[Q123-Q147] SAP-C01 Practice Test Give You First Time Success with 100% Money Back Guarantee!

SAP-C01 Practice Test Give You First Time Success with 100% Money Back Guarantee!

All Obstacles During SAP-C01 Exam Preparation with SAP-C01 Real Test Questions

NEW QUESTION 123
An enterprise runs 103 line-of-business applications on virtual machines in an on-premises data center. Many of the applications are simple PHP, Java, or Ruby web applications, are no longer actively developed, and serve little traffic.
Which approach should be used to migrate these applications to AWS with the LOWEST infrastructure costs?

• A. Use VM Import/Export to create AMIs for each virtual machine and run them in single-instance AWS Elastic Beanstalk environments by configuring a custom image.
• B. Deploy the applications to single-instance AWS Elastic Beanstalk environments without a load balancer.
• C. Use AWS SMS to create AMIs for each virtual machine and run them in Amazon EC2.
• D. Convert each application to a Docker image and deploy to a small Amazon ECS cluster behind an Application Load Balancer.

Answer: A

 

NEW QUESTION 124
A company is moving a business-critical multi-tier application to AWS. The architecture consists of a desktop client application and server infrastructure. The server infrastructure resides in an on-premises data center that frequently fails to maintain the application uptime SLA of 99.95%. A solutions architect must re-architect the application to ensure that it can meet or exceed the SLA.
The application contains a PostgreSQL database running on a single virtual machine. The business logic and presentation layers are load balanced between multiple virtual machines. Remote users complain about slow load times while using this latency-sensitive application.
Which of the following will meet the availability requirements with little change to the application while improving user experience and minimizing costs?

• A. Migrate the database to an Amazon RDS Aurora PostgreSQL configuration. Host the application and presentation layers in an Auto Scaling configuration on Amazon EC2 instances behind an Application Load Balancer. Use Amazon AppStream 2.0 to improve the user experience.
• B. Migrate the database to an Amazon Redshift cluster with at least two nodes. Combine and host the application and presentation layers in automatically scaled Amazon ECS containers behind an Application Load Balancer. Use Amazon CloudFront to improve the user experience.
• C. Migrate the database to an Amazon RDS PostgreSQL Mulli-AZ configuration. Host the application and presentation layers in automatically scaled AWS Fargate containers behind a Network Load Balancer. Use Amazon ElastiCache to improve the user experience.
• D. Migrate the database to a PostgreSQL database in Amazon EC2. Host the application and presentation layers in automatically scaled Amazon ECS containers behind an Application Load Balancer. Allocate an Amazon Workspaces Workspace for each end user to improve the user experience.

Answer: A

Explanation:
Aurora would improve availability that can replicate to multiple AZ (6 copies). Auto scaling would improve the performance together with a ALB. AppStream is like Citrix that deliver hosted Apps to users.

 

NEW QUESTION 125
A company is using AWS CloudFormation as its deployment tool for all application. It stages all application binaries and templates within Amazon S3 bucket with versioning enable Developers have access to an Amazon EC2 instance that hosts the integrated development (IDE). The developers download the application binaries from Amazon S3 to the EC2 instance, make changes, and upload the binaries to an S3 bucket after running the unit locally. The developers want to improve the existing deployment mechanism and implement Ci/CD using AWS CodePipeline.
The developers have the following requirements:
* Use AWS CodeCommit for source control
* Automate unit testing and security scanning.
* Alert the developers when unit tests fail
* Turn application features on and off, and customize deployment dynamically as part of Ci/CD.
* Have the lead developer provide approval before deploying an application.
Which solution will meet these requirements?

• A. Use AWS CodeBuild to run tests and security scans. Use an Amazon EventBridge rule to send Amazon SNS alerts to the developers when unit test fail. Write AWS Cloud Developer kit (AWS CDK) constructs for different solution features, and use a manifest file to turn on and off in the AWS application. Use a manual improve stage in the pipeline to allow the lead developer to approve applications.
• B. Use AWS CodeBuild to run unit test and security scans. use Lambda in a subsequent stage in the pipeline to send Amazon SNS alerts to the developers when tests fail. Write Amplify plugins for different solution features and utilize user prompts to turn features on and off. Use Amazon SES is the pipleline to allow the lead developer to approve applications.

Answer: A

 

NEW QUESTION 126
A large company experienced a drastic increase in its monthly AWS spend. This is after Developers accidentally launched Amazon EC2 instances in unexpected regions. The company has established practices around least privileges for Developers and controls access to on-premises resources using Active Directory groups. The company now wants to control costs by restricting the level of access that Developers have to the AWS Management Console without impacting their productivity. The company would also like to allow Developers to launch Amazon EC2 in only one region, without limiting access to other services in any region.
How can this company achieve these new security requirements while minimizing the administrative burden on the Operations team?

• A. Set up SAML-based authentication tied to an IAM role that has the PowerUserAccess managed policy attached to it. Attach a customer managed policy that denies access to Amazon EC2 in each region except for the one required.
• B. Set up SAML-based authentication tied to an IAM role that has an AdministrativeAccess managed policy attached to it. Attach a customer managed policy that denies access to Amazon EC2 in each region except for the one required.
• C. Create an IAM user for each Developer and add them to the developer IAM group that has the PowerUserAccess managed policy attached to it. Attach a customer managed policy that allows the Developers access to Amazon EC2 only in the required region.
• D. Set up SAML-based authentication tied to an IAM role that has a PowerUserAccess managed policy and a customer managed policy that deny all the Developers access to any AWS services except AWS Service Catalog. Within AWS Service Catalog, create a product containing only the EC2 resources in the approved region.

Answer: A

Explanation:
Explanation
The tricks here are: - SAML for AD federation and authentication - PowerUserAccess vs AdministrativeAccess. (PowerUSer has less privilege, which is the required once for developers). Admin, has more rights. The description of "PowerUser access" given by AWS is "Provides full access to AWS services and resources, but does not allow management of Users and groups."

 

NEW QUESTION 127
A company is using multiple AWS accounts The DNS records are stored in a private hosted zone for Amazon Route 53 in Account A The company's applications and databases are running in Account B.
A solutions architect win deploy a two-net application In a new VPC To simplify the configuration, the db.example com CNAME record set tor the Amazon RDS endpoint was created in a private hosted zone for Amazon Route 53.
During deployment, the application failed to start. Troubleshooting revealed that db.example com is not resolvable on the Amazon EC2 instance The solutions architect confirmed that the record set was created correctly in Route 53.
Which combination of steps should the solutions architect take to resolve this issue? (Select TWO J

• A. Use SSH to connect to the application tier EC2 instance Add an RDS endpoint IP address to the /eto/resolv.conf file
• B. Create a private hosted zone for the example.com domain m Account B Configure Route 53 replication between AWS accounts
• C. Associate a new VPC in Account B with a hosted zone in Account A. Delete the association authorization In Account A.
• D. Create an authorization lo associate the private hosted zone in Account A with the new VPC In Account B
• E. Deploy the database on a separate EC2 instance in the new VPC Create a record set for the instance's private IP in the private hosted zone

Answer: C,D

 

NEW QUESTION 128
A company manages an on-premises data ingestion application that receives metrics from loT devices in JSON format. The data is collected transformed and stored m a data warehouse for analysis The current infrastructure has severe performance issues at peak loads due to insufficient compute capacity causing some of the data ingestion to be dropped The company wants to migrate the application to AWS The solution must support its current analytics tool that connects to the data warehouse with a Java Database Connectivity (JDBC) driver. The company requires a resilient and cost-effective solution that will address the performance issues Which solution will meet these requirements?

