Amazon-Web-Services SAP-C01 Braindump 2021

NEW QUESTION 1
A retail company processes point-of-state data on application servers in its data center and writes outputs to Amazon DynamoDB table. The data center is connected to the company’s VPC with an AWS Direct Connect (DX) connection, and the application servers require a consistent network connection at speed greater than 2 Gbps.
The company decides that the DynamoDB table needs to be highly available and fault tolerant. The company policy states that the data should be available across two regions.
What changes should the company make to meet these requirements?

• A. Establish a second DX connection for redundanc
• B. Use DynamoDB global tables to replicate data to a second Region modify the application to fail over to the second Region.
• C. Use an AWS managed VPN as a backup to D
• D. Create an identical DynamoDB table in a second Regio
• E. Modify the application to replicate data to both regions.
• F. Establish a second DX connection for redundanc
• G. Create an identical DynamoDB table in a second Regio
• H. Enable DynamoDB auto scaling to manage throughput capacit
• I. Modify the application to write to the second Region.
• J. Use AWS managed VPN as a backup to D
• K. Create an identical DynamoDB table in a second Region.Enable DynamoDB streams to capture changes to the tabl
• L. Use AWS Lambda to replicate changes to the second Region.

Answer: A

NEW QUESTION 2
An enterprise runs 103 line-of-business applications on virtual machines in an on-premises data center. Many of the applications are simple PHP, Java, or Ruby web applications, are no longer actively developed, and serve little traffic.
Which approach should be used to migrate these applications to AWS with the LOWEST infrastructure costs ?

• A. Deploy the applications to single-instance AWS Elastic Beanstalk environments without a load balancer.
• B. Use AWS SMS to create AMIs for each virtual machine and run them in Amazon EC2.
• C. Convert each application to a Docker image and deploy to a small Amazon ECS cluster behind an Application Load Balancer.
• D. Use VM Import/Export to create AMIs for each virtual machine and run them in single-instance AWS Elastic Beanstalk environments by configuring a custom image.

Answer: A

Explanation:
https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features-managing-env-types.html

NEW QUESTION 3
A Solutions Architect is working with a company that is extremely sensitive to its IT costs and wishes to implement controls that will result in a predictable AWS spend each month.
Which combination of steps can help the company control and monitor its monthly AWS usage to achieve a cost that is as close as possible to the target amount? (Choose three.)

• A. Implement an IAM policy that requires users to specify a ‘workload’ tag for cost allocation when launching Amazon EC2 instances.
• B. Contact AWS Support and ask that they apply limits to the account so that users are not able to launch more than a certain number of instance types.
• C. Purchase all upfront Reserved Instances that cover 100% of the account’s expected Amazon EC2 usage.
• D. Place conditions in the users’ IAM policies that limit the number of instances they are able to launch.
• E. Define ‘workload’ as a cost allocation tag in the AWS Billing and Cost Management console.
• F. Set up AWS Budgets to alert and notify when a given workload is expected to exceed a defined cost.

Answer: AEF

NEW QUESTION 4
A company has a website that enables users to upload videos Company policy states the uploaded videos must be analyzed for restricted content An uploaded video is placed in Amazon S3, and a message is pushed to an Amazon SQS queue with the video's location A backend application pulls this location from Amazon SQS and analyzes the video
The video analysis is compute-intensive and occurs sporadically during the day The website scales with demand The video analysis application runs on a fixed number of instances Peak demand occurs during the holidays, so the company must add instances to the application during this time All instances used are currently on-demand Amazon EC2 T2 instances The company wants to reduce the cost of the current solution.
Which of the following solutions is MOST cost-effective?

