SAA-C02 : AWS Certified Solutions Architect – Associate SAA-C02 : Part 04

• InfraExam
• SAA-C02 : AWS Certified Solutions Architect – Associate SAA-C02
• 19 mins read
• June 12, 2024

SAA-C02 : AWS Certified Solutions Architect – Associate SAA-C02 : Part 04

1. A company has a multi-tier application that runs six front-end web servers in an Amazon EC2 Auto Scaling group in a single Availability Zone behind an Application Load Balancer (ALB). A solutions architect needs to modify the infrastructure to be highly available without modifying the application.

   Which architecture should the solutions architect choose that provides high availability?

   • Create an Auto Scaling group that uses three instances across each of two Regions.
   • Modify the Auto Scaling group to use three instances across each of two Availability Zones.
   • Create an Auto Scaling template that can be used to quickly create more instances in another Region.
   • Change the ALB in front of the Amazon EC2 instances in a round-robin configuration to balance traffic to the web tier.
   Explanation:
   Expanding Your Scaled and Load-Balanced Application to an Additional Availability Zone.When one Availability Zone becomes unhealthy or unavailable, Amazon EC2 Auto Scaling launches new instances in an unaffected zone. When the unhealthy Availability Zone returns to a healthy state, Amazon EC2 Auto Scaling automatically redistributes the application instances evenly across all of the zones for your Auto Scaling group. Amazon EC2 Auto Scaling does this by attempting to launch new instances in the Availability Zone with the fewest instances. If the attempt fails, however, Amazon EC2 Auto Scaling attempts to launch in other Availability Zones until it succeeds.

   You can expand the availability of your scaled and load-balanced application by adding an Availability Zone to your Auto Scaling group and then enabling that zone for your load balancer. After you’ve enabled the new Availability Zone, the load balancer begins to route traffic equally among all the enabled zones.

2. A company runs an application on a group of Amazon Linux EC2 instances. For compliance reasons, the company must retain all application log files for 7 years. The log files will be analyzed by a reporting tool that must access all files concurrently.

   Which storage solution meets these requirements MOST cost-effectively?

   • Amazon Elastic Block Store (Amazon EBS)
   • Amazon Elastic File System (Amazon EFS)
   • Amazon EC2 instance store
   • Amazon S3
   Explanation:
   Amazon S3Requests to Amazon S3 can be authenticated or anonymous. Authenticated access requires credentials that AWS can use to authenticate your requests. When making REST API calls directly from your code, you create a signature using valid credentials and include the signature in your request. Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. This means customers of all sizes and industries can use it to store and protect any amount of data for a range of use cases, such as websites, mobile applications, backup and restore, archive, enterprise applications, IoT devices, and big data analytics. Amazon S3 provides easy-to-use management features so you can organize your data and configure finely-tuned access controls to meet your specific business, organizational, and compliance requirements. Amazon S3 is designed for 99.999999999% (11 9’s) of durability, and stores data for millions of applications for companies all around the world.

3. A media streaming company collects real-time data and stores it in a disk-optimized database system. The company is not getting the expected throughput and wants an in-memory database storage solution that performs faster and provides high availability using data replication.

   Which database should a solutions architect recommend?

   • Amazon RDS for MySQL
   • Amazon RDS for PostgreSQL.
   • Amazon ElastiCache for Redis
   • Amazon ElastiCache for Memcached
   Explanation:
   In-memory databases on AWS Amazon Elasticache for Redis.Amazon ElastiCache for Redis is a blazing fast in-memory data store that provides submillisecond latency to power internet-scale, real-time applications. Developers can use ElastiCache for Redis as an in-memory nonrelational database. The ElastiCache for Redis cluster configuration supports up to 15 shards and enables customers to run Redis workloads with up to 6.1 TB of in-memory capacity in a single cluster. ElastiCache for Redis also provides the ability to add and remove shards from a running cluster. You can dynamically scaleout and even scale in your Redis cluster workloads to adapt to changes in demand.

4. A company hosts its product information webpages on AWS. The existing solution uses multiple Amazon C2 instances behind an Application Load Balancer in an Auto Scaling group. The website also uses a custom DNS name and communicates with HTTPS only using a dedicated SSL certificate. The company is planning a new product launch and wants to be sure that users from around the world have the best possible experience on the new website.

   What should a solutions architect do to meet these requirements?

   • Redesign the application to use Amazon CloudFront.
   • Redesign the application to use AWS Elastic Beanstalk.
   • Redesign the application to use a Network Load Balancer.
   • Redesign the application to use Amazon S3 static website hosting.
   Explanation:
   What Is Amazon CloudFront?Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users. CloudFront delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you’re serving with CloudFront, the user is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance.

