   Routing traffic to an Amazon CloudFront web distribution by using your domain name.

   If you want to speed up delivery of your web content, you can use Amazon CloudFront, the AWS content delivery network (CDN). CloudFront can deliver your entire website – including dynamic, static, streaming, and interactive content – by using a global network of edge locations. Requests for your content are automatically routed to the edge location that gives your users the lowest latency.

   To use CloudFront to distribute your content, you create a web distribution and specify settings such as the Amazon S3 bucket or HTTP server that you want CloudFront to get your content from, whether you want only selected users to have access to your content, and whether you want to require users to use HTTPS.

   When you create a web distribution, CloudFront assigns a domain name to the distribution, such asd111111abcdef8.cloudfront.net. You can use this domain name in the URLs for your content, for example:

   http://d111111abcdef8.cloudfront.net/logo.jpg

   Alternatively, you might prefer to use your own domain name in URLs, for example:

   http://example.com/logo.jpg

   If you want to use your own domain name, use Amazon Route 53 to create an alias record that points to your CloudFront distribution. An alias record is a Route 53 extension to DNS. It’s similar to a CNAME record, but you can create an alias record both for the root domain, such as example.com, and for subdomains, such aswww.example.com. (You can create CNAME records only for subdomains.) When Route 53 receives a DNS query that matches the name and type of an alias record, Route 53 responds with the domain name that is associated with your distribution.

8. A company has been storing analytics data in an Amazon RDS instance for the past few years. The company asked a solutions architect to find a solution that allows users to access this data using an API. The expectation is that the application will experience periods of inactivity but could receive bursts of traffic within seconds.

   Which solution should the solutions architect suggest?

   • Set up an Amazon API Gateway and use Amazon ECS.
   • Set up an Amazon API Gateway and use AWS Elastic Beanstalk.
   • Set up an Amazon API Gateway and use AWS Lambda functions.
   • Set up an Amazon API Gateway and use Amazon EC2 with Auto Scaling.

   Explanation:

   AWS Lambda

   With Lambda, you can run code for virtually any type of application or backend service – all with zero administration. Just upload your code and Lambda takes care of everything required to run and scale your code with high availability. You can set up your code to automatically trigger from other AWS services or call it directly from any web or mobile app.

   How it works

   

   Amazon API Gateway

   Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale. APIs act as the “front door” for applications to access data, business logic, or functionality from your backend services. Using API Gateway, you can create RESTful APIs and WebSocket APIs that enable real-time two-way communication applications. API Gateway supports containerized and serverless workloads, as well as web applications.

   API Gateway handles all the tasks involved in accepting and processing up to hundreds of thousands of concurrent API calls, including traffic management, CORS support, authorization and access control, throttling, monitoring, and API version management. API Gateway has no minimum fees or startup costs. You pay for the API calls you receive and the amount of data transferred out and, with the API Gateway tiered pricing model, you can reduce your cost as your API usage scales.

9. A company must generate sales reports at the beginning of every month. The reporting process launches 20 Amazon EC2 instances on the first of the month. The process runs for 7 days and cannot be interrupted. The company wants to minimize costs.

   Which pricing model should the company choose?

   • Reserved Instances
   • Spot Block Instances
   • On-Demand Instances
   • Scheduled Reserved Instances
   Explanation
   Scheduled Reserved Instances

   Scheduled Reserved Instances (Scheduled Instances) enable you to purchase capacity reservations that recur on a daily, weekly, or monthly basis, with a specified start time and duration, for a one-year term. You reserve the capacity in advance, so that you know it is available when you need it. You pay for the time that the instances are scheduled, even if you do not use them.

   Scheduled Instances are a good choice for workloads that do not run continuously, but do run on a regular schedule. For example, you can use Scheduled Instances for an application that runs during business hours or for batch processing that runs at the end of the week.

   If you require a capacity reservation on a continuous basis, Reserved Instances might meet your needs and decrease costs.

   How Scheduled Instances Work

   Amazon EC2 sets aside pools of EC2 instances in each Availability Zone for use as Scheduled Instances. Each pool supports a specific combination of instance type, operating system, and network.

   To get started, you must search for an available schedule. You can search across multiple pools or a single pool. After you locate a suitable schedule, purchase it.

   You must launch your Scheduled Instances during their scheduled time periods, using a launch configuration that matches the following attributes of the schedule that you purchased: instance type, Availability Zone, network, and platform. When you do so, Amazon EC2 launches EC2 instances on your behalf, based on the specified launch specification. Amazon EC2 must ensure that the EC2 instances have terminated by the end of the current scheduled time period so that the capacity is available for any other Scheduled Instances it is reserved for. Therefore, Amazon EC2 terminates the EC2 instances three minutes before the end of the current scheduled time period.