• A. Keep the website on T2 instances Determine the minimum number of website instances required during off-peak times and use Spot Instances to cover them while using Reserved Instances to covet peak demand Use Amazon EC2 R4 and Amazon EC2 R5 Reserved Instances in an Auto Scaling group for the video analysis application
• B. Keep the website on 12 instances Determine the minimum number of website instances required during off-peak times and use Reserved Instances to cover them while using On-Demand Instances to cover peak demand Use Spot Fleet for thevideo analysis application comprised of Amazon EC2 C4 and Amazon EC2 C5 Spot Instances
• C. Migrate the website to AWS Elastic Beanstalk and Amazon EC2 C4 instances Determine the minimum number of website instances required during off-peak times and use On-Demand instances to cover them while using Spot capacity to cover peak demand Use Spot Fleet for the video analysis application comprised of C4 and Amazon EC2 C5 instances
• D. Migrate the website to AWS Elastic Beanstalk and Amazon EC2 R4 instances Determine the minimum number of website instances required during off-peak times and use Reserved Instances to cover them while using On-Demand Instances to cover peak demand Use Spot Fleet for the video analysis application comprised of R4 and Amazon EC2 R5 instances.

Answer: B

NEW QUESTION 5
A company has a 24 TB MySQL database in its on-premises data center that grows at the rate of 10 GB per day. The data center is connected to the company’s AWS infrastructure with a 50 Mbps VPN connection.
The company is migrating the application and workload to AWS. The application code is already installed and tested on Amazon EC2. The company now needs to migrate the database and wants to go live on AWS within 3 weeks.
Which of the following approaches meets the schedule with LEAST downtime?

• A. 1. Use the VM Import/Export service to import a snapshot on the on-premises database into AWS.2.Launch a new EC2 instance from the snapshot.3. Set up ongoing database replication from on premises to the EC2 database over the VPN.4. Change the DNS entry to point to the EC2 database.5. Stop the replication.
• B. 1. Launch an AWS DMS instance.2. Launch an Amazon RDS Aurora MySQL DB instance.3. Configure the AWS DMS instance with on-premises and Amazon RDS database information.4. Start the replication task within AWS DMS over the VPN.5. Change the DNS entry to point to the Amazon RDS MySQL database.6. Stop the replication.
• C. 1. Create a database export locally using database-native tools.2. Import that into AWS using AWS Snowball.3. Launch an Amazon RDS Aurora DB instance.4. Load the data in the RDS Aurora DB instance from the export.5. Set up database replication from the on-premises database to the RDS Aurora DB instance over the VPN.6. Change the DNS entry to point to the RDS Aurora DB instance.7. Stop the replication.
• D. 1. Take the on-premises application offline.2. Create a database export locally using database-native tools.3. Import that into AWS using AWS Snowball.4. Launch an Amazon RDS Aurora DB instance.5. Load the data in the RDS Aurora DB instance from the export.6. Change the DNS entry to point to the Amazon RDS Aurora DB instance.7. Put the Amazon EC2 hosted application online.

Answer: C

NEW QUESTION 6
A Solution Architect is designing a deployment strategy for an application tier and gas the following requirements.
* The application code will need a 500 HB static dataset to be present before application startup.
* The application tier be able to scale Up and down based on demand with as little startup time as possible.
* The development team should be able to update the code multiple times each day.
* Critical operating system (OS) patches must be installed within 48 hours of being released. Which deployment strategy meets these requirements?

• A. Use AWS Manager to create a new AMI with the updated OS patches . Update the Auto Scaling group to use the patches AMI and replace existing unpatche
• B. Use AWS CodeDeploy to push the application code to the instance
• C. Store the static data in Amazon EFS.
• D. Use AWS System Manager to create a new AMI with upload OS patche
• E. Update the Auto Scaling group to use the patches AMI and replace existing unpatches and the application code as a batch job every nigh
• F. Store the static data in Amazon EFS.
• G. Use an Amazon provided AMI for the OS Configure an Auto Scaling group set to a static instance coun
• H. Configure an Amazon EC2 data script to download the data from Amazon S3 install OS patches with AWS system Manager when they are release
• I. Use Codedeploy to push the application code to the instances.
• J. Use an Amazon provided AMI for the OS Configure an Auto Scaling group Configure an Amazon EC2 user data script to download the data from Amazon S3. Replace existing instances after eachAmazon-provided AMI releas
• K. Use AWS CodeDeploy to push the application code to the instances.