   If the content is already in the edge location with the lowest latency, CloudFront delivers it immediately.

   If the content is not in that edge location, CloudFront retrieves it from an origin that you’ve defined – such as an Amazon S3 bucket, a MediaPackage channel, or an HTTP server (for example, a web server) that you have identified as the source for the definitive version of your content.

   As an example, suppose that you’re serving an image from a traditional web server, not from CloudFront. For example, you might serve an image, sunsetphoto.png, using the URL http://example.com/sunsetphoto.png.

   Your users can easily navigate to this URL and see the image. But they probably don’t know that their request was routed from one network to another – through the complex collection of interconnected networks that comprise the internet – until the image was found.

   CloudFront speeds up the distribution of your content by routing each user request through the AWS backbone network to the edge location that can best serve your content. Typically, this is a CloudFront edge server that provides the fastest delivery to the viewer. Using the AWS network dramatically reduces the number of networks that your users’ requests must pass through, which improves performance. Users get lower latency – the time it takes to load the first byte of the file – and higher data transfer rates.

   You also get increased reliability and availability because copies of your files (also known as objects) are now held (or cached) in multiple edge locations around the world.

5. A solutions architect is designing the cloud architecture for a new application being deployed on AWS. The process should run in parallel while adding and removing application nodes as needed based on the number of jobs to be processed. The processor application is stateless. The solutions architect must ensure that the application is loosely coupled and the job items are durably stored.

   Which design should the solutions architect use?

   • Create an Amazon SNS topic to send the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch configuration that uses the AMI. Create an Auto Scaling group using the launch configuration. Set the scaling policy for the Auto Scaling group to add and remove nodes based on CPU usage.
   • Create an Amazon SQS queue to hold the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch configuration that uses the AMI. Create an Auto Scaling group using the launch configuration. Set the scaling policy for the Auto Scaling group to add and remove nodes based on network usage.
   • Create an Amazon SQS queue to hold the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch template that uses the AMI. Create an Auto Scaling group using the launch template. Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of items in the SQS queue.
   • Create an Amazon SNS topic to send the jobs that need to be processed. Create an Amazon Machine Image (AMI) that consists of the processor application. Create a launch template that uses the AMI. Create an Auto Scaling group using the launch template. Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of messages published to the SNS topic.
   Explanation:
   Amazon Simple Queue ServiceAmazon Simple Queue Service (SQS) is a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications. SQS eliminates the complexity and overhead associated with managing and operating message oriented middleware, and empowers developers to focus on differentiating work. Using SQS, you can send, store, and receive messages between software components at any volume, without losing messages or requiring other services to be available. Get started with SQS in minutes using the AWS console, Command Line Interface or SDK of your choice, and three simple commands.

   SQS offers two types of message queues. Standard queues offer maximum throughput, best-effort ordering, and at-least-once delivery. SQS FIFO queues are designed to guarantee that messages are processed exactly once, in the exact order that they are sent.

   Scaling Based on Amazon SQS

   There are some scenarios where you might think about scaling in response to activity in an Amazon SQS queue. For example, suppose that you have a web app that lets users upload images and use them online. In this scenario, each image requires resizing and encoding before it can be published. The app runs on EC2 instances in an Auto Scaling group, and it’s configured to handle your typical upload rates. Unhealthy instances are terminated and replaced to maintain current instance levels at all times. The app places the raw bitmap data of the images in an SQS queue for processing. It processes the images and then publishes the processed images where they can be viewed by users. The architecture for this scenario works well if the number of image uploads doesn’t vary over time. But if the number of uploads changes over time, you might consider using dynamic scaling to scale the capacity of your Auto Scaling group.

6. A marketing company is storing CSV files in an Amazon S3 bucket for statistical analysis. An application on an Amazon EC2 instance needs permission to efficiently process the CSV data stored in the S3 bucket.

   Which action will MOST securely grant the EC2 instance access to the S3 bucket?

   • Attach a resource-based policy to the S3 bucket.
   • Create an IAM user for the application with specific permissions to the S3 bucket.
   • Associate an IAM role with least privilege permissions to the EC2 instance profile.
   • Store AWS credentials directly on the EC2 instance for applications on the instance to use for API calls.

7. A company has on-premises servers running a relational database. The current database serves high read traffic for users in different locations. The company wants to migrate to AWS with the least amount of effort. The database solution should support disaster recovery and not affect the company’s current traffic flow.

   Which solution meets these requirements?

   • Use a database in Amazon RDS with Multi-AZ and at least one read replica.
   • Use a database in Amazon RDS with Multi-AZ and at least one standby replica.
   • Use databases hosted on multiple Amazon EC2 instances in different AWS Regions.
   • Use databases hosted on Amazon EC2 instances behind an Application Load Balancer in different Availability Zones.

