- (Exam Topic 1)
A global company handles a large amount of personally identifiable information (Pll) through an internal web portal. The company's application runs in a corporate data center that is connected to AWS through an AWS Direct Connect connection. The application stores the Pll in Amazon S3. According to a compliance requirement, traffic from the web portal to Amazon S3 must not travel across the internet.
What should a SysOps administrator do to meet the compliance requirement?

1. A. Provision an interface VPC endpoint for Amazon S3. Modify the application to use the interface endpoint.
2. B. Configure AWS Network Firewall to redirect traffic to the internal S3 address.
3. C. Modify the application to use the S3 path-style endpoint.
4. D. Set up a range of VPC network ACLs to redirect traffic to the Internal S3 address.

Correct Answer: B

- (Exam Topic 1)
A company recently migrated its application to a VPC on AWS. An AWS Site-to-Site VPN connection connects the company’s on-premises network to the VPC. The application retrieves customer data from another system that resides on premises. The application uses an on-premises DNS server to resolve domain records. After the migration, the application is not able to connect to the customer data because of name resolution errors.
Which solution will give the application the ability to resolve the internal domain names?

1. A. Launch EC2 instances in the VP
2. B. On the EC2 instances, deploy a custom DNS forwarder that forwards all DNS requests to the on-premises DNS serve
3. C. Create an Amazon Route 53 private hosted zone that uses the EC2 instances for name servers.
4. D. Create an Amazon Route 53 Resolver outbound endpoin
5. E. Configure the outbound endpoint to forward DNS queries against the on-premises domain to the on-premises DNS server.
6. F. Set up two AWS Direct Connect connections between the AWS environment and the on-premises networ
7. G. Set up a link aggregation group (LAG) that includes the two connection
8. H. Change the VPC resolver address to point to the on-premises DNS server.
9. I. Create an Amazon Route 53 public hosted zone for the on-premises domai
10. J. Configure the network ACLs to forward DNS requests against the on-premises domain to the Route 53 public hosted zone.

Correct Answer: B
https://docs.aws.amazon.com/zh_tw/Route53/latest/DeveloperGuide/resolver-forwarding-outbound-queries.html

- (Exam Topic 1)
A SysOps administrator is building a process for sharing Amazon RDS database snapshots between different accounts associated with different business units within the same company. All data must be encrypted at rest.
How should the administrator implement this process?

1. A. Write a script to download the encrypted snapshot, decrypt it using the AWS KMS encryption key usedto encrypt the snapshot, then create a new volume in each account.
2. B. Update the key policy to grant permission to the AWS KMS encryption key used to encrypt the snapshot with all relevant accounts, then share the snapshot with those accounts.
3. C. Create an Amazon EC2 instance based on the snapshot, then save the instance's Amazon EBS volume as a snapshot and share it with the other account
4. D. Require each account owner to create a new volume from that snapshot and encrypt it.
5. E. Create a new unencrypted RDS instance from the encrypted snapshot, connect to the instance using SSH/RD
6. F. export the database contents into a file, then share this file with the other accounts.

Correct Answer: B

- (Exam Topic 1)
A compliance team requires all administrator passwords tor Amazon RDS DB instances to be changed at toast annually
Which solution meets this requirement in the MOST operationally efficient manned

1. A. Store the database credentials in AWS Secrets Manager Configure automate rotation for the secret every 365 days
2. B. Store the database credentials as a parameter in the RDS parameter group Create a database trigger to rotate the password every 365 days
3. C. Store the database credentials in a private Amazon S3 bucket Schedule an AWS Lambda function to generate a new set of credentials every 365 days
4. D. Store the database credentials in AWS Systems Manager Parameter Store as a secure string parameter Configure automatic rotation for the parameter every 365 days

Correct Answer: A

- (Exam Topic 1)
A company runs workloads on 90 Amazon EC2 instances in the eu-west-1 Region in an AWS account. In 2 months, the company will migrate the workloads from eu-west-1 to the eu-west-3 Region.
The company needs to reduce the cost of the EC2 instances. The company is willing to make a 1-year commitment that will begin next week. The company must choose an EC2 Instance purchasing option that will provide discounts for the 90 EC2 Instances regardless of Region during the 1-year period. Which solution will meet these requirements?

1. A. Purchase EC2 Standard Reserved Instances.
2. B. Purchase an EC2 Instance Savings Plan.
3. C. Purchase EC2 Convertible Reserved Instances.
4. D. Purchase a Compute Savings Plan.

Correct Answer: B