A social media application is experiencing high volumes of new user requests after a recent marketing campaign. The application is served by an Amazon RDS for MySQL instance. A solutions architect examines the database performance and notices high CPU usage and many "too many connections" errors that lead to failed requests on the database. The solutions architect needs to address the failed requests. Which solution will meet this requirement?
A. Deploy an Amazon DynamoDB Accelerator (DAX) cluster. Configure the application to use the DAX cluster.
B. Deploy an RDS Proxy. Configure the application to use the RDS Proxy.
C. Migrate the database to an Amazon RDS for PostgreSQL instance.
D. Deploy an Amazon ElastiCache (Redis OSS) cluster. Configure the application to use the ElastiCache cluster.
A development team maintains a web application by using a single AWS CloudFormation
template. The template defines web servers and an Amazon RDS database. The team
uses the Cloud Formation template to deploy the Cloud Formation stack to different
environments.
During a recent application deployment, a developer caused the primary development
database to be dropped and recreated. The result of this incident was a loss of data. The
team needs to avoid accidental database deletion in the future.
Which solutions will meet these requirements? (Choose two.)
A. Add a CloudFormation Deletion Policy attribute with the Retain value to the database resource.
B. Update the CloudFormation stack policy to prevent updates to the database.
C. Modify the database to use a Multi-AZ deployment.
D. Create a CloudFormation stack set for the web application and database deployments.
E. Add a Cloud Formation DeletionPolicy attribute with the Retain value to the stack.
Explanation:
AWS CloudFormation is a service that enables developers to model and provision AWS
resources using templates. The developer can add a CloudFormation Deletion Policy
attribute with the Retain value to the database resource. This will prevent the database
from being deleted when the stack is deleted or updated. The developer can also update
the CloudFormation stack policy to prevent updates to the database. This will prevent
accidental changes to the database configuration or properties.
A company has an Amazon S3 bucket that contains sensitive data. The data must be
encrypted in transit and at rest. The company encrypts the data in the S3 bucket by using
an AWS Key Management Service (AWS KMS) key. A developer needs to grant several
other AWS accounts the permission to use the S3 GetObject operation to retrieve the data
from the S3 bucket.
How can the developer enforce that all requests to retrieve the data provide encryption in
transit?
A. Define a resource-based policy on the S3 bucket to deny access when a request meets the condition “aws:SecureTransport”: “false”.
B. Define a resource-based policy on the S3 bucket to allow access when a request meets the condition “aws:SecureTransport”: “false”.
C. Define a role-based policy on the other accounts' roles to deny access when a request meets the condition of “aws:SecureTransport”: “false”.
D. Define a resource-based policy on the KMS key to deny access when a request meets the condition of “aws:SecureTransport”: “false”.
Explanation: Amazon S3 supports resource-based policies, which are JSON documents that specify the permissions for accessing S3 resources. A resource-based policy can be used to enforce encryption in transit by denying access to requests that do not use HTTPS. The condition key aws:SecureTransport can be used to check if the request was sent using SSL. If the value of this key is false, the request is denied; otherwise, the request is allowed.
A company maintains a REST service using Amazon API Gateway and the API Gateway native API key validation. The company recently launched a new registration page, which allows users to sign up for the service. The registration page creates a new API key using CreateApiKey and sends the new key to the user. When the user attempts to call the API using this key. the user receives a 403 Forbidden error. Existing users are unaffected and can still call the API. What code updates will grant these new users access to the API?
A. The createDeploymer.t method must be called so the API can be redeployed to include the newly created API key.
B. The updateAuthorizer method must be called to update the API's authorizer to include the newly created API key
C. The importApiKeys method must be called to import all newly created API keys into the current stage of the API.
D. The createUsagePlanKey method must be called to associate the newly created API key with the correct usage plan.
A software company is launching a multimedia application. The application will allow guest users to access sample content before the users decide if they want to create an account to gain full access. The company wants to implement an authentication process that can identify users who have already created an account. The company also needs to keep track of the number of guest users who eventually create an account. Which combination of steps will meet these requirements? {Select TWO.)
