AWS Certified Solutions Architect – Professional 1-10

表示モード

画像位置

文字位置

理解度の自動記録

問題幅 % 60〜100%

Q1AWS Certified Solutions Architect Professional

Q1. An online learning service company runs a read-heavy web application on Amazon EKS and Amazon DynamoDB.
It uses Amazon Route 53 to manage DNS.
During peak times, hundreds of users access the application simultaneously.
Most users are located in the United States, but usage has recently been expanding in Europe and the Middle East.
The company needs to reduce application response latency for all users around the world.
Which solution meets this requirement?

A. Deploy the application to multiple AWS Regions.
Create a global secondary index (GSI) in the primary Region.
Increase the provisioned throughput of the DynamoDB read capacity units (RCUs).
Modify the application to use the GSI.
Create Route 53 failover record sets with the us-east-1 Region as the primary.
Set the eu-central-1 and me-central-1 Regions as the secondary Regions.
Configure Route 53 health checks and enable Evaluate Target Health.
B. Use a DynamoDB Accelerator (DAX) cluster with memory-optimized instances.
Deploy the application across three Availability Zones.
Modify the application to use the DAX endpoint.
Modify the Route 53 record set to use the endpoint of the new deployment.
C. Increase the compute resources of the application.
Create an Amazon CloudFront distribution and set the application endpoint as the origin.
Create a DynamoDB read replica in the primary AWS Region.
Modify the application to use the DynamoDB replica endpoint.
D. Deploy the application to multiple AWS Regions.
Convert the DynamoDB table to a global table with replicas in the target Regions.
Modify the application to access the nearest DynamoDB replica.
Create Route 53 geolocation record sets for the target Regions.
Configure Route 53 health checks and enable Evaluate Target Health.

Show answer

Correct answer: D. Deploy the application to multiple AWS Regions. Convert the DynamoDB table to a global table with replicas in the target Regions. Modify the application to access the nearest DynamoDB replica. Create Route 53 geolocation record sets for the target Regions. Configure Route 53 health checks and enable Evaluate Target Health.

To reduce latency for users worldwide, both the application and its data must be placed close to the users.
Converting DynamoDB to a global table creates a replica in each target Region, so the application can access the nearest replica with low latency.
In addition, the application is deployed to multiple Regions, and Route 53 geolocation routing directs users to their nearest Region.
Failover routing (A) is a feature for redundancy rather than proximity, and DAX (B) is limited to caching within a single Region.
CloudFront with a single-Region DB replica (C) cannot handle geographic distribution of the data layer, including writes.
Amazon DynamoDB Global Tables

Q2AWS Certified Solutions Architect Professional

Q2. A SaaS company operates its service across hundreds of production AWS accounts.
The company uses AWS Organizations with all features enabled and centrally manages backups with AWS Backup.
The company is concerned about ransomware attacks.
It has therefore established a new policy that all backups must remain unaffected even if privileged user credentials are compromised in any one of the production accounts.
Which combination of steps meets this new policy? (Choose three.)

A. Implement cross-account backup to a designated non-production account using AWS Backup vaults.
B. Add a service control policy (SCP) that restricts changes to AWS Backup vaults.
C. Implement AWS Backup Vault Lock in compliance mode.
D. Configure backup frequency, lifecycle, and retention so that at least one backup always exists in the cold tier.
E. Configure AWS Backup to write all backups to an Amazon S3 bucket in a designated non-production account.
Ensure that S3 Object Lock is enabled on that S3 bucket.
F. Implement least-privilege access on the IAM service role assigned to AWS Backup.

Show answer

Correct answer: A, B, C

To make backups that cannot be deleted even if privileged user credentials are compromised, three things are needed: isolation, immutability, and operational restriction.
Cross-account backup (A) isolates backups so that even if a production account’s administrator privileges are stolen, the separate destination account is not affected.
Vault Lock compliance mode (C) provides an immutable lock that cannot be deleted or have its retention period shortened even by the root user.
The SCP (B) prohibits changes to vaults at the organization level, so even account administrators cannot override it.
D and F are useful but do not provide direct resistance to privilege compromise, and E is not a native mechanism, so it is unsuitable.
AWS Backup Vault Lock

Q3AWS Certified Solutions Architect Professional

Q3. An online retail company runs an e-commerce application on AWS.
The application runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB).
It uses an Amazon RDS DB instance as the database backend.
Amazon CloudFront is configured with the ALB as its only origin and caches static content.
All public zones are hosted in Amazon Route 53.
After an application update, the ALB intermittently began returning 502 status codes (Bad Gateway).
The cause is malformed HTTP headers passed to the ALB.
When the solutions architect reloads the page immediately after an error occurs, it displays normally.
While work on this issue proceeds, the company needs to show visitors a custom error page instead of the standard ALB error page.
Which combination of steps meets this requirement with the least operational overhead? (Choose two.)

A. Create an Amazon S3 bucket.
Configure the S3 bucket for static website hosting.
Upload the custom error page to Amazon S3.
B. Create an Amazon CloudWatch alarm that invokes an AWS Lambda function when the ALB health check response Target.FailedHealthChecks is greater than 0.
Configure the Lambda function to change the ALB forwarding rule to point to a publicly accessible web server.
C. Add a health check to the existing Amazon Route 53 record and modify it.
Configure a fallback target for when the health check fails.
Change the DNS record to point to a publicly accessible web page.
D. Create an Amazon CloudWatch alarm that invokes an AWS Lambda function when the ALB health check response Elb.InternalError is greater than 0.
Configure the Lambda function to change the ALB forwarding rule to point to a publicly accessible web server.
E. Configure a custom error page in CloudFront by adding a custom error response.
Change the DNS record to point to a publicly accessible web page.

Show answer

Correct answer: A, E

To show your own error page instead of the 502 error returned by the ALB through CloudFront, the lowest-overhead option is the CloudFront custom error response feature.
With E, when the origin (the ALB) returns a 502, CloudFront can return your own page for the specified HTTP status.
That error page itself must be served from somewhere, so with A you configure an S3 bucket as a static site and place the custom error page there.
This combination requires no additional servers or complex failover, making operations minimal.
DNS failover using Route 53 health checks (C) is coarse-grained and operationally heavy, and B and D, which rewrite ALB rules with Lambda, are complex to implement and maintain, so they are not suitable.
Generating Custom Error Responses in CloudFront

Q4AWS Certified Solutions Architect Professional

Q4. A company operates an on-premises monitoring system that uses a PostgreSQL database to store event data.
It cannot keep up with large volumes of data ingestion, and storage shortages occur frequently.
The company plans to move to a hybrid configuration, and a VPN connection between the internal network and AWS has already been established.
The solution must have the following characteristics.
* A managed AWS service that minimizes operational effort.
* A buffer that scales automatically with data throughput and requires no ongoing management.
* A visualization tool that can build a dashboard for observing events in near real time.
* Support for semi-structured JSON data and dynamic schemas.
Which combination of components can build a monitoring solution that meets these requirements? (Choose two.)

A. Use Amazon Kinesis Data Firehose (now Amazon Data Firehose) to buffer events.
Create an AWS Lambda function to process and transform the events.
B. Create an Amazon Kinesis data stream to buffer events.
Create an AWS Lambda function to process and transform the events.
C. Set up an Amazon Aurora PostgreSQL DB cluster to receive events.
Use Amazon QuickSight to read from the database and create near-real-time visualizations and dashboards.
D. Set up Amazon Elasticsearch Service (Amazon ES / now Amazon OpenSearch Service) to receive events.
Use the Kibana (now OpenSearch Dashboards) endpoint deployed with Amazon ES to create near-real-time visualizations and dashboards.
E. Set up an Amazon Neptune DB instance to receive events.
Use Amazon QuickSight to read from the database and create near-real-time visualizations and dashboards.

Show answer

Correct answer: A, D

The requirements are four points: fully managed, an auto-scaling buffer with no management, near-real-time visualization, and support for semi-structured JSON.
Amazon Kinesis Data Firehose (now Amazon Data Firehose) is a managed buffer that requires no shard management and scales automatically, and it can also transform data with Lambda (A).
Amazon Elasticsearch Service (now Amazon OpenSearch Service) (D) can ingest dynamic-schema JSON and create near-real-time dashboards with the included Kibana.
A Kinesis data stream (B) requires shard management, which violates the no-management requirement, and Aurora (C) and Neptune (E) are not optimal for visualizing semi-structured data.
What Is Amazon Data Firehose

Q5AWS Certified Solutions Architect Professional

Q5. A company operates dozens of AWS accounts for multiple teams, applications, and environments.
The company has defined a set of custom controls that all accounts must have.
It is concerned that account misconfigurations could lead to security issues or compliance violations.
The solutions architect must design a solution that deploys these custom controls in a repeatable manner using Infrastructure as Code (IaC).
Which solution meets this requirement with the least operational overhead?

A. Configure AWS Config rules in each account to evaluate account settings against the custom controls.
Define an AWS Lambda function in an AWS CloudFormation template.
Program the Lambda function to remediate noncompliant AWS Config rules.
Deploy the CloudFormation template as a stack set when accounts are created.
Configure the stack set to invoke the Lambda function.
B. Configure AWS Systems Manager associations to remediate configuration issues across accounts.
Define the desired configuration state in an AWS CloudFormation template using AWS::SSM::Association.
Deploy the CloudFormation template as a stack set to all accounts when accounts are created.
C. Enable AWS Control Tower to set up and govern a multi-account environment.
Use blueprints that apply security best practices.
Use Customizations for AWS Control Tower and CloudFormation templates to define the custom controls for each account.
Use Amazon EventBridge to deploy Customizations for AWS Control Tower on the account provisioning lifecycle event.
D. Enable AWS Security Hub in all accounts and aggregate findings in a central administrator account.
Develop an AWS CloudFormation template that creates an Amazon EventBridge rule, an AWS Lambda function, and a CloudFormation stack in each account to remediate Security Hub findings.
Deploy the CloudFormation stack during account provisioning to set up automatic remediation.

Show answer

Correct answer: C. Enable AWS Control Tower to set up and govern a multi-account environment. Use blueprints that apply security best practices. Use Customizations for AWS Control Tower and CloudFormation templates to define the custom controls for each account. Use Amazon EventBridge to deploy Customizations for AWS Control Tower on the account provisioning lifecycle event.

The requirement is to deploy custom governance controls to dozens of accounts repeatably with IaC and minimal operations.
AWS Control Tower provides managed setup and governance of a multi-account environment and can apply best-practice blueprints.
You can define custom controls with Customizations for AWS Control Tower (CfCT) and CloudFormation, and deploy them automatically on the account provisioning lifecycle event with EventBridge.
A, B, and D, which individually implement Config rules, Lambda remediation, or Security Hub remediation in each account, involve heavy build-out and maintenance and do not represent minimal operations.
Customizations for AWS Control Tower

Q6AWS Certified Solutions Architect Professional

Q6. A solutions architect is responsible for redesigning a three-tier application that a company runs on-premises.
The application provides personalized recommendations based on user profiles.
The company already has an AWS account and has configured a VPC to host the application.
The frontend is a Java-based application running on on-premises VMs.
The company hosts its personalization model on a physical application server, and the model is implemented using TensorFlow.
This personalization model leverages artificial intelligence and machine learning (AI/ML).
User information is stored in a Microsoft SQL Server database.
The web application calls the personalization model, and the model retrieves user profiles from the database and returns recommendations.
The company wants to migrate this redesigned application to AWS.
Which solution meets this requirement with the least operational overhead?

A. Use AWS Server Migration Service (AWS SMS) to migrate the on-premises physical application server and the web application VMs to AWS.
Use AWS Database Migration Service (AWS DMS) to migrate the SQL Server database to Amazon RDS for SQL Server.
B. Export the personalization model.
Store the model artifacts in Amazon S3.
Deploy the model to Amazon SageMaker and create an endpoint.
Host the Java application on AWS Elastic Beanstalk.
Use AWS Database Migration Service (AWS DMS) to migrate the SQL Server database to Amazon RDS for SQL Server.
C. Use AWS Application Migration Service to migrate the on-premises personalization model and VMs to Amazon EC2 instances in an Auto Scaling group.
Use AWS Database Migration Service (AWS DMS) to migrate the SQL Server database to an EC2 instance.
D. Containerize the personalization model and the Java application.
Deploy the model and application to Amazon Elastic Kubernetes Service (Amazon EKS) using an Amazon EKS managed node group.
Host the node group within the VPC.
Use AWS Database Migration Service (AWS DMS) to migrate the SQL Server database to Amazon RDS for SQL Server.

Show answer

Correct answer: B. Export the personalization model. Store the model artifacts in Amazon S3. Deploy the model to Amazon SageMaker and create an endpoint. Host the Java application on AWS Elastic Beanstalk. Use AWS Database Migration Service (AWS DMS) to migrate the SQL Server database to Amazon RDS for SQL Server.

Because the requirement is to migrate the three-tier application to AWS with the least operational overhead, replacing each element with managed services is optimal.
Deploying the TensorFlow recommendation model to Amazon SageMaker and creating an endpoint provides a serverless inference platform with no server management.
The Java application runs on the managed Elastic Beanstalk, and SQL Server is migrated to Amazon RDS for SQL Server with DMS.
A and C, which migrate VMs and servers as-is to EC2, leave operational overhead, and D, which runs containers on EKS, also adds cluster-management effort, so B is the minimal-operations choice.
Deploy a Model in Amazon SageMaker

Q7AWS Certified Solutions Architect Professional

Q7. A solutions architect is reviewing an application’s resiliency before release.
The application runs on Amazon EC2 instances placed in private subnets of a VPC.
The EC2 instances are provisioned by an Auto Scaling group with both a minimum and maximum capacity of 1.
The application stores data in an Amazon RDS for MySQL DB instance.
The VPC has subnets in three Availability Zones but only one NAT gateway.
The solutions architect must propose a solution that ensures the application runs across multiple Availability Zones.
Which solution meets this requirement?

A. Deploy additional NAT gateways in the other Availability Zones.
Modify the route tables with the appropriate routes.
Change the RDS for MySQL DB instance to a Multi-AZ configuration.
Configure the Auto Scaling group to launch instances across Availability Zones.
Set the minimum and maximum capacity of the Auto Scaling group to 3.
B. Replace the NAT gateway with a virtual private gateway.
Replace the RDS for MySQL DB instance with an Amazon Aurora MySQL DB cluster.
Configure the Auto Scaling group to launch instances across all subnets in the VPC.
Set the minimum and maximum capacity of the Auto Scaling group to 3.
C. Replace the NAT gateway with a NAT instance.
Migrate the RDS for MySQL DB instance to an RDS PostgreSQL DB instance.
Launch a new EC2 instance in another Availability Zone.
D. Deploy additional NAT gateways in the other Availability Zones.
Modify the route tables with the appropriate routes.
Enable automated backups for the RDS for MySQL DB instance and change the backup retention to 7 days.
Configure the Auto Scaling group to launch instances across all subnets in the VPC.
Keep the minimum and maximum capacity of the Auto Scaling group at 1.

Show answer

Correct answer: A. Deploy additional NAT gateways in the other Availability Zones. Modify the route tables with the appropriate routes. Change the RDS for MySQL DB instance to a Multi-AZ configuration. Configure the Auto Scaling group to launch instances across Availability Zones. Set the minimum and maximum capacity of the Auto Scaling group to 3.

The requirement is to run a single-AZ configuration (a single NAT gateway, an ASG min/max of 1, and single-AZ RDS) across multiple AZs.
The correct availability design is to add a NAT gateway in each AZ, change RDS to a Multi-AZ configuration, and have the Auto Scaling group launch across multiple AZs.
Setting the ASG min/max to 3 distributes instances across the AZs.
Replacing NAT with a virtual private gateway (B), changing the DB engine (C), and keeping capacity at 1 (D) all fail to guarantee continuous operation across multiple AZs.
Amazon RDS Multi-AZ Deployments

Q8AWS Certified Solutions Architect Professional

Q8. A company has many AWS accounts and manages them centrally with AWS Organizations.
The solutions architect must implement a solution that allows a common network to be shared across multiple accounts.
The company’s infrastructure team owns a dedicated infrastructure account that has a VPC.
The infrastructure team must use this account to manage the network, and the individual accounts must not be able to manage their own network.
At the same time, each account must be able to create AWS resources within the subnets.
Which combination of actions should the solutions architect take to meet these requirements? (Choose two.)

A. Create a Transit Gateway in the infrastructure account.
B. Enable resource sharing from the AWS Organizations management account.
C. Create a VPC in each AWS account in the organization.
Configure those VPCs to share the same CIDR range and subnets as the infrastructure account’s VPC.
Peer each individual account’s VPC with the infrastructure account’s VPC.
D. Create a resource share in AWS Resource Access Manager in the infrastructure account.
Select the specific AWS Organizations OU that will use the shared network.
Select each subnet to associate with the resource share.
E. Create a resource share in AWS Resource Access Manager in the infrastructure account.
Select the specific AWS Organizations OU that will use the shared network.
Select each prefix list to associate with the resource share.

Show answer

Correct answer: B, D

The requirement to share a single VPC in the infrastructure account across multiple accounts, where each account cannot manage its own network but can create resources within the subnets, is achieved with VPC sharing (Shared VPC).
First enable resource sharing from the Organizations management account (B), then share the subnets with the target OU using AWS RAM in the infrastructure account (D).
This lets the owner centrally manage the network while participant accounts place resources in the shared subnets.
A Transit Gateway (A) is for connectivity between VPCs and is not needed for this requirement, and sharing a prefix list (E) cannot share the subnets themselves.
Share Your VPC

Q9AWS Certified Solutions Architect Professional

Q9. A company provides files to customers through an SFTP server accessible over the internet.
The SFTP server runs on a single Amazon EC2 instance with an Elastic IP address assigned.
Customers connect to the SFTP server through that Elastic IP address and authenticate with SSH.
The EC2 instance has a security group attached that allows access from all customer IP addresses.
The solutions architect must implement a solution that increases availability while minimizing infrastructure management complexity and impact on customers.
The solution must not change how customers connect.
Which solution meets this requirement?

A. Disassociate the Elastic IP address from the EC2 instance.
Create an Amazon S3 bucket to use for SFTP file hosting.
Create an AWS Transfer Family server.
Configure the Transfer Family server with a publicly accessible endpoint.
Associate the SFTP Elastic IP address with the new endpoint.
Point the Transfer Family server to the S3 bucket.
Sync all files from the SFTP server to the S3 bucket.
B. Disassociate the Elastic IP address from the EC2 instance.
Create an Amazon S3 bucket to use for SFTP file hosting.
Create an AWS Transfer Family server.
Configure the Transfer Family server with a VPC-hosted, internet-facing endpoint.
Associate the SFTP Elastic IP address with the new endpoint.
Attach a security group with the customer IP addresses to the new endpoint.
Point the Transfer Family server to the S3 bucket.
Sync all files from the SFTP server to the S3 bucket.
C. Disassociate the Elastic IP address from the EC2 instance.
Create a new Amazon Elastic File System (Amazon EFS) file system for SFTP file hosting.
Create an AWS Fargate task definition to run the SFTP server.
Specify the EFS file system as a mount in the task definition.
Create a Fargate service using the task definition, and place a Network Load Balancer (NLB) in front of the service.
When configuring the service, attach a security group with the customer IP addresses to the task running the SFTP server.
Associate the Elastic IP address with the NLB.
Sync all files from the SFTP server.
D. Disassociate the Elastic IP address from the EC2 instance.
Create a multi-attach Amazon Elastic Block Store (Amazon EBS) volume for SFTP file hosting.
Create a Network Load Balancer (NLB) with the Elastic IP address attached.
Create an Auto Scaling group of EC2 instances to run the SFTP server.
Define in the Auto Scaling group that launched instances attach the new multi-attach EBS volume.
Configure the Auto Scaling group to automatically add instances behind the NLB.
Configure the EC2 instances that the Auto Scaling group launches to use a security group that allows the customer IP addresses.
Sync all files from the SFTP server to the new multi-attach EBS volume.

Show answer

Correct answer: B. Disassociate the Elastic IP address from the EC2 instance. Create an Amazon S3 bucket to use for SFTP file hosting. Create an AWS Transfer Family server. Configure the Transfer Family server with a VPC-hosted, internet-facing endpoint. Associate the SFTP Elastic IP address with the new endpoint. Attach a security group with the customer IP addresses to the new endpoint. Point the Transfer Family server to the S3 bucket. Sync all files from the SFTP server to the S3 bucket.

The requirement is to improve availability and minimize management overhead for an internet-facing SFTP server without changing how customers connect (the same Elastic IP and SSH).
A VPC-hosted, internet-facing endpoint of AWS Transfer Family allows both Elastic IP association and source-IP restriction via security groups.
By using S3 as the backend and syncing existing files, customers can connect with the same IP and SSH as before.
A public endpoint (A) cannot be given an Elastic IP or security group, and configurations using EFS with Fargate (C) or multi-attach EBS (D) are complex and increase management overhead.
Create a Server with an Endpoint Hosted in Your VPC

Q10AWS Certified Solutions Architect Professional

Q10. A company plans to migrate its on-premises data center to the AWS Cloud.
The scope includes thousands of virtualized Linux and Microsoft Windows servers, SAN storage, Java and PHP applications that use MySQL, and Oracle databases.
There are many dependent services, both inside and outside the same data center.
The technical documentation is incomplete and outdated.
The solutions architect must understand the current environment and estimate the cost of cloud resources after migration.
Which tools or services should be used to plan the cloud migration? (Choose three.)

Show answer

Correct answer: A, D, F

You select tools for the planning phase that help you understand an environment with incomplete documentation and estimate post-migration costs.
AWS Application Discovery Service (A) automatically discovers existing servers and their dependencies, and AWS Migration Hub (F) centrally manages migration status.
The AWS Cloud Adoption Readiness Tool (CART, D) assesses migration readiness.
AWS SMS (B) is a tool for executing migration, X-Ray (C) is for application tracing, and Inspector (E) is for vulnerability assessment, none of which apply to the planning purposes of understanding the current state or estimating costs.
What Is AWS Application Discovery Service

AWS Certified Solutions Architect – Professional 1-10

Choose confidence levels to display