Question 1

A company is designing a web application with an internet-facing Application Load Balancer (ALB).

The company needs the ALB to receive HTTPS web traffic from the public internet. The ALB must send only HTTPS traffic to the web application servers hosted on the Amazon EC2 instances on port 443. The ALB must perform a health check of the web application servers over HTTPS on port 8443.

Which combination of configurations of the security group that is associated with the ALB will meet these requirements? (Choose three.)

Options :

A : Allow HTTPS inbound traffic from 0.0.0.0/0 for port 443.

B : Allow all outbound traffic to 0.0.0.0/0 for port 443.

C : Allow HTTPS outbound traffic to the web application instances for port 443.

D : Allow HTTPS inbound traffic from the web application instances for port 443.

E : Allow HTTPS outbound traffic to the web application instances for the health check on port 8443.

F : Allow HTTPS inbound traffic from the web application instances for the health check on port 8443.

Answer: A,C,E

Question 2

A large multinational investment bank has a web application that requires a minimum of 4 EC2 instances to run to ensure that it can cater to its users across the globe. You are instructed to ensure fault tolerance of this system.

Which of the following is the best option?

Options :

A : Deploy an Auto Scaling group with 4 instances in one Availability Zone behind an Application Load Balancer.

B : Deploy an Auto Scaling group with 1 instance in each of 4 Availability Zones behind an Application Load Balancer.

C : Deploy an Auto Scaling group with 2 instances in each of 3 Availability Zones behind an Application Load Balancer.

D :

Deploy an Auto Scaling group with 2 instances in each of 2 Availability Zones behind an Application Load Balancer.

Answer: C

Question 3

A leading IT consulting company has an application which processes a large stream of financial data by an Amazon ECS Cluster then stores the result to a DynamoDB table. You have to design a solution to detect new entries in the DynamoDB table then automatically trigger a Lambda function to run some tests to verify the processed data.

What solution can be easily implemented to alert the Lambda function of new entries while requiring minimal configuration change to your architecture?

Options :

A : Enable DynamoDB Streams to capture table activity and automatically trigger the Lambda function.

B : Use CloudWatch Alarms to trigger the Lambda function whenever a new entry is created in the DynamoDB table.

C : Invoke the Lambda functions using SNS each time that the ECS Cluster successfully processed financial data.

D : Use Systems Manager Automation to detect new entries in the DynamoDB table then automatically invoke the Lambda function for processing.

Answer: A

Question 4

A client is hosting their company website on a cluster of web servers that are behind a public-facing load balancer. The client also uses Amazon Route 53 to manage their public DNS.

How should the client configure the DNS zone apex record to point to the load balancer?

Options :

A : Create an A record aliased to the load balancer DNS name.

B :

Create a CNAME record pointing to the load balancer DNS name.

C : Create an alias for CNAME record to the load balancer DNS name.

D :

Create an A record pointing to the IP address of the load balancer.

Answer: A

Question 5

A company has several web servers that need to frequently access a common Amazon RDS MySQL Multi-AZ DB instance. The company wants a secure method for the web servers to connect to the database while meeting a security requirement to rotate user credentials frequently. Which solution meets these requirements?

Options :

A :

Store the database user credentials in AWS Secrets Manager. Grant the necessary IAM permissions to allow the web servers to access AWS Secrets Manager

B :

Store the database user credentials in AWS Systems Manager OpsCenter. Grant the necessary IAM permissions to allow the web servers to access OpsCenter.

C :

Store the database user credentials in a secure Amazon S3 bucket. Grant the necessary IAM permissions to allow the web servers to retrieve credentials and access the database

D :

Store the database user credentials in files encrypted with AWS Key Management Service (AWS KMS) on the web server file system. The web server should be able to decrypt the files and access the database.

Answer: A