- (Exam Topic 2)
A company has implemented a self-managed DNS solution on three Amazon EC2 instances behind a Network Load Balancer (NLB) in the us-west-2 Region. Most of the company's users are located in the United States and Europe. The company wants to improve the performance and availability of the solution. The company launches and configures three EC2 instances in the eu-west-1 Region and adds the EC2 instances as targets for a new NLB.
Which solution can the company use to route traffic to all the EC2 instances?

1. A. Create an Amazon Route 53 geolocation routing policy to route requests to one of the two NLB
2. B. Create an Amazon CloudFront distributio
3. C. Use the Route 53 record as the distribution's origin.
4. D. Create a standard accelerator in AWS Global Accelerato
5. E. Create endpoint groups in us-west-2 and eu-west-1. Add the two NLBs as endpoints for the endpoint groups.
6. F. Attach Elastic IP addresses to the six EC2 instance
7. G. Create an Amazon Route 53 geolocation routing policy to route requests to one of the six EC2 instance
8. H. Create an Amazon CloudFront distributio
9. I. Usethe Route 53 record as the distribution's origin.
10. J. Replace the two NLBs with two Application Load Balancers (ALBs). Create an Amazon Route 53 latency routing policy to route requests to one of the two ALB
11. K. Create an Amazon CloudFront distributio
12. L. Use the Route 53 record as the distribution's origin.

Correct Answer: B
For standard accelerators, Global Accelerator uses the AWS global network to route traffic to the optimal regional endpoint based on health, client location, and policies that you configure, which increases the availability of your applications. Endpoints for standard accelerators can be Network Load Balancers, Application Load Balancers, Amazon EC2 instances, or Elastic IP addresses that are located in one AWS Region or multiple Regions.
https://docs.aws.amazon.com/global-accelerator/latest/dg/what-is-global-accelerator.html

- (Exam Topic 1)
A company is using a SQL database to store movie data that is publicly accessible. The database runs on an Amazon RDS Single-AZ DB instance A script runs queries at random intervals each day to record the number of new movies that have been added to the database. The script must report a final total during business hours The company's development team notices that the database performance is inadequate for development tasks when the script is running. A solutions architect must recommend a solution to resolve this issue. Which solution will meet this requirement with the LEAST operational overhead?

1. A. Modify the DB instance to be a Multi-AZ deployment
2. B. Create a read replica of the database Configure the script to query only the read replica
3. C. Instruct the development team to manually export the entries in the database at the end of each day
4. D. Use Amazon ElastiCache to cache the common queries that the script runs against the database

Correct Answer: B

- (Exam Topic 1)
A company has an application that runs on Amazon EC2 instances and uses an Amazon Aurora database. The EC2 instances connect to the database by using user names and passwords that are stored locally in a file. The company wants to minimize the operational overhead of credential management.
What should a solutions architect do to accomplish this goal?

1. A. Use AWS Secrets Manage
2. B. Turn on automatic rotation.
3. C. Use AWS Systems Manager Parameter Stor
4. D. Turn on automatic rotation.
5. E. Create an Amazon S3 bucket lo store objects that are encrypted with an AWS Key
6. F. Management Service (AWS KMS) encryption ke
7. G. Migrate the credential file to the S3 bucke
8. H. Point the application to the S3 bucket.
9. I. Create an encrypted Amazon Elastic Block Store (Amazon EBS) volume (or each EC2 instanc
10. J. Attach the new EBS volume to each EC2 instanc
11. K. Migrate the credential file to the new EBS volum
12. L. Point the application to the new EBS volume.

Correct Answer: A
https://aws.amazon.com/cn/blogs/security/how-to-connect-to-aws-secrets-manager-service-within-a-virtual-priv https://aws.amazon.com/blogs/security/rotate-amazon-rds-database-credentials-automatically-with-aws-secrets

- (Exam Topic 1)
An image-processing company has a web application that users use to upload images. The application uploads the images into an Amazon S3 bucket. The company has set up S3 event notifications to publish the object creation events to an Amazon Simple Queue Service (Amazon SQS) standard queue. The SQS queue serves as the event source for an AWS Lambda function that processes the images and sends the results to users through email.
Users report that they are receiving multiple email messages for every uploaded image. A solutions architect determines that SQS messages are invoking the Lambda function more than once, resulting in multiple email messages.
What should the solutions architect do to resolve this issue with the LEAST operational overhead?

1. A. Set up long polling in the SQS queue by increasing the ReceiveMessage wait time to 30 seconds.
2. B. Change the SQS standard queue to an SQS FIFO queu
3. C. Use the message deduplication ID to discard duplicate messages.
4. D. Increase the visibility timeout in the SQS queue to a value that is greater than the total of the function timeout and the batch window timeout.
5. E. Modify the Lambda function to delete each message from the SQS queue immediately after the message is read before processing.

Correct Answer: C

- (Exam Topic 3)
An application running on an Amazon EC2 instance in VPC-A needs to access files in another EC2 instance in VPC-B. Both VPCs are in separate AWS accounts. The network administrator needs to design a solution to configure secure access to EC2 instance in VPC-B from VPC-A. The connectivity should not have a single point of failure or bandwidth concerns.
Which solution will meet these requirements?

1. A. Set up a VPC peering connection between VPC-A and VPC-B.
2. B. Set up VPC gateway endpoints for the EC2 instance running in VPC-B.
3. C. Attach a virtual private gateway to VPC-B and set up routing from VPC-A.
4. D. Create a private virtual interface (VIF) for the EC2 instance running in VPC-B and add appropriate routes from VPC-A.

Correct Answer: A
AWS uses the existing infrastructure of a VPC to create a VPC peering connection; it is neither a gateway nor a VPN connection, and does not rely on a separate piece of physical hardware. There is no single point of failure for communication or a bandwidth bottleneck.
https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html