- (Exam Topic 3)
A solutions architect is reviewing an application's resilience before launch. The application runs on an Amazon EC2 instance that is deployed in a private subnet of a VPC.
The EC2 instance is provisioned by an Auto Scaling group that has a minimum capacity of I and a maximum capacity of I. The application stores data on an Amazon RDS for MySQL DB instance. The VPC has subnets configured in three Availability Zones and is configured with a single NAT gateway.
The solutions architect needs to recommend a solution to ensure that the application will operate across multiple Availability Zones.
Which solution will meet this requirement?

1. A. Deploy an additional NAT gateway in the other Availability Zone
2. B. Update the route tables with appropriate route
3. C. Modify the RDS for MySQL DB instance to a Multi-AZ configuratio
4. D. Configure the Auto Scaling group to launch instances across Availability Zone
5. E. Set the minimum capacity and maximum capacity of the Auto Scaling group to 3.
6. F. Replace the NAT gateway with a virtual private gatewa
7. G. Replace the RDS for MySQL DB instance with an Amazon Aurora MySQL DB cluste
8. H. Configure the Auto Scaling group to launch instances across all subnets in the VP
9. I. Set the minimum capacity and maximum capacity of the Auto Scaling group to 3.
10. J. Replace the NAT gateway with a NAT instanc
11. K. Migrate the RDS for MySQL DB instance to an RDS for PostgreSQL DB instanc
12. L. Launch a new EC2 instance in the other Availability Zones.
13. M. Deploy an additional NAT gateway in the other Availability Zone
14. N. Update the route tables with appropriate route
15. O. Modify the RDS for MySQL DB instance to turn on automatic backups and retain the backups for 7 day
16. P. Configure the Auto Scaling group to launch instances across all subnets in the VP
17. Q. Keep the minimum capacity and the maximum capacity of the Auto Scaling group at 1.

Correct Answer: A

- (Exam Topic 3)
A research company is running daily simul-ations in the AWS Cloud to meet high demand. The simu-lations run on several hundred Amazon EC2 instances that are based on Amazon Linux 2. Occasionally, a simu-lation gets stuck and requires a cloud operations engineer to solve the problem by connecting to an EC2 instance through SSH.
Company policy states that no EC2 instance can use the same SSH key and that all connections must be logged in AWS CloudTrail.
How can a solutions architect meet these requirements?

1. A. Launch new EC2 instances, and generate an individual SSH key for each instanc
2. B. Store the SSH key in AWS Secrets Manage
3. C. Create a new IAM policy, and attach it to the engineers' IAM role with an Allow statement for the GetSecretValue actio
4. D. Instruct the engineers to fetch the SSH key from Secrets Manager when they connect through any SSH client.
5. E. Create an AWS Systems Manager document to run commands on EC2 instances to set a new unique SSH ke
6. F. Create a new IAM policy, and attach it to the engineers' IAM role with an Allow statement to run Systems Manager document
7. G. Instruct the engineers to run the document to set an SSH key and to connect through any SSH client.
8. H. Launch new EC2 instances without setting up any SSH key for the instance
9. I. Set up EC2 Instance Connect on each instanc
10. J. Create a new IAM policy, and attach it to the engineers' IAM role with an Allow statement for the SendSSHPublicKey actio
11. K. Instruct the engineers to connect to the instance by using a browser-based SSH client from the EC2 console.
12. L. Set up AWS Secrets Manager to store the EC2 SSH ke
13. M. Create a new AWS Lambda function to create a new SSH key and to call AWS Systems Manager Session Manager to set the SSH key on the EC2instanc
14. N. Configure Secrets Manager to use the Lambda function for automatic rotation once dail
15. O. Instruct the engineers to fetch the SSH key from Secrets Manager when they connect through any SSH client.

Correct Answer: C

- (Exam Topic 1)
A company has an organization in AWS Organizations that has a large number of AWS accounts. One of the AWS accounts is designated as a transit account and has a transit gateway that is shared with all of the other AWS accounts AWS Site-to-Site VPN connections are configured between ail of the company's global offices and the transit account The company has AWS Config enabled on all of its accounts.
The company's networking team needs to centrally manage a list of internal IP address ranges that belong to the global offices Developers Will reference this list to gain access to applications securely.
Which solution meets these requirements with the LEAST amount of operational overhead?

1. A. Create a JSON file that is hosted in Amazon S3 and that lists all of the internal IP address ranges Configure an Amazon Simple Notification Service (Amazon SNS) topic in each of the accounts that can be involved when the JSON file is update
2. B. Subscribe an AWS Lambda function to the SNS topic to update all relevant security group rules with Vie updated IP address ranges.
3. C. Create a new AWS Config managed rule that contains all of the internal IP address ranges Use the rule to check the security groups in each of the accounts to ensure compliance with the list of IP address range
4. D. Configure the rule to automatically remediate any noncompliant security group that is detected.
5. E. In the transit account, create a VPC prefix list with all of the internal IP address range
6. F. Use AWS Resource Access Manager to share the prefix list with all of the other account
7. G. Use the shared prefix list to configure security group rules is the other accounts.
8. H. In the transit account create a security group with all of the internal IP address range
9. I. Configure the security groups in me other accounts to reference the transit account's securitygroup by using a nested security group reference of *<transit-account-id>./sg-1a2b3c4d".

Correct Answer: C
Customer-managed prefix lists — Sets of IP address ranges that you define and manage. You can share your prefix list with other AWS accounts, enabling those accounts to reference the prefix list in their own resources. https://docs.aws.amazon.com/vpc/latest/userguide/managed-prefix-lists.html
a VPC prefix list is created in the transit account with all of the internal IP address ranges, and then shared to all of the other accounts using AWS Resource Access Manager. This allows for central management of the IP address ranges, and eliminates the need for manual updates to security group rules in each account. This solution also allows for compliance checks to be run using AWS Config and for any non-compliant security groups to be automatically remediated.

- (Exam Topic 1)
A company is processing videos in the AWS Cloud by using Amazon EC2 instances in an Auto Scaling group. It takes 30 minutes to process a video. Several EC2 instances scale in and out depending on the number of videos in an Amazon Simple Queue Service (Amazon SQS) queue.
The company has configured the SQS queue with a redrive policy that specifies a target dead-letter queue and a maxReceiveCount of 1. The company has set the visibility timeout for the SQS queue to 1 hour. The company has set up an Amazon CloudWatch alarm to notify the development team when there are messages in the dead-letter queue.
Several times during the day, the development team receives notification that messages are in the dead-letter queue and that videos have not been processed properly. An investigation finds no errors in the application logs.
How can the company solve this problem?

1. A. Turn on termination protection for the EC2 instances.
2. B. Update the visibility timeout for the SOS queue to 3 hours.
3. C. Configure scale-in protection for the instances during processing.
4. D. Update the redrive policy and set maxReceiveCount to 0.

Correct Answer: B
The best solution for this problem is to update the visibility timeout for the SQS queue to 3 hours. This is because when the visibility timeout is set to 1 hour, it means that if the EC2 instance doesn't process the message within an hour, it will be moved to the dead-letter queue. By increasing the visibility timeout to 3 hours, this should give the EC2 instance enough time to process the message before it gets moved to the dead-letter queue. Additionally, configuring scale-in protection for the EC2 instances during processing will help to ensure that the instances are not terminated while the messages are being processed.

- (Exam Topic 3)
A company needs to aggregate Amazon CloudWatch logs from its AWS accounts into one central logging account. The collected logs must remain in the AWS Region of
creation. The central logging account will then process the logs, normalize the logs into standard output format, and stream the output logs to a security tool for more processing.
A solutions architect must design a solution that can handle a large volume of logging data that needs to be ingested. Less logging will occur outside normal business hours than during normal business hours. The logging solution must scale with the anticipated load. The solutions architect has decided to use an AWS Control Tower design to handle the multi-account logging process.
Which combination of steps should the solutions architect take to meet the requirements? (Select THREE.)

1. A. Create a destination Amazon Kinesis data stream in the central logging account.
2. B. Create a destination Amazon Simple Queue Service (Amazon SQS) queue in the central logging account.
3. C. Create an IAM role that grants Amazon CloudWatch Logs the permission to add data to the Amazon Kinesis data strea
4. D. Create a trust polic
5. E. Specify the trust policy in the IAM rol
6. F. In each member account, create a subscription filter for each log group to send data to the Kinesis data stream.
7. G. Create an IAM role that grants Amazon CloudWatch Logs the permission to add data to the Amazon Simple Queue Service (Amazon SQS) queu
8. H. Create a trust polic
9. I. Specify the trust policy in the IAM rol
10. J. In each member account, create a single subscription filter for all log groups to send data to the SQS queue.
11. K. Create an AWS Lambda functio
12. L. Program the Lambda function to normalize the logs in the central logging account and to write the logs to the security tool.
13. M. Create an AWS Lambda functio
14. N. Program the Lambda function to normalize the logs in the member accounts and to write the logs to the security tool.

Correct Answer: ACE