- (Exam Topic 3)
A solutions architect must secure a VPC network that hosts Amazon EC2 instances The EC2 ^stances contain highly sensitive data and tun n a private subnet According to company policy the EC2 instances mat run m the VPC can access only approved third-party software repositories on the internet for software product updates that use the third party's URL Other internet traffic must be blocked.
Which solution meets these requirements?

1. A. Update the route table for the private subnet to route the outbound traffic to an AWS Network Firewall.Configure domain list rule groups
2. B. Set up an AWS WAF web AC
3. C. Create a custom set of rules that filter traffic requests based on source and destination IP address range sets.
4. D. Implement strict inbound security group roles Configure an outbound rule that allows traffic only to the authorized software repositories on the internet by specifying the URLs
5. E. Configure an Application Load Balancer (ALB) in front of the EC2 instance
6. F. Direct an outbound traffic to the ALB Use a URL-based rule listener in the ALB's target group for outbound access to the internet

Correct Answer: C

- (Exam Topic 2)
A solutions architect needs to securely store a database user name and password that an application uses to access an Amazon RDS DB instance. The application that accesses the database runs on an Amazon EC2 instance. The solutions architect wants to create a secure parameter in AWS Systems Manager Parameter Store.
What should the solutions architect do to meet this requirement?

1. A. Create an IAM role that has read access to the Parameter Store paramete
2. B. Allow Decrypt access to an AWS Key Management Service (AWS KMS) key that is used to encrypt the paramete
3. C. Assign this IAM role to the EC2 instance.
4. D. Create an IAM policy that allows read access to the Parameter Store paramete
5. E. Allow Decrypt access to an AWS Key Management Service (AWS KMS) key that is used to encrypt the paramete
6. F. Assign this IAM policy to the EC2 instance.
7. G. Create an IAM trust relationship between the Parameter Store parameter and the EC2 instanc
8. H. Specify Amazon RDS as a principal in the trust policy.
9. I. Create an IAM trust relationship between the DB instance and the EC2 instanc
10. J. Specify Systems Manager as a principal in the trust policy.

Correct Answer: B
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html

- (Exam Topic 2)
A company produces batch data that comes from different databases. The company also produces live stream data from network sensors and application APIs. The company needs to consolidate all the data into one place for business analytics. The company needs to process the incoming data and then stage the data in different Amazon S3 buckets. Teams will later run one-time queries and import the data into a business intelligence tool to show key performance indicators (KPIs).
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)

1. A. Use Amazon Athena foe one-time queries Use Amazon QuickSight to create dashboards for KPIs
2. B. Use Amazon Kinesis Data Analytics for one-time queries Use Amazon QuickSight to create dashboards for KPIs
3. C. Create custom AWS Lambda functions to move the individual records from me databases to an Amazon Redshift duster
4. D. Use an AWS Glue extract transform, and toad (ETL) job to convert the data into JSON format Load the data into multiple Amazon OpenSearch Service (Amazon Elasticsearch Service) dusters
5. E. Use blueprints in AWS Lake Formation to identify the data that can be ingested into a data lake Use AWS Glue to crawl the source extract the data and load the data into Amazon S3 in Apache Parquet format

Correct Answer: CE

- (Exam Topic 2)
A company uses a popular content management system (CMS) for its corporate website. However, the required patching and maintenance are burdensome. The company is redesigning its website and wants anew solution. The website will be updated four times a year and does not need to have any dynamic content available. The solution must provide high scalability and enhanced security.
Which combination of changes will meet these requirements with the LEAST operational overhead? (Choose two.)

1. A. Deploy an AWS WAF web ACL in front of the website to provide HTTPS functionality
2. B. Create and deploy an AWS Lambda function to manage and serve the website content
3. C. Create the new website and an Amazon S3 bucket Deploy the website on the S3 bucket with static website hosting enabled
4. D. Create the new websit
5. E. Deploy the website by using an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer.

Correct Answer: AD

- (Exam Topic 1)
A company wants to run its critical applications in containers to meet requirements tor scalability and availability The company prefers to focus on maintenance of the critical applications The company does not want to be responsible for provisioning and managing the underlying infrastructure that runs the containerized workload
What should a solutions architect do to meet those requirements?

1. A. Use Amazon EC2 Instances, and Install Docker on the Instances
2. B. Use Amazon Elastic Container Service (Amazon ECS) on Amazon EC2 worker nodes
3. C. Use Amazon Elastic Container Service (Amazon ECS) on AWS Fargate
4. D. Use Amazon EC2 instances from an Amazon Elastic Container Service (Amazon ECS)-op6mized Amazon Machine Image (AMI).

Correct Answer: C
using AWS ECS on AWS Fargate since they requirements are for scalability and availability without having to provision and manage the underlying infrastructure to run the containerized workload. https://docs.aws.amazon.com/AmazonECS/latest/userguide/what-is-fargate.html