[Q207-Q229] 検証済みAWS-Solutions-Associate問題集PDF資料 [2022]

Share

検証済みAWS-Solutions-Associate問題集PDF資料 [2022]

最新のAWS-Solutions-Associate実際の無料試験問題更新された501問あります

質問 207
An organization regularly bocks up their application data. The application backups are required to be stored on Amazon S3 for a certain amount of time, and need to be accessed instantly in the event of a disaster recovery.
Which of the following Amazon S3 storage classes would be the MOST cost-effective option to meet the needs of this scenario?

  • A. Reduced Redundancy Class (RRS)
  • B. Glacier Storage Class
  • C. Standard Storage Class
  • D. Standard - Infrequent Access (IA)

正解: D

 

質問 208
A company has a service that produces event data. The company wants to use AWS to process the event data as it is received. The data is written in a specific order that must be maintained throughout processing The company wants to implement a solution that minimizes operational overhead.
How should a solution architect accomplish this''

  • A. Create an Amazon Simple Queue Service (Amazon SOS) standard queue to hold messages Set up an AWS Lambda function :o process messages from the queue independently
  • B. Create an Amazon Simple Queue Service (Amazon SOS) FIFO queue to hold messages. Set up an AWS Lambda function to process messages from the queue.
  • C. Create an Amazon Simple Notification Service (Amazon SNS) topic to deliver notifications containing payloads to process Configure an Amazon Simple Queue Service (Amazon SQS) queue as a subscriber.
  • D. Create an Amazon Simple Notification Service (Amazon SNS) topic to deliver notifications containing payloads to process. Configure an AWS Lambda function as a subscriber

正解: B

 

質問 209
SQL Server _____ store log ins and passwords in the master database.

  • A. can be configured to but by default does not
  • B. does
  • C. doesn't

正解: B

 

質問 210
A healthcare computer stores highly sensitive records. Compliance requires that multiple copies be stored in different locations. Each record must be stored for 7 years. The company has a service level agreement (SLA) to provide records to government agencies immediately for the first 30 days and thin within 4 hours of a request thereafter.
What should a solutions architect recommend?

  • A. Use Amazon S3 with cross-origin resource sharing (CCRS) enabled. After 30 days. Transition on the data to Amazon S3 Glacier using a lifecycle policy.
  • B. Use Amazon S3 with cross-origin replication enabled. After 30 days, transition the data to Amazon S3 Glacier Deep Archive a lifecycle policy.
  • C. Use Amazon S3 with cross-Region Region replication enabled. After 30 days. Transition the data to Amazon S3 Glacier using lifecycle policy.
  • D. Use Amazon S3 with cross-origin resource sharing (CCRS) enabled. After 30 days, transition on the data to Amazon S3 Glacier Deep Archive using a lifecycle policy.

正解: B

 

質問 211
A company wants to use AWS Systems Manager to manage a fleet ol Amazon EC2 instances. According to the company's security requirements, no EC2 instances can have internet access. A solutions architect needs to design network connectivity from the EC2 instances to Systems Manager while fulfilling this security obligation.
Which solution will meet these requirements?

  • A. Deploy a NAT gateway into a public subnet. Configure private subnets with a default route to the NAT gateway.
  • B. Deploy an internet gateway. Configure a network ACL to deny traffic to all destinations except Systems Manager.
  • C. Deploy the EC2 instances into a private subnet with no route to the internet.
  • D. Configure an interface VPC endpoint for Systems Manager. Update routes to use the endpoint.

正解: A

 

質問 212
A solutions architect at an ecommerce company wants to back up application log data to Amazon S3 The solutions architect is unsure how frequently the logs will be accessed or which logs will be accessed the most The company wants to keep costs as low as possible by using the appropriate S3 storage class.
Which S3 storage class should be implemented to meet these requirements?

