AWS Certified Solutions Architect - Associate (SAA-C03)

In AWS IAM, what does the principle of least privilege mean?

A. Providing users with minimum access to perform their job function

B. Providing users with root access

C. Providing all users with administrative access

D. Restricting all user access

a

Which of the following services would you use to manage user access to AWS services and resources across multiple AWS accounts?

A. AWS Identity and Access Management (IAM)

B. AWS Single Sign-On (SSO)

C. AWS Management Console

D. Amazon Simple Notification Service (SNS)

b

What is the purpose of Availability Zones within the AWS global infrastructure?

A. They serve as separate geographic areas for data storage

B. They serve to increase latency for applications

C. They provide isolated locations within a region

D. They restrict user access to data

c

Which of the following best describes the AWS Shared Responsibility Model?

A. Amazon is responsible for all aspects of cloud security

B. Customers are responsible for all aspects of cloud security

C. Amazon and customers share responsibilities for cloud security

D. None of the above

c

When using AWS Identity and Access Management (IAM), what is the best practice for managing the root user?

A. Share the root user credentials with your team

B. Use the root user for your everyday tasks

C. Lock away the root user credentials and use them sparingly

D. Delete the root user account

c

What is a best practice for securing IAM users and root users?

A. Disable multi-factor authentication (MFA)

B. Share credentials between users

C. Enable multi-factor authentication (MFA)

D. Store credentials in plain text

c

In AWS IAM, what would you use to define who can access a service and what actions they can perform?

A. S3 Buckets

B. Policies

C. MFA

D. AWS Config

b

In AWS, how can an IAM user assume a role in another account?

A. By using AWS CloudTrail

B. By using AWS Security Token Service (STS)

C. By using AWS IAM

D. By using Amazon GuardDuty

b

Which AWS service is best suited for managing and governing multiple AWS accounts?

A. AWS Organizations

B. AWS IAM

C. Amazon GuardDuty

D. AWS CloudTrail

a

What is a resource policy in AWS?

A. A tool for monitoring AWS resources

B. An IAM policy that applies to specific AWS resources

C. An AWS service for managing resources

D. A type of security group

b

In which scenario should you federate a directory service with IAM roles?

A. When you want to enable access to AWS Management Console without IAM users

B. When you want to encrypt data at rest

C. When you want to monitor your AWS environment

D. When you want to launch EC2 instances

a

Which AWS service is primarily used for application configuration and credentials security?

A. AWS Key Management Service (KMS)

B. AWS Config

C. AWS Secrets Manager

D. Amazon Inspector

C

In AWS, how can you securely store and retrieve database credentials?

A. Using AWS RDS only

B. Using IAM roles

C. Using AWS Secrets Manager

D. By storing them in an EC2 instance

C

Which AWS service provides a system to manage and control service endpoints?

A. Amazon Route 53

B. AWS VPC Endpoint Services

C. Amazon API Gateway

D. AWS Direct Connect

B

AWS Service Endpoints are used for...

A. Connecting to services outside your VPC

B. Exposing a public API for your service

C. Ensuring all your data is encrypted

D. Connecting your VPC to AWS services in a secure manner

D

To control ports, protocols, and network traffic on AWS, you should use:

A. Network Access Control Lists (ACLs) and Security Groups

B. IAM Policies only

C. AWS Shield

D. AWS Firewall Manager

A

Security Groups in AWS...

A. Operate at the subnet level and evaluate all incoming and outgoing traffic.

B. Operate at the instance level and are stateful.

C. Can only be used with EC2 instances.

D. Can be attached to VPCs.

B

What is the use of Network ACLs in AWS?

A. To filter traffic at the subnet level

B. To manage users in an AWS account

C. To enforce encryption at rest for S3 buckets

D. To monitor AWS resources

A

How can you best protect sensitive data being sent to an AWS service?

A. Use HTTPS to encrypt all data

B. Use AWS Config to monitor all data

C. Store the data in S3 buckets only

D. Use an IAM policy to restrict access

A

Which of the following is not a common practice to increase security in AWS?

