Solutions Architect Professional Practice Questions & Answers • ExamPrepare

120 questions in this view

Page 1 of 20

Question 1

A company runs several containerized applications on Amazon ECS. The company's development teams use AWS CodeBuild to build container images and push the container images to Amazon ECR. The company needs a solution that scans images for vulnerabilities in operating system packages and programming language dependencies. Images with critical vulnerabilities must not be pushed to Amazon ECR. Images already in Amazon ECR must be automatically re-scanned. The company must be notified if critical vulnerabilities are found.

Which solution will meet these requirements?

Turn on Amazon ECR basic scanning and enable scan on push. Use CodeBuild to build and push the images to Amazon ECR, retrieve scan findings, and fail the build if the findings show critical vulnerabilities. Create an Amazon EventBridge rule that matches ECR scan events with critical severity and invokes an AWS Lambda function. Configure the Lambda function to notify the company by using Amazon SES.
Turn on Amazon ECR enhanced scanning and enable continuous scanning. Use CodeBuild to build and push the images to Amazon ECR, retrieve scan findings, and fail the build if the findings show critical vulnerabilities. Create an Amazon EventBridge rule that matches Amazon Inspector findings with critical severity for ECR images. Configure the EventBridge rule to send notifications by using Amazon SNS.
Run the Amazon Inspector SBOM Generator in CodeBuild. Call the Amazon Inspector Scan API to scan for vulnerabilities. Fail the build if the scan finds critical vulnerabilities. Turn on Amazon ECR enhanced scanning and enable continuous scanning. Push the images to Amazon ECR. Create an Amazon EventBridge rule that matches Amazon Inspector findings with critical severity for ECR images. Configure the EventBridge rule to send notifications by using Amazon SNS.
Run the Amazon Inspector SBOM Generator in CodeBuild. Call the Amazon Inspector Scan API to scan for vulnerabilities. Fail the build if the scan finds critical vulnerabilities. Turn on Amazon ECR basic scanning and enable scan on push. Push the images to Amazon ECR. Create an Amazon EventBridge rule that matches Amazon Inspector findings with critical severity for ECR images. Configure the EventBridge rule to invoke a Lambda function that notifies the company by using Amazon SES.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

A company is planning a large event where a promotional offer will be introduced. The company's website is hosted on AWS and backed by an Amazon RDS for PostgreSQL DB instance. The website explains the promotion and includes a sign-up page that collects user information and preferences. Management expects large and unpredictable volumes of traffic periodically, which will create many database writes. A solutions architect needs to build a solution that does not change the underlying data model and ensures that submissions are not dropped before they are committed to the database.

Which solution will meet these requirements?

Immediately before the event, scale up the existing DB instance to meet the anticipated demand. Then scale down after the event.
Use Amazon SQS to decouple the application and database layers. Configure an AWS Lambda function to write items from the queue into the database.
Migrate to Amazon DynamoDB and manage throughput capacity with automatic scaling.
Use Amazon ElastiCache (Memcached) to increase write capacity to the DB instance.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

A company uses an on-premises Active Directory service to authenticate users. The company wants to use the same authentication service to sign in to the company's AWS accounts. The company uses an organization in AWS Organizations to manage its AWS accounts. The company has already used AWS Site-to-Site VPN to establish connectivity between the on-premises environment and the company's AWS accounts.

The company must establish conditional access to the accounts based on user groups and roles. User identities must be managed in a single location.

Which solution will meet these requirements?

Configure AWS IAM Identity Center to use an Identity Center directory as its source. Use the System for Cross-domain Identity Management (SCIM) v2.0 protocol to enable automatic provisioning for Identity Center identities. Use IAM Identity Center permission sets to grant access to the AWS accounts.
Configure AWS IAM Identity Center to connect to the Active Directory service by using SAML 2.0. Use the System for Cross-domain Identity Management (SCIM) v2.0 protocol to enable automatic provisioning for Identity Center identities. Use Attribute-based access controls (ABACs) to grant access to the AWS accounts.
In one of the company's AWS accounts, configure IAM to use a SAML 2.0 identity provider. Provision IAM users that are mapped to the federated users. Grant access to each IAM user that corresponds to appropriate groups in the Active Directory service. Grant access to the required AWS accounts by using cross-account IAM users.
In one of the company's AWS accounts, configure IAM to use an OpenID Connect (OIDC) identity provider. Provision IAM roles that grant access to the AWS account for the federated users that correspond to appropriate groups in the Active Directory service. Grant access to the required AWS accounts by using cross-account IAM roles.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