• A. Replatform the application Use Amazon API Gateway to handle data ingestion Use AWS Lambda to transform the data Create an Amazon Aurora PostgreSQL DB cluster with an Aurora Replica in two private subnets to store data Use Amazon QuickSight to generate reports and visualize data
• B. Replatform the application Create an Application Load Balancer and an Amazon EC2 instance with Auto Scaling to host the application to ingest and transform the data Create an Amazon RDS PostgreSQL Multi-AZ DB instance in a private subnet to store data Use Amazon QuickSight to generate reports and visualize data
• C. Re-architect the application Load the data into Amazon S3 Use AWS Glue to transform me data Store the table schema in an AWS Glue Data Catalog Use Amazon Athena to query the data
• D. Re-architect the application Load the data into Amazon S3 Use Amazon EMR to transform tne data Create an external schema in an AWS Glue Data Catalog Use Amazon Redshift Spectrum to query the data

Answer: B

 

NEW QUESTION 129
A user has created a VPC with public and private subnets using the VPC Wizard. The VPC has CIDR
20.0.0.0/16. The private subnet uses CIDR 20.0.0.0/24.
Which of the below mentioned entries are required in the main route table to allow the instances in VPC to communicate with each other?

• A. Destination : 20.0.0.0/24 and Target : Local
• B. Destination : 20.0.0.0/16 and Target : Local
• C. Destination : 20.0.0.0/16 and Target : ALL
• D. Destination : 20.0.0.0/0 and Target : ALL

Answer: B

Explanation:
Explanation
A user can create a subnet with VPC and launch instances inside that subnet. If the user has created a public private subnet, the instances in the public subnet can receive inbound traffic directly from the Internet, whereas the instances in the private subnet cannot. If these subnets are created with Wizard, AWS will create two route tables and attach to the subnets. The main route table will have the entry "Destination: 20.0.0.0/16 and Target: Local", which allows all instances in the VPC to communicate with each other.
http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario2.html

 

NEW QUESTION 130
A company used Amazon EC2 instances to deploy a web fleet to host a blog site. The EC2 instances are behind an Application Load Balancer (ALB) and are configured in an Auto Scaling group. The web application stores all blog content on an Amazon EFS volume.
The company recently added a feature for bloggers to add video to their posts, attracting 10 times the previous user traffic. At peak times of day, users report buffering and timeout issues while attempting to reach the site or watch videos.
Which is the MOST cost-efficient and scalable deployment that will resolve the issues for users?

• A. Set up an Amazon CloudFront distribution for all suite contents, and point the distribution at the ALB.
• B. Update the blog site to use instance store volumes for storage. Copy the site contents to the volumes at launch and to Amazon S3 at shutdown.
• C. Configure an Amazon CloudFront distribution. Point the distribution to an S3 bucket, and migrate the videos from EFS to Amazon S3.
• D. Reconfigure Amazon EFS to enable maximum I/O.

Answer: A

 

NEW QUESTION 131
A company recently deployed multiple Amazon Elastic File System (Amazon EFS) file systems in an AWS account The company wants to access the EFS file systems n Amazon Linux EC2 instance in a second AWS account Permissions are already granted from the source account.
Which combination of actions should the solutions architect recommend to meet these requirements? (Select TWO.)

• A. Add a line to the /etc/hosts file on the EC2 instance that references the FileSystemld of the EFS file system.
• B. Add a line to the /etc/hosts file on the EC2 instance that references the IpAddress of the EFS mount target
• C. Call the DescribeMountTargets operation in the source account for the file system to identify the mount target name for the Availability Zone that matches the Availability Zone of the EC2 instance
• D. Add a line to the /etc/hosts file on the EC2 instance that references the MountTargetld of the EFS mount target
• E. Call the DescribeMountTargets operation in the source account for the file system to identify the mount target IP address for the Availability Zone that matches the Availability Zone of the EC2 instance

Answer: A,E

 

NEW QUESTION 132
A company recently completed a large-scale migration to AWS Development teams that support various business units have their own accounts in AWS Organizations. A central cloud team is responsible for controlling which services and resources can be accessed, and for creating operational strategies for all teams with the company. Some teams are approaching their account service quotas. The cloud team needs to create an automated and operationally efficient solution to proactively monitor service quotas.
Monitoring should account every 15 minutes and send alerts when a team exceeds 80% utilization.
Which solution will meet these requirements?