A. Store access keys in your application code

B. Rotate credentials regularly

C. Use multi-factor authentication

D. Enable CloudTrail logging

A

How are IAM policies used in controlling access in AWS?

A. They specify which actions are allowed or denied on resources

B. They specify which AWS accounts can be used

C. They control the creation of new EC2 instances

D. They manage the storage capacity of S3 buckets

A

Which AWS service is best suited to manage user sign-up and sign-in functionality for mobile and web apps?

A. AWS Identity and Access Management (IAM)

B. AWS Lambda

C. Amazon Cognito

D. Amazon S3

C

Which service would you use to monitor your AWS accounts for unusual and unexpected behaviors?

A. AWS Config

B. AWS CloudTrail

C. Amazon GuardDuty

D. AWS Security Hub

C

You want to automate the discovery and protection of sensitive data in AWS. Which service would you use?

A. AWS Shield

B. Amazon Macie

C. AWS IAM

D. Amazon Inspector

B

How does AWS mitigate Distributed Denial of Service (DDoS) attacks?

A. By using Amazon Macie

B. By using Amazon Cognito

C. By using AWS Shield

D. By using Amazon GuardDuty

C

To protect your web application from SQL Injection, what should you implement?

A. Amazon Cognito

B. AWS WAF with appropriate rules

C. AWS Shield

D. Amazon GuardDuty

B

To enable Single Sign-On (SSO) capabilities in your application, you can leverage:

A. Amazon Inspector

B. AWS CloudFormation

C. Amazon S3

D. Amazon Cognito

D

Which AWS service would be best to detect potentially unauthorized and malicious activity across your AWS accounts?

A. AWS IAM

B. AWS CloudTrail

C. Amazon Macie

D. Amazon GuardDuty

D

How can Amazon Macie be used?

A. To prevent DDoS attacks

B. To manage users and their access to your apps

C. To discover, classify, and protect sensitive data

D. To provide single sign-on (SSO) capabilities

C

What is a common method to prevent SQL Injection attacks?

A. Use complex passwords

B. Use encrypted connections

C. Use input validation and prepared statements

D. Enable multi-factor authentication

C

To safeguard your application from brute force attacks, which AWS service would you use?

A. Amazon Cognito

B. AWS IAM

C. Amazon GuardDuty

D. AWS Shield

A

In an AWS VPC, Security Groups and Network ACLs are used for:

A. Logging network traffic

B. Managing IAM users

C. Controlling inbound and outbound traffic

D. Encryption of data at rest

C

What is the purpose of NAT Gateway in a VPC?

A. To enable instances in a private subnet to connect to the internet or other AWS services

B. To prevent outside traffic from reaching instances in a private subnet

C. To encrypt data in transit

D. To manage IAM users

A

Which AWS service or feature allows you to control traffic in and out of your VPC?

A. AWS Shield

B. Route Tables

C. Amazon S3

D. AWS Config

B

How would you segregate your public-facing applications and internal applications within a VPC?

A. By using different AWS accounts for each type of application

B. By creating public and private subnets

C. By using separate IAM roles for each type of application

D. By creating different S3 buckets for each type of application

B

A network ACL in AWS...

A. Operates at the instance level

B. Is stateful

C. Operates at the subnet level

D. Can be attached to a VPC

C

If a company wants to host a publicly accessible web application and also manage a private database, what network design would be most secure?

A. Using a single public subnet for both

B. Using a single private subnet for both

C. Using a public subnet for the web application and a private subnet for the database

D. Using two public subnets, one for the web application and one for the database

C

What is the main benefit of using a VPC with public and private subnets compared to a VPC with only public subnets?

A. Cost savings

B. Increased storage capacity

C. Improved network performance

D. Enhanced security and control over the network environment

D

Which of the following best describes a security group in AWS?

A. An inbound firewall rule that applies to an instance level

B. A service that monitors unusual activity in your AWS accounts

C. A tool for managing user identities and access

D. An outbound firewall rule that applies to the VPC level

A

In terms of security, why would you use a NAT Gateway in a VPC?

