Question 1

An international foreign exchange company has a serverless forex trading application that was built using AWS SAM and is hosted on AWS Serverless Application Repository. They have millions of users worldwide who use their online portal 24/7 to trade currencies. However, they are receiving a lot of complaints that it takes a few minutes for their users to log in to their portal lately, including occasional HTTP 504 errors. As the Solutions Architect, you are tasked to optimize the system and to significantly reduce the time to log in to improve the customers' satisfaction.

Which of the following should you implement in order to improve the performance of the application with minimal cost? (Select TWO.)

Options :

A : Use Lambda@Edge to allow your Lambda functions to customize content that CloudFront delivers and to execute the authentication process in AWS locations closer to the users.

B : Set up multiple and geographically disperse VPCs to various AWS regions then create a transit VPC to connect all of your resources. Deploy the Lambda function in each region using AWS SAM, in order to handle the requests faster.

C : Set up an origin failover by creating an origin group with two origins. Specify one as the primary origin and the other as the second origin which CloudFront automatically switches to when the primary origin returns specific HTTP status code failure responses.

D : Increase the cache hit ratio of your CloudFront distribution by configuring your origin to add a Cache-Control max-age directive to your objects, and specify the longest practical value for max-age.

E : Deploy your application to multiple AWS regions to accommodate your users around the world. Set up a Route 53 record with latency routing policy to route incoming traffic to the region that provides the best latency to the user.

Answer: A,C

Question 2

An enterprise company wants to allow its developers to purchase third-party software through AWS

Marketplace. The company uses an AWS Organizations account structure with full features enabled, and has a

shared services account in each organizational unit (OU) that will be used by procurement managers. The

procurement team's policy indicates that developers should be able to obtain third-party software from an

approved list only and use Private Marketplace in AWS Marketplace to achieve this requirement . The

procurement team wants administration of Private Marketplace to be restricted to a role named

procurement-manager-role, which could be assumed by procurement managers Other IAM users groups, roles,

and account administrators in the company should be denied Private Marketplace administrative access

What is the MOST efficient way to design an architecture to meet these requirements?

Options :

A : Create an IAM role named procurement-manager-role in all AWS accounts in the organization Add the PowerUserAccess managed policy to the role Apply an inline policy to all IAM users and roles in every AWS account to deny permissions on the AWSPrivateMarketplaceAdminFullAccess managed policy.

B : Create an IAM role named procurement-manager-role in all AWS accounts in the organization Add the AdministratorAccess managed policy to the role Define a permissions boundary with the AWSPrivateMarketplaceAdminFullAccess managed policy and attach it to all the developer roles.

C : Create an IAM role named procurement-manager-role in all the shared services accounts in the organization Add the AWSPrivateMarketplaceAdminFullAccess managed policy to the role Create an organization root-level SCP to deny permissions to administer Private Marketplace to everyone except the role named procurement-manager-role Create another organization root-level SCP to deny permissions to create an IAM role named procurement-manager-role to everyone in the organization.

D : Create an IAM role named procurement-manager-role in all AWS accounts that will be used by developers. Add the AWSPrivateMarketplaceAdminFullAccess managed policy to the role. Create an SCP in Organizations to deny permissions to administer Private Marketplace to everyone except the role named procurement-manager-role. Apply the SCP to all the shared services accounts in the organization.

Answer: C

Question 3

A company requires that all internal application connectivity use private IP addresses. To facilitate this policy,

a solutions architect has created interface endpoints to connect to AWS public services. Upon testing, the

solutions architect notices that the service names are resolving to public IP addresses, and that internal services

cannot connect to the interface endpoints.

Which step should the solutions architect take to resolve this issue?

Options :

A : Update the subnet route table with a route to the interface endpoint.

B : Enable the private DNS option on the VPC attributes.

C : Configure the security group on the interface endpoint to allow connectivity to the AWS services.

D : Configure an Amazon Route 53 private hosted zone with a conditional forwarder for the internal application.

Answer: B

Question 4

A company needs to modernize a legacy .NET Framework application. The application uses an application server and a Microsoft SQL Server database. The company also needs to perform the following tasks: # Containerize the application into microservices. • Keep control of the operating system patches and storage for the application layer. • Add load balancing for the web servers. • Make the application highly available. Which solution will meet these requirements?

Options :

A :

Convert the application into a containerized application by using AWS App2Container. Deploy the containerized application on Amazon Elastic Container Service (Amazon ECS). Run the ECS cluster on Amazon EC2 instances in an Auto Scaling group. Place an Application Load Balancer in front of the Auto Scaling group. Use Amazon RDS for SOL Server with a Multi-AZ deployment to host the database.

B :

Convert the application into a containerized application by using AWS App2Container. Deploy the containerized application on Amazon Elastic Container Service (Amazon ECS). Run the ECS cluster on EC2 instances in an Auto Scaling group. Place a Network Load Balancer in front of the Auto Scaling group. Use Amazon Aurora MySQL with a Multi-AZ deployment to host the database.

C :

Convert the application into a containerized application by using the Porting Assistant for .NET tool. Deploy the containerized application on Amazon Elastic Kubernetes Service (Amazon EKS). Run the EKS cluster by using AWS Fargate. Place a Network Load Balancer in front of the Auto Scaling group. Host the database on Amazon Aurora MySQL. Configure cross-Region read replicas for the database.

D :

Convert the application into a containerized application by using the Porting Assistant for .NET tool. Deploy the containerized application on Amazon Elastic Kubernetes Service (Amazon EKS). Run the EKS cluster by using AWS Fargate. Place an Application Load Balancer in front of the Auto Scaling group. Use Amazon RDS for SQL Server with a Multi-AZ deployment to host the database.

Answer: A

Question 5

The www.tutorialsdojonews.com website is using the WordPress platform that runs on a fleet of Amazon EC2 instances behind an application load balancer to deliver news around the globe. There are a lot of customers complaining about the slow loading time of the website. The solutions architect has created a CloudFront distribution and set the ALB as the origin to improve the read performance. After several days, the IT Security team reported that the setup is not secure and it should enable end-to-end HTTPS connections from the user's browser to the origin via CloudFront.

Which of the following options should the solutions architect implement to satisfy the above requirements?

Options :

A : Use a self-signed certificate in both the origin and CloudFront.

B : Configure the CloudFront distribution to redirect HTTP to HTTPS protocol. Generate a new SSL certificate on AWS Certificate Manager and use it as the CloudFront distribution and origin certificate.

C : Configure CloudFront to use its default certificate. Configure the CloudFront distribution to redirect HTTP to HTTPS protocol. For the origin, generate a new SSL certificate on AWS Certificate Manager.

D : Use third-party CA certificate on both the origin and CloudFront.

Answer: B

Confidently Practice Online with Free SAP-C02 Exam Cram

Buying Options: