- (Exam Topic 3)
An Amazon EC2 instance is located in a private subnet in a new VPC. This subnet does not have outbound internet access, but the EC2 instance needs the ability to download monthly security updates from an outside vendor.
What should a solutions architect do to meet these requirements?

1. A. Create an internet gateway, and attach it to the VP
2. B. Configure the private subnet route table to use the internet gateway as the default route.
3. C. Create a NAT gateway, and place it in a public subne
4. D. Configure the private subnet route table to use the NAT gateway as the default route.
5. E. Create a NAT instance, and place it in the same subnet where the EC2 instance is locate
6. F. Configure the private subnet route table to use the NAT instance as the default route.
7. G. Create an internet gateway, and attach it to the VP
8. H. Create a NAT instance, and place it in the same subnet where the EC2 instance is locate
9. I. Configure the private subnet route table to use the internet gateway as the default route.

Correct Answer: B
This approach will allow the EC2 instance to access the internet and download the monthly security updates while still being located in a private subnet. By creating a NAT gateway and placing it in a public subnet, it will allow the instances in the private subnet to access the internet through the NAT gateway. And then, configure the private subnet route table to use the NAT gateway as the default route. This will ensure that all outbound traffic is directed through the NAT gateway, allowing the EC2 instance to access the internet while still maintaining the security of the private subnet.

- (Exam Topic 1)
A company performs monthly maintenance on its AWS infrastructure. During these maintenance activities, the company needs to rotate the credentials tor its Amazon ROS tor MySQL databases across multiple AWS Regions
Which solution will meet these requirements with the LEAST operational overhead?

1. A. Store the credentials as secrets in AWS Secrets Manage
2. B. Use multi-Region secret replication for the required Regions Configure Secrets Manager to rotate the secrets on a schedule
3. C. Store the credentials as secrets in AWS Systems Manager by creating a secure string parameter Use multi-Region secret replication for the required Regions Configure Systems Manager to rotate the secrets on a schedule
4. D. Store the credentials in an Amazon S3 bucket that has server-side encryption (SSE) enabled Use Amazon EventBridge (Amazon CloudWatch Events) to invoke an AWS Lambda function to rotate the credentials
5. E. Encrypt the credentials as secrets by using AWS Key Management Service (AWS KMS) multi-Region customer managed keys Store the secrets in an Amazon DynamoDB global table Use an AWS Lambda function to retrieve the secrets from DynamoDB Use the RDS API to rotate the secrets.

Correct Answer: A
https://aws.amazon.com/blogs/security/how-to-replicate-secrets-aws-secrets-manager-multiple-regions/

- (Exam Topic 3)
A company collects data from thousands of remote devices by using a RESTful web services application that runs on an Amazon EC2 instance. The EC2 instance receives the raw data, transforms the raw data, and stores all the data in an Amazon S3 bucket. The number of remote devices will increase into the millions soon. The company needs a highly scalable solution that minimizes operational overhead.
Which combination of steps should a solutions architect take to meet these requirements9 (Select TWO.)

1. A. Use AWS Glue to process the raw data in Amazon S3.
2. B. Use Amazon Route 53 to route traffic to different EC2 instances.
3. C. Add more EC2 instances to accommodate the increasing amount of incoming data.
4. D. Send the raw data to Amazon Simple Queue Service (Amazon SOS). Use EC2 instances to process the data.
5. E. Use Amazon API Gateway to send the raw data to an Amazon Kinesis data strea
6. F. Configure Amazon Kinesis Data Firehose to use the data stream as a source to deliver the data to Amazon S3.

Correct Answer: AE
"RESTful web services" => API Gateway.
"EC2 instance receives the raw data, transforms the raw data, and stores all the data in an Amazon S3 bucket"
=> GLUE with (Extract - Transform - Load)

- (Exam Topic 3)
A company is reviewing a recent migration of a three-tier application to a VPC. The security team discovers that the principle of least privilege is not being applied to Amazon EC2 security group ingress and egress rules between the application tiers.
What should a solutions architect do to correct this issue?

1. A. Create security group rules using the instance ID as the source or destination.
2. B. Create security group rules using the security group ID as the source or destination.
3. C. Create security group rules using the VPC CIDR blocks as the source or destination.
4. D. Create security group rules using the subnet CIDR blocks as the source or destination.

Correct Answer: B
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html

- (Exam Topic 3)
A company’s compliance team needs to move its file shares to AWS. The shares run on a Windows Server SMB file share. A self-managed on-premises Active Directory controls access to the files and folders.
The company wants to use Amazon FSx for Windows File Server as part of the solution. The company must ensure that the on-premises Active Directory groups restrict access to the FSx for Windows File Server SMB compliance shares, folders, and files after the move to AWS. The company has created an FSx for Windows File Server file system.
Which solution will meet these requirements?

1. A. Create an Active Directory Connector to connect to the Active Director
2. B. Map the Active Directory groups to IAM groups to restrict access.
3. C. Assign a tag with a Restrict tag key and a Compliance tag valu
4. D. Map the Active Directory groups to IAM groups to restrict access.
5. E. Create an IAM service-linked role that is linked directly to FSx for Windows File Server to restrict access.
6. F. Join the file system to the Active Directory to restrict access.

Correct Answer: D
Joining the FSx for Windows File Server file system to the on-premises Active Directory will allow the company to use the existing Active Directory groups to restrict access to the file shares, folders, and files after the move to AWS. This option allows the company to continue using their existing access controls and management structure, making the transition to AWS more seamless.