   You can’t stop or reboot Scheduled Instances, but you can terminate them manually as needed. If you terminate a Scheduled Instance before its current scheduled time period ends, you can launch it again after a few minutes. Otherwise, you must wait until the next scheduled time period.

   The following diagram illustrates the lifecycle of a Scheduled Instance.

   

10. A gaming company has multiple Amazon EC2 instances in a single Availability Zone for its multiplayer game that communicates with users on Layer 4. The chief technology officer (CTO) wants to make the architecture highly available and cost-effective.

    What should a solutions architect do to meet these requirements? (Choose two.)?

    • Increase the number of EC2 instances.
    • Decrease the number of EC2 instances.
    • Configure a Network Load Balancer in front of the EC2 instances.
    • Configure an Application Load Balancer in front of the EC2 instances.
    • Configure an Auto Scaling group to add or remove instances in multiple Availability Zones automatically.
    Explanation:
    Network Load Balancer overview

    A Network Load Balancer functions at the fourth layer of the Open Systems Interconnection (OSI) model. It can handle millions of requests per second. After the load balancer receives a connection request, it selects a target from the target group for the default rule. It attempts to open a TCP connection to the selected target on the port specified in the listener configuration.

    When you enable an Availability Zone for the load balancer, Elastic Load Balancing creates a load balancer node in the Availability Zone. By default, each load balancer node distributes traffic across the registered targets in its Availability Zone only. If you enable cross-zone load balancing, each load balancer node distributes traffic across the registered targets in all enabled Availability Zones. For more information, see Availability Zones.

    If you enable multiple Availability Zones for your load balancer and ensure that each target group has at least one target in each enabled Availability Zone, this increases the fault tolerance of your applications. For example, if one or more target groups does not have a healthy target in an Availability Zone, we remove the IP address for the corresponding subnet from DNS, but the load balancer nodes in the other Availability Zones are still available to route traffic. If a client doesn’t honor the time-to-live (TTL) and sends requests to the IP address after it is removed from DNS, the requests fail.

    For TCP traffic, the load balancer selects a target using a flow hash algorithm based on the protocol, source IP address, source port, destination IP address, destination port, and TCP sequence number. The TCP connections from a client have different source ports and sequence numbers, and can be routed to different targets. Each individual TCP connection is routed to a single target for the life of the connection.

    For UDP traffic, the load balancer selects a target using a flow hash algorithm based on the protocol, source IP address, source port, destination IP address, and destination port. A UDP flow has the same source and destination, so it is consistently routed to a single target throughout its lifetime. Different UDP flows have different source IP addresses and ports, so they can be routed to different targets.

    An Auto Scaling group contains a collection of Amazon EC2 instances that are treated as a logical grouping for the purposes of automatic scaling and management. An Auto Scaling group also enables you to use Amazon EC2 Auto Scaling features such as health check replacements and scaling policies. Both maintaining the number of instances in an Auto Scaling group and automatic scaling are the core functionality of the Amazon EC2 Auto Scaling service.

    The size of an Auto Scaling group depends on the number of instances that you set as the desired capacity. You can adjust its size to meet demand, either manually or by using automatic scaling.

    An Auto Scaling group starts by launching enough instances to meet its desired capacity. It maintains this number of instances by performing periodic health checks on the instances in the group. The Auto Scaling group continues to maintain a fixed number of instances even if an instance becomes unhealthy. If an instance becomes unhealthy, the group terminates the unhealthy instance and launches another instance to replace it.

11. A company currently operates a web application backed by an Amazon RDS MySQL database. It has automated backups that are run daily and are not encrypted. A security audit requires future backups to be encrypted and the unencrypted backups to be destroyed. The company will make at least one encrypted backup before destroying the old backups.

    What should be done to enable encryption for future backups?

    • Enable default encryption for the Amazon S3 bucket where backups are stored.
    • Modify the backup section of the database configuration to toggle the Enable encryption check box.
    • Create a snapshot of the database. Copy it to an encrypted snapshot. Restore the database from the encrypted snapshot.
    • Enable an encrypted read replica on RDS for MySQL. Promote the encrypted read replica to primary. Remove the original database instance.
    Explanation:
    However, because you can encrypt a copy of an unencrypted DB snapshot, you can effectively add encryption to an unencrypted DB instance. That is, you can create a snapshot of your DB instance, and then create an encrypted copy of that snapshot. You can then restore a DB instance from the encrypted snapshot, and thus you have an encrypted copy of your original DB instance.