  • A. S3 Glacier
  • B. S3 Intelligent-Tiering
  • C. S3 Standard-Infrequent Access (S3 Standard-IA)
  • D. S3 One Zone-Infrequent Access (S3 One Zone-IA)

正解: B

解説:
Explanation
https://aws.amazon.com/s3/storage-classes/

 

質問 213
An organization has created 5 IAM users. The organization wants to give them the same login ID but different passwords. How can the organization achieve this?

  • A. It is not possible to have the same login ID for multiple IAM users of the same account
  • B. The organization should create each user in a separate region so that they have their own URL to login
  • C. The organization should create various groups and add each user with the same login ID to different groups. The user can login with their own group ID
  • D. The organization should create a separate login ID but give the IAM users the same alias so that each one can login with their alias

正解: A

解説:
AWS Identity and Access Management is a web service which allows organizations to manage users and user permissions for various AWS services.
Whenever the organization is creating an IAM user, there should be a unique ID for each user. It is not possible to have the same login ID for multiple users. The names of users, groups, roles, instance profiles must be alphanumeric, including the following common characters: plus (+), equal (=), comma (,), period (.), at (@), and dash (-).
Reference:
http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_SettingUpUser.html

 

質問 214
A company has an application hosted on Amazon EC2 instances in two VPCs across different AWS Regions.
To communicate with each other, the instances use the internet for connectivity. The security team wants to ensure that no communication between the instances happens over the internet.
What should a solutions architect do to accomplish this?

  • A. Create a VPC endpoint and update the route table of the EC2 instances' subnet.
  • B. Create a VPN connection and update the route table of the EC2 instances' subnet.
  • C. Create a VPC peering connection and update the route table of the EC2 instances' subnet.
  • D. Create a NAT gateway and update the route table of the EC2 instances' subnet.

正解: C

 

質問 215
An application running on AWS uses an Amazon Aurora Multi-AZ deployment for its database When evaluating performance metrics, a solutions architect discovered that the database reads are causing high I/O and adding latency to the write requests against the database What should the solutions architect do to separate the read requests from the write requests?

  • A. Enable read-through caching on the Amazon Aurora database
  • B. Create a read replica and modify the application to use the appropriate endpoint
  • C. Create a second Amazon Aurora database and link it to the primary database as a read replica.
  • D. Update the application to read from the Multi-AZ standby instance

正解: B

解説:
Explanation
Amazon RDS Read Replicas
Amazon RDS Read Replicas provide enhanced performance and durability for RDS database (DB) instances.
They make it easy to elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads. You can create one or more replicas of a given source DB Instance and serve high-volume application read traffic from multiple copies of your data, thereby increasing aggregate read throughput. Read replicas can also be promoted when needed to become standalone DB instances. Read replicas are available in Amazon RDS for MySQL, MariaDB, PostgreSQL, Oracle, and SQL Server as well as Amazon Aurora.
For the MySQL, MariaDB, PostgreSQL, Oracle, and SQL Server database engines, Amazon RDS creates a second DB instance using a snapshot of the source DB instance. It then uses the engines' native asynchronous replication to update the read replica whenever there is a change to the source DB instance. The read replica operates as a DB instance that allows only read-only connections; applications can connect to a read replica just as they would to any DB instance. Amazon RDS replicates all databases in the source DB instance.
Amazon Aurora futher extends the benefits of read replicas by employing an SSD-backed virtualized storage layer purpose-built for database workloads. Amazon Aurora replicas share the same underlying storage as the source instance, lowering costs and avoiding the need to copy data to the replica nodes. For more information about replication with Amazon Aurora, see the online documentation.

https://aws.amazon.com/rds/features/read-replicas/

 

質問 216
A solutions architect is designing an application for a two-step order process The first step is synchronous and must return to the user with little latency The second step takes longer, so it will be implemented in a separate component Orders must be processed exactly once and in the order in which they are received How should the solutions architect integrate these components?