Answer: C

NEW QUESTION 7
A retail company is running an application that stores invoice files in Amazon S3 bucket and metadata about the files in an Amazon. The S3 bucket and DynamoDB table are in us-east-1. The company wants to protect itself from data corruption and loss of connectivity to either Region.
Which option meets these requirements?

• A. Create a DynamoDB global table to replicate data between us-east-1 and eu-west-1. Enable continuous backup on the DynamoDB table in us-east-1. Enable versioning on the S3 bucket.
• B. Create an AWS Lambda function triggered by Amazon CloudWatch Events to make regular backups of the DynamoDB tabl
• C. Set up S3 cross-region replication from us-east-1 to eu-west-1. Set up MFA deleteon the S3 bucket in us-east-1.
• D. Create a DynamoDB global table to replicate data between us-east-1 and eu-west-1. Enable versioning on the S3 bucke
• E. Implement strict ACLs on the S3 bucket.
• F. Create a DynamoDB global table to replicate data between us-east-1 and eu-west-1. Enable continuous backup on the DynamoDB table in us-east-1. Set up S3 cross-region replication from us-east-1 toeu-west-1.

Answer: A

Explanation:
https://aws.amazon.com/blogs/aws/new-cross-region-replication-for-amazon-s3/

NEW QUESTION 8
A Company has a security event whereby an Amazon S3 bucket with sensitive information was made public. Company policy is to never have public S3 objects, and the Compliance team must be informed immediately when any public objects are identified.
How can the presence of a public S3 object be detected, set to trigger alarm notifications, and automatically remediated in the future? (Choose two.)

• A. Turn on object-level logging for Amazon S3. Turn on Amazon S3 event notifications to notify by using an Amazon SNS topic when a PutObject API call is made with a public-read permission.
• B. Configure an Amazon CloudWatch Events rule that invokes an AWS Lambda function to secure the S3 bucket.
• C. Use the S3 bucket permissions for AWS Trusted Advisor and configure a CloudWatch event to notify by using Amazon SNS.
• D. Turn on object-level logging for Amazon S3. Configure a CloudWatch event to notify by using an SNS topic when a PutObject API call with public-read permission is detected in the AWS CloudTrail logs.
• E. Schedule a recursive Lambda function to regularly change all object permissions inside the S3 bucket.

Answer: BD

Explanation:
https://aws.amazon.com/blogs/security/how-to-detect-and-automatically-remediate-unintended-permissions-in-a

NEW QUESTION 9
A photo-sharing and publishing company receives 10,000 to 150,000 images daily. The company receives the images from multiple suppliers and users registered with the service. The company is moving to AWS and wants to enrich the existing metadata by adding data using Amazon Rekognition.
The following is an example of the additional data:

As part of the cloud migration program, the company uploaded existing image data to Amazon S3 and told users to upload images directly to Amazon S3.
What should the Solutions Architect do to support these requirements?

• A. Trigger AWS Lambda based on an S3 event notification to create additional metadata using Amazon Rekognitio
• B. Use Amazon DynamoDB to store the metadata and Amazon ES to create an inde
• C. Use a web front-end to provide search capabilities backed by Amazon ES.
• D. Use Amazon Kinesis to stream data based on an S3 even
• E. Use an application running in Amazon EC2 to extract metadata from the image
• F. Then store the data on Amazon DynamoDB and Amazon CloudSearch and create an inde
• G. Use a web front-end with search capabilities backed by CloudSearch.
• H. Start an Amazon SQS queue based on S3 event notification
• I. Then have Amazon SQS send the metadata information to Amazon DynamoD
• J. An application running on Amazon EC2 extracts data from Amazon Rekognition using the API and adds data to DynamoDB and Amazon E
• K. Use a web front-end to provide search capabilities backed by Amazon ES.
• L. Trigger AWS Lambda based on an S3 event notification to create additional metadata using Amazon Rekognitio
• M. Use Amazon RDS MySQL Multi-AZ to store the metadata information and use Lambda to create an inde
• N. Use a web front-end with search capabilities backed by Lambda.

