- (Exam Topic 3)
A company is running a publicly accessible serverless application that uses Amazon API Gateway and AWS Lambda. The application's traffic recently spiked due to fraudulent requests from botnets.
Which steps should a solutions architect take to block requests from unauthorized users? (Select TWO.)

1. A. Create a usage plan with an API key that is shared with genuine users only.
2. B. Integrate logic within the Lambda function to ignore the requests from fraudulent IP addresses.
3. C. Implement an AWS WAF rule to target malicious requests and trigger actions to filter them out.
4. D. Convert the existing public API to a private AP
5. E. Update the DNS records to redirect users to the new API endpoint.
6. F. Create an IAM role for each user attempting to access the AP
7. G. A user will assume the role when making the API call.

Correct Answer: AC
https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-usage-plans.html#:~:text=Don https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-api-usage-plans.html

- (Exam Topic 3)
A company is using AWS to design a web application that will process insurance quotes Users will request quotes from the application Quotes must be separated by quote type, must be responded to within 24 hours, and must not get lost The solution must maximize operational efficiency and must minimize maintenance. Which solution meets these requirements?

1. A. Create multiple Amazon Kinesis data streams based on the quote type Configure the web application to send messages to the proper data stream Configure each backend group of application servers to use the Kinesis Client Library (KCL) to pool messages from its own data stream
2. B. Create an AWS Lambda function and an Amazon Simple Notification Service (Amazon SNS) topic for each quote type Subscribe the Lambda function to its associated SNS topic Configure the application to publish requests tot quotes to the appropriate SNS topic
3. C. Create a single Amazon Simple Notification Service (Amazon SNS) topic Subscribe Amazon Simple Queue Service (Amazon SQS) queues to the SNS topic Configure SNS message filtering to publish messages to the proper SQS queue based on the quote type Configure each backend application server to use its own SQS queue
4. D. Create multiple Amazon Kinesis Data Firehose delivery streams based on the quote type to deliver data streams to an Amazon Elasucsearch Service (Amazon ES) cluster Configure the application to send messages to the proper delivery stream Configure each backend group of application servers to search for the messages from Amazon ES and process them accordingly

Correct Answer: C

- (Exam Topic 3)
A company runs an application on a group of Amazon Linux EC2 instances. For compliance reasons, the company must retain all application log files for 7 years. The log files will be analyzed by a reporting tool that must be able to access all the files concurrently.
Which storage solution meets these requirements MOST cost-effectively?

1. A. Amazon Elastic Block Store (Amazon EBS)
2. B. Amazon Elastic File System (Amazon EFS)
3. C. Amazon EC2 instance store
4. D. Amazon S3

Correct Answer: D

- (Exam Topic 3)
A company has a custom application with embedded credentials that retrieves information from an Amazon RDS MySQL DB instance. Management says the application must be made more secure with the least amount of programming effort.
What should a solutions architect do to meet these requirements?

1. A. Use AWS Key Management Service (AWS KMS) customer master keys (CMKs) to create keys.Configure the application to load the database credentials from AWS KM
2. B. Enable automatic key rotation.
3. C. Create credentials on the RDS for MySQL database for the application user and store the credentials in AWS Secrets Manage
4. D. Configure the application to load the database credentials from Secrets Manage
5. E. Create an AWS Lambda function that rotates the credentials in Secret Manager.
6. F. Create credentials on the RDS for MySQL database for the application user and store the credentials in AWS Secrets Manage
7. G. Configure the application to load the database credentials from Secrets Manage
8. H. Set up a credentials rotation schedule for the application user in the RDS for MySQL database using Secrets Manager.
9. I. Create credentials on the RDS for MySQL database for the application user and store the credentials in AWS Systems Manager Parameter Stor
10. J. Configure the application to load the database credentials from Parameter Stor
11. K. Set up a credentials rotation schedule for the application user in the RDS for MySQL database using Parameter Store.

Correct Answer: B

- (Exam Topic 3)
A company wants to implement a disaster recovery plan for its primary on-premises file storage volume. The file storage volume is mounted from an Internet Small Computer Systems Interface (iSCSI) device on a local storage server. The file storage volume holds hundreds of terabytes (TB) of data.
The company wants to ensure that end users retain immediate access to all file types from the on-premises systems without experiencing latency.
Which solution will meet these requirements with the LEAST amount of change to the company's existing infrastructure?

1. A. Provision an Amazon S3 File Gateway as a virtual machine (VM) that is hosted on premise
2. B. Set thelocal cache to 10 T
3. C. Modify existing applications to access the files through the NFS protoco
4. D. To recover from a disaster, provision an Amazon EC2 instance and mount the S3 bucket that contains the files.
5. E. Provision an AWS Storage Gateway tape gatewa
6. F. Use a data backup solution to back up all existing data to a virtual tape librar
7. G. Configure the data backup solution to run nightly after the initial backup is complet
8. H. To recover from a disaster, provision an Amazon EC2 instance and restore the data to an Amazon Elastic Block Store (Amazon EBS) volume from the volumes in the virtual tape library.
9. I. Provision an AWS Storage Gateway Volume Gateway cached volum
10. J. Set the local cache to 10 T
11. K. Mount the Volume Gateway cached volume to the existing file server by using iSCS
12. L. and copy all files to the storage volum
13. M. Configure scheduled snapshots of the storage volum
14. N. To recover from a disaster, restore a snapshot to an Amazon Elastic Block Store (Amazon EBS) volume and attach the EBS volume to an Amazon EC2 instance.
15. O. Provision an AWS Storage Gateway Volume Gateway stored volume with the same amount of disk space as the existing file storage volum
16. P. Mount the Volume Gateway stored volume to the existing file server by using iSCSI, and copy all files to the storage volum
17. Q. Configure scheduled snapshots of the storage volum
18. R. To recover from a disaster, restore a snapshot to an Amazon Elastic Block Store (Amazon EBS) volume and attach the EBS volume to an Amazon EC2 instance.

Correct Answer: C