8. A company’s application is running on Amazon EC2 instances within an Auto Scaling group behind an Elastic Load Balancer. Based on the application’s history the company anticipates a spike in traffic during a holiday each year. A solutions architect must design a strategy to ensure that the Auto Scaling group proactively increases capacity to minimize any performance impact on application users.

   Which solution will meet these requirements?

   • Create an Amazon CloudWatch alarm to scale up the EC2 instances when CPU utilization exceeds 90%.
   • Create a recurring scheduled action to scale up the Auto Scaling group before the expected period of peak demand.
   • Increase the minimum and maximum number of EC2 instances in the Auto Scaling group during the peak demand period.
   • Configure an Amazon Simple Notification Service (Amazon SNS) notification to send alerts when there are autoscaling EC2_INSTANCE_LAUNCH events.

9. A company hosts an application on multiple Amazon EC2 instances. The application processes messages from an Amazon SQS queue, writes for an Amazon RDS table, and deletes
   the message from the queue. Occasional duplicate records are found in the RDS table. The SQS queue does not contain any duplicate messages.

   What should a solutions architect do to ensure messages are being processed once only?

   • Use the CreateQueue API call to create a new queue.
   • Use the AddPermission API call to add appropriate permissions.
   • Use the ReceiveMessage API call to set an appropriate wait time.
   • Use the ChangeMessageVisibility API call to increase the visibility timeout.

10. An Amazon EC2 administrator created the following policy associated with an IAM group containing several users:

    

    What is the effect of this policy?

    • Users can terminate an EC2 instance in any AWS Region except us-east-1.
    • Users can terminate an EC2 instance with the IP address 10.100.100.1 in the us-east-1 Region.
    • Users can terminate an EC2 instance in the us-east-1 Region when the user’s source IP is 10.100.100.254.
    • Users cannot terminate an EC2 instance in the us-east-1 Region when the user’s source IP is 10.100.100.254.

11. A solutions architect is optimizing a website for an upcoming musical event. Videos of the performances will be streamed in real time and then will be available on demand. The event is expected to attract a global online audience.

    Which service will improve the performance of both the real-time and on-demand steaming?

    • Amazon CloudFront
    • AWS Global Accelerator
    • Amazon Route S3
    • Amazon S3 Transfer Acceleration

12. A company has a three-tier image-sharing application. It uses an Amazon EC2 instance for the front-end layer, another for the backend tier, and a third for the MySQL database. A solutions architect has been tasked with designing a solution that is highly available, and requires the least amount of changes to the application

    Which solution meets these requirements?

    • Use Amazon S3 to host the front-end layer and AWS Lambda functions for the backend layer. Move the database to an Amazon DynamoDB table and use Amazon S3 to store and serve users’ images.
    • Use load-balanced Multi-AZ AWS Elastic Beanstalk environments for the front-end and backend layers. Move the database to an Amazon RDS instance with multiple read replicas to store and serve users’ images.
    • Use Amazon S3 to host the front-end layer and a fleet of Amazon EC2 instances in an Auto Scaling group for the backend layer. Move the database to a memory optimized instance type to store and serve users’ images.
    • Use load-balanced Multi-AZ AWS Elastic Beanstalk environments for the front-end and backend layers. Move the database to an Amazon RDS instance with a Multi-AZ deployment. Use Amazon S3 to store and serve users’ images.

13. A solutions architect is designing a system to analyze the performance of financial markets while the markets are closed. The system will run a series of compute-intensive jobs for 4 hours every night. The time to complete the compute jobs is expected to remain constant, and jobs cannot be interrupted once started. Once completed, the system is expected to run for a minimum of 1 year.

    Which type of Amazon EC2 instances should be used to reduce the cost of the system?

    • Spot Instances
    • On-Demand Instances
    • Standard Reserved Instances
    • Scheduled Reserved Instances

14. A company built a food ordering application that captures user data and stores it for future analysis. The application’s static front end is deployed on an Amazon EC2 instance. The front-end application sends the requests to the backend application running on separate EC2 instance. The backend application then stores the data in Amazon RDS.

    What should a solutions architect do to decouple the architecture and make it scalable?

    • Use Amazon S3 to serve the front-end application, which sends requests to Amazon EC2 to execute the backend application. The backend application will process and store the data in Amazon RDS.
    • Use Amazon S3 to serve the front-end application and write requests to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe Amazon EC2 instances to the HTTP/HTTPS endpoint of the topic, and process and store the data in Amazon RDS.
    • Use an EC2 instance to serve the front end and write requests to an Amazon SQS queue. Place the backend instance in an Auto Scaling group, and scale based on the queue depth to process and store the data in Amazon RDS.
    • Use Amazon S3 to serve the static front-end application and send requests to Amazon API Gateway, which writes the requests to an Amazon SQS queue. Place the backend instances in an Auto Scaling group, and scale based on the queue depth to process and store the data in Amazon RDS.