Answer: A

Explanation:
https://github.com/aws-samples/lambda-refarch-imagerecognition

NEW QUESTION 10
A company has decided to move some workloads onto AWS to create a grid environment to run market analytics. The grid will consist of many similar instances, spun-up by a job-scheduling function. Each time a large analytics workload is completed, a new VPC is deployed along with job scheduler and grid nodes. Multiple grids could be running in parallel.
Key requirements are:
Grid instances must communicate with Amazon S3 retrieve data to be processed.
Grid instances must communicate with Amazon DynamoDB to track intermediate data,
The job scheduler need only to communicate with the Amazon EC2 API to start new grid nodes.
A key requirement is that the environment has no access to the internet, either directly or via the on-premises proxy. However, the application needs to be able to seamlessly communicate to Amazon S3, Amazon DynamoDB, and Amazon EC2 API, without the need for reconfiguration for each new deployment.
Which of the following should the Solutions Architect do to achieve this target architecture? (Choose three.)

• A. Enable VPC endpoints for Amazon S3 and DynamoDB.
• B. Disable Private DNS Name Support.
• C. Configure the application on the grid instances to use the private DNS name of the Amazon S3 endpoint.
• D. Populate the on-premises DNS server with the private IP addresses of the EC2 endpoint.
• E. Enable an interface VPC endpoint for EC2.
• F. Configure Amazon S3 endpoint policy to permit access only from the grid nodes.

Answer: ACE

Explanation:
https://aws.amazon.com/premiumsupport/knowledge-center/connect-s3-vpc-endpoint/ https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html

NEW QUESTION 11
A retail company has a custom NET web application running on AWS that uses Microsoft SQL Server for the database The application servers maintain a user's session locally.
Which combination of architecture changes are needed ensure all tiers of the solution are highly available? (Select THREE.)

• A. Refactor the application to store the user's session in Amazon ElastiCache Use Application Load Balancers to distribute the load between application instances
• B. Set up the database to generate hourly snapshots using Amazon EBS Configure an Amazon CloudWatch Events rule to launch a new database instance if the primary one fails
• C. Migrate the database to Amazon RDS tor SQL Server Configure the RDS instance to use a Multi-AZ deployment
• D. Move the NET content to an Amazon S3 bucket Configure the bucket for static website hosting
• E. Put the application instances in an Auto Scaling group Configure the Auto Scaling group to create new instances if an instance becomes unhealthy
• F. Deploy Amazon CloudFront in front of the application tier Configure CloudFront to serve content from healthy application instances only

Answer: BDE

NEW QUESTION 12
A large company experienced a drastic increase in its monthly AWS spend. This is after Developers accidentally launched Amazon EC2 instances in unexpected regions. The company has established practices around least privileges for Developers and controls access to on-premises resources using Active Directory groups. The company now wants to control costs by restricting the level of access that Developers have to the AWS Management Console without impacting their productivity. The company would also like to allow Developers to launch Amazon EC2 in only one region, without limiting access to other services in any region.
How can this company achieve these new security requirements while minimizing the administrative burden on the Operations team?

• A. Set up SAML-based authentication tied to an IAM role that has an AdministrativeAccess managed policy attached to i
• B. Attach a customer managed policy that denies access to Amazon EC2 in each region except for the one required.
• C. Create an IAM user for each Developer and add them to the developer IAM group that has the PowerUserAccess managed policy attached to i
• D. Attach a customer managed policy that allows the Developers access to Amazon EC2 only in the required region.
• E. Set up SAML-based authentication tied to an IAM role that has a PowerUserAccess managed policy and a customer managed policy that deny all the Developers access to any AWS services except AWS Service Catalo
• F. Within AWS Service Catalog, create a product containing only the EC2 resources in the approved region.
• G. Set up SAML-based authentication tied to an IAM role that has the PowerUserAccess managed policy attached to i
• H. Attach a customer managed policy that denies access to Amazon EC2 in each region except for the one required.

