Question 1

A clinic runs its medical record system using a fleet of Windows-based Amazon EC2 instances with several EBS volumes attached to it. Since the records that they are storing are confidential health files of their patients, it is a requirement that the latest security patches are installed on the EC2 instances. In addition, there should be a system in the cloud architecture that checks all of the EC2 instances if they are using an approved Amazon Machine Image (AMI). The system that will be implemented should not impede developers from launching instances using an unapproved AMI, but you still have to be notified if there are non-compliant EC2 instances in your VPC.

Which of the following should the solutions architect implement to protect and monitor all of your instances as required above? (Select TWO.)

Options :

A : Use AWS Shield Advanced to automatically patch all of your EC2 instances and detect uncompliant EC2 instances which do not use approved AMIs.

B : Use the AWS Config Managed Rule which automatically checks whether your running EC2 instances are using approved AMIs. Set up CloudWatch Alarms to notify you if there are any non-compliant instances running in your VPC.

C : Set up a patch baseline that defines which patches are approved for installation on your instances using AWS Systems Manager Patch Manager.

D : Set up Amazon GuardDuty that continuously monitors your instances if the latest security patches are installed and if there is an instance that is using an unapproved AMI. Use CloudWatch Alarms to notify you if there are any non-compliant instances running in your VPC.

E : Create an IAM policy that will restrict the developers from launching EC2 instances with an unapproved AMI.

Answer: B,C

Question 2

A company is planning to migrate an application from on premises to AWS. The application currently uses an

Oracle database and the company can tolerate a brief downtime of 1 hour when performing the switch to the

new infrastructure As part of the migration. the database engine will be changed to MySQL. A solutions

architect needs to determine which AWS services can be used to perform the migration while minimizing the

amount of work and time required.

Which of the following will meet the requirements?

Options :

A :

Use AWS SCT to generate the schema scripts and apply them on the target prior to migration Use AWS

DMS to analyse the current schema and provide a recommendation for the optimal database engine

Then, use AWS DMS to migrate to the recommended engine Use AWS SCT to identify what embedded

SQL code in the application can be converted and what has to be done manually

B :

Use AWS SCT to generate the schema scripts and apply them on the target prior to migration. Use AWS

DMS to begin moving data from the on-premises database to AWS. After the initial copy continue to

use AWS DMS to keep the databases m sync until cutting over to the new database Use AWS SCT to

identify what embedded SOL code in the application can be converted and what has to be done

manually.

C :

Use AWS DMS lo help identify the best target deployment between installing the database engine on

Amazon EC2 directly or moving to Amazon RDS. Then, use AWS DMS to migrate to the platform. Use

AWS Application Discovery Service to identify what embedded SQL code in the application can be

converted and what has to be done manually.

D :

Use AWS DMS to begin moving data from the on-premises database to AWS After the initial copy,

continue to use AWS DMS to keep the databases in sync until cutting over to the new database use

AWS Application Discovery Service to identify what embedded SQL code m the application can be

convened and what has to be done manually

Answer: B

Question 3

A media company hosts its entire infrastructure on the AWS cloud. There is a requirement to copy information to or from the shared resources from another AWS account. The solutions architect has to provide the other account access to several AWS resources such as Amazon S3, AWS KMS, and Amazon ES in the form of a list of AWS account ID numbers. In addition, the user in the other account should still work in the trusted account and there is no need to give up his or her user permissions in place of the role permissions. The solutions architect must also set up a solution that continuously assesses, audits, and monitors the policy configurations.

Which of the following is the MOST suitable type of policy that you should use in this scenario?

Options :

A : Set up cross-account access with a resource-based Policy. Use AWS Config rules to periodically audit changes to the IAM policy and monitor the compliance of the configuration.

B : Set up a service-linked role with a service control policy. Use AWS Systems Manager rules to periodically audit changes to the IAM policy and monitor the compliance of the configuration.

C : Set up a service-linked role with an identity-based policy. Use AWS Systems Manager rules to periodically audit changes to the IAM policy and monitor the compliance of the configuration.

D : Set up cross-account access with a user-based policy configuration. Use AWS Config rules to periodically audit changes to the IAM policy and monitor the compliance of the configuration.

Answer: A

Question 4

A hospital chain in London uses an online central hub for its doctors and nurses. The application interacts with millions of requests per day to fetch various medical data of their patients. The system is composed of a web tier, an application tier, and a database tier that receives large and unpredictable traffic demands. The Solutions Architect must ensure that this infrastructure is highly-available and scalable enough to handle web traffic fluctuations automatically.

Which of the following options should the solutions architect implement to meet the above requirements?

Options :

A : Run the web and application tiers in stateful instances in an autoscaling group, using CloudWatch for monitoring. Run the database tier using RDS with Multi-AZ enabled.

B : Run the web and application tiers in stateless instances in an autoscaling group, using Elasticache Memcached for tier synchronization and CloudWatch for monitoring. Run the database tier using RDS with Multi-AZ enabled.

C : Run the web and application tiers in stateful instances in an autoscaling group, using CloudWatch for monitoring. Run the database tier using RDS with read replicas.

D : Run the web and application tiers in stateless instances in an autoscaling group, using Elasticache Memcached for tier synchronization and CloudWatch for monitoring. Run the database tier using RDS with read replicas.

Answer: D

Question 5

A leading commercial bank has a hybrid network architecture and is extensively using AWS for its day-to-day operations. The bank uses an Amazon S3 bucket to store sensitive bank records. It has versioning enabled and does not have any encryption. The new solutions architect for the company was asked to implement Server-Side Encryption with Customer-Provided Encryption Keys (SSE-C) for the Amazon S3 bucket to ensure data inside it is secured both at rest and in transit.

Which of the following options should the solutions architect implement to achieve the company requirements? (Select TWO.)

Options :

A : For presigned URLs, specify the algorithm using the x-amz-server-side-encryption-customer-key-MD5 request header

B : For Amazon S3 REST API calls, use the following HTTP Request Headers: x-amz-server-side-encryption-customer-algorithm x-amz-server-side-encryption-customer-key x-amz-server-side-encryption-customer-key-MD5

C : Only use the S3 console to upload and update objects with SSE-C encryption.

D : Use WSS (WebSocket Secure)

E : For presigned URLs, specify the algorithm using the x-amz-server-side-encryption-customer-algorithm request header

Answer: A,B

Confidently Practice Online with Free SAP-C02 Exam Cram

Buying Options: