Question 1

An enterprise company wants to allow its developers to purchase third-party software through AWS

Marketplace. The company uses an AWS Organizations account structure with full features enabled, and has a

shared services account in each organizational unit (OU) that will be used by procurement managers. The

procurement team's policy indicates that developers should be able to obtain third-party software from an

approved list only and use Private Marketplace in AWS Marketplace to achieve this requirement . The

procurement team wants administration of Private Marketplace to be restricted to a role named

procurement-manager-role, which could be assumed by procurement managers Other IAM users groups, roles,

and account administrators in the company should be denied Private Marketplace administrative access

What is the MOST efficient way to design an architecture to meet these requirements?

Options :

A :

Create an IAM role named procurement-manager-role in all AWS accounts in the organization Add the

PowerUserAccess managed policy to the role Apply an inline policy to all IAM users and roles in every

AWS account to deny permissions on the AWSPrivateMarketplaceAdminFullAccess managed policy.

B :

Create an IAM role named procurement-manager-role in all AWS accounts in the organization Add the

AdministratorAccess managed policy to the role Define a permissions boundary with the

AWSPrivateMarketplaceAdminFullAccess managed policy and attach it to all the developer roles.

C :

Create an IAM role named procurement-manager-role in all the shared services accounts in the

organization Add the AWSPrivateMarketplaceAdminFullAccess managed policy to the role Create an

organization root-level SCP to deny permissions to administer Private Marketplace to everyone except

the role named procurement-manager-role Create another organization root-level SCP to deny

permissions to create an IAM role named procurement-manager-role to everyone in the organization.

D :

Create an IAM role named procurement-manager-role in all AWS accounts that will be used by

developers. Add the AWSPrivateMarketplaceAdminFullAccess managed policy to the role. Create an

SCP in Organizations to deny permissions to administer Private Marketplace to everyone except the role

named procurement-manager-role. Apply the SCP to all the shared services accounts in the organization.

Answer: C

Question 2

An online bank portal is using Amazon ElastiCache for Redis as its distributed session management layer as well as to store database queries that are expensive to perform. There are some queries that involve joins across multiple tables or queries with intensive calculations and the query results are stored in ElastiCache to avoid having to re-execute the same query again. The solutions architect has been instructed to improve the data durability of the ElastiCache Redis cluster in the event of a hardware fault in an underlying physical server or if the node is accidentally rebooted. In addition, the solutions architect must ensure that there is low data loss potential with minimal downtime.

Which of the following option is the most suitable solution to meet the company requirements?

Options :

A : Set up a Multi-AZ with automatic failover.

B : Schedule a daily automatic backup of the cluster, which writes all data from the cache to a Redis RDB file every midnight.

C : Improve the cache hit ratio of your Redis cluster.

D : Enable the Redis append-only file feature (AOF).

Answer: A

Question 3

A leading financial company owns multiple AWS accounts that are consolidated under one AWS Organization. To properly manage all of the resources in your organization, the solutions architect has been tasked to ensure that the tags are always added when users create any resources across all the accounts.

Which of the following options are the recommended actions to achieve the company requirements? (Select TWO.)

Options :

A : Set up the CloudFormation Resource Tags property to apply tags to certain resource types upon creation.

B : Set up AWS Service Catalog to tag the provisioned resources with corresponding unique identifiers for portfolio, product, and users.

C : Set up AWS generated tags by activating it in the Billing and Cost Management console of the member account.

D : Set up AWS Systems Manager Automation to automatically add tags to your provisioned resources.

E : Set up AWS Config to add the corresponding tags to your resources right from the very moment that they are created.

Answer: A,B

Question 4

A company has 10 accounts that are part of an organization in AWS Organizations AWS Config is configured

in each account All accounts belong to either the Prod OU or the NonProd OU

The company has set up an Amazon EventBridge rule in each AWS account to notify an Amazon Simple

Notification Service (Amazon SNS) topic when an Amazon EC2 security group inbound rule is created with

0.0.0.0/0 as the source The company's security team is subscribed to the SNS topic

For all accounts in the NonProd OU the security team needs to remove the ability to create a security group

inbound rule that includes 0.0.0.0/0 as the source

Which solution will meet this requirement with the LEAST operational overhead?

Options :

A : Modify the EventBridge rule to invoke an AWS Lambda function to remove the security group inbound

rule and to publish to the SNS topic Deploy the updated rule to the NonProd OU

B : Add the vpc-sg-open-only-to-authorized-ports AWS Config managed rule to the NonProd OU

C :

Configure an SCP to allow the ec2 AulhonzeSecurityGrouplngress action when the value of the aws Sourcelp condition key is not 0.0.0.0/0 Apply the SCP to the NonProd OU

D :

Configure an SCP to deny the ec2 AuthorizeSecurityGrouplngress action when the value of the aws Sourcelp condition key is 0.0.0.0/0 Apply the SCP to the NonProd OU

Answer: D

Question 5

A company has a critical application in which the data tier is deployed in a single AWS Region. The data tier uses an Amazon DynamoDB table and an Amazon Aurora MySQL DB cluster. The current Aurora MySQL engine version supports a global database. The application tier is already deployed in two Regions.

Company policy states that critical applications must have application tier components and data tier components deployed across two Regions. The RTO and RPO must be no more than a few minutes each. A solutions architect must recommend a solution to make the data tier compliant with company policy.

Which combination of steps will meet these requirements? (Choose two.)

Options :

A : Add another Region to the Aurora MySQL DB cluster

B : Add another Region to each table in the Aurora MySQL DB cluster

C : Set up scheduled cross-Region backups for the DynamoDB table and the Aurora MySQL DB cluster

D : Convert the existing DynamoDB table to a global table by adding another Region to its configuration

E : Use Amazon Route 53 Application Recovery Controller to automate database backup and recovery to the secondary Region

Answer: A,D