• A. Create an Amazon EvenBridge (Amazon CloudWatch Events) rule that triggers an AWS Lambda function to refresh the AWS Trusted Advisor service limit checks and retrieve the most current utilization and service limit data. IF the current utilization is above 80% use Amazon Pinpoint to send an alert to the cloud team. Create an AWS CloudFormation template and deploy the necessary resources to each account.
• B. Create an Amazon CloudWatch alarm that triggers an AWS Lambada function to call the Amazon CloudWatch GettingSightRuleReport. API to retrieve the most current utilization and service limit data if the current utilization is above 80%, publish an Amazon Simple Email Service (Amazon SES) notification to alert the cloud team. Create AWS CloudFormation SrackSets that deploy the necessary resource to all Organizations accounts.
• C. Create a scheduled AWS Config rule to trigger an AWS Lambada function to call the GetServiceQuota API. If any service utilization is above 80%, publish a message to an Amazon Simple Notification Service (Amazon SNS) topic to alert the cloud team. Create an AWS CloudFormation template and deploy the necessary resources to each account.
• D. Create an Amazon EvenBridge (Amazon CloudWatch Events) rule that triggers an AWS Lambada function to refresh the AWS Trusted Advisor service limit checks and retrieve the most current utilization and service limit data. If the current utilization is above 80% puclish a message to an Amazon Simple Notification Service (Amazon SNS) topic to alert the cloud team. Create AWS CloudFormation StackSets that deploy the necessary resources to all Organizations accounts.

Answer: D

Explanation:
https://aws.amazon.com/solutions/implementations/limit-monitor/

 

NEW QUESTION 133
A company stores sales transaction data in Amazon DynamoDB tables. To detect anomalous behaviors and respond quickly, all changes to the items stored in the DynamoDB tables must be logged within 30 minutes.
Which solution meets the requirements?

• A. Use Amazon DynamoDB Streams to capture and send updates to AWS Lambda. Create a Lambda function to output records to Amazon Kinesis Data Streams. Analyze any anomalies with Amazon Kinesis Data Analytics. Send SNS notifications when anomalous behaviors are detected.
• B. Use event patterns in Amazon CloudWatch Events to capture DynamoDB API call events with an AWS Lambda function as a target to analyze behavior. Send SNS notifications when anomalous behaviors are detected.
  https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Streams.html
• C. Copy the DynamoDB tables into Apache Hive tables on Amazon EMR every hour and analyze them for anomalous behaviors. Send Amazon SNS notifications when anomalous behaviors are detected.
• D. Use AWS CloudTrail to capture all the APIs that change the DynamoDB tables. Send SNS notifications when anomalous behaviors are detected using CloudTrail event filtering.

Answer: A

 

NEW QUESTION 134
A Solutions Architect must update an application environment within AWS Elastic Beanstalk using a blue/green deployment methodology. The Solutions Architect creates an environment that is identical to the existing application environment and deploys the application to the new environment.
What should be done next to complete the update?

• A. Select the Swap Environment URLs option
• B. Update the DNS records to point to the green environment
• C. Replace the Auto Scaling launch configuration
• D. Redirect to the new environment using Amazon Route 53

Answer: A

Explanation:
Explanation
https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.CNAMESwap.html

 

NEW QUESTION 135
A company hosts a web application on AWS that uses Amazon RDS (or MySQL Multi-AZ DB instances Usage of the web application has increased recently Users have indicated that dynamic reports in the application load slowly Which configuration change will improve application performance while ensuring the database is highly available for data operations?

