- (Topic 4)
A company has an on-premises server that uses an Oracle database to process and store customer information The company wants to use an AWS database service to achieve higher availability and to improve application performance. The company also wants to offload reporting from its primary database system.
Which solution will meet these requirements in the MOST operationally efficient way?

1. A. Use AWS Database Migration Service (AWS DMS) to create an Amazon RDS DB instance in multiple AWS Regions Point the reporting functions toward a separate DB instance from the primary DB instance.
2. B. Use Amazon RDS in a Single-AZ deployment to create an Oracle database Create a read replica in the same zone as the primary DB instanc
3. C. Direct the reporting functions to the read replica.
4. D. Use Amazon RDS deployed in a Multi-AZ cluster deployment to create an Oracle database Direct the reporting functions to use the reader instance in the cluster deployment
5. E. Use Amazon RDS deployed in a Multi-AZ instance deployment to create an Amazon Aurora databas
6. F. Direct the reporting functions to the reader instances.

Correct Answer: D
Amazon Aurora is a fully managed relational database that is compatible with MySQL and PostgreSQL. It provides up to five times better performance than MySQL and
up to three times better performance than PostgreSQL. It also provides high availability and durability by replicating data across multiple Availability Zones and continuously backing up data to Amazon S31. By using Amazon RDS deployed in a Multi-AZ instance deployment
to create an Amazon Aurora database, the solution can achieve higher availability and improve application performance.
Amazon Aurora supports read replicas, which are separate instances that share the same underlying storage as the primary instance. Read replicas can be used to offload read-only queries from the primary instance and improve performance. Read replicas can also be used for reporting functions2. By directing the reporting functions to the reader instances, the solution can offload reporting from its primary database system.
* A. Use AWS Database Migration Service (AWS DMS) to create an Amazon RDS DB instance in multiple AWS Regions Point the reporting functions toward a separate DB instance from the pri-mary DB instance. This solution will not meet the requirement of using an AWS database service, as AWS DMS is a service that helps users migrate databases to AWS, not a database service itself. It also involves creating multiple DB instances in different Regions, which may increase complexity and cost.
* B. Use Amazon RDS in a Single-AZ deployment to create an Oracle database Create a read replica in the same zone as the primary DB instance. Direct the reporting functions to the read replica. This solution will not meet the requirement of achieving higher availability, as a Single-AZ deployment does not provide failover protection in case of an Availability Zone outage. It also involves using Oracle as the database engine, which may not provide better performance than Aurora.
* C. Use Amazon RDS deployed in a Multi-AZ cluster deployment to create an Oracle database Di-rect the reporting functions to use the reader instance in the cluster deployment. This solution will not meet the requirement of improving application performance, as Oracle may not provide better performance than Aurora. It also involves using a cluster deployment, which is only supported for Aurora, not for Oracle. Reference URL: https://aws.amazon.com/rds/aurora/

- (Topic 4)
A serverless application uses Amazon API Gateway. AWS Lambda, and Amazon DynamoDB. The Lambda function needs permissions to read and write to the DynamoDB table.
Which solution will give the Lambda function access to the DynamoDB table MOST securely?

1. A. Create an 1AM user with programmatic access to the Lambda functio
2. B. Attach a policy to the user that allows read and write access to the DynamoDB tabl
3. C. Store the access_key_id and secret_access_key parameters as part of the Lambda environment variable
4. D. Ensure that other AWS users do not have read and write access to the Lambda function configuration
5. E. Create an 1AM role that includes Lambda as a trusted servic
6. F. Attach a policy to the role that allows read and write access to the DynamoDB tabl
7. G. Update the configuration of the Lambda function to use the new role as the execution role.
8. H. Create an 1AM user with programmatic access to the Lambda functio
9. I. Attach a policy to the user that allows read and write access to the DynamoDB tabl
10. J. Store the access_key_id and secret_access_key parameters in AWS Systems Manager Parameter Store as secure string parameter
11. K. Update the Lambda function code to retrieve the secure string parameters before connecting to the DynamoDB table.
12. L. Create an 1AM role that includes DynamoDB as a trusted servic
13. M. Attach a policy to the role that allows read and write access from the Lambda functio
14. N. Update the code of the Lambda function to attach to the new role as an execution role.