Answer: D

Explanation:
The tricks here are: - SAML for AD federation and authentication - PowerUserAccess vs AdministrativeAccess. (PowerUSer has less privilege, which is the required once for developers). Admin, has more rights. The description of "PowerUser access" given by AWS is “Provides full access to AWS services and resources, but does not allow management of Users and groups.”

NEW QUESTION 13
A company has developed a web application that runs on Amazon EC2 instances in one AWS Region. The company has taken on new business in other countries and must deploy its application into other to meet low-latency requirements for its users. The regions can be segregated, and an application running in one region does not need to communicate with instances in other regions.
How should the company’s Solutions Architect automate the deployment of the application so that it can be MOST efficiently deployed into multiple regions?

• A. Write a bash script that uses the AWS CLI to query the current state in one region and output a JSON representatio
• B. Pass the JSON representation to the AWS CLI, specifying the --region parameter to deploy the application to other regions.
• C. Write a bash script that uses the AWS CLI to query the current state in one region and output an AWS CloudFormation templat
• D. Create a CloudFormation stack from the template by using the AWS CLI, specifying the --region parameter to deploy the application to other regions.
• E. Write a CloudFormation template describing the application’s infrastructure in the resources section.Create a CloudFormation stack from the template by using the AWS CLI, specify multiple regions using the --regions parameter to deploy the application.
• F. Write a CloudFormation template describing the application’s infrastructure in the Resources section.Use a CloudFormation stack set from an administrator account to launch stack instances that deploy the application to other regions.

Answer: D

Explanation:
A stack set lets you create stacks in AWS accounts across regions by using a single AWS CloudFormation template. All the resources included in each stack are defined by the stack set's AWS CloudFormation template. As you create the stack set, you specify the template to use, as well as any parameters and
capabilities that template requires. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html
https://sanderknape.com/2021/07/cloudformation-stacksets-automated-cross-account-region-deployments/

NEW QUESTION 14
A company stores sales transaction data in Amazon DynamoDB tables. To detect anomalous behaviors and respond quickly, all changes to the items stored in the DynamoDB tables must be logged within 30 minutes. Which solution meets the requirements?

• A. Copy the DynamoDB tables into Apache Hive tables on Amazon EMR every hour and analyze them for anomalous behavior
• B. Send Amazon SNS notifications when anomalous behaviors are detected.
• C. Use AWS CloudTrail to capture all the APIs that change the DynamoDB table
• D. Send SNS notifications when anomalous behaviors are detected using CloudTrail event filtering.
• E. Use Amazon DynamoDB Streams to capture and send updates to AWS Lambd
• F. Create a Lambda function to output records to Amazon Kinesis Data Stream
• G. Analyze any anomalies with Amazon Kinesis Data Analytic
• H. Send SNS notifications when anomalous behaviors are detected.
• I. Use event patterns in Amazon CloudWatch Events to capture DynamoDB API call events with an AWS Lambda function as a target to analyze behavio
• J. Send SNS notifications when anomalous behaviors are detected.

Answer: C

Explanation:
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Streams.html

NEW QUESTION 15
A company wants to move a web application to AWS. The application stores session information locally on each web server, which will make auto scaling difficult. As part of the migration, the application will be rewritten to decouple the session data from the web servers. The company requires low latency, scalability, and availability.
Which service will meet the requirements for storing the session information in the MOST cost-effective way?

• A. Amazon ElastiCache with the Memcached engine
• B. Amazon S3
• C. Amazon RDS MySQL
• D. Amazon ElastiCache with the Redis engine

Answer: D

Explanation:
https://aws.amazon.com/caching/session-management/ https://aws.amazon.com/elasticache/redis-vs-memcached/

NEW QUESTION 16
A group of research institutions and hospitals are in a partnership to study 2 PBs of genomic data. The institute that owns the data stores it in an Amazon S3 bucket and updates it regularly. The institute would like to give all of the organizations in the partnership read access to the data. All members of the partnership are extremely cost-conscious, and the institute that owns the account with the S3 bucket is concerned about covering the costs for requests and data transfers from Amazon S3.
Which solution allows for secure datasharing without causing the institute that owns the bucket to assume all the costs for S3 requests and data transfers?