A. To provide instances in a private subnet access to the internet without exposing them to inbound internet traffic

B. To protect your VPC from DDoS attacks

C. To encrypt data in transit between your VPC and the internet

D. To monitor your VPC for unauthorized access

A

To control traffic between subnets within a VPC, you should use:

A. Security Groups

B. Route Tables

C. AWS Direct Connect

D. AWS IAM Policies

B

How can AWS Shield be used in securing your application?

A. To manage user identities and access

B. To provide automatic protection to applications against DDoS attacks

C. To encrypt data at rest

D. To store and manage database credentials

B

Which AWS service is primarily used to protect your web applications from common web exploits?

A. AWS Shield

B. AWS Single Sign-On

C. AWS WAF (Web Application Firewall)

D. AWS Secrets Manager

C

Which AWS service allows centralized management of multiple AWS accounts and business applications with single sign-on (SSO) capabilities?

A. Amazon Cognito

B. AWS Shield

C. AWS WAF

D. AWS Single Sign-On

D

If you have a database password that your application needs to access an RDS instance, where should you store it?

A. In the application code

B. In AWS Secrets Manager

C. In an Amazon S3 bucket

D. In AWS Shield

B

Which of the following services provides a private network connection from your on-premise networks to AWS?

A. AWS WAF

B. AWS Direct Connect

C. AWS VPN

D. AWS Shield

B

You want to create a secure and private tunnel from your network or device to your VPC. Which AWS service will you use?

A. AWS Shield

B. AWS WAF

C. AWS VPN

D. AWS Direct Connect

C

Which of the following can help to protect your applications against SQL injection and XSS attacks?

A. AWS Shield

B. AWS WAF

C. AWS SSO

D. AWS Secrets Manager

B

AWS Direct Connect provides:

A. Automated protection against DDoS attacks

B. Single sign-on capabilities for AWS applications

C. A dedicated private connection from a remote network to your VPC

D. A firewall that protects your web applications from common exploits

C

AWS VPN can be used to:

A. Store and manage database credentials

B. Provide single sign-on capabilities

C. Establish a secure and private connection from your network or device to your VPC

D. Protect against DDoS attacks

C

Which AWS service is designed to protect against most common, frequently observed DDoS attacks?

A. AWS Direct Connect

B. AWS WAF

C. AWS Shield

D. AWS SSO

C

Your company hosts a web application on AWS using EC2 instances behind an Application Load Balancer. The application is facing continuous DDoS attacks. What is the most effective AWS service to mitigate these attacks?

A. AWS Inspector

B. AWS Shield

C. AWS Macie

D. AWS GuardDuty

B

A financial company wants to securely store the access keys of its AWS users. These keys should be encrypted and rotated automatically. Which AWS service should the company use?

A. AWS IAM

B. AWS CloudTrail

C. AWS Secrets Manager

D. Amazon S3

C

You are the Solutions Architect for a company that has sensitive data stored in S3 buckets. The company's security policy mandates that all data should be encrypted at rest. What is the simplest way to ensure that all future data stored in the bucket is encrypted?

A. Use AWS KMS to encrypt the data before storing it in S3.

B. Use S3 client-side encryption before uploading the data.

C. Use S3 server-side encryption and set the bucket policy to deny all PUT requests that don't include the "x-amz-server-side-encryption" header.

D. Use AWS CloudTrail to monitor PUT requests and send alerts for non-encrypted files.

C

Your organization needs a solution that allows internal users to authenticate once and gain access to all of their AWS applications without having to log in to each one separately. Which AWS service would you choose to meet this requirement?

A. AWS IAM

B. Amazon Cognito

C. AWS Single Sign-On (SSO)

D. AWS Security Token Service

C

You have a web application running on an EC2 instance which connects to an RDS instance. Both are in the same VPC. How should you securely allow the EC2 instance to connect to the RDS instance?

A. Use security groups to allow inbound traffic from the EC2 instance to the RDS instance.

B. Use network ACLs to allow inbound traffic from the EC2 instance to the RDS instance.

C. Store the RDS endpoint in the EC2 instance user-data.

D. Use AWS KMS to encrypt the connection between the EC2 instance and the RDS instance.

A

A solutions architect wants to design a solution to save costs for Amazon EC2 instances that do not need to run during a 2-week company shutdown. The applications running on the EC2 instances store data in instance memory that must be present when the instances resume operation.

