- (Exam Topic 3)
A company's application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. On the first day of every month at midnight. The application becomes much slower when the month-end financial calcualtion bath runs. This causes the CPU utilization of the EC2 instaces to immediately peak to 100%, which disrupts the application.
What should a solution architect recommend to ensure the application is able to handle the workload and avoid downtime?

1. A. Configure an Amazon CloudFront distribution in from of the ALB.
2. B. Configure an EC2 Auto Scaling simple scaling policy based on CPU utilization.
3. C. Configure an EC2 Auto Scaling scheduled scaling policy based on the monthly schedule.
4. D. Configure Amazon ElasticCache to remove some of the workload from tha EC2 instances.

Correct Answer: A

- (Exam Topic 1)
A company is preparing to launch a public-facing web application in the AWS Cloud. The architecture consists of Amazon EC2 instances within a VPC behind an Elastic Load Balancer (ELB). A third-party service is used for the DNS. The company's solutions architect must recommend a solution to detect and protect against large-scale DDoS attacks.
Which solution meets these requirements?

1. A. Enable Amazon GuardDuty on the account.
2. B. Enable Amazon Inspector on the EC2 instances.
3. C. Enable AWS Shield and assign Amazon Route 53 to it.
4. D. Enable AWS Shield Advanced and assign the ELB to it.

Correct Answer: D
https://aws.amazon.com/shield/faqs/

- (Exam Topic 2)
A company stores its application logs in an Amazon CloudWatch Logs log group. A new policy requires the company to store all application logs in Amazon OpenSearch Service (Amazon Elasticsearch Service) in near-real time.
Which solution will meet this requirement with the LEAST operational overhead?

1. A. Configure a CloudWatch Logs subscription to stream the logs to Amazon OpenSearch Service (Amazon Elasticsearch Service).
2. B. Create an AWS Lambda functio
3. C. Use the log group to invoke the function to write the logs to Amazon OpenSearch Service (Amazon Elasticsearch Service).
4. D. Create an Amazon Kinesis Data Firehose delivery strea
5. E. Configure the log group as the delivery stream's sourc
6. F. Configure Amazon OpenSearch Service (Amazon Elasticsearch Service) as the delivery stream's destination.
7. G. Install and configure Amazon Kinesis Agent on each application server to deliver the logs to Amazon Kinesis Data Stream
8. H. Configure Kinesis Data Streams to deliver the logs to Amazon OpenSearch Service (Amazon Elasticsearch Service)

Correct Answer: B
https://computingforgeeks.com/stream-logs-in-aws-from-cloudwatch-to-elasticsearch/

- (Exam Topic 1)
A company needs to store data in Amazon S3 and must prevent the data from being changed. The company wants new objects that are uploaded to Amazon S3 to remain unchangeable for a nonspecific amount of time until the company decides to modify the objects. Only specific users in the company’s AWS account can have the ability to delete the objects. What should a solutions architect do to meet these requirements?

1. A. Create an S3 Glacier vault Apply a write-once, read-many (WORM) vault lock policy to the objects
2. B. Create an S3 bucket with S3 Object Lock enabled Enable versioning Set a retention period of 100 years Use governance mode as the S3 bucket's default retention mode for new objects
3. C. Create an S3 bucket Use AWS CloudTrail to (rack any S3 API events that modify the objects Upon notification, restore the modified objects from any backup versions that the company has
4. D. Create an S3 bucket with S3 Object Lock enabled Enable versioning Add a legal hold to the objects Add the s3 PutObjectLegalHold permission to the IAM policies of users who need to delete the objects

Correct Answer: D
"The Object Lock legal hold operation enables you to place a legal hold on an object version. Like setting a retention period, a legal hold prevents an object version from being overwritten or deleted. However, a legal hold doesn't have an associated retention period and remains in effect until removed." https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-legal-hold.html

- (Exam Topic 3)
An application that is hosted on Amazon EC2 instances needs to access an Amazon S3 bucket Traffic must not traverse the internet How should a solutions architect configure access to meet these requirements?

1. A. Create a private hosted zone by using Amazon Route 53
2. B. Set up a gateway VPC endpoint for Amazon S3 in the VPC
3. C. Configure the EC2 instances to use a NAT gateway to access the S3 bucket
4. D. Establish an AWS Site-to-Site VPN connection between the VPC and the S3 bucket

Correct Answer: B