- (Exam Topic 2)
A company manufactures smart vehicles. The company uses a custom application to collect vehicle data. The vehicles use the MQTT protocol to connect to the application.
The company processes the data in 5-minute intervals. The company then copies vehicle telematics data to on-premises storage. Custom applications analyze this data to detect anomalies.
The number of vehicles that send data grows constantly. Newer vehicles generate high volumes of data. The on-premises storage solution is not able to scale for peak traffic, which results in data loss. The company must modernize the solution and migrate the solution to AWS to resolve the scaling challenges.
Which solution will meet these requirements with the LEAST operational overhead?

1. A. Use AWS IOT Greengrass to send the vehicle data to Amazon Managed Streaming for Apache Kafka (Amazon MSK). Create an Apache Kafka application to store the data in Amazon S3. Use a pretrained model in Amazon SageMaker to detect anomalies.
2. B. Use AWS IOT Core to receive the vehicle dat
3. C. Configure rules to route data to an Amazon Kinesis Data Firehose delivery stream that stores the data in Amazon S3. Create an Amazon Kinesis Data Analytics application that reads from the delivery stream to detect anomalies.
4. D. Use AWS IOT FleetWise to collect the vehicle dat
5. E. Send the data to an Amazon Kinesis data stream.Use an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Use the built-in machine learning transforms in AWS Glue to detect anomalies.
6. F. Use Amazon MQ for RabbitMQ to collect the vehicle dat
7. G. Send the data to an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Use Amazon Lookout for Metrics to detect anomalies.

Correct Answer: B
Using AWS IoT Core to receive the vehicle data will enable connecting the smart vehicles to the cloud using the MQTT protocol1. AWS IoT Core is a platform that enables you to connect devices to AWS Services and other devices, secure data and interactions, process and act upon device data, and enable applications to interact with devices even when they are offline2. Configuring rules to route data to an Amazon Kinesis Data Firehose delivery stream that stores the data in Amazon S3 will enable processing and storing the vehicle data in a scalable and reliable way3. Amazon Kinesis Data Firehose is a fully managed service that delivers real-time streaming data to destinations such as Amazon S3. Creating an Amazon Kinesis Data Analytics application that reads from the delivery stream to detect anomalies will enable analyzing the vehicle data using SQL queries or Apache Flink applications. Amazon Kinesis Data Analytics is a fully managed service that enables you to process and analyze streaming data using SQL or Java.

- (Exam Topic 2)
A large company runs workloads in VPCs that are deployed across hundreds of AWS accounts. Each VPC consists to public subnets and private subnets that span across multiple Availability Zones. NAT gateways are deployed in the public subnets and allow outbound connectivity to the internet from the private subnets.
A solutions architect is working on a hub-and-spoke design. All private subnets in the spoke VPCs must route traffic to the internet through an egress VPC. The solutions architect already has deployed a NAT gateway in an egress VPC in a central AWS account.
Which set of additional steps should the solutions architect take to meet these requirements?

1. A. Create peering connections between the egress VPC and the spoke VPC
2. B. Configure the required routing to allow access to the internet.
3. C. Create a transit gateway, and share it with the existing AWS account
4. D. Attach existing VPCs to the transit gateway Configure the required routing to allow access to the internet.
5. E. Create a transit gateway in every accoun
6. F. Attach the NAT gateway to the transit gateway
7. G. Configure the required routing to allow access to the internet.
8. H. Create an AWS PrivateLink connection between the egress VPC and the spoke VPC
9. I. Configure the required routing to allow access to the internet

Correct Answer: B
https://d1.awsstatic.com/architecture-diagrams/ArchitectureDiagrams/NAT-gateway-centralized-egress-ra.pdf?d

- (Exam Topic 1)
A global media company is planning a multi-Region deployment of an application. Amazon DynamoDB global tables will back the deployment to keep the user experience consistent across the two continents where users are concentrated. Each deployment will have a public Application Load Balancer (ALB). The company manages public DNS internally. The company wants to make the application available through an apex domain.
Which solution will meet these requirements with the LEAST effort?

1. A. Migrate public DNS to Amazon Route 53. Create CNAME records for the apex domain to point to the AL
2. B. Use a geolocation routing policy to route traffic based on user location.
3. C. Place a Network Load Balancer (NLB) in front of the AL
4. D. Migrate public DNS to Amazon Route 53.Create a CNAME record for the apex domain to point to the NLB's static IP addres
5. E. Use a geolocation routing policy to route traffic based on user location.
6. F. Create an AWS Global Accelerator accelerator with multiple endpoint groups that target endpoints in appropriate AWS Region
7. G. Use the accelerator's static IP address to create a record in public DNS for the apex domain.
8. H. Create an Amazon API Gateway API that is backed by AWS Lambda in one of the AWS Regions.Configure a Lambda function to route traffic to application deployments by using the round robin metho
9. I. Create CNAME records for the apex domain to point to the API's URL.