Which approach should the solutions architect recommend to shut down and resume the EC2 instances?

A) Modify the application to store the data on instance store volumes. Reattach the volumes while restarting them.

B) Snapshot the EC2 instances before stopping them. Restore the snapshot after restarting the instances.

C) Run the applications on EC2 instances enabled for hibernation. Hibernate the instances before the 2-week company shutdown.

D) Note the Availability Zone for each EC2 instance before stopping it. Restart the instances in the same Availability Zones after the 2-week company shutdown.

C

A company plans to run a monitoring application on an Amazon EC2 instance in a VPC. Connections are made to the EC2 instance using

the instance's private IPv4 address. A solutions architect needs to

design a solution that will allow traffic to be quickly directed to a standby EC2 instance if the applicationfails and becomes unreachable.

Which approach will meet these requirements?

A) Deploy an Application Load Balancer configured with a listener for the private IP address and register the primary EC2 instance with the load balancer. Upon failure, de-register the instance and register the

standby EC2 instance.

B) Configure a custom DHCP option set. Configure DHCP to assign the same private IP address to the standby EC2 instance when the primary EC2 instance fails.

C) Attach a secondary elastic network interface to the EC2 instance configured with the private IP address. Move the network interface to the standby EC2 instance if the primary EC2 instance becomes

unreachable.

D) Associate an Elastic IP address with the network interface of the primary EC2 instance. Disassociate the Elastic IP from the primary instance upon failure and associate it with a standby EC2 instance.

C

An analytics company is planning to offer a web analytics service to its users. The service will require that the users' webpages include a JavaScript script that makes authenticated GET requests to the company's Amazon S3

bucket.

What must a solutions architect do to ensure that the script will successfully execute?

A) Enable cross-origin resource sharing (CORS) on the S3 bucket.

B) Enable S3 Versioning on the S3 bucket.

C) Provide the users with a signed URL for the script.

D) Configure an S3 bucket policy to allow public execute privileges.

A company uses Amazon EC2 Reserved Instances to run its data processing workload. The nightly job typically takes 7 hours to run and must finish within a 10-hour time window. The company anticipates temporary increases in demand at the end of each month that will cause the job to run over the time limit with the capacity of the current resources. Once started, the processing job cannot be interrupted before completion. The company wants to implement a solution that would provide increased resource capacity as cost-effectively as possible.

What should a solutions architect do to accomplish this?

A) Deploy On-Demand Instances during periods of high demand.

B) Create a second EC2 reservation for additional instances.

C) Deploy Spot Instances during periods of high demand.

D) Increase the EC2 instance size in the EC2 reservation to support the increased workload.

A

A company runs an online voting system for a weekly live television program. During broadcasts, users submit hundreds of thousands of votes within minutes to a front-end fleet of Amazon EC2 instances that run in an Auto Scaling group. The EC2 instances write the votes to an Amazon RDS database. However, the database is unable to keep up with the requests that come from the EC2instances. A solutions architect must design a solution that processes the votes in the most efficient manner and without down time.

Which solution meets these requirements?

A) Migrate the front-end application to AWS Lambda. Use Amazon API Gateway to route user requests to the Lambda functions.

B) Scale the database horizontally by converting it to a Multi-AZ deployment. Configure the front-end application to write to both the primary and secondary DB instances.

C) Configure the front-end application to send votes to an Amazon Simple Queue Service (Amazon SQS)queue. Provision worker instances to read the SQS queue and write the vote information to the database.

D) Use Amazon EventBridge (Amazon CloudWatch Events) to create a scheduled event to re-provision the database with larger, memory optimized instances during voting periods. When voting ends, re-provision the database to use smaller instances.

C

A website runs a custom web application that receives a burst of traffic each day at noon. The users upload new pictures and content daily, but have been complaining of timeouts. The architecture uses Amazon EC2 Auto Scaling groups, and the application consistently takes 1 minute to initiate upon boot up before responding to user requests.

How should a solutions architect redesign the architecture to better respond to changing traffic?