• A. Migrate to Amazon Aurora MySQL with two Aurora Replicas in different Availability Zones Configure the application to direct read requests to the reader endpoint
• B. Configure the application to direct read requests to the primary and standby DB instances
• C. Create two read replicas in the same Availability Zone as the primary DB instance Use Amazon Route 53 to evenly distribute read requests to the replicas
• D. Add a read replica and configure the application to direct read requests to it

Answer: D

 

NEW QUESTION 136
A group of Amazon EC2 instances have been configured as high performance computing (HPC) cluster. The instances are running in a placement group, and are able to communicate with each other at network of up to
20 Gbps.
The cluster needs to communicate with a control EC2 instance outside of the placement group. The control instance has the same instance type and AMI as the other instances, and is configured with a public IP address.
How can the Solutions Architect improve the network speeds between the control instance and the instances in the placement group?

• A. Ensure that the instances are communicating using the private IP addresses.
• B. Ensure that the control instance is using an Elastic Network Adapter.
• C. Move the control instance inside the placement group.
• D. Terminate the control instance and relaunch in the placement group.

Answer: A

 

NEW QUESTION 137
A company is creating an account strategy so that they can begin using AWS. The Security team will provide each team with the permissions they need to follow the principle or least privileged access. Teams would like to keep their resources isolated from other groups, and the Finance team would like each team's resource usage separated for billing purposes.
Which account creation process meets these requirements and allows for changes?

• A. Create individual accounts for each team. Assign the security as the master account, and enable consolidated billing for all other accounts. Create a cross-account role for security to manage accounts, and send logs to a bucket in the security account.
• B. Create a master account for billing using Organizations, and create each team's account from that master account. Create a security account for logs and cross-account access. Apply service control policies on each account, and grant the Security team cross-account access to all accounts. Security will create IAM policies for each account to maintain least privilege access.
• C. Create a new AWS Organizations account. Create groups in Active Directory and assign them to roles in AWS to grant federated access. Require each team to tag their resources, and separate bills based on tags. Control access to resources through IAM granting the minimally required privilege.
• D. Create a new AWS account, and use AWS Service Catalog to provide teams with the required resources.
  Implement a third-party billing to provide the Finance team with the resource use for each team based on tagging. Isolate resources using IAM to avoid account sprawl. Security will control and monitor logs and permissions.

Answer: A

 

NEW QUESTION 138
A solutions architect at a largo company needs to set up network security for outbound traffic to the internet from all AWS accounts within an organization m AWS Organizations The organization has more than 100 AWS accounts, and the accounts route to each other by using a centralized AWS Transit Gateway. Each account has both an internet gateway and a NAT gateway for outbound traffic to the interne) The company deploys resources only Into a single AWS Region
The company needs the ability to add centrally managed rule-based filtering on all outbound traffic to the internet for all AWS accounts in the organization The peak load of outbound traffic will not exceed 25 Gbps in each Availability Zone
Which solution meets these requirements?

• A. Create an AWS Network Firewall firewal for rule-based filtering in each AWS account Modify all default routes to point to the Network Firewall firewalls in each account.
• B. In each AWS account, create an Auto Scaling group of network-optimized Amazon EC2 instances that run an open-source internet proxy for rule-based filtering Modify all default routes to point to the proxy's Auto Scaling group.
• C. Creates a new VPC for outbound traffic to the internet Connect the existing transit gateway to the new VPC Configure a new NAT gateway Create an Auto Scaling group of Amazon EC2 Instances that run an open-source internet proxy for rule-based filtering across all Availability Zones in the Region Modify all default routes to point to the proxy's Auto Scaling group
• D. Create a new VPC for outbound traffic to the internet Connect the existing transit gateway to the new VPC Configure a new NAT gateway Use an AWS Network Firewall firewall for rule-based filtering Create Network Firewall endpoints In each Availability Zone Modify all default routes to point to the Network Firewall endpoints

Answer: D

Explanation:
https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/
https://aws.amazon.com/blogs/networking-and-content-delivery/deploy-centralized-traffic-filtering-using-aws-network-firewall/

 

NEW QUESTION 139
A company has a legacy application running on servers on premises. To increase the application's reliability, the company wants to gain actionable insights using application logs. A Solutions Architect has been given following requirements for the solution:

Aggregate logs using AWS.

