AWS Architect Test 2

Your company currently has a set of EC2 Instances hosted in AWS. The states of these instances need to be monitored and each state needs to be changed when a metric breaches a threshold value. Which step could be helpful to fulfill this requirement? (SELECT TWO)

• Use CloudWatch logs to store the state change of the instances.

• Create an Amazon CloudWatch alarm that monitors an Amazon EC2 instance

• Use SQS to trigger a record to be added to a DynamoDB table.

• Use AWS Lambda to store a change record in a DynamoDB table.

You own a MySQL RDS instance in AWS Region us-east-1. The instance has a Multi-AZ instance in another availability zone for high availability. As business grows, there are more and more clients coming from Europe (eu-west-2) and most of the database workload is read-only. What is the proper way to reduce the load on the source RDS instance?

• Create a snapshot of the instance and launch a new instance in eu-west-2.

• Promote the Multi-AZ instance to be a Read Replica and move the instance to eu-west-2 region.

• Configure a read-only Multi-AZ instance in eu-west-2 as Read Replicas cannot span across regions.

• Create a Read Replica in the AWS Region eu-west-2.

Third-party sign-in (Federation) has been implemented in your web application to allow users who need access to AWS resources. Users have been successfully logging in using Google, Facebook, and other third-party credentials. Suddenly, their access to some AWS resources has been restricted. What is the most likely cause of the restricted use of AWS resources?

• IAM policies for resources were changed, thereby restricting access to AWS resources

• Federation protocols are used to authorize services and need to be updated

• AWS changed the services allowed to be accessed via federated login

• The identity providers no longer allow access to AWS services

A security audit discovers that one of your RDS MySQL instances is not encrypted. The instance has a Read Replica in the same AWS region which is also not encrypted. You need to fix this issue as soon as possible. What is the proper way to add encryption to the instance and its replica?

• Copy a DB snapshot and encrypt the snapshot. Restore a new DB instance from the encrypted snapshot and add a Read Replica.

• Encrypt the DB instance. Launch a new Read Replica and the replica is encrypted automatically.

• Create a DB snapshot and encrypt the snapshot. Launch a new instance and its Read Replica from the snapshot.

• Promote the Read Replica to be a standalone instance and encrypt it. Add a new Read Replica to the standalone instance.

Your recent security review revealed a large spike in attempted logins to your AWS account. With respect to sensitive data stored in encryption enabled S3, the data has not been encrypted and is susceptible to fraud if it was to be stolen. You’ve recommended AWS Key Management Service as a solution. Which of the following is true regarding the operation of KMS?

• Only KMS generated keys can be used to encrypt or decrypt data

• Data es encrypted at rest

• KMS allows all users and roles to use the keys by default

• Data is encrypted in transit

Your company has a set of EC2 Instances hosted in AWS. It is mandatory to prepare for disasters and come up with the necessary disaster recovery procedures. What would be helpful in mitigating the effects of a disaster for the EC2 Instances?

• Place an ELB in front of the EC2 Instances

• Use auto scaling to ensure that the minimun number of instances are always running

• Use cloudfront in front of the EC2 Instances

• Use AMIs to recreate the EC2 intances in another region

A company has a set of Hyper-V machines and VMware virtual machines. They are now planning to migrate these resources to the AWS Cloud. What should they use to move these resources to the AWS Cloud?

• DB Migration Utility

• AWS Server Migration Service

• Use AWS Migration Tools

• Use AWS Config Tools

A Singapore based large Architect firm is using Amazon S3 bucket to save all architecture drawings. This firm works globally multiple accounts are created within the Singapore region as well in other regions to access AWS resources. Users in all these accounts access the Amazon S3 bucket for architectural drawings. AWS Organisation is created for accounts in the Singapore region. Central IT Teams are managing access to S3 buckets using Service Control Policies with AWS Organisations.

• SCP will block access to Amazon S3 bucket to all accounts within the Singapore region including root users of each account within AWS Organisation as well as access to users outside this region who have access to S3 bucket.

• SCP will block access to Amazon S3 bucket to all accounts within the Singapore region including root users of each account within AWS Organisation not to users outside this region who have access to S3 bucket.

• SCP will block access to Amazon S3 bucket to all accounts within the Singapore region excluding root users of each account within AWS Organisation as well as access to users outside this region who have access to S3 bucket.

• SCP will block access to Amazon S3 bucket to all accounts within the Singapore region excluding root users of each account within AWS Organisation not to users outside this region who have access to S3 bucket.

A global content management company is using Amazon Aurora as a database for scaling millions of documents with high throughput. The Development Team has created a new version of the database which needs to be shared with TEST and PRODUCTION accounts within the company which will run their own OLAP queries. The company is using AWS Organisations to manage policies have consolidated billing across all AWS accounts. Which of the following can be done to share DB clusters with the TEST account?

• Enable sharing for Master account of AWS organizations grant access to TEST account sharing DB cluster from its own account as well as DB shared by Production account.

• Enable sharing for member accounts of AWS organizations grant access to the TEST account sharing DB cluster from its own account.

• Enable sharing for Master member account of AWS organizations grant access TEST account sharing DB cluster from its own account as well as DB shared by Production account.

• Enable sharing for Master account of AWS organizations grant access to TEST account sharing DB cluster from its own account.

A Financial firm is planning to build a highly resilient application with primary database servers at on-premise data centers while DB snapshots at Amazon S3 bucket. IT Team is looking for a cost-effective secure way of the initial transfer of large customer financial databases between on-premise servers to Amazon S3 bucket with no impact on client usage of these applications. Also, post this data transfer, the on-premise application will be fetching data from the database in Amazon S3 in case of a primary database fails.

• Use Amazon S3 Transfer Acceleration for transferring data between the on-premise Amazon S3 bucket while using AWS Data Sync for accessing these S3 bucket data from the on-premise application.

• Use AWS Data Sync for transferring data between the on-premise Amazon S3 bucket while using AWS Storage Gateway for accessing these S3 bucket data from the on-premise application.

• Use AWS Snowball Edge for transferring data between the on-premise Amazon S3 bucket while using AWS Storage Gateway for accessing these S3 bucket data from the on-premise application.

• Use AWS Transfer for transferring data between the on-premise Amazon S3 bucket while using AWS Data Sync for accessing these S3 bucket data from the on-premise application.