A) Configure a Network Load Balancer with a slow start configuration.

B) Configure Amazon ElastiCache for Redis to offload direct requests from the EC2 instances.

C) Configure an Auto Scaling step scaling policy with an EC2 instance warmup condition.

D) Configure Amazon CloudFront to use an Application Load Balancer as the origin.

C

An application running on AWS uses an Amazon Aurora Multi-AZ DB cluster deployment for its database. When evaluating performance metrics, a solutions architect discovered that the database reads are causing high I/O and adding latency to the write requests against the database.

What should the solutions architect do to separate the read requests from the write requests?

A) Enable read-through caching on the Aurora database.

B) Update the application to read from the Multi-AZ standby instance.

C) Create an Aurora replica and modify the application to use the appropriate endpoints.

D) Create a second Aurora database and link it to the primary database as a read replica.

C

A company stores sensitive customer data in an Amazon S3 bucket. To meet compliance requirements, they need to ensure that only certain IAM users can access this data. What is the most effective method to control access to this S3 bucket?

A. Implement S3 bucket policies that specify the allowed IAM users

B. Encrypt the data in the S3 bucket using AWS KMS

C. Use S3 versioning to control access to the data

D. Enable AWS CloudTrail to monitor access to the S3 bucket

a

Your organization is using Amazon RDS to store critical business data. There is a need to grant different levels of access to this database for various teams. Which of the following is the best approach to manage these permissions?

A. Create IAM roles with specific database policies and assign them to the teams

B. Configure network ACLs to control the traffic to and from the RDS instance

C. Use RDS security groups to manage access at the database level

D. Implement AWS Shield to protect the database from unauthorized access

a

You are designing a cloud architecture for a new application. The application will store sensitive data and must comply with strict regulatory standards for data access and auditing. Which combination of AWS services would best meet these requirements?

A. AWS IAM for access control, Amazon S3 for data storage, and AWS CloudTrail for auditing

B. AWS WAF for access control, Amazon EC2 for data storage, and AWS Config for auditing

C. Amazon Cognito for access control, AWS EBS for data storage, and AWS Inspector for auditing

D. AWS KMS for data encryption, Amazon RDS for data storage, and Amazon CloudWatch for auditing

a

A company wants to ensure that its critical data stored in Amazon S3 remains available in the event of a regional AWS service disruption. Which of the following strategies should they implement?

A. Enable versioning on the S3 buckets

B. Use S3 Transfer Acceleration

C. Configure S3 Cross-Region Replication

D. Implement S3 Lifecycle Policies

c

Your application is using Amazon RDS and you need to implement a disaster recovery strategy that minimizes data loss and achieves a recovery point objective (RPO) of 5 minutes. Which approach would you recommend?

A. Create a read replica of the RDS instance in another region

B. Use AWS Backup with a backup frequency of 5 minutes

C. Enable Multi-AZ deployments for the RDS instance

D. Set up RDS snapshots to occur every 5 minutes

c

An organization is storing critical data on Amazon EBS volumes attached to EC2 instances. Which method would provide the fastest recovery time if an EBS volume fails?

A. Restoring from EBS snapshots

B. Using EBS Multi-Attach feature

C. Implementing Amazon EBS encryption

D. Launching a new instance from an AMI created from the EBS volume

a

A company needs to classify and manage data stored in Amazon S3 based on retention requirements. Which AWS feature or service should be used to automate the movement of objects between different storage classes?

A. S3 Intelligent-Tiering

B. S3 Lifecycle Policies

C. AWS Storage Gateway

D. AWS DataSync

B

An organization wants to retain application log files for a minimum of 7 years for compliance reasons. The data is infrequently accessed. Which S3 storage class is most cost-effective for this use case?

A. S3 Standard

B. S3 Intelligent-Tiering

C. S3 Glacier

D. S3 Glacier Deep Archive

D

Your company is storing sensitive customer data in Amazon RDS. They need to ensure that backups of this data are retained for a period of 5 years due to regulatory requirements. What action should be taken to meet this requirement?

