AWS SAA - W5

You are working as an architect in your organization. You have peered VPC A as requester and VPC B as accepted, and both VPCs can communicate with each other. Now you want resources in both the VPCs to reach out to the internet. But anyone on the internet should not be able to reach resources within both the VPCs. Which of the below will achieve the desired outcome?

• Create a NAT Gateway in VPC A and route VPC B's outbound to VPC A's NAT Gateway

• Create an Internet Gateway in VPC A and route VPC B's outbound to VPC A's Internet Gateway

• Create NAT Gateways in both VPCs and configure routes for each VPC to use its own NAT Gateway

• Simply create a NAT Instance in VPC A. Nothing else is required.

A company runs a number of core enterprise applications in an on-premises data center. The data center is connected to an Amazon VPC using AWS Direct Connect. The company will be creating additional AWS accounts and these accounts will also need to be quickly, and cost-effectively connected to the on-premises data center in order to access the core applications. What deployment changes should a Solutions Architect implement to meet these requirements with the LEAST operational overhead?

• Create a Direct Connect connection in each new account. Route the network traffic to the on-premises servers.

• Configure AWS Transit Gateway between the accounts. Assign Direct Connect to the transit gateway and route network traffic to the on-premises servers.

• Configure VPC endpoints in the Direct Connect VPC for all required services. Route the network traffic to the on-premises servers

• Create a VPN connection between each new account and the Direct Connect VPC. Route the network traffic to the on-premises servers.

Answer explanation

CORRECT: "Configure AWS Transit Gateway between the accounts. Assign Direct Connect to the transit gateway and route network traffic to the on-premises servers" is the correct answer.

INCORRECT: "Create a VPN connection between each new account and the Direct Connect VPC. Route the network traffic to the on-premises servers" is incorrect. You cannot connect VPCs using AWS managed VPNs and would need to configure a software VPN and then complex routing configurations. This is not the best solution.

INCORRECT: "Create a Direct Connect connection in each new account. Route the network traffic to the on-premises servers" is incorrect. This is an expensive solution as you would need to have multiple Direct Connect links.

INCORRECT: "Configure VPC endpoints in the Direct Connect VPC for all required services. Route the network traffic to the on-premises servers" is incorrect. You cannot create VPC endpoints for all services and this would be a complex solution for those you can.

A company runs an application in an Amazon VPC that requires access to an Amazon Elastic Container Service (Amazon ECS) cluster that hosts an application in another VPC. The company's security team requires that all traffic must not traverse the internet. Which solution meets this requirement?

• Configure a gateway endpoint for Amazon ECS. Update the route table to include an entry pointing to the ECS cluster.

• Configure an Amazon Route 53 private hosted zone for each VPC. Use private records to resolve internal IP addresses in each VPC.

• Create a Network Load Balancer and AWS PrivateLink endpoint for Amazon ECS in the VPC that hosts the ECS cluster.

• Create a Network Load Balancer in one VPC and an AWS PrivateLink endpoint for Amazon ECS in another VPC.

Answer explanation

CORRECT: "Create a Network Load Balancer in one VPC and an AWS PrivateLink endpoint for Amazon ECS in another VPC" is the correct answer.

INCORRECT: "Create a Network Load Balancer and AWS PrivateLink endpoint for Amazon ECS in the VPC that hosts the ECS cluster" is incorrect. The endpoint should be in the consumer VPC, not the service provider VPC (see the diagram above).

INCORRECT: "Configure a gateway endpoint for Amazon ECS. Update the route table to include an entry pointing to the ECS cluster" is incorrect. You cannot use a gateway endpoint to connect to a private service. Gateway endpoints are only for S3 and DynamoDB.

INCORRECT: "Configure an Amazon Route 53 private hosted zone for each VPC. Use private records to resolve internal IP addresses in each VPC" is incorrect. This does not provide a mechanism for resolving each other’s addresses and there’s no method of internal communication using private IPs such as VPC peering.

A multi-tier application runs with eight front-end web servers in an Amazon EC2 Auto Scaling group in a single Availability Zone behind an Application Load Balancer. A solutions architect needs to modify the infrastructure to be highly available without modifying the application. Which architecture should the solutions architect choose that provides high availability?

• Modify the Auto Scaling group to use four instances across each of a two Availability Zones

• Create an Auto Scaling group that uses four instances across each of two subnets

• Create an Auto Scaling group that uses four instances across each of two Regions

• Create an Auto Scaling template that can be used to quickly create more instances in another Region

Answer explanation

CORRECT: "Modify the Auto Scaling group to use four instances across each of two Availability Zones" is the correct answer.

INCORRECT: "Create an Auto Scaling group that uses four instances across each of two Regions" is incorrect as EC2 Auto Scaling does not support multiple regions.

INCORRECT: "Create an Auto Scaling template that can be used to quickly create more instances in another Region" is incorrect as EC2 Auto Scaling does not support multiple regions.

INCORRECT: "Create an Auto Scaling group that uses four instances across each of two subnets" is incorrect as the subnets could be in the same AZ.

A shared services VPC is being setup for use by several AWS accounts. An application needs to be securely shared from the shared services VPC. The solution should not allow consumers to connect to other instances in the VPC. How can this be setup with the least administrative effort? (choose 2)

• Use AWS ClassicLink to expose the application as an endpoint service

• Setup VPC peering between each AWS VPC

• Create a Network Load Balancer (NLB)

• Use AWS PrivateLink to expose the application as an endpoint service

• Configure security groups to restrict access

Answer explanation

CORRECT: "Create a Network Load Balancer (NLB)" is a correct answer.

CORRECT: "Use AWS PrivateLink to expose the application as an endpoint service" is also a correct answer.