Automate log analysis for errors.

Notify the Operations team when errors go beyond a specified threshold.
What solution meets the requirements?

• A. Install Logstash on servers, send logs to Amazon S3 and use Amazon Athena to identify errors, use sendmail to notify the Operations team of errors.
• B. Install Amazon Kinesis Agent on servers, send logs to Amazon Kinesis Data Streams and use Amazon Kinesis Data Analytics to identify errors, create an Amazon CloudWatch alarm to notify the Operations team of errors
• C. Install an AWS X-Ray agent on servers, send logs to AWS Lambda and analyze them to identify errors, use Amazon CloudWatch Events to notify the Operations team of errors.
• D. Install the Amazon CloudWatch agent on servers, send logs to Amazon CloudWatch Logs and use metric filters to identify errors, create a CloudWatch alarm to notify the Operations team of errors.

Answer: D

Explanation:
Explanation
https://docs.aws.amazon.com/kinesis-agent-windows/latest/userguide/what-is-kinesis-agent-windows.html
https://medium.com/@khandelwal12nidhi/build-log-analytic-solution-on-aws-cc62a70057b2

 

NEW QUESTION 140
A large company will be migrating to AWS. The company has 20 business units and anticipates another 10 coming online in the future. Each business unit will need its own IP range and will operate in its own AWS account. There will be a lot of communication between business units with very large data transfers. The company wants to make sure that the proposed solution will minimize data transfer costs and reduce complexity How should a solutions architect design the network to meet these requirements?

• A. Create a transit gateway in a networking account. Share the transit gateway with each business unit's AWS account. Attach the VPC in each account to the transit gateway.
• B. Create a transit VPC in a networking account. Within each business unit's AWS account create redundant VPN connections to the transit VPC.
• C. Create a VPC for each business unit's AWS account Use VPC peering to route traffic between the VPCs in each account.
• D. Create two subnets for each business unit in a networking account. Share the subnets with each business unit's AWS account using AWS Resource Access Manager.

Answer: A

Explanation:
Explanation
https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/trans

 

NEW QUESTION 141
A solutions architect is designing a network for a new cloud deployment Each account will need autonomy to modify route tables and make changes. Centralized and controlled egress internet connectivity is also needed. The cloud footprint is expected to grow to thousands of AWS accounts Which architecture will meet these requirements?

• A. A shared services VPC to host central assets to include a fleet of firewalls with a route to the internet. Each spoke VPC will peer to the central VPC.
• B. A centralized shared VPC with a subnet for each account. Outbound internet traffic will controlled through a fleet of proxy servers.
• C. A centralized transit VPC with a VPN connection to a standalone VPC in each account Outbound internet traffic will be controlled by firewall appliances.
• D. A shared transit gateway to which each VPC will be attached. Outbound internet access will route through a fleet of VPN-attached firewalls.

Answer: D

 

NEW QUESTION 142
A company is running a web application with On-Demand Amazon EC2 instances in Auto Scaling groups that scale dynamically based on custom metrics After extensive testing the company determines that the m5
2xlarge instance size is optimal for the workload Application data is stored in db r4 4xlarge Amazon RDS instances that are confirmed to be optimal The traffic to the web application spikes randomly during the day What other cost-optimization methods should the company implement to further reduce costs without impacting the reliability of the application?