    DB instances that are encrypted can’t be modified to disable encryption.

    You can’t have an encrypted read replica of an unencrypted DB instance or an unencrypted read replica of an encrypted DB instance.

    Encrypted read replicas must be encrypted with the same key as the source DB instance when both are in the same AWS Region.

    You can’t restore an unencrypted backup or snapshot to an encrypted DB instance.

    To copy an encrypted snapshot from one AWS Region to another, you must specify the KMS key identifier of the destination AWS Region. This is because KMS encryption keys are specific to the AWS Region that they are created in.

12. A company is hosting a website behind multiple Application Load Balancers. The company has different distribution rights for its content around the world. A solutions architect needs to ensure that users are served the correct content without violating distribution rights.

    Which configuration should the solutions architect choose to meet these requirements?

    • Configure Amazon CloudFront with AWS WAF.
    • Configure Application Load Balancers with AWS WAF.
    • Configure Amazon Route 53 with a geolocation policy.
    • Configure Amazon Route 53 with a geoproximity routing policy.

13. A solutions architect has created a new AWS account and must secure AWS account root user access.

    Which combination of actions will accomplish this? (Choose two.)

    • Ensure the root user uses a strong password.
    • Enable multi-factor authentication to the root user.
    • Store root user access keys in an encrypted Amazon S3 bucket.
    • Add the root user to a group containing administrative permissions.
    • Apply the required permissions to the root user with an inline policy document.

14. A solutions architect at an ecommerce company wants to back up application log data to Amazon S3. The solutions architect is unsure how frequently the logs will be accessed or which logs will be accessed the most. The company wants to keep costs as low as possible by using the appropriate S3 storage class.

    Which S3 storage class should be implemented to meet these requirements?

    • S3 Glacier
    • S3 Intelligent-Tiering
    • S3 Standard-Infrequent Access (S3 Standard-IA)
    • S3 One Zone-Infrequent Access (S3 One Zone-IA)
    Explanation:
    S3 Intelligent-Tiering

    S3 Intelligent-Tiering is a new Amazon S3 storage class designed for customers who want to optimize storage costs automatically when data access patterns change, without performance impact or operational overhead. S3 Intelligent-Tiering is the first cloud object storage class that delivers automatic cost savings by moving data between two access tiers – frequent access and infrequent access – when access patterns change, and is ideal for data with unknown or changing access patterns.

    S3 Intelligent-Tiering stores objects in two access tiers: one tier that is optimized for frequent access and another lower-cost tier that is optimized for infrequent access. For a small monthly monitoring and automation fee per object, S3 Intelligent-Tiering monitors access patterns and moves objects that have not been accessed for 30 consecutive days to the infrequent access tier. There are no retrieval fees in S3 Intelligent-Tiering. If an object in the infrequent access tier is accessed later, it is automatically moved back to the frequent access tier. No additional tiering fees apply when objects are moved between access tiers within the S3 Intelligent-Tiering storage class. S3 Intelligent-Tiering is designed for 99.9% availability and 99.999999999% durability, and offers the same low latency and high throughput performance of S3 Standard.

15. A company’s website is used to sell products to the public. The site runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). There is also an Amazon CloudFront distribution, and AWS WAF is being used to protect against SQL injection attacks. The ALB is the origin for the CloudFront distribution. A recent review of security logs revealed an external malicious IP that needs to be blocked from accessing the website.

    What should a solutions architect do to protect the application?

    • Modify the network ACL on the CloudFront distribution to add a deny rule for the malicious IP address.
    • Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address.
    • Modify the network ACL for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.
    • Modify the security groups for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.
    Explanation:
    If you want to allow or block web requests based on the IP addresses that the requests originate from, create one or more IP match conditions. An IP match condition lists up to 10,000 IP addresses or IP address ranges that your requests originate from. Later in the process, when you create a web ACL, you specify whether to allow or block requests from those IP addresses.

    AWS Web Application Firewall (WAF) – Helps to protect your web applications from common application-layer exploits that can affect availability or consume excessive resources. As you can see in my post (New – AWS WAF), WAF allows you to use access control lists (ACLs), rules, and conditions that define acceptable or unacceptable requests or IP addresses. You can selectively allow or deny access to specific parts of your web application and you can also guard against various SQL injection attacks. We launched WAF with support for Amazon CloudFront.

16. A solutions architect is designing an application for a two-step order process. The first step is synchronous and must return to the user with little latency. The second step takes longer, so it will be implemented in a separate component. Orders must be processed exactly once and in the order in which they are received.