• A. Ensure that all organizations in the partnership have AWS account
• B. In the account with the S3 bucket, create a cross-account role for each account in the partnership that allows read access to the dat
• C. Have the organizations assume and use that read role when accessing the data.
• D. Ensure that all organizations in the partnership have AWS account
• E. Create a bucket policy on the bucket that owns the dat
• F. The policy should allow the accounts in the partnership read access to the bucke
• G. Enable Requester Pays on the bucke
• H. Have the organizations use their AWS credentials whenaccessing the data.
• I. Ensure that all organizations in the partnership have AWS account
• J. Configure buckets in each of the accounts with a bucket policy that allows the institute that owns the data the ability to write to the bucke
• K. Periodically sync the data from the institute’s account to the other organization
• L. Have the organizations use their AWS credentials when accessing the data using their accounts.
• M. Ensure that all organizations in the partnership have AWS account
• N. In the account with the S3 bucket, create a cross-account role for each account in the partnership that allows read access to the dat
• O. Enable Requester Pays on the bucke
• P. Have the organizations assume and use that read role when accessing the data.

Answer: B

Explanation:
https://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html

NEW QUESTION 17
An online retailer needs to regularly process large product catalogs, which are handled in batches. These are sent out to be processed by people using the Amazon Mechanical Turk service, but the retailer has asked its Solutions Architect to design a workflow orchestration system that allows it to handle multiple concurrent Mechanical Turk operations, deal with the result assessment process, and reprocess failures.
Which of the following options gives the retailer the ability to interrogate the state of every workflow with the LEAST amount of implementation effort?

• A. Trigger Amazon CloudWatch alarms based upon message visibility in multiple Amazon SQS queues (one queue per workflow stage) and send messages via Amazon SNS to trigger AWS Lambda functions to process the next ste
• B. Use Amazon ES and Kibana to visualize Lambda processing logs to see the workflow states.
• C. Hold workflow information in an Amazon RDS instance with AWS Lambda functions polling RDS for status change
• D. Worker Lambda functions then process the next workflow step
• E. Amazon QuickSight will visualize workflow states directly out of Amazon RDS.
• F. Build the workflow in AWS Step Functions, using it to orchestrate multiple concurrent workflow
• G. The status of each workflow can be visualized in the AWS Management Console, and historical data can be written to Amazon S3 and visualized using Amazon QuickSight.
• H. Use Amazon SWF to create a workflow that handles a single batch of catalog records with multiple worker tasks to extract the data, transform it, and send it through Mechanical Tur
• I. Use Amazon ES and Kibana to visualize AWS Lambda processing logs to see the workflow states.

Answer: C

Explanation:
AWS Step Functions is a fully managed service that makes it easy to coordinate the components of distributed applications and microservices using visual workflows. Instead of writing a Decider program, you define state machines in JSON. AWS customers should consider using Step Functions for new applications. If Step Functions does not fit your needs, then you should consider Amazon Simple Workflow (SWF). Amazon SWF provides you complete control over your orchestration logic, but increases the complexity of developing applications. You may write decider programs in the programming language of your choice, or you may use the Flow framework to use programming constructs that structure asynchronous interactions for you. AWS will continue to provide the Amazon SWF service, Flow framework, and support all Amazon SWF customers. https://aws.amazon.com/swf/faqs/

NEW QUESTION 18
A company is running an email application across multiple AWS Regions. The company uses Ohio (us-east-2) as the primary Region and Northern Virginia (us-east-1) as the Disaster Recovery (DR) Region. The data is continuously replicated from the primary Region to the DR Region by a single instance on the public subnet in both Regions. The replication messages between the Regions have a significant backlog during certain times of the day. The backlog clears on its own after a short time, but it affects the application’s RPO.
Which of the following solutions should help remediate this performance problem? (Select TWO)

• A. Increase the size of the instances.
• B. Have the instance in the primary Region write the data to an Amazon SQS queue in the primary Region instead, and have the instance in the DR Region poll from this queue.
• C. Use multiple instances on the primary and DR Regions to send and receive the replication data.
• D. Change the DR Region to Oregon (us-west-2) instead of the current DR Region.
• E. Attach an additional elastic network interface to each of the instances in both Regions and set up load balancing between the network interfaces.