  • A. Use an Amazon SQS FIFO queues
  • B. Create an SNS topic and subscribe an Amazon SQS FIFO queue to that topic
  • C. Use an AWS Lambda function along with Amazon SQS standard queues
  • D. Create an SNS topic and subscribe an Amazon SQS Standard queue to that topic.

正解: B

 

質問 217
Your system recently experienced down time during the troubleshooting process. You found that a new administrator mistakenly terminated several production EC2 instances.
Which of the following strategies will help prevent a similar situation in the future?
The administrator still must be able to:
* launch, start stop, and terminate development resources.
* launch and start production instances.

  • A. Create an IAM user and apply an IAM role which prevents users from terminating production EC2 instances.
  • B. Leverage resource based tagging, along with an IAM user which can prevent specific users from terminating production, EC2 resources.
  • C. Leverage EC2 termination protection and multi-factor authentication, which together require users to authenticate before terminating EC2 instances
  • D. Create an IAM user, which is not allowed to terminate instances by leveraging production EC2 termination protection.

正解: B

解説:
Working with volumes
When an API action requires a caller to specify multiple resources, you must create a policy statement that allows users to access all required resources. If you need to use a Condition element with one or more of these resources, you must create multiple statements as shown in this example.
The following policy allows users to attach volumes with the tag "volume_user=iam-user-name" to instances with the tag "department=dev", and to detach those volumes from those instances. If you attach this policy to an IAM group, the aws:username policy variable gives each IAM user in the group permission to attach or detach volumes from the instances with a tag named volume_user that has his or her IAM user name as a value.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"ec2:AttachVolume",
"ec2:DetachVolume"
],
"Resource": "arn:aws:ec2:us-east-1:123456789012:instance/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/department": "dev"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:AttachVolume",
"ec2:DetachVolume"
],
"Resource": "arn:aws:ec2:us-east-1:123456789012:volume/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/volume_user": "${aws:username}"
}
}
}
]
}
Launching instances (RunInstances)
The RunInstances API action launches one or more instances. RunInstances requires an AMI and creates an instance; and users can specify a key pair and security group in the request. Launching into EC2-VPC requires a subnet, and creates a network interface. Launching from an Amazon EBS-backed AMI creates a volume.
Therefore, the user must have permission to use these Amazon EC2 resources. The caller can also configure the instance using optional parameters to RunInstances, such as the instance type and a subnet. You can create a policy statement that requires users to specify an optional parameter, or restricts users to particular values for a parameter. The examples in this section demonstrate some of the many possible ways that you can control the configuration of an instance that a user can launch.
Note that by default, users don't have permission to describe, start, stop, or terminate the resulting instances.
One way to grant the users permission to manage the resulting instances is to create a specific tag for each instance, and then create a statement that enables them to manage instances with that tag. For more information, see 2: Working with instances.
a. AMI
The following policy allows users to launch instances using only the AMIs that have the specified tag,
"department=dev", associated with them. The users can't launch instances using other AMIs because the Condition element of the first statement requires that users specify an AMI that has this tag. The users also can't launch into a subnet, as the policy does not grant permissions for the subnet and network interface resources. They can, however, launch into EC2-Classic. The second statement uses a wildcard to enable users to create instance resources, and requires users to specify the key pair project_keypair and the security group sg-1a2b3c4d. Users are still able to launch instances without a key pair.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region::image/ami-*"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/department": "dev"
}
}
},
{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region:account:instance/*",
"arn:aws:ec2:region:account:volume/*",
