AWS CERTIFIED SOLUTIONS ARCHITECT
TEST BANK UPDATED FULL QUESTIONS
AND ACCURATE SOLUTIONS
●● You have been evaluating the NACLs in your company. Most of the
NACLs are configured the same:
100 All Traffic Allow
200 All Traffic Deny
* All Traffic Deny
How can the last rule * All Traffic Deny be edited?
Answer: You can't modify or remove this rule.
●● A new startup company decides to use AWS to host their web
application. They configure a VPC as well as two subnets within the
VPC. They also attach an internet gateway to the VPC. In the first
subnet, they create the EC2 instance which will host their web
application. They confirm that the web application can be accessed via
the internet. They then deploy a second application to an instance
running in the second subnet, but when checking this application cannot
be reached. Which of the following are potential reasons for this
happening?
Answer: - The EC2 instance does not have a public IP address.
,- The second subnet does not have a route in the route table to the
internet gateway.
●● You have been evaluating the NACLs in your company. Currently,
you are looking at the default network ACL. What is true about the
default network ACL?
Answer: You can add or remove rules from the default network ACL.
●● You work in healthcare for an IVF clinic. You host an application on
AWS, which allows patients to track their medication during IVF cycles.
The application also allows them to view test results, which contain
sensitive medical data. You have a regulatory requirement that the
application is secure and you must use a firewall managed by AWS that
enables control and visibility over VPC-to-VPC traffic and prevents the
VPCs hosting your sensitive application resources from accessing
domains using unauthorized protocols. What AWS service would
support this?
Answer: AWS Network Firewall
●● A small software team is creating an application which will give
subscribers real-time weather updates. The application will run on EC2
and will make several requests to AWS services such as S3 and
DynamoDB. What is the best way to grant permissions to these other
AWS services?
,Answer: Create an IAM role that you attach to the EC2 instance to give
temporary security credentials to applications running on the instance.
●● An international company has many clients around the world. These
clients need to transfer gigabytes to terabytes of data quickly and on a
regular basis to an S3 bucket. Which S3 feature will enable these long
distance data transfers in a secure and fast manner?
Answer: Transfer Acceleration
●● Recent worldwide events have dictated that you perform your duties
as a Solutions Architect from home. You need to be able to manage
several EC2 instances while working from home and have been testing
the ability to SSH into these instances. One instance in particular has
been a problem and you cannot SSH into this instance. What should you
check first to troubleshoot this issue?
Answer: Make sure that the security group for the instance allows
inbound on port 22 from your home IP address
●● Your company is storing highly sensitive data in S3 Buckets. The
data includes personal and financial information. An audit has
determined that this data must be stored in a secured manner and any
data stored in the buckets already or data coming into the buckets must
be analyzed and alerts sent out flagging improperly stored data. Which
AWS service can be used to meet this requirement?
Answer: Amazon Macie
, ●● A new startup company decides to use AWS to host their web
application. They configure a VPC as well as two subnets within the
VPC. They also attach an internet gateway to the VPC. In the first
subnet, they create an EC2 instance to host a web application. There is a
network ACL and a security group, which both have the proper ingress
and egress to and from the internet. There is a route in the route table to
the internet gateway. The EC2 instances added to the subnet need to
have a globally unique IP address to ensure internet access. Which
option below would not be classed as a globally unique IP address?
Answer: Private IP address
●● A company has a great deal of data in S3 buckets for which they
want to create a database. Creating the RDS database, normalizing the
data, and migrating to the RDS database will take time and is the long-
term plan. But there's an immediate need to query this data to retrieve
information necessary for an audit. Which AWS service will enable
querying data in S3 using standard SQL commands?
Answer: Amazon Athena
●● Several instances you are creating have a specific data requirement.
The requirement states that the data on the root device needs to persist
independently from the lifetime of the instance. After considering AWS
storage options, which is the simplest way to meet these requirements?
Answer: Store your root device data on Amazon EBS and set the
DeleteOnTermination attribute to false using a block device mapping.