A. Enable RDS automated backups and set the retention period to 5 years

B. Regularly take RDS snapshots and store them in S3 Glacier

C. Use AWS Backup with a custom backup policy for RDS

D. Manually export data to Amazon S3 and apply S3 Lifecycle Policies

C

A company is deploying a new application on AWS and wants to ensure that the data stored in their Amazon RDS database is encrypted at rest. Which of the following options would enable them to achieve this?

A. Use AWS Shield to protect the database.

B. Implement SSL/TLS for data in transit to RDS.

C. Enable RDS encryption with AWS Key Management Service (KMS).

D. Apply Amazon S3 server-side encryption to RDS.

C

Your organization needs to manage encryption keys for AWS services and ensure that these keys are rotated regularly. Which AWS service provides this capability?

A. AWS CloudHSM

B. AWS Identity and Access Management (IAM)

C. AWS Key Management Service (KMS)

D. Amazon Inspector

C

You are designing a system on AWS where you need to encrypt data before sending it to an Amazon S3 bucket. Which approach ensures the best security practice for this requirement?

A. Use S3 default encryption with an S3-managed key.

B. Use client-side encryption with a customer-managed key in AWS KMS.

C. Rely on Amazon S3 data transfer encryption using SSL/TLS.

D. Encrypt data using AWS Shield before sending it to S3.

B

A healthcare company needs to store patient records in compliance with HIPAA regulations. Which AWS service should be used to store these records with the necessary compliance controls?

A. Amazon S3, ensuring that the bucket is set to private and server-side encryption is enabled

B. Amazon EC2, with encrypted EBS volumes for data storage

C. AWS Lambda, for processing and storing data in a serverless environment

D. Amazon DynamoDB, with encryption at rest enabled and fine-grained access control

A

An e-commerce company must adhere to PCI DSS compliance for its payment processing system. Which of the following AWS features or services would be most appropriate for securing the cardholder data?

A. Use AWS Shield for DDoS protection

B. Implement AWS WAF to protect the web applications

C. Store the cardholder data in Amazon RDS with encryption enabled

D. Use AWS Direct Connect for secure, private connections

C

A financial services company operates under stringent regulatory requirements for data retention and auditability. They are planning to use AWS for their operations. Which combination of services and features should they use to ensure compliance with these requirements?

A. Amazon S3 with Lifecycle Policies for data retention, and AWS CloudTrail for audit trails

B. AWS Elastic Beanstalk for application deployment, and AWS Shield for security

C. Amazon EC2 with encrypted EBS volumes, and Amazon CloudFront for content delivery

D. AWS Config for resource tracking and changes, and Amazon Inspector for security assessment

A

A company stores sensitive data files in an Amazon S3 bucket. They want to ensure that these files are encrypted at rest using keys managed in AWS KMS. Which of the following methods should they use to achieve this?

A. Enable S3 default encryption with an AWS managed key.

B. Use client-side encryption with a customer-managed key outside of AWS.

C. Apply S3 bucket policies to enforce encryption.

D. Use S3 server-side encryption with a customer-managed AWS KMS key.

D

An organization wants to encrypt its Amazon EBS volumes to protect sensitive data at rest. They require the ability to manage and rotate the encryption keys themselves. What is the most suitable approach?

A. Use AWS-managed keys in AWS KMS for EBS encryption.

B. Enable EBS encryption with a customer-managed AWS KMS key.

C. Encrypt data using client-side encryption before storing it on EBS volumes.

D. Use Amazon S3 server-side encryption for EBS volumes.

B

A database hosted on Amazon RDS needs to be encrypted at rest to meet compliance requirements. Which of the following options should be used to meet this requirement while ensuring key management is handled within AWS?

A. Enable RDS encryption using an AWS-managed KMS key.

B. Encrypt the database at the application layer before storing data in RDS.

C. Use a third-party tool to encrypt data within the RDS instance.

D. Enable RDS encryption with a customer-managed KMS key.

D

A company is running a web application on an EC2 instance behind an Elastic Load Balancer (ELB). They want to ensure that the data transmitted between the clients and the ELB is encrypted. Which of the following actions should they take?