A company uses an Amazon Aurora PostgreSQL database to support an application. The application processes real-time data and displays historical trends. During business hours, the application experiences a high request rate. Approximately 95% of the requests are read operations to retrieve the same data repeatedly.

The application's response time degrades significantly during peak hours, and database CPU utilization reaches 85%. The company requires the data to be available within 100 ms. The application must be strongly consistent for queries. Responses must be no more than 15 seconds out of date.

The company needs a caching solution to improve response times and improve application performance.

Which solution will meet these requirements?

Implement an Amazon ElastiCache (Redis OSS) cache with a lazy loading pattern. Configure the application to check the cache before querying the Aurora database. Add write-through operations to update the cache when data changes in the database.
Deploy Amazon DynamoDB Accelerator (DAX) in front of the Aurora database. Configure DAX to store the most frequently accessed data with a TTL of 15 seconds. Modify the application to query DAX instead of Aurora directly.
Add Amazon RDS read replicas to the Aurora database. Implement a client-side caching library that uses local memory caching. Configure the application to distribute read requests across the replicas.
Implement an Amazon ElastiCache (Redis OSS) cache with write-through and TTL. Set the TTL for the data to 15 seconds. Configure the application to update the cache directly and asynchronously update the database.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

A company uses AWS Organizations for a multi-account setup in the AWS Cloud. The company's finance team has a data processing application that uses AWS Lambda and Amazon DynamoDB. The company's marketing team wants to access the data that is stored in the DynamoDB table.

The DynamoDB table contains confidential data. The marketing team can have access to only specific attributes of data in the DynamoDB table. The finance team and the marketing team have separate AWS accounts.

What should a solutions architect do to provide the marketing team with the appropriate access to the DynamoDB table?

Create an SCP to grant the marketing team's AWS account access to the specific attributes of the DynamoDB table. Attach the SCP to the OU of the finance team.
Create an IAM role in the finance team's account by using IAM policy conditions for specific DynamoDB attributes (fine-grained access control). Establish trust with the marketing team's account. In the marketing team's account, create an IAM role that has permissions to assume the IAM role in the finance team's account.
Create a resource-based IAM policy that includes conditions for specific DynamoDB attributes (fine-grained access control). Attach the policy to the DynamoDB table. In the marketing team's account, create an IAM role that has permissions to access the DynamoDB table in the finance team's account.
Create an IAM role in the finance team's account to access the DynamoDB table. Use an IAM permissions boundary to limit the access to the specific attributes. In the marketing team's account, create an IAM role that has permissions to assume the IAM role in the finance team's account.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

A company is building an application that will run on an AWS Lambda function. Hundreds of customers will use the application. The company wants to give each customer a quota of requests for a specific time period. The quotas must match customer usage patterns. Some customers must receive a higher quota for a shorter time period.

Which solution will meet these requirements?

Create an Amazon API Gateway REST API with a proxy integration to invoke the Lambda function. For each customer, configure an API Gateway usage plan that includes an appropriate request quota. Create an API key from the usage plan for each user that the customer needs.
Create an Amazon API Gateway HTTP API with a proxy integration to invoke the Lambda function. For each customer, configure an API Gateway usage plan that includes an appropriate request quota. Configure route-level throttling for each usage plan. Create an API key from the usage plan for each user that the customer needs.
Create a Lambda function alias for each customer. Include a concurrency limit with an appropriate request quota. Create a Lambda function URL for each function alias. Share the Lambda function URL for each alias with the relevant customer.
Create an Application Load Balancer (ALB) in a VPC. Configure the Lambda function as a target for the ALB. Configure an AWS WAF web ACL for the ALB. For each customer, configure a rate-based rule that includes an appropriate request quota.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.