"arn:aws:ec2:region:account:key-pair/project_keypair",
"arn:aws:ec2:region:account:security-group/sg-1a2b3c4d"
]
}
]
}
Alternatively, the following policy allows users to launch instances using only the specified AMIs, ami-9e1670f7 and ami-45cf5c3c. The users can't launch an instance using other AMIs (unless another statement grants the users permission to do so), and the users can't launch an instance into a subnet.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region::image/ami-9e1670f7",
"arn:aws:ec2:region::image/ami-45cf5c3c",
"arn:aws:ec2:region:account:instance/*",
"arn:aws:ec2:region:account:volume/*",
"arn:aws:ec2:region:account:key-pair/*",
"arn:aws:ec2:region:account:security-group/*"
]
}
]
}
Alternatively, the following policy allows users to launch instances from all AMIs owned by Amazon. The Condition element of the first statement tests whether ec2:Owner is amazon. The users can't launch an instance using other AMIs (unless another statement grants the users permission to do so). The users are able to launch an instance into a subnet.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region::image/ami-*"
],
"Condition": {
"StringEquals": {
"ec2:Owner": "amazon"
}
}
},
{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region:account:instance/*",
"arn:aws:ec2:region:account:subnet/*",
"arn:aws:ec2:region:account:volume/*",
"arn:aws:ec2:region:account:network-interface/*",
"arn:aws:ec2:region:account:key-pair/*",
"arn:aws:ec2:region:account:security-group/*"
]
}
]
}
b. Instance type
The following policy allows users to launch instances using only the t2.micro or t2.small instance type, which you might do to control costs. The users can't launch larger instances because the Condition element of the first statement tests whether ec2:InstanceType is either t2.micro or t2.small.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region:account:instance/*"
],
"Condition": {
"StringEquals": {
"ec2:InstanceType": ["t2.micro", "t2.small"]
}
}
},
{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region::image/ami-*",
"arn:aws:ec2:region:account:subnet/*",
"arn:aws:ec2:region:account:network-interface/*",
"arn:aws:ec2:region:account:volume/*",
"arn:aws:ec2:region:account:key-pair/*",
"arn:aws:ec2:region:account:security-group/*"
]
}
]
}
Alternatively, you can create a policy that denies users permission to launch any instances except t2.micro and t2.small instance types.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region:account:instance/*"
],
"Condition": {
"StringNotEquals": {
"ec2:InstanceType": ["t2.micro", "t2.small"]
}
}
},
{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region::image/ami-*",
"arn:aws:ec2:region:account:network-interface/*",
"arn:aws:ec2:region:account:instance/*",
"arn:aws:ec2:region:account:subnet/*",
"arn:aws:ec2:region:account:volume/*",
"arn:aws:ec2:region:account:key-pair/*",
"arn:aws:ec2:region:account:security-group/*"
]
}
]
}
c. Subnet
The following policy allows users to launch instances using only the specified subnet, subnet-12345678. The group can't launch instances into any another subnet (unless another statement grants the users permission to do so). Users are still able to launch instances into EC2-Classic.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region:account:subnet/subnet-12345678",
"arn:aws:ec2:region:account:network-interface/*",
"arn:aws:ec2:region:account:instance/*",
"arn:aws:ec2:region:account:volume/*",
"arn:aws:ec2:region::image/ami-*",
"arn:aws:ec2:region:account:key-pair/*",
"arn:aws:ec2:region:account:security-group/*"
]
}
]
}
Alternatively, you could create a policy that denies users permission to launch an instance into any other subnet. The statement does this by denying permission to create a network interface, except where subnet subnet-12345678 is specified. This denial overrides any other policies that are created to allow launching instances into other subnets. Users are still able to launch instances into EC2-Classic.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region:account:network-interface/*"
],
"Condition": {
"ArnNotEquals": {
"ec2:Subnet": "arn:aws:ec2:region:account:subnet/subnet-12345678"
}
}
},
{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region::image/ami-*",
"arn:aws:ec2:region:account:network-interface/*",
"arn:aws:ec2:region:account:instance/*",
"arn:aws:ec2:region:account:subnet/*",
"arn:aws:ec2:region:account:volume/*",
"arn:aws:ec2:region:account:key-pair/*",
"arn:aws:ec2:region:account:security-group/*"
]
}
]
}

 

質問 218
Disabling automated backups ______ disable the point-in-time recovery.