A. Implement AWS Shield for the ELB.

B. Enable TLS termination on the ELB with an SSL/TLS certificate from AWS Certificate Manager.

C. Use AWS KMS to encrypt the data in transit.

D. Configure the EC2 instance to encrypt the traffic with AWS WAF.

B

A Solutions Architect needs to design a system where the data transmitted between an Amazon CloudFront distribution and its origin, an Amazon S3 bucket, is encrypted. What is the most effective way to achieve this?

A. Enable AWS Shield on the CloudFront distribution.

B. Use AWS KMS to encrypt the data in transit.

C. Configure CloudFront to use HTTPS to communicate with the S3 bucket.

D. Apply an AWS WAF web ACL to the CloudFront distribution.

C

An application running on AWS needs to securely transmit sensitive data to another server outside of AWS. The Solutions Architect plans to use AWS Certificate Manager (ACM) for this purpose. Which of the following steps should be taken to ensure secure data transmission?

A. Install an ACM-provided SSL/TLS certificate on the application server and enforce HTTPS for data transmission.

B. Use ACM to create a VPN tunnel between the AWS environment and the external server.

C. Implement AWS Direct Connect with ACM for secure data transmission.

D. Configure Amazon S3 to use an ACM certificate for data encryption in transit.

A

A company is using AWS Key Management Service (KMS) to manage encryption keys for their S3 data. They need to ensure that only specific IAM users can use the keys to decrypt data. What is the best way to control access to the KMS keys?

A. Assign an IAM policy to the KMS key that explicitly allows the specified IAM users to use the key.

B. Enable AWS CloudTrail for the KMS key to monitor which IAM users are accessing the key.

C. Use S3 bucket policies to restrict access to the encrypted data, not the KMS key.

D. Encrypt the data with a customer-managed key and share the key only with specific IAM users.

A

An organization wants to audit the usage of their AWS KMS keys and track which resources are accessing these keys. What should they implement to achieve this requirement?

A. Enable logging in AWS CloudTrail for all KMS key usage.

B. Configure AWS Config to record changes to KMS key policies.

C. Set up Amazon CloudWatch alarms for KMS key access.

D. Use AWS IAM Access Advisor to monitor KMS key access.

A

A Solutions Architect needs to ensure that an AWS KMS key used for encrypting data in an Amazon RDS instance can only be accessed by the RDS service on behalf of the account. Which policy should be attached to the KMS key?

A. A policy that explicitly denies all IAM users and roles access to the KMS key, except for the RDS service.

B. A policy that grants full KMS access to all IAM roles and users within the account.

C. An AWS managed policy that automatically restricts access to the service that created the KMS key.

D. A policy that grants the RDS service principal the necessary permissions to use the KMS key.

D

A company is using Amazon RDS for its database needs. They want to ensure that the database is backed up daily and that these backups are retained for 30 days. Which of the following should they configure?

A. Enable RDS Read Replicas for daily backups.

B. Set up AWS DataSync to replicate data to an Amazon S3 bucket daily.

C. Configure RDS Automated Backups with a retention period of 30 days.

D. Use AWS Backup with a daily schedule and a retention period of 30 days.

C

An organization is storing critical data on Amazon EBS volumes attached to their EC2 instances. They want to implement a disaster recovery strategy that allows for quick recovery in case of EBS volume failure. What is the most efficient way to achieve this?

A. Regularly take and store EBS snapshots to Amazon S3.

B. Use Amazon S3 to create a mirror of the data stored in EBS volumes.

C. Implement EBS Multi-Attach to create redundant data copies.

D. Configure AWS Storage Gateway for seamless data replication.

A

A company has a large-scale application that generates terabytes of data every day. They need a cost-effective solution to back up this data while ensuring that it is easily retrievable when needed. Which AWS service or feature should they use?

A. Amazon S3 with Lifecycle Policies to transition older backups to S3 Glacier.

B. AWS Backup with a lifecycle policy to transition backups to a lower-cost storage class.

C. Use Amazon EFS for automatic backups of the data.

D. Implement Amazon RDS snapshots for daily backups.

A

A company stores sensitive customer information in an Amazon S3 bucket. To comply with legal requirements, they must ensure that only certain authorized personnel can access this data. Which of the following is the best approach to restrict access to the S3 bucket?