15. A solutions architect needs to design a managed storage solution for a company’s application that includes high-performance machine learning. This application runs on AWS Fargate, and the connected storage needs to have concurrent access to files and deliver high performance.

    Which storage option should the solutions architect recommend?

    • Create an Amazon S3 bucket for the application and establish an IAM role for Fargate to communicate with Amazon S3.
    • Create an Amazon FSx for Lustre file share and establish an IAM role that allows Fargate to communicate with FSx for Lustre.
    • Create an Amazon Elastic File System (Amazon EFS) file share and establish an IAM role that allows Fargate to communicate with Amazon Elastic File System (Amazon EFS).
    • Create an Amazon Elastic Block Store (Amazon EBS) volume for the application and establish an IAM role that allows Fargate to communicate with Amazon Elastic Block Store (Amazon EBS).

16. A bicycle sharing company is developing a multi-tier architecture to track the location of its bicycles during peak operating hours. The company wants to use these data points in its existing analytics platform. A solutions architect must determine the most viable multi-tier option to support this architecture. The data points must be accessible from the REST API.

    Which action meets these requirements for storing and retrieving location data?

    • Use Amazon Athena with Amazon S3.
    • Use Amazon API Gateway with AWS Lambda.
    • Use Amazon QuickSight with Amazon Redshift.
    • Use Amazon API Gateway with Amazon Kinesis Data Analytics.

17. A solutions architect is designing a web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The company strictly requires that the application be resilient against malicious internet activity and attacks, and protect against new common vulnerabilities and exposures.

    What should the solutions architect recommend?

    • Leverage Amazon CloudFront with the ALB endpoint as the origin.
    • Deploy an appropriate managed rule for AWS WAF and associate it with the ALB.
    • Subscribe to AWS Shield Advanced and ensure common vulnerabilities and exposures are blocked.
    • Configure network ACLs and security groups to allow only ports 80 and 443 to access the EC2 instances.

18. A company has an application that calls AWS Lambda functions. A code review shows that database credentials are stored in a Lambda function’s source code, which violates the company’s security policy. The credentials must be securely stored and must be automatically rotated on an ongoing basis to meet security policy requirements.

    What should a solutions architect recommend to meet these requirements in the MOST secure manner?

    • Store the password in AWS CloudHSM. Associate the Lambda function with a role that can use the key ID to retrieve the password from CloudHSM. Use CloudHSM to automatically rotate the password.
    • Store the password in AWS Secrets Manager. Associate the Lambda function with a role that can use the secret ID to retrieve the password from Secrets Manager. Use Secrets Manager to automatically rotate the password.
    • Store the password in AWS Key Management Service (AWS KMS). Associate the Lambda function with a role that can use the key ID to retrieve the password from AWS KMS. Use AWS KMS to automatically rotate the uploaded password.
    • Move the database password to an environment variable that is associated with the Lambda function. Retrieve the password from the environment variable by invoking the function. Create a deployment script to automatically rotate the password.

19. A company is managing health records on-premises. The company must keep these records indefinitely, disable any modifications to the records once they are stored, and granularly audit access at all levels. The chief technology officer (CTO) is concerned because there are already millions of records not being used by any application, and the current infrastructure is running out of space. The CTO has requested a solutions architect design a solution to move existing data and support future records.

    Which services can the solutions architect recommend to meet these requirements?

    • Use AWS DataSync to move existing data to AWS. Use Amazon S3 to store existing and new data. Enable Amazon S3 object lock and enable AWS CloudTrail with data events.
    • Use AWS Storage Gateway to move existing data to AWS. Use Amazon S3 to store existing and new data. Enable Amazon S3 object lock and enable AWS CloudTrail with management events.
    • Use AWS DataSync to move existing data to AWS. Use Amazon S3 to store existing and new data. Enable Amazon S3 object lock and enable AWS CloudTrail with management events.
    • Use AWS Storage Gateway to move existing data to AWS. Use Amazon Elastic Block Store (Amazon EBS) to store existing and new data. Enable Amazon S3 object lock and enable Amazon S3 server access logging.

20. A company wants to use Amazon S3 for the secondary copy of its on-premises dataset. The company would rarely need to access this copy. The storage solution’s cost should be minimal.

    Which storage solution meets these requirements?

    • S3 Standard
    • S3 Intelligent-Tiering
    • S3 Standard-Infrequent Access (S3 Standard-IA)
    • S3 One Zone-Infrequent Access (S3 One Zone-IA)