- (Topic 3)
A solutions architect observes that a nightly batch processing job is automatically scaled up for 1 hour before the desired Amazon EC2 capacity is reached. The peak capacity is the ‘same every night and the batch jobs always start at 1 AM. The solutions architect needs to find a cost-effective solution that will allow for the desired EC2 capacity to be reached quickly and allow the Auto Scaling group to scale down after the batch jobs are complete.
What should the solutions architect do to meet these requirements?

1. A. Increase the minimum capacity for the Auto Scaling group.
2. B. Increase the maximum capacity for the Auto Scaling group.
3. C. Configure scheduled scaling to scale up to the desired compute level.
4. D. Change the scaling policy to add more EC2 instances during each scaling operation.

Correct Answer: C
By configuring scheduled scaling, the solutions architect can set the Auto Scaling group to automatically scale up to the desired compute level at a specific time (IAM) when the batch job starts and then automatically scale down after the job is complete. This will allow the desired EC2 capacity to be reached quickly and also help in reducing the cost.

- (Topic 4)
A company is developing a marketing communications service that targets mobile app users. The company needs to send confirmation messages with Short Message Service (SMS) to its users. The users must be able to reply to the SMS messages. The company must store the responses for a year for analysis.
What should a solutions architect do to meet these requirements?

1. A. Create an Amazon Connect contact flow to send the SMS message
2. B. Use AWS Lambda to process the responses.
3. C. Build an Amazon Pinpoint journe
4. D. Configure Amazon Pinpoint to send events to an Amazon Kinesis data stream for analysis and archiving.
5. E. Use Amazon Simple Queue Service (Amazon SQS) to distribute the SMS message
6. F. Use AWS Lambda to process the responses.
7. G. Create an Amazon Simple Notification Service (Amazon SNS) FIFO topi
8. H. Subscribe an Amazon Kinesis data stream to the SNS topic for analysis and archiving.

Correct Answer: B
https://aws.amazon.com/pinpoint/product-details/sms/ Two-Way Messaging: Receive SMS messages from your customers and reply back to them in a chat-like interactive experience. With Amazon Pinpoint, you can create automatic responses when customers send you messages that contain certain keywords. You can even use Amazon Lex to create conversational bots. A majority of mobile phone users read incoming SMS messages almost immediately after receiving them. If you need to be able to provide your customers with urgent or important information, SMS messaging may be the right solution for you. You can use Amazon Pinpoint to create targeted groups of customers, and then send them campaign-based messages. You can also use Amazon Pinpoint to send direct messages, such as appointment confirmations, order updates, and one-time passwords.

- (Topic 4)
A solutions architect is creating a new Amazon CloudFront distribution for an application. Some of the information submitted by users is sensitive. The application uses HTTPS but needs another layer of security. The sensitive information should.be protected throughout the entire application stack, and access to the information should be restricted to certain applications.
Which action should the solutions architect take?

1. A. Configure a CloudFront signed URL.
2. B. Configure a CloudFront signed cookie.
3. C. Configure a CloudFront field-level encryption profile.
4. D. Configure CloudFront and set the Origin Protocol Policy setting to HTTPS Only for the Viewer Protocol Policy.

Correct Answer: C
it allows the company to protect sensitive information submitted by users
throughout the entire application stack and restrict access to certain applications. By configuring a CloudFront field-level encryption profile, the company can encrypt specific fields of user data at the edge locations before sending it to the origin servers. By using public-private key pairs, the company can ensure that only authorized applications can decrypt and access the sensitive information. References:
✑ Field-Level Encryption
✑ Encrypting and Decrypting Data

- (Topic 3)
An Amazon EC2 instance is located in a private subnet in a new VPC. This subnet does not have outbound internet access, but the EC2 instance needs the ability to download monthly security updates from an outside vendor.
What should a solutions architect do to meet these requirements?

1. A. Create an internet gateway, and attach it to the VP
2. B. Configure the private subnet route table to use the internet gateway as the default route.
3. C. Create a NAT gateway, and place it in a public subne
4. D. Configure the private subnet route table to use the NAT gateway as the default route.
5. E. Create a NAT instance, and place it in the same subnet where the EC2 instance is locate
6. F. Configure the private subnet route table to use the NAT instance as the default route.
7. G. Create an internet gateway, and attach it to the VP
8. H. Create a NAT instance, and place it in the same subnet where the EC2 instance is locate
9. I. Configure the private subnet route table to use the internet gateway as the default route.

Correct Answer: B
This approach will allow the EC2 instance to access the internet and download the monthly security updates while still being located in a private subnet. By creating a NAT gateway and placing it in a public subnet, it will allow the instances in the private subnet to access the internet through the NAT gateway. And then, configure the private subnet route table to use the NAT gateway as the default route. This will ensure that all outbound traffic is directed through the NAT gateway, allowing the EC2 instance to access the internet while still maintaining the security of the private subnet.

- (Topic 4)
A company stores data in Amazon S3. According to regulations, the data must not contain personally identifiable information (Pll). The company recently discovered that S3 buckets have some objects that contain Pll. The company needs to automatically detect Pll in S3 buckets and to notify the company's security team.
Which solution will meet these requirements?

1. A. Use Amazon Maci
2. B. Create an Amazon EventBridge rule to filter the SensitiveData event type from Macie findings and to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
3. C. Use Amazon GuardDut
4. D. Create an Amazon EventBridge rule to filter the CRITICAL event type from GuardDuty findings and to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
5. E. Use Amazon Maci
6. F. Create an Amazon EventBridge rule to filter the SensitiveData:S30bject/Personal event type from Macie findings and to send an Amazon Simple Queue Service (Amazon SQS) notification to the security team.
7. G. Use Amazon GuardDut
8. H. Create an Amazon EventBridge rule to filter the CRITICAL event type from GuardDuty findings and to send an Amazon Simple Queue Service (Amazon SQS) notification to the security team.

Correct Answer: A
Amazon Macie can also send its findings to Amazon EventBridge, which is a serverless event bus that makes it easy to connect applications using data from a variety of sources. You can create an EventBridge rule that filters the SensitiveData event type from Macie findings and sends an Amazon SNS notification to the security team. Amazon SNS is a fully managed messaging service that enables you to send messages to subscribers or other applications. References: https://docs.aws.amazon.com/macie/latest/userguide/macie-findings.html#macie-findings- eventbridge