A. Implement S3 bucket encryption with AWS KMS.

B. Use AWS Shield to protect the bucket from unauthorized access.

C. Configure S3 bucket policies to allow access only to authorized IAM roles.

D. Enable Multi-Factor Authentication (MFA) on all IAM accounts.

C

An organization's application archives its logs to Amazon S3. The company policy requires that these logs be retained for 2 years for auditing purposes and then automatically deleted. Which S3 feature should be used to comply with this policy?

A. S3 Intelligent-Tiering to move the logs to a cheaper storage class after 2 years.

B. S3 Lifecycle policies to delete the logs after they are 2 years old.

C. S3 Versioning to keep the logs for 2 years.

D. S3 Replication to replicate the logs to another bucket for 2 years.

B

A media company uses Amazon EBS volumes to store video files. They need to ensure that the data is protected from accidental deletion or overwriting. What should they implement to secure their data?

A. Use AWS Backup to regularly back up the EBS volumes.

B. Implement EBS Multi-Attach on the volumes for redundancy.

C. Enable termination protection on the EC2 instances associated with the EBS volumes.

D. Configure IAM policies to restrict delete permissions on the EBS volumes.

A

A company is using AWS Key Management Service (KMS) for encryption keys associated with their S3 data. They have a policy to rotate encryption keys annually. How can they automate the key rotation process?

A. Enable automatic key rotation in AWS KMS for the customer master key (CMK).

B. Manually create a new CMK in AWS KMS every year and update the S3 bucket to use the new key.

C. Use AWS Config to set up a rule for rotating keys and associate it with the S3 bucket.

D. Implement a custom AWS Lambda function to rotate the keys and update the S3 bucket.

A

An organization uses AWS Certificate Manager (ACM) for SSL/TLS certificates in their application load balancers. What is the process to renew these certificates?

A. Certificates in ACM are automatically renewed; no action is required by the user.

B. Manually request a new certificate in ACM and update the load balancer configuration.

C. Use AWS Lambda to automate the renewal process of ACM certificates.

D. Configure an Amazon CloudWatch alarm to notify when a certificate is about to expire, then renew it manually.

A

A Solutions Architect needs to ensure that RDS database encryption keys are rotated every 90 days. What is the most effective method to achieve this?

A. Configure the RDS instance to automatically rotate the encryption key every 90 days.

B. Use AWS KMS to enable automatic rotation for the CMK used for RDS encryption.

C. Manually rotate the RDS encryption key in the AWS Management Console every 90 days.

D. Write an AWS Lambda script that rotates the RDS encryption key and schedule it to run every 90 days.

B

A company wants to build a scalable RESTful API for their e-commerce platform. Which AWS service would be the most suitable for creating and managing this API?

A. AWS Lambda

B. Amazon EC2

C. Amazon API Gateway

D. AWS Elastic Beanstalk

C

An organization is using Amazon API Gateway for their REST API. They need to ensure that the API can handle a large number of requests without degrading performance. What feature should they implement to manage the traffic effectively?

A. Enable Amazon CloudFront with API Gateway.

B. Implement AWS Auto Scaling with the API Gateway.

C. Use API Gateway caching to cache request responses.

D. Configure an Elastic Load Balancer in front of the API Gateway.

C

A Solutions Architect is designing a REST API using Amazon API Gateway. The API needs to interact with backend services hosted on AWS Lambda and Amazon DynamoDB. What is the best practice for the Architect to follow when designing this API?

A. Directly integrate the API Gateway with DynamoDB and Lambda.

B. Use Amazon EC2 as a proxy between API Gateway and backend services.

C. Store request data in S3 and process it with Lambda functions.

D. Deploy the API on Elastic Beanstalk for better management.

A

A company needs to securely transfer files directly into and out of Amazon S3 using SFTP, FTPS, and FTP. Which AWS service is most appropriate for this requirement?

A. AWS Storage Gateway

B. Amazon Elastic File System (EFS)

C. AWS Transfer Family

D. Amazon Elastic Block Store (EBS)

C