Correct Answer: B
Option B suggests creating an IAM role that includes Lambda as a trusted service, meaning the role is specifically designed for Lambda functions. The role should have a policy attached to it that grants the required read and write access to the DynamoDB table.

- (Topic 2)
A company wants to use the AWS Cloud to make an existing application highly available and resilient. The current version of the application resides in the company's data center. The application recently experienced data loss after a database server crashed because of an unexpected power outage.
The company needs a solution that avoids any single points of failure. The solution must give the application the ability to scale to meet user demand.
Which solution will meet these requirements?

1. A. Deploy the application servers by using Amazon EC2 instances in an Auto Scaling group across multiple Availability Zone
2. B. Use an Amazon RDS DB instance in a Multi-AZ configuration.
3. C. Deploy the application servers by using Amazon EC2 instances in an Auto Scaling group in a single Availability Zon
4. D. Deploy the databaseon an EC2 instanc
5. E. Enable EC2 Auto Recovery.
6. F. Deploy the application servers by using Amazon EC2 instances in an Auto Scalinggroup across multiple Availability Zone
7. G. Use an Amazon RDS DB instance with a read replica in a single Availability Zon
8. H. Promote the read replica to replace the primary DB instance if the primary DB instance fails.
9. I. Deploy the application servers by using Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones Deploy the primary and secondary database servers on EC2 instances across multiple Availability Zones Use Amazon Elastic Block Store (Amazon EBS) Multi-Attach to create shared storage between the instances.

Correct Answer: A
Deploy the application servers by using Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones. Use an Amazon RDS DB instance in a Multi-AZ configuration. To make an existing application highly available and resilient while avoiding any single points of failure and giving the application the ability to scale to meet user demand, the best solution would be to deploy the application servers using Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones and use an Amazon RDS DB instance in a Multi-AZ configuration. By using an Amazon RDS DB instance in a Multi-AZ configuration, the database is automatically replicated across multiple Availability Zones, ensuring that the database is highly available and can withstand the failure of a single Availability Zone. This provides fault tolerance and avoids any single points of failure.

- (Topic 4)
A company runs demonstration environments for its customers on Amazon EC2 instances. Each environment is isolated in its own VPC. The company’s operations team needs to be notified when RDP or SSH access to an environment has been established.

1. A. Configure Amazon CloudWatch Application Insights to create AWS Systems Manager OpsItems when RDP or SSH access is detected.
2. B. Configure the EC2 instances with an IAM instance profile that has an IAM role with the AmazonSSMManagedInstanceCore policy attached.
3. C. Publish VPC flow logs to Amazon CloudWatch Log
4. D. Create required metric filter
5. E. Create an Amazon CloudWatch metric alarm with a notification action for when the alarm is in the ALARM state.
6. F. Configure an Amazon EventBridge rule to listen for events of type EC2 Instance State- change Notificatio
7. G. Configure an Amazon Simple Notification Service (Amazon SNS) topic as a targe
8. H. Subscribe the operations team to the topic.

Correct Answer: C
https://aws.amazon.com/blogs/security/how-to-monitor-and-visualize-failed- ssh-access-attempts-to-amazon-ec2-linux-instances/

- (Topic 3)
A company collects data from thousands of remote devices by using a RESTful web services application that runs on an Amazon EC2 instance. The EC2 instance receives the raw data, transforms the raw data, and stores all the data in an Amazon S3 bucket. The number of remote devices will increase into the millions soon. The company needs a highly scalable solution that minimizes operational overhead.
Which combination of steps should a solutions architect take to meet these requirements9 (Select TWO.)

1. A. Use AWS Glue to process the raw data in Amazon S3.
2. B. Use Amazon Route 53 to route traffic to different EC2 instances.
3. C. Add more EC2 instances to accommodate the increasing amount of incoming data.
4. D. Send the raw data to Amazon Simple Queue Service (Amazon SOS). Use EC2 instances to process the data.
5. E. Use Amazon API Gateway to send the raw data to an Amazon Kinesis data strea
6. F. Configure Amazon Kinesis Data Firehose to use the data stream as a source to deliver the data to Amazon S3.

Correct Answer: AE
"RESTful web services" => API Gateway.
"EC2 instance receives the raw data, transforms the raw data, and stores all the data in an Amazon S3 bucket" => GLUE with (Extract - Transform - Load)