Answer: AC

NEW QUESTION 19
A company needs to run a software package that has a license that must be run on the same physical host for the duration of its use. The software package is only going to be used for 90 days. The company requires patching and restarting of all instances every 30 days.
How can these requirements be met using AWS?

• A. Run a dedicated instance with auto-placement disabled.
• B. Run the instance on a dedicated host with Host Affinity set to Host.
• C. Run an On-Demand instance with a Reserved Instance to ensure consistent placement.
• D. Run the instance on a licensed host with termination set for 90 days.

Answer: B

Explanation:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/how-dedicated-hosts-work.html

NEW QUESTION 20
A company is using AWS CloudFormation to deploy its infrastructure. The company is concerned that, if a production CloudFormation stack is deleted, important data stored in Amazon RDS databases or Amazon EBS volumes might also be deleted.
How can the company prevent users from accidentally deleting data in this way?

• A. Modify the CloudFormation templates to add a DeletionPolicy attribute to RDS and EBS resources.
• B. Configure a stack policy that disallows the deletion of RDS and EBS resources.
• C. Modify IAM policies to deny deleting RDS and EBS resources that are tagged with an “aws:cloudformation:stack-name” tag.
• D. Use AWS Config rules to prevent deleting RDS and EBS resources.

Answer: A

Explanation:
With the DeletionPolicy attribute you can preserve or (in some cases) backup a resource when its stack is deleted. You specify a DeletionPolicy attribute for each resource that you want to control. If a resource has no DeletionPolicy attribute, AWS CloudFormation deletes the resource by default. To keep a resource when its stack is deleted, specify Retain for that resource. You can use retain for any resource. For example, you can retain a nested stack, Amazon S3 bucket, or EC2 instance so that you can continue to use or modify those resources after you delete their stacks. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html

NEW QUESTION 21
A bank is re-architecting its mainframe-based credit card approval processing application to a cloud-native application on the AWS cloud.
The new application will receive up to 1,000 requests per second at peak load. There are multiple steps to each transaction, and each step must receive the result of the previous step. The entire request must return an authorization response within less than 2 seconds with zero data loss. Every request must receive a response. The solution must be Payment Card Industry Data Security Standard (PCI DSS)-compliant.
Which option will meet all of the bank’s objectives with the LEAST complexity and LOWEST cost while also meeting compliance requirements?

• A. Create an Amazon API Gateway to process inbound requests using a single AWS Lambda task that performs multiple steps and returns a JSON object with the approval statu
• B. Open a support case to increase the limit for the number of concurrent Lambdas to allow room for bursts of activity due to the new application.
• C. Create an Application Load Balancer with an Amazon ECS cluster on Amazon EC2 Dedicated instances in a target group to process incoming request
• D. Use Auto Scaling to scale the cluster out/in based on average CPU utilizatio
• E. Deploy a web service that processes all of the approval steps and returns a JSON object with the approval status.
• F. Deploy the application on Amazon EC2 on Dedicated Instance
• G. Use an Elastic Load Balancer in front of a farm of application servers in an Auto Scaling group to handle incoming request
• H. Scale out/in based on a custom Amazon CloudWatch metric for the number of inbound requests per second after measuring the capacity of a single instance.
• I. Create an Amazon API Gateway to process inbound requests using a series of AWS Lambda processes, each with an Amazon SQS input queu
• J. As each step completes, it writes its result to the next step’s queu
• K. The final step returns a JSON object with the approval statu
• L. Open a support case to increase the limit for the number of concurrent Lambdas to allow room for bursts of activity due to the new application.

Answer: B

NEW QUESTION 22
......