A. Create an Amazon Cognito user pool. Configure the user pool to allow unauthenticated users. Exchange user tokens for temporary credentials that allow authenticated users to assume a role.
B. Create an Amazon Cognito identity pool. Configure the identity pool to allow unauthenticated users. Exchange unique identity for temporary credentials that allow all users to assume a role.
C. Create an Amazon CloudFront distribution. Configure the distribution to allow unauthenticated users. Exchange user tokens for temporary credentials that allow all users to assume a role.
D. Create a role for authenticated users that allows access to all content. Create a role for unauthenticated users that allows access to only the sample content.
E. Allow all users to access the sample content by default. Create a role for authenticated users that allows access to the other content.
A developer is building a microservice that uses AWS Lambda to process messages from
an Amazon Simple Queue Service (Amazon SQS) standard queue. The Lambda function
calls external APIs to enrich the SOS message data before loading the data into an
Amazon Redshift data warehouse. The SOS queue must handle a maximum of 1.000
messages per second.
During initial testing, the Lambda function repeatedly inserted duplicate data into the
Amazon Redshift table. The duplicate data led to a problem with data analysis. All duplicate
messages were submitted to the queue within 1 minute of each other.
How should the developer resolve this issue?
A. Create an SOS FIFO queue. Enable message deduplication on the SOS FIFO queue.
B. Reduce the maximum Lambda concurrency that the SOS queue can invoke.
C. Use Lambda's temporary storage to keep track of processed message identifiers.
D. Configure a message group ID for every sent message. Enable message deduplication on the SQS standard queue.
When a developer tries to run an AWS Code Build project, it raises an error because the length of all environment variables exceeds the limit for the combined maximum of characters. What is the recommended solution?
A. Add the export LC-_ALL" on _ US, tuft" command to the pre _ build section to ensure POSIX Localization.
B. Use Amazon Cognate to store key-value pairs for large numbers of environment variables
C. Update the settings for the build project to use an Amazon S3 bucket for large numbers of environment variables
D. Use AWS Systems Manager Parameter Store to store large numbers ot environment variables
Explanation:
This solution allows the developer to overcome the limit for the combined maximum of
characters for environment variables in AWS CodeBuild. AWS Systems Manager
Parameter Store provides secure, hierarchical storage for configuration data management
and secrets management. The developer can store large numbers of environment
variables as parameters in Parameter Store and reference them in the buildspec file using
parameter references. Adding export LC_ALL=“en_US.utf8” command to the pre_build
section will not affect the environment variables limit. Using Amazon Cognito or an Amazon
S3 bucket to store key-value pairs for environment variables will require additional
configuration and integration.
A company runs a payment application on Amazon EC2 instances behind an Application Load Balance The EC2 instances run in an Auto Scaling group across multiple Availability Zones The application needs to retrieve application secrets during the application startup and export the secrets as environment variables These secrets must be encrypted at rest and need to be rotated every month. Which solution will meet these requirements with the LEAST development effort?
A. Save the secrets in a text file and store the text file in Amazon S3 Provision a customer managed key Use the key for secret encryption in Amazon S3 Read the contents of the text file and read the export as environment variables Configure S3 Object Lambda to rotate the text file every month
B. Save the secrets as strings in AWS Systems Manager Parameter Store and use the default AWS Key Management Service (AWS KMS) key Configure an Amazon EC2 user data script to retrieve the secrets during the startup and export as environment variables Configure an AWS Lambda function to rotate the secrets in Parameter Store every month.
C. Save the secrets as base64 encoded environment variables in the application properties. Retrieve the secrets during the application startup. Reference the secrets in the application code. Write a script to rotate the secrets saved as environment variables.