TEST BANK UPDATED FULL QUESTIONS
AND ACCURATE SOLUTIONS
●● You have been evaluating the NACLs in your company. Most of the
NACLs are configured the same:
100 All Traffic Allow
200 All Traffic Deny
* All Traffic Deny
How can the last rule * All Traffic Deny be edited?
Answer: You can't modify or remove this rule.
●● A new startup company decides to use AWS to host their web
application. They configure a VPC as well as two subnets within the
VPC. They also attach an internet gateway to the VPC. In the first
subnet, they create the EC2 instance which will host their web
application. They confirm that the web application can be accessed via
the internet. They then deploy a second application to an instance
running in the second subnet, but when checking this application cannot
be reached. Which of the following are potential reasons for this
happening?
Answer: - The EC2 instance does not have a public IP address.
,- The second subnet does not have a route in the route table to the
internet gateway.
●● You have been evaluating the NACLs in your company. Currently,
you are looking at the default network ACL. What is true about the
default network ACL?
Answer: You can add or remove rules from the default network ACL.
●● You work in healthcare for an IVF clinic. You host an application on
AWS, which allows patients to track their medication during IVF cycles.
The application also allows them to view test results, which contain
sensitive medical data. You have a regulatory requirement that the
application is secure and you must use a firewall managed by AWS that
enables control and visibility over VPC-to-VPC traffic and prevents the
VPCs hosting your sensitive application resources from accessing
domains using unauthorized protocols. What AWS service would
support this?
Answer: AWS Network Firewall
●● A small software team is creating an application which will give
subscribers real-time weather updates. The application will run on EC2
and will make several requests to AWS services such as S3 and
DynamoDB. What is the best way to grant permissions to these other
AWS services?
,Answer: Create an IAM role that you attach to the EC2 instance to give
temporary security credentials to applications running on the instance.
●● An international company has many clients around the world. These
clients need to transfer gigabytes to terabytes of data quickly and on a
regular basis to an S3 bucket. Which S3 feature will enable these long
distance data transfers in a secure and fast manner?
Answer: Transfer Acceleration
●● Recent worldwide events have dictated that you perform your duties
as a Solutions Architect from home. You need to be able to manage
several EC2 instances while working from home and have been testing
the ability to SSH into these instances. One instance in particular has
been a problem and you cannot SSH into this instance. What should you
check first to troubleshoot this issue?
Answer: Make sure that the security group for the instance allows
inbound on port 22 from your home IP address
●● Your company is storing highly sensitive data in S3 Buckets. The
data includes personal and financial information. An audit has
determined that this data must be stored in a secured manner and any
data stored in the buckets already or data coming into the buckets must
be analyzed and alerts sent out flagging improperly stored data. Which
AWS service can be used to meet this requirement?
Answer: Amazon Macie
, ●● A new startup company decides to use AWS to host their web
application. They configure a VPC as well as two subnets within the
VPC. They also attach an internet gateway to the VPC. In the first
subnet, they create an EC2 instance to host a web application. There is a
network ACL and a security group, which both have the proper ingress
and egress to and from the internet. There is a route in the route table to
the internet gateway. The EC2 instances added to the subnet need to
have a globally unique IP address to ensure internet access. Which
option below would not be classed as a globally unique IP address?
Answer: Private IP address
●● A company has a great deal of data in S3 buckets for which they
want to create a database. Creating the RDS database, normalizing the
data, and migrating to the RDS database will take time and is the long-
term plan. But there's an immediate need to query this data to retrieve
information necessary for an audit. Which AWS service will enable
querying data in S3 using standard SQL commands?
Answer: Amazon Athena
●● Several instances you are creating have a specific data requirement.
The requirement states that the data on the root device needs to persist
independently from the lifetime of the instance. After considering AWS
storage options, which is the simplest way to meet these requirements?
Answer: Store your root device data on Amazon EBS and set the
DeleteOnTermination attribute to false using a block device mapping.