INCORRECT: "Use AWS ClassicLink to expose the application as an endpoint service" is incorrect. ClassicLink allows you to link EC2-Classic instances to a VPC in your account, within the same region. This solution does not include EC2-Classic which is now deprecated (replaced by VPC).

INCORRECT: "Setup VPC peering between each AWS VPC" is incorrect. VPC peering could be used along with security groups to restrict access to the application and other instances in the VPC. However, this would be administratively difficult as you would need to ensure that you maintain the security groups as resources and addresses change.

INCORRECT: "Configure security groups to restrict access" is incorrect. This could be used in conjunction with VPC peering but better method is to use PrivateLink for this use case.

A web application that allows users to upload and share documents is running on a single Amazon EC2 instance with an Amazon EBS volume. To increase availability the architecture has been updated to use an Auto Scaling group of several instances across Availability Zones behind an Application Load Balancer. After the change users can only see a subset of the documents. What is the BEST method for a solutions architect to modify the solution so users can see all documents?

• Run a script to synchronize the data between Amazon EBS volumes

• Copy the data from all EBS volumes to Amazon EFS. Modify the application to save new documents to Amazon EFS

• Configure the Application Load Balancer to send the request to all servers. Return each document from the correct server

• Use Sticky Sessions with the ALB to ensure users are directed to the same EC2 instance in a session

Answer explanation

CORRECT: "Copy the data from all EBS volumes to Amazon EFS. Modify the application to save new documents to Amazon EFS" is the correct answer.

INCORRECT: "Run a script to synchronize the data between Amazon EBS volumes" is incorrect. This is a complex and messy approach. A better solution is to use a shared storage layer.

INCORRECT: "Use Sticky Sessions with the ALB to ensure users are directed to the same EC2 instance in a session" is incorrect as this will just “stick” a user to the same instance. They won’t see documents uploaded to other instances / EBS volumes.

INCORRECT: "Configure the Application Load Balancer to send the request to all servers. Return each document from the correct server" is incorrect as there is no mechanism here for selecting a specific document. The requirement also requests that all documents are visible.

A company have 500 TB of data in an on-premises file share that needs to be moved to Amazon S3 Glacier. The migration must not saturate the company's low-bandwidth internet connection and the migration must be completed within a few weeks. What is the MOST cost-effective solution?

• Use AWS Global Accelerator to accelerate upload and optimize usage of the available bandwidth

• Order 7 AWS Snowball appliances and select an Amazon S3 bucket as the destination. Create a lifecycle policy to transition the S3 objects to Amazon S3 Glacier

• Order 7 AWS Snowball appliances and select an S3 Glacier vault as the destination. Create a bucket policy to enforce a VPC endpoint

• Create an AWS Direct Connect connection and migrate the data straight into Amazon Glacier

Answer explanation

CORRECT: "Order 7 AWS Snowball appliances and select an Amazon S3 bucket as the destination. Create a lifecycle policy to transition the S3 objects to Amazon S3 Glacier" is the correct answer.

INCORRECT: "Order 7 AWS Snowball appliances and select an S3 Glacier vault as the destination. Create a bucket policy to enforce a VPC endpoint" is incorrect as you cannot set a Glacier vault as the destination, it must be an S3 bucket. You also can’t enforce a VPC endpoint using a bucket policy.

INCORRECT: "Create an AWS Direct Connect connection and migrate the data straight into Amazon Glacier" is incorrect as this is not the most cost-effective option and takes time to setup.

INCORRECT: "Use AWS Global Accelerator to accelerate upload and optimize usage of the available bandwidth" is incorrect as this service is not used for accelerating or optimizing the upload of data from on-premises networks.

A High Performance Computing (HPC) application will be migrated to AWS. The application requires low network latency and high throughput between nodes and will be deployed in a single AZ. How should the application be deployed for best inter-node performance?

• Behind a Network Load Balancer (NLB)

• In a partition placement group

• In a spread placement group

• In a cluster placement group

Answer explanation

CORRECT: "In a cluster placement group" is the correct answer.

INCORRECT: "In a partition placement group" is incorrect. A partition placement group is used for grouping instances into logical segments. It provides control and visibility into instance placement but is not the best option for performance.

INCORRECT: "In a spread placement group" is incorrect. A spread placement group is used to spread instances across underlying hardware. It is not the best option for performance.

INCORRECT: "Behind a Network Load Balancer (NLB)" is incorrect. A network load balancer is used for distributing incoming connections, this does assist with inter-node performance.

A company requires a solution for replicating data to AWS for disaster recovery. Currently, the company uses scripts to copy data from various sources to a Microsoft Windows file server in the on-premises data center. The company also requires that a small amount of recent files are accessible to administrators with low latency. What should a Solutions Architect recommend to meet these requirements?

• Update the script to copy data to an Amazon EBS volume instead of the onpremises file server.

• Update the script to copy data to an Amazon EFS volume instead of the onpremises file server.

• Update the script to copy data to an AWS Storage Gateway for File Gateway virtual appliance instead of the on-premises file server.

• Update the script to copy data to an Amazon S3 Glacier archive instead of the on-premises file server.

Answer explanation

CORRECT: "Update the script to copy data to an AWS Storage Gateway for File Gateway virtual appliance instead of the on-premises file server" is the correct answer.

INCORRECT: "Update the script to copy data to an Amazon EBS volume instead of the on-premises file server" is incorrect. This would also need an attached EC2 instance running Windows to be able to mount using the same protocols and would not offer any local low-latency access.

INCORRECT: "Update the script to copy data to an Amazon EFS volume instead of the on-premises file server" is incorrect. This solution would not provide a local cache.

INCORRECT: "Update the script to copy data to an Amazon S3 Glacier archive instead of the on-premises file server" is incorrect. This would not provide any immediate access with low-latency.