D. Store the secrets in AWS Secrets Manager Provision a new customer master key Use the key to encrypt the secrets Enable automatic rotation Configure an Amazon EC2 user data script to programmatically retrieve the secrets during the startup and export as environment variables
Explanation:
AWS Secrets Manager: Built for managing secrets, providing encryption,
automatic rotation, and access control.
Customer Master Key (CMK): Provides an extra layer of control over encryption
through AWS KMS.
Automatic Rotation: Enhances security by regularly changing the secret.
User Data Script: Allows secrets retrieval at instance startup and sets them as
environment variables for seamless use within the application.
An ecommerce startup is preparing for an annual sales event. As the traffic to the company's application increases, the development team wants to be notified when the Amazon EC2 instance's CPU utilization exceeds 80%. Which solution will meet this requirement?
A. Create a custom Amazon CloudWatch alarm that sends a notification to an Amazon SNS topic when the CPU utilization exceeds 80%.
B. Create a custom AWS CloudTrail alarm that sends a notification to an Amazon SNS topic when the CPU utilization exceeds 80%.
C. Create a cron job on the EC2 instance that invokes the --describe-instance-information command on the host instance every 15 minutes and sends the results to an Amazon SNS topic.
D. Create an AWS Lambda function that queries the AWS CloudTrail logs for the CPUUtilization metric every 15 minutes and sends a notification to an Amazon SNS topic when the CPU utilization exceeds 80%.
Explanation: Step-by-Step Breakdown:
Requirement Summary:
Get notified when EC2CPU Utilization > 80%
Option A: CloudWatch Alarm with SNS
Correct and standard AWS practice
CloudWatch automatically collectsEC2 metrics, including CPUUtilization.
You can set aCloudWatch Alarmwith a threshold (80% in this case).
Then,trigger an SNS notificationto email, SMS, Lambda, etc.
Option B: AWS CloudTrail alarm
Incorrect: CloudTrail logsAPI activity, not performance metrics.
It doesn’t track metrics like CPU utilization.
Option C: Cron job on EC2 running --describe-instance-information
Incorrect: This doesn’t give CPU usage.
Also inefficient, and polling is bad practice when CloudWatch already monitors this
natively.
Option D: Lambda function querying CloudTrail for CPU usage
Incorrect and conceptually flawed.
CloudTrail does not store performance metrics; CloudWatch does.
A developer created a Node.js-based AWS Lambda function by using a container image of an AWS OS-only base image. There is a new security patch for Node.js that must be patched to the new Lambda function. Which solution will meet this requirement?
A. Set the runtime update mode of the Lambda function to Auto.
B. Patch the runtime version by redeploying the same version of the Lambda function.
C. Rebuild the Lambda container code with the latest version of the AWS OS base image. Publish a new version of the Lambda function.
D. Rebuild the Lambda container code with the latest Node.js patch version. Publish a new version of the Lambda function.
Explanation:
Why Option D is Correct: When using a container-based AWS Lambda function,
you are responsible for updating the base image for runtime patches. Rebuilding
the container with the latest Node.js patch version ensures the function is updated
with the required security patches. Publishing a new version of the Lambda
function makes the updated image available for use.
A company wants to use AWS AppConfig to gradually deploy a new feature to 15% of users to test the feature before a full deployment. Which solution will meet this requirement with the LEAST operational overhead?
A. Set up a custom script within the application to randomly select 15% of users. Assign a flag for the new feature to the selected users.
B. Create separate AWS AppConfig feature flags for both groups of users. Configure the flags to target 15% of users.
C. Create an AWS AppConfig feature flag. Define a variant for the new feature, and create a rule to target 15% of users.
D. Use AWS AppConfig to create a feature flag without variants. Implement a custom traffic splitting mechanism in the application code.
Explanation:
Comprehensive Detailed and Lengthy Step-by-Step Explanation with All AWS Developer References:
1. Understanding the Use Case:
The company wants to gradually release a new feature to 15% of users to perform testing.
AWS AppConfig is designed to manage and deploy configurations, including feature flags,
allowing controlled rollouts.