    How should the solutions architect integrate these components?

    • Use Amazon SQS FIFO queues.
    • Use an AWS Lambda function along with Amazon SQS standard queues.
    • Create an SNS topic and subscribe an Amazon SQS FIFO queue to that topic.
    • Create an SNS topic and subscribe an Amazon SQS Standard queue to that topic.

17. A web application is deployed in the AWS Cloud. It consists of a two-tier architecture that includes a web layer and a database layer. The web server is vulnerable to cross-site scripting (XSS) attacks.

    What should a solutions architect do to remediate the vulnerability?

    • Create a Classic Load Balancer. Put the web layer behind the load balancer and enable AWS WAF.
    • Create a Network Load Balancer. Put the web layer behind the load balancer and enable AWS WAF.
    • Create an Application Load Balancer. Put the web layer behind the load balancer and enable AWS WAF.
    • Create an Application Load Balancer. Put the web layer behind the load balancer and use AWS Shield Standard.
    Explanation:
    Working with cross-site scripting match conditions

    Attackers sometimes insert scripts into web requests in an effort to exploit vulnerabilities in web applications. You can create one or more cross-site scripting match conditions to identify the parts of web requests, such as the URI or the query string, that you want AWS WAF Classic to inspect for possible malicious scripts. Later in the process, when you create a web ACL, you specify whether to allow or block requests that appear to contain malicious scripts.

    Web Application Firewall

    You can now use AWS WAF to protect your web applications on your Application Load Balancers. AWS WAF is a web application firewall that helps protect your web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources.

18. A company’s website is using an Amazon RDS MySQL Multi-AZ DB instance for its transactional data storage. There are other internal systems that query this DB instance to fetch data for internal batch processing. The RDS DB instance slows down significantly when the internal systems fetch data. This impacts the website’s read and write performance, and the users experience slow response times.

    Which solution will improve the website’s performance?

    • Use an RDS PostgreSQL DB instance instead of a MySQL database.
    • Use Amazon ElastiCache to cache the query responses for the website.
    • Add an additional Availability Zone to the current RDS MySQL Multi-AZ DB instance.
    • Add a read replica to the RDS DB instance and configure the internal systems to query the read replica.
    Explanation:
    Amazon RDS Read Replicas

    Enhanced performance

    You can reduce the load on your source DB instance by routing read queries from your applications to the read replica. Read replicas allow you to elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads. Because read replicas can be promoted to master status, they are useful as part of a sharding implementation.

    To further maximize read performance, Amazon RDS for MySQL allows you to add table indexes directly to Read Replicas, without those indexes being present on the master.

19. An application runs on Amazon EC2 instances across multiple Availability Zones. The instances run in an Amazon EC2 Auto Scaling group behind an Application Load Balancer. The application performs best when the CPU utilization of the EC2 instances is at or near 40%.

    What should a solutions architect do to maintain the desired performance across all instances in the group?

    • Use a simple scaling policy to dynamically scale the Auto Scaling group.
    • Use a target tracking policy to dynamically scale the Auto Scaling group.
    • Use an AWS Lambda function to update the desired Auto Scaling group capacity.
    • Use scheduled scaling actions to scale up and scale down the Auto Scaling group.
    Explanation:
    “With target tracking scaling policies, you select a scaling metric and set a target value. Amazon EC2 AutoScaling creates and manages the CloudWatch alarms that trigger the scaling policy and calculates the scaling djustment based on the metric and the target value. The scaling policy adds or removes capacity as required to keep the metric at, or close to, the specified target value. In addition to keeping the metric close to the targetvalue, a target tracking scaling policy also adjusts to changes in the metric due to a changing load pattern. For example, you can use target tracking scaling to: Configure a target tracking scaling policy to keep the average aggregate CPU utilization of your Auto Scaling group at 40 percent. Configure a target tracking scaling policy to keep the request count per target of your Application Load Balancer target group at 1000 for your AutoScaling group.”

20. A company runs an internal browser-based application. The application runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. The Auto Scaling group scales up to 20 instances during work hours, but scales down to 2 instances overnight. Staff are complaining that the application is very slow when the day begins, although it runs well by mid-morning.

    How should the scaling be changed to address the staff complaints and keep costs to a minimum?

    • Implement a scheduled action that sets the desired capacity to 20 shortly before the office opens.
    • Implement a step scaling action triggered at a lower CPU threshold, and decrease the cooldown period.
    • Implement a target tracking action triggered at a lower CPU threshold, and decrease the cooldown period.
    • Implement a scheduled action that sets the minimum and maximum capacity to 20 shortly before the office opens.