• A. Reduce the RDS instance size to db r4 xlarge and add five equivalents sized read replicas to provide reliability
• B. Double the instance count in the Auto Scaling groups and reduce the instance size to m5 large
• C. Reserve capacity for all EC2 instances and leverage Spot Instance pricing for the RDS database
• D. Reserve capacity for the RDS database and the minimum number of EC2 instances that are constantly running

Answer: B

Explanation:
Explanation
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/capacity-reservations-using.html#capacity-reservations Reserve capacity is not reserved instance

 

NEW QUESTION 143
A company is creating a sequel for a popular online game. A large number of users from all over the world will play the game within the first week after launch. Currently, the game consists of the following components deployed in a single AWS Region:
* Amazon S3 bucket that stores game assets
* Amazon DynamoDB table that stores player scores
A solutions architect needs to design a multi-Region solution that will reduce latency improve reliability, and require the least effort to implement What should the solutions architect do to meet these requirements'

• A. Create another S3 bucket in the same Region, and configure S3 Same-Region Replication between the buckets- Create an Amazon CloudFront distribution and configure origin failover with two origin accessing the S3 buckets Create a new DynamoDB table m a new Region Use the new table as a replica target for DynamoDB global tables.
• B. Create another S3 bucket in a new Region and configure S3 Cross-Region Replication between the buckets Create an Amazon CloudFront distribution and configure origin failover with two origins accessing the S3 buckets in each Region. Configure DynamoDB global tables by enabling Amazon DynamoDB Streams, and add a replica table in a new Region.
• C. Create an Amazon CloudFront distribution to serve assets from the S3 bucket Configure S3 Cross-Region Replication Create a new DynamoDB able in a new Region Use the new table as a replica target tor DynamoDB global tables.
• D. Create an Amazon CloudFront distribution to serve assets from the S3 bucket. Configure S3 Same-Region Replication. Create a new DynamoDB able m a new Region. Configure asynchronous replication between the DynamoDB tables by using AWS Database Migration Service (AWS DMS) with change data capture (CDC)

Answer: B

 

NEW QUESTION 144
An internal security audit of AWS resources within a company found that a number of Amazon EC2 instances running Microsoft Windows workloads were missing several important operating system-level patches. A Solutions Architect has been asked to fix existing patch deficiencies, and to develop a workflow to ensure that future patching requirements are identified and taken care of quickly. The Solutions Architect has decided to use AWS Systems Manager. It is important that EC2 instance reboots do not occur at the same time on all Windows workloads to meet organizational uptime requirements.
Which workflow will meet these requirements in an automated manner?

• A. Add a Patch Group tag with a value of either Windows servers1 or Windows Server2 to all existing EC2 instances. Ensure that all Windows EC2 instances are assigned this tag. Associate the AWS-WindowsPatchBaseline with both Windows Servers patch groups. Define two non-overlapping AWS Systems Manager maintenance windows, conduct patching within them, and associate each with a different patch group. Assign the AWS-RunWindowsPatchBaseline document as a task within each maintenance window. Create an AWS Systems Manager State Manager document to define commands to be executed during patch execution.
• B. Add a Patch Group tag with a value of Windows Servers to all existing EC2 instances. Ensure that all Windows EC2 instances are assigned this tag. Associate the AWS-DefaultPatchBaseline to the Windows servers patch group. Define an AWS Systems Manager maintenance window, conduct patching within it, and associate it with the Windows Servers patch group. Register instances with the maintenance window using associated subnet IDs. Assign the AWS-RunPatchBaseline document as a task within each maintenance window.
• C. Add a Patch Group tag with a value of either Windows Servers1 or Windows Server2 to all existing EC2 instances. Ensure that all Windows EC2 instances are assigned this tag. Associate the AWS-DefaultPatchBaseline with both Windows Servers patch groups. Define two non-overlapping AWS Systems Manager maintenance windows, conduct patching within them, and associate each with a different patch group. Register targets with specific maintenance windows using the Patch Group tags.
  Assign the AWS-RunPatchBaseline document as a task within each maintenance window.
• D. Add a Patch Group tag a value of Windows Servers to all existing EC2 instances. Ensure that all Windows EC2 instances are assigned this tag. Associate the AWS-WindowsPatchBaseline document as a task associated with the Windows Servers patch group. Create an Amazon CloudWatch Events rule configured to use a cron expression to schedule the execution of patching using the AWS Systems Manager run command. Create an AWS Systems Manager State Manager document to define commands to be executed during patch execution.