2. Key AWS AppConfig Features:
Feature Flags:Enable or disable features dynamically without redeploying code.
Variants:Define different configurations for subsets of users.
Targeting Rules:Specify rules for which users receive a particular variant.
3. Explanation of the Options:
Option A:"Set up a custom script within the application to randomly select 15% of
users. Assign a flag for the new feature to the selected users."While possible, this
approach requires significant operational effort to manage user selection and
ensure randomness. It does not leverage AWS AppConfig's built-in capabilities,
which increases overhead.
Option B:"Create separate AWS AppConfig feature flags for both groups of users.
Configure the flags to target 15% of users."Creating multiple feature flags for
different user groups complicates configuration management and does not
optimize the use of AWS AppConfig.
Option C:"Create an AWS AppConfig feature flag. Define a variant for the new
feature, and create a rule to target 15% of users."This is the correct solution. Using
AWS AppConfig feature flags with variants and targeting rules is the most efficient
approach. It minimizes operational overhead by leveraging AWS AppConfig's builtin
targeting and rollout capabilities.
Option D:"Use AWS AppConfig to create a feature flag without variants. Implement
a custom traffic splitting mechanism in the application code."This approach
requires custom implementation within the application code, increasing complexity
and operational effort.
4. Implementation Steps for Option C:
Set Up AWS AppConfig:
Create a Feature Flag:
Define a Targeting Rule:
Deploy the Configuration:
A developer is creating an AWS Lambda function that needs credentials to connect to an
Amazon RDS for MySQL database. An Amazon S3 bucket currently stores the credentials.
The developer needs to improve the existing solution by implementing credential rotation
and secure storage. The developer also needs to provide integration with the Lambda
function.
Which solution should the developer use to store and retrieve the credentials with the
LEAST management overhead?
A. Store the credentials in AWS Systems Manager Parameter Store. Select the database that the parameter will access. Use the default AWS Key Management Service (AWS KMS) key to encrypt the parameter. Enable automatic rotation for the parameter. Use the parameter from Parameter Store on the Lambda function to connect to the database.
B. Encrypt the credentials with the default AWS Key Management Service (AWS KMS) key. Store the credentials as environment variables for the Lambda function. Create a second Lambda function to generate new credentials and to rotate the credentials by updating the environment variables of the first Lambda function. Invoke the second Lambda function by using an Amazon EventBridge rule that runs on a schedule. Update the database to use the new credentials. On the first Lambda function, retrieve the credentials from the environment variables. Decrypt the credentials by using AWS KMS, Connect to the database.
C. Store the credentials in AWS Secrets Manager. Set the secret type to Credentials for Amazon RDS database. Select the database that the secret will access. Use the default AWS Key Management Service (AWS KMS) key to encrypt the secret. Enable automatic rotation for the secret. Use the secret from Secrets Manager on the Lambda function to connect to the database.
D. Encrypt the credentials by using AWS Key Management Service (AWS KMS). Store the credentials in an Amazon DynamoDB table. Create a second Lambda function to rotate the credentials. Invoke the second Lambda function by using an Amazon EventBridge rule that runs on a schedule. Update the DynamoDB table. Update the database to use the generated credentials. Retrieve the credentials from DynamoDB with the first Lambda function. Connect to the database.
Explanation: AWS Secrets Manager is a service that helps you protect secrets needed to access your applications, services, and IT resources. Secrets Manager enables you to store, retrieve, and rotate secrets such as database credentials, API keys, and passwords. Secrets Manager supports a secret type for RDS databases, which allows you to select an existing RDS database instance and generate credentials for it. Secrets Manager encrypts the secret using AWS Key Management Service (AWS KMS) keys and enables automatic rotation of the secret at a specified interval. A Lambda function can use the AWS SDK or CLI to retrieve the secret from Secrets Manager and use it to connect to the database.
| Page 7 out of 31 Pages |
| Previous |