SAP-C01 (Page 14)

A company has multiple business units.Each business unit has its own AWS account and runs a single website within that account.The company also has a single logging account.Logs from each business unit website are aggregated into a single Amazon S3 bucket in the logging account.The S3 bucket policy provides each business unit with access to write data into the bucket and requires data to be encrypted.The company needs to encrypt logs uploaded into the bucket using a single AWS Key Management Service (AWS KMS) CMK.The CMK that protects the data must be rotated once every 365 days.Which strategy is the MOST operationally efficient for the company to use to meet these requirements?Read More →

A company is using Amazon WorkSpaces to provide access to its corporate applications across multiple global locations.User profile data is stored on anAmazon FSx for Windows File Server file system that is configured with a DNS alias.The file system is linked to an existing Active Directory service.Recently, the company added a new application that unexpectedly caused user profiles to grow significantly.The company increased the FSx for Windows FileServer file system size from 3 TiB to 6 TiB to prevent any issues.A few days later, the company made changes to the application’s configuration.The user profile storage usage decreased significantly, leaving a large amount of free space on the file system.A solutions architect needs to reduce the size of the file system to avoid unnecessary costs.What should the solutions architect do to achieve this goal?Read More →

A data analytics company has an Amazon Redshift cluster that consists of several reserved nodes.The cluster is experiencing unexpected bursts of usage because a team of employees is compiling a deep audit analysis report.The queries to generate the report are complex read queries and are CPU intensive.Business requirements dictate that the cluster must be able to service read and write queries at all times.A solutions architect must devise a solution that accommodates the bursts of usage.Which solution meets these requirements MOST cost-effectively?Read More →

A security engineer determined that an existing application retrieves credentials to an Amazon RDS for MySQL database from an encrypted file in Amazon S3.For the next version of the application, the security engineer wants to implement the following application design changes to improve security:✑ The database must use strong, randomly generated passwords stored in a secure AWS managed service.✑ The application resources must be deployed through AWS CloudFormation.✑ The application must rotate credentials for the database every 90 days.A solutions architect will generate a CloudFormation template to deploy the application.Which resources specified in the CloudFormation template will meet the security engineer’s requirements with the LEAST amount of operational overhead?Read More →

A solutions architect is auditing the security setup of an AWS Lambda function for a company.The Lambda function retrieves the latest changes from an Amazon Aurora database.The Lambda function and the database run in the same VPC.Lambda environment variables are providing the database credentials to the Lambda function.The Lambda function aggregates data and makes the data available in an Amazon S3 bucket that is configured for server-side encryption with AWS KMS managed encryption keys (SSE-KMS).The data must not travel across the internet.If any database credentials become compromised, the company needs a solution that minimizes the impact of the compromise.What should the solutions architect recommend to meet these requirements?Read More →

A company has migrated a legacy application to the AWS Cloud.The application runs on three Amazon EC2 instances that are spread across three Availability Zones.One EC2 instance is in each Availability Zone.The EC2 instances are running in three private subnets of the VPC and are set up as targets for an Application Load Balancer (ALB) that is associated with three public subnets.The application needs to communicate with on-premises systems.Only traffic from IP addresses in the company’s IP address range are allowed to access the on-premises systems.The company’s security team is bringing only one IP address from its internal IP address range to the cloud.The company has added this IP address to the allow list for the company firewall.The company also has created an Elastic IP address for this IP address.A solutions architect needs to create a solution that gives the application the ability to communicate with the on-premises systems.The solution also must be able to mitigate failures automatically.Which solution will meet these requirements?Read More →

A company is developing a new service that will be accessed using TCP on a static port.A solutions architect must ensure that the service is highly available, has redundancy across Availability Zones, and is accessible using the DNS name my.service.com, which is publicly accessible.The service must use fixed address assignments so other companies can add the addresses to their allow lists.Assuming that resources are deployed in multiple Availability Zones in a single Region, which solution will meet these requirements?Read More →

A company implements a containerized application by using Amazon Elastic Container Service (Amazon ECS) and Amazon API Gateway.The application data is stored in Amazon Aurora databases and Amazon DynamoDB databases.The company automates infrastructure provisioning by using AWS CloudFormation.The company automates application deployment by using AWS CodePipeline.A solutions architect needs to implement a disaster recovery (DR) strategy that meets an RPO of 2 hours and an RTO of 4 hours.Which solution will meet these requirements MOST cost-effectively?Read More →

A company has five physical data centers in specific locations around the world.Each data center has hundreds of physical servers with a mix of Windows andLinux-based applications and database services.Each data center also has an AWS Direct Connect connection of 10 Gbps to AWS with a company-approvedVPN solution to ensure that data transfer is secure.The company needs to shut down the existing data centers as quickly as possible and migrate the servers and applications to AWS.Which solution meets these requirements?Read More →

A company has a media catalog with metadata for each item in the catalog.Different types of metadata are extracted from the media items by an application running on AWS Lambda.Metadata is extracted according to a number of rules with the output stored in an Amazon ElastiCache for Redis cluster.The extraction process is done in batches and takes around 40 minutes to complete.The update process is triggered manually whenever the metadata extraction rules change.The company wants to reduce the amount of time it takes to extract metadata from its media catalog.To achieve this, a solutions architect has split the single metadata extraction Lambda function into a Lambda function for each type of metadata.Which additional steps should the solutions architect take to meet the requirements?Read More →