Correct Answer: C
AWS Global Accelerator is a service that directs traffic to optimal endpoints (in this case, the Application Load Balancer) based on the health of the endpoints and network routing. It allows you to create an accelerator that directs traffic to multiple endpoint groups, one for each Region where the application is deployed. The accelerator uses the AWS global network to optimize the traffic routing to the healthy endpoint.
By using Global Accelerator, the company can use a single static IP address for the apex domain, and traffic will be directed to the optimal endpoint based on the user's location, without the need for additional load balancers or routing policies.
Reference:
AWS Global Accelerator documentation: https://aws.amazon.com/global-accelerator/ Routing User Traffic to the Optimal AWS Region using Global Accelerator documentation:
https://aws.amazon.com/blogs/networking-and-content-delivery/routing-user-traffic-to-the-optimal-aws-region-u

- (Exam Topic 2)
A company is building a call center by using Amazon Connect. The company’s operations team is defining a disaster recovery (DR) strategy across AWS Regions. The contact center has dozens of contact flows, hundreds of users, and dozens of claimed phone numbers.
Which solution will provide DR with the LOWEST RTO?

1. A. Create an AWS Lambda function to check the availability of the Amazon Connect instance and to send a notification to the operations team in case of unavailabilit
2. B. Create an Amazon EventBridge rule to invoke the Lambda function every 5 minute
3. C. After notification, instruct the operations team to use theAWS Management Console to provision a new Amazon Connect instance in a second Regio
4. D. Deploy the contact flows, users, and claimed phone numbers by using an AWS CloudFormation template.
5. E. Provision a new Amazon Connect instance with all existing users in a second Regio
6. F. Create an AWS Lambda function to check the availability of the Amazon Connect instanc
7. G. Create an Amazon EventBridge rule to invoke the Lambda function every 5 minute
8. H. In the event of an issue, configure the Lambda function to deploy an AWS CloudFormation template that provisions contact flows and claimed numbers in the second Region.
9. I. Provision a new Amazon Connect instance with all existing contact flows and claimed phone numbers in a second Regio
10. J. Create an Amazon Route 53 health check for the URL of the Amazon Connect instanc
11. K. Create an Amazon CloudWatch alarm for failed health check
12. L. Create an AWS Lambda function to deploy an AWS CloudFormation template that provisions all user
13. M. Configure the alarm to invoke the Lambda function.
14. N. Provision a new Amazon Connect instance with all existing users and contact flows in a second Region.Create an Amazon Route 53 health check for the URL of the Amazon Connect instanc
15. O. Create an Amazon CloudWatch alarm for failed health check
16. P. Create an AWS Lambda function to deploy an AWS CloudFormation template that provisions claimed phone number
17. Q. Configure the alarm to invoke the Lambda function.

Correct Answer: D
Option D provisions a new Amazon Connect instance with all existing users and contact flows in a second Region. It also sets up an Amazon Route 53 health check for the URL of the Amazon Connect instance, an Amazon CloudWatch alarm for failed health checks, and an AWS Lambda function to deploy an AWS CloudFormation template that provisions claimed phone numbers. This option allows for the fastest recovery time because all the necessary components are already provisioned and ready to go in the second Region. In the event of a disaster, the failed health check will trigger the AWS Lambda function to deploy the CloudFormation template to provision the claimed phone numbers, which is the only missing component.

- (Exam Topic 2)
A company is creating a centralized logging service running on Amazon EC2 that will receive and analyze logs from hundreds of AWS accounts. AWS PrivateLink is being used to provide connectivity between the client services and the logging service.
In each AWS account with a client, an interface endpoint has been created for the logging service and is available. The logging service running on EC2 instances with a Network Load Balancer (NLB) are deployed in different subnets. The clients are unable to submit logs using the VPC endpoint.
Which combination of steps should a solutions architect take to resolve this issue? (Select TWO.)

1. A. Check that the NACL is attached to the logging service subnet to allow communications to and from the NLB subnet
2. B. Check that the NACL is attached to the NLB subnet to allow communications to and from the logging service subnets running on EC2 instances.
3. C. Check that the NACL is attached to the logging service subnets to allow communications to and from the interface endpoint subnet
4. D. Check that the NACL is attached to the interface endpoint subnet to allow communications to and from the logging service subnets running on EC2 instances.
5. E. Check the security group for the logging service running on the EC2 instances to ensure it allows Ingress from the NLB subnets.
6. F. Check the security group for the loggia service running on EC2 instances to ensure it allows ingress from the clients.
7. G. Check the security group for the NLB to ensure it allows ingress from the interlace endpoint subnets.

Correct Answer: AC