Answer: C

 

NEW QUESTION 145
A company plans to move regulated and security-sensitive businesses to AWS. The Security team is developing a framework to validate the adoption of AWS best practice and industry-recognized compliance standards. The AWS Management Console is the preferred method for teams to provision resources.
Which strategies should a Solutions Architect use to meet the business requirements and continuously assess, audit, and monitor the configurations of AWS resources? (Choose two.)

• A. Use AWS Config rules to periodically audit changes to AWS resources and monitor the compliance of the configuration. Develop AWS Config custom rules using AWS Lambda to establish a test-driven development approach, and further automate the evaluation of configuration changes against the required controls.
• B. Use AWS CloudTrail events to assess management activities of all AWS accounts. Ensure that CloudTrail is enabled in all accounts and available AWS services. Enable trails, encrypt CloudTrail event log files with an AWS KMS key, and monitor recorded activities with CloudWatch Logs.
• C. Use the Amazon CloudWatch Events near-real-time capabilities to monitor system events patterns, and trigger AWS Lambda functions to automatically revert non-authorized changes in AWS resources. Also, target Amazon SNS topics to enable notifications and improve the response time of incident responses.
• D. Use CloudTrail integration with Amazon SNS to automatically notify unauthorized API activities. Ensure that CloudTrail is enabled in all accounts and available AWS services. Evaluate the usage of Lambda functions to automatically revert non-authorized changes in AWS resources.
  https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html
  https://docs.aws.amazon.com/en_pv/awscloudtrail/latest/userguide/best-practices-security.html The AWS Config console shows the compliance status of your rules and resources. You can see how your AWS resources comply overall with your desired configurations, and learn which specific resources are noncompliant. You can also use the AWS CLI, the AWS Config API, and AWS SDKs to make requests to the AWS Config service for compliance information. https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config.html
• E. Use Amazon CloudWatch Logs agent to collect all the AWS SDK logs. Search the log data using a pre-defined set of filter patterns that machines mutating API calls. Send notifications using Amazon CloudWatch alarms when unintended changes are performed. Archive log data by using a batch export to Amazon S3 and then Amazon Glacier for a long-term retention and auditability.

Answer: A,B

 

NEW QUESTION 146
Once the user has set ElastiCache for an application and it is up and running, which services, does Amazon not provide for the user:

• A. Automating common administrative tasks such as failure detection and recovery, and software patching.
• B. Providing detailed monitoring metrics associated with your Cache Nodes, enabling you to diagnose and react to issues very quickly
• C. The ability for client programs to automatically identify all of the nodes in a cache cluster, and to initiate and maintain connections to all of these nodes
• D. Providing default Time to Live (TTL) in the AWS Elasticache Redis Implementation for different type of data.

Answer: D

Explanation:
Explanation
Amazon provides failure detection and recovery, and software patching and monitoring tools which is called CloudWatch. In addition it provides also Auto Discovery to automatically identify and initialize all nodes of cache cluster for Amazon ElastiCache.
http://docs.aws.amazon.com/AmazonElastiCache/latest/UserGuide/WhatIs.html

 

NEW QUESTION 147
......

Fully Updated Free Actual Amazon SAP-C01 Exam Questions: https://www.actualtestsquiz.com/SAP-C01-test-torrent.html

Free SAP-C01 Questions for Amazon SAP-C01 Exam [Nov-2022]: https://drive.google.com/open?id=1ZiaYlw54C2CtS5NbadQFKtXsHU_jJbhf