  • A. will never
  • B. will
  • C. if configured to can

正解: B

 

質問 219
A Solutions Architect needs to allow developers to have SSH connectivity to web servers. The requirements are as follows:
1 Limit access to users origination from the corporate network.
2 Web servers cannot have SSH access directly from the Internet.
3 Web servers reside in a private subnet.
Which combination of steps must the Architect complete to meet these requirements?
(Choose two.)

  • A. Attach an 1AM role to the bastion host with relevant permissions.
  • B. Configure the web servers' security group to allow SSH traffic from a bastion host.
  • C. Create a bastion host that authenticates users against the corporate directory.
  • D. Deny all SSH traffic from the corporate network in the inbound network ACL.
  • E. Create a bastion host with security group rules that only allow traffic from the corporate network.

正解: B,E

解説:
Explanation
https://aws.amazon.com/blogs/security/how-to-record-ssh-sessions-established-through-a-bastion-host/

 

質問 220
A company is developing a mobile game that streams score updates to a backend processor and then posts results on a leaderboard. A solutions architect needs to design a solution that can handle large traffic spikes, process the mobile game updates in order of receipt, and store the processed updates in a highly available database. The company also wants to minimize the management overhead required to maintain the solution.
What should the solutions architect do to meet these requirements?

  • A. Push score updates to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe an AWS Lambda function to the SNS topic to process the updates. Store the processed updates in a SOL database running on Amazon EC2.
  • B. Push score updates to Amazon Kinesis Data Streams. Process the updates in Kinesis Data Streams with AWS Lambda. Store the processed updates in Amazon DynamoDB.
  • C. Push score updates to Amazon Kinesis Data Streams. Process the updates with a fleet of Amazon EC2 instances set up for Auto Scaling. Store the processed updates in Amazon Redshifl.
  • D. Push score updates to an Amazon Simple Queue Service (Amazon SOS) queue. Use a fleet of Amazon EC2 instances with Auto Scaling to process the updates in the SQS queue. Store the processed updates in an Amazon RDS Multi-AZ DB instance.

正解: B

 

質問 221
A company has a custom application running on an Amazon EC2 instance that:
* Reads a large amount of data from Amazon S3
* Performs a multi-stage analysis.
* Writes the results to Amazon DynamoDB.
The application writes a significant number of large, temporary files during the multi-stage analysis. The process performance depends on the temporary storage performance.
What would be the fastest storage option for holding the temporary files?

  • A. Multiple Amazon S3 buckets with Transfer Acceleration for storage
  • B. Multiple instance store volumes with software RAID 0
  • C. Multiple Amazon EFS volumes using the Network File System version 4.1 (NFSv4.1) protocol.
  • D. Multiple Amazon EBS drives with Provisioned IOPS and EBS optimization.

正解: B

 

質問 222
A customer is deploying an SSL enabled web application to AWS and would like to implement a separation of roles between the EC2 service administrators that are entitled to login to instances as well as making API calls and the security officers who will maintain and have exclusive access to the application's X.509 certificate that contains the private key.

  • A. Configure the web servers to retrieve the certificate upon boot from an CloudHSM is managed by the security officers.
  • B. Configure system permissions on the web servers to restrict access to the certificate only to the authority security officers
  • C. Upload the certificate on an S3 bucket owned by the security officers and accessible only by EC2 Role of the web servers.
  • D. Configure IAM policies authorizing access to the certificate store only to the security officers and terminate SSL on an ELB.

正解: D

解説:
Explanation/Reference:
Explanation:
You'll terminate the SSL at ELB. and the web request will get unencrypted to the EC2 instance, even if the certs are stored in S3, it has to be configured on the web servers or load balancers somehow, which becomes difficult if the keys are stored in S3. However, keeping the keys in the cert store and using IAM to restrict access gives a clear separation of concern between security officers and developers. Developer's personnel can still configure SSL on ELB without actually handling the keys.

