- (Exam Topic 2)
A company's web application is running on Amazon EC2 instances behind an Application Load Balancer. The company recently changed its policy, which now requires the application to be accessed from one specific country only.
Which configuration will meet this requirement?

1. A. Configure the security group for the EC2 instances.
2. B. Configure the security group on the Application Load Balancer.
3. C. Configure AWS WAF on the Application Load Balancer in a VPC.
4. D. Configure the network ACL for the subnet that contains the EC2 instances.

Correct Answer: C
https://aws.amazon.com/about-aws/whats-new/2017/10/aws-waf-now-supports-geographic-match/

- (Exam Topic 3)
A company’s compliance team needs to move its file shares to AWS. The shares run on a Windows Server SMB file share. A self-managed on-premises Active Directory controls access to the files and folders.
The company wants to use Amazon FSx for Windows File Server as part of the solution. The company must ensure that the on-premises Active Directory groups restrict access to the FSx for Windows File Server SMB compliance shares, folders, and files after the move to AWS. The company has created an FSx for Windows File Server file system.
Which solution will meet these requirements?

1. A. Create an Active Directory Connector to connect to the Active Director
2. B. Map the Active Directory groups to IAM groups to restrict access.
3. C. Assign a tag with a Restrict tag key and a Compliance tag valu
4. D. Map the Active Directory groups to IAM groups to restrict access.
5. E. Create an IAM service-linked role that is linked directly to FSx for Windows File Server to restrict access.
6. F. Join the file system to the Active Directory to restrict access.

Correct Answer: D
Joining the FSx for Windows File Server file system to the on-premises Active Directory will allow the company to use the existing Active Directory groups to restrict access to the file shares, folders, and files after the move to AWS. This option allows the company to continue using their existing access controls and management structure, making the transition to AWS more seamless.

- (Exam Topic 1)
A company is hosting a web application on AWS using a single Amazon EC2 instance that stores
user-uploaded documents in an Amazon EBS volume. For better scalability and availability, the company duplicated the architecture and created a second EC2 instance and EBS volume in another Availability Zone placing both behind an Application Load Balancer After completing this change, users reported that, each time they refreshed the website, they could see one subset of their documents or the other, but never all of the documents at the same time.
What should a solutions architect propose to ensure users see all of their documents at once?

1. A. Copy the data so both EBS volumes contain all the documents.
2. B. Configure the Application Load Balancer to direct a user to the server with the documents
3. C. Copy the data from both EBS volumes to Amazon EFS Modify the application to save new documents to Amazon EFS
4. D. Configure the Application Load Balancer to send the request to both servers Return each document from the correct server.

Correct Answer: A
Amazon EFS provides file storage in the AWS Cloud. With Amazon EFS, you can create a file system, mount the file system on an Amazon EC2 instance, and then read and write data to and from your file system. You can mount an Amazon EFS file system in your VPC, through the Network File System versions 4.0 and a4.1 (NFSv4) protocol. We recommend using a current generation Linux NFSv4.1 client, such as those found in the latest Amazon Linux, Redhat, and Ubuntu AMIs, in conjunction with the Amazon EFS Mount Helper. For instructions, see Using the amazon-efs-utils Tools.
For a list of Amazon EC2 Linux Amazon Machine Images (AMIs) that support this protocol, see NFS Support. For some AMIs, you'll need to install an NFS client to mount your file system on your Amazon EC2 instance. For instructions, see Installing the NFS Client.
You can access your Amazon EFS file system concurrently from multiple NFS clients, so applications that scale beyond a single connection can access a file system. Amazon EC2 instances running in multiple Availability Zones within the same AWS Region can access the file system, so that many users can access and share a common data source.
https://docs.aws.amazon.com/efs/latest/ug/how-it-works.html#how-it-works-ec2

- (Exam Topic 3)
A company’s security team requests that network traffic be captured in VPC Flow Logs. The logs will be frequently accessed for 90 days and then accessed intermittently.
What should a solutions architect do to meet these requirements when configuring the logs?

1. A. Use Amazon CloudWatch as the targe
2. B. Set the CloudWatch log group with an expiration of 90 days
3. C. Use Amazon Kinesis as the targe
4. D. Configure the Kinesis stream to always retain the logs for 90 days.
5. E. Use AWS CloudTrail as the targe
6. F. Configure CloudTrail to save to an Amazon S3 bucket, and enable S3 Intelligent-Tiering.
7. G. Use Amazon S3 as the targe
8. H. Enable an S3 Lifecycle policy to transition the logs to S3 Standard-Infrequent Access (S3 Standard-IA) after 90 days.

Correct Answer: D
There's a table here that specifies that VPC Flow logs can go directly to S3. Does not need to go via CloudTrail and then to S3. Nor via CW.
https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html#AWS-logs-i

- (Exam Topic 1)
An application allows users at a company's headquarters to access product data. The product data is stored in an Amazon RDS MySQL DB instance. The operations team has isolated an application performance slowdown and wants to separate read traffic from write traffic. A solutions architect needs to optimize the application's performance quickly.
What should the solutions architect recommend?

1. A. Change the existing database to a Multi-AZ deploymen
2. B. Serve the read requests from the primary Availability Zone.
3. C. Change the existing database to a Multi-AZ deploymen
4. D. Serve the read requests from the secondary Availability Zone.
5. E. Create read replicas for the databas
6. F. Configure the read replicas with half of the compute and storage resources as the source database.
7. G. Create read replicas for the databas
8. H. Configure the read replicas with the same compute and storage resources as the source database.

Correct Answer: D
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_MySQL.Replication.ReadReplicas.html