 

質問 223
What is the maximum key length of a tag?

  • A. 512 Unicode characters
  • B. 256 Unicode characters
  • C. 128 Unicode characters
  • D. 64 Unicode characters

正解: C

 

質問 224
A company manages its own Amazon EC2 instances that run MySQL databases The company is manually managing replication and scaling as demand increases or decreases The company needs a new solution that simplifies the process of adding or removing compute capacity to or from its database tier as needed The solution also must offer improved performance, scaling and durability with minimal effort from operations Witch solution meets these requirements?

  • A. Create an EC2 Auto Scaling group for the database tier Migrate the existing databases to the new environment.
  • B. Migrate tie databases to Amazon Aurora Serverless tor Aurora PostgreSQL
  • C. Combine the databases into one larger MySQL database Run the larger database on larger EC2 instances
  • D. Migrate thee databases to Amazon Aurora Serverless for Aurora MySQL

正解: C

 

質問 225
True or False: When using IAM to control access to your RDS resources, the key names that can be used are case sensitive. For example, aws:CurrentTime is NOT equivalent to AWS:currenttime.

  • A. FALSE
  • B. TRUE

正解: B

 

質問 226
A/An __ acts as a firewall that controls the traffic allowed to reach one or more instances.

  • A. lAM
  • B. security group
  • C. ACL
  • D. Private IP Addresses

正解: B

 

質問 227
A company is using Amazon Redshift for analytics and to generate customer reports. The company recently acquired 50 TB of additional customer demographic data. The .........S3. The company needs a solution that joins the data and visualizes the results with the least possible cost and effort.
What should a solutions architect recommend to meet these requirements?

  • A. Increase the size of the Amazon Redshift cluster, and load the data from Amazon S3. Use Amazon EMR Notebooks to query the data and build the visualizations,,,
  • B. Use Amazon Athena to query the data in Amazon S3. Use Amazon QuickSight to join the data from Athena with the existing data in Amazon Redshift and to build...
  • C. Use Amazon Redshift Spectrum to query the data in Amazon S3 directly and join that data with the existing data in Amazon Redshift. Use Amazon QuickSight to....
  • D. Export the data from the Amazon Redshift cluster into Apache Parquet files in Amazon S3. Use Amazon Elasticsearch Service (Amazon ES) to query the data. Use..

正解: B

 

質問 228

Refer to the architecture diagram above of a batch processing solution using Simple Queue Service (SOS) to set up a message queue between EC2 instances which are used as batch processors Cloud Watch monitors the number of Job requests (queued messages) and an Auto Scaling group adds or deletes batch servers automatically based on parameters set in Cloud Watch alarms. You can use this architecture to implement which of the following features in a cost effective and efficient manner?

  • A. Coordinate number of EC2 instances with number of job requests automatically thus Improving cost effectiveness.
  • B. Reduce the overall lime for executing jobs through parallel processing by allowing a busy EC2 instance that receives a message to pass it to the next instance in a daisy-chain setup.
  • C. Implement message passing between EC2 instances within a batch by exchanging messages through SOS.
  • D. Handle high priority jobs before lower priority jobs by assigning a priority metadata field to SQS messages.
  • E. Implement fault tolerance against EC2 instance failure since messages would remain in SQS and worn can continue with recovery of EC2 instances implement fault tolerance against SQS failure by backing up messages to S3.

正解: E

 

質問 229
......

AWS-Solutions-Associate認定概要最新のAWS-Solutions-AssociatePDF問題集はこちら:https://www.goshiken.com/Amazon/AWS-Solutions-Associate-mondaishu.html

無料AWS-Solutions-Associate試験ブレーン問題集認定ガイド問題と解答:https://drive.google.com/open?id=1BijCQn9Nla6f8HfBiNjJqOa3FbO0rjpE