Amazon SAP-C01 Online Practice Questions and Exam Preparation

Amazon SAP-C01 Online Questions & Answers

• Question 431:

  When I/O performance is more important than fault tolerance, which of the following configurations should be used?

  A. SPAN 10
  B. RAID 1
  C. RAID 0
  D. NFS 1
  C. RAID 0

• Question 432:

  A company has a complex web application that leverages Amazon CloudFront for global scalability and performance. Over time, users report that the web application is slowing down. The company's operations team reports that the CloudFront cache hit ratio has been dropping steadily. The cache metrics report indicates that query strings on some URLs are inconsistently ordered and are specified sometimes in mixed- case letters and sometimes in lowercase letters.

  Which set of actions should the solutions architect take to increase the cache hit ratio as quickly possible?

  A. Deploy a Lambda@Edge function to sort parameters by name and force them to be lowercase. Select the CloudFront viewer request trigger to invoke the function.
  B. Update the CloudFront distribution to disable caching based on query string parameters.
  C. Deploy a reverse proxy after the load balancer to post process the emitted URLs in the application to force the URL strings to be lowercase.
  D. Update the CloudFront distribution to specify case-insensitive query string processing.
  A. Deploy a Lambda@Edge function to sort parameters by name and force them to be lowercase. Select the CloudFront viewer request trigger to invoke the function.

• Question 433:

  A company has a requirement that only allows specially hardened AMIs to be launched into public subnets in a VPC, and for the AMIs to be associated with a specific security group. Allowing non-compliant instances to launch into the public subnet could present a significant security risk if they are allowed to operate.

  A mapping of approved AMIs to subnets to security groups exists in an Amazon DynamoDB table in the same AWS account. The company created an AWS Lambda function that, when invoked, will terminate a given Amazon EC2 instance if the combination of AMI, subnet, and security group are not approved in the DynamoDB table.

  What should the Solutions Architect do to MOST quickly mitigate the risk of compliance deviations?

  A. Create an Amazon CloudWatch Events rule that matches each time an EC2 instance is launched using one of the allowed AMIs, and associate it with the Lambda function as the target.
  B. For the Amazon S3 bucket receiving the AWS CloudTrail logs, create an S3 event notification configuration with a filter to match when logs contain the ec2:RunInstances action, and associate it with the Lambda function as the target.
  C. Enable AWS CloudTrail and configure it to stream to an Amazon CloudWatch Logs group. Create a metric filter in CloudWatch to match when the ec2:RunInstances action occurs, and trigger the Lambda function when the metric is greater than 0.
  D. Create an Amazon CloudWatch Events rule that matches each time an EC2 instance is launched, and associate it with the Lambda function as the target.
  D. Create an Amazon CloudWatch Events rule that matches each time an EC2 instance is launched, and associate it with the Lambda function as the target.

• Question 434:

  How can multiple compute resources be used on the same pipeline in AWS Data Pipeline?

  A. You can use multiple compute resources on the same pipeline by defining multiple cluster objects in your definition file and associating the cluster to use for each activity via its runs On field.
  B. You can use multiple compute resources on the same pipeline by defining multiple cluster definition files
  C. You can use multiple compute resources on the same pipeline by defining multiple clusters for your activity.
  D. You cannot use multiple compute resources on the same pipeline.
  A. You can use multiple compute resources on the same pipeline by defining multiple cluster objects in your definition file and associating the cluster to use for each activity via its runs On field.

• Question 435:

  In the context of AWS CloudFormation, which of the following statements is correct?

  A. Actual resource names are a combination of the resource ID, stack, and logical resource name.
  B. Actual resource name is the stack resource name.
  C. Actual resource name is the logical resource name.
  D. Actual resource names are a combination of the stack and logical resource name.
  D. Actual resource names are a combination of the stack and logical resource name.

• Question 436:

  A solutions architect is designing a multi-account structure that has 10 existing accounts. The design must meet the following requirements:

  1.

  Consolidate all accounts into one organization

  2.

  Allow full access to the Amazon EC2 service from the management account and the secondary accounts

  3.

  Minimize the effort required to add additional secondary accounts Which combination of steps should be included in the solution? (Select TWO )

  A. Create an organization from the management account Send invitations to the secondary accounts from the management account Accept the invitations and create an OU
  B. Create an organization from the management account. Send a join request to the management account from each secondary account Accept the requests and create an OU
  C. Create a VPC peering connection between the management account and the secondary accounts Accept the request for the VPC peering connection
  D. Create a service control policy (SCP) that enables full EC2 access, and attach the policy to the OU
  E. Create a full EC2 access policy and map the policy to a role in each account Trust every other account to assume the role
  A. Create an organization from the management account Send invitations to the secondary accounts from the management account Accept the invitations and create an OU
  E. Create a full EC2 access policy and map the policy to a role in each account Trust every other account to assume the role

• Question 437:

  A company has a policy that all Amazon EC2 instances that are running a database must exist within the same subnets in a shared VPC. Administrators must follow security compliance requirements and are not allowed to directly log in to

  the shared account. All company accounts are members of the same organization in AWS Organizations. The number of accounts will rapidly increase as the company grows.

  A solutions architect uses AWS Resource Access Manager to create a resource share in the shared account.

  What is the MOST operationally efficient configuration to meet these requirements?

  A. Add the VPC to the resource share. Add the account IDs as principals
  B. Add all subnets within the VPC to the resource share. Add the account IDs as principals
  C. Add all subnets within the VPC to the resource share. Add the organization as a principal
  D. Add the VPC to the resource share. Add the organization as a principal
  C. Add all subnets within the VPC to the resource share. Add the organization as a principal

• Question 438:

  Which of the following statements is correct about the number of security groups and rules applicable for an EC2-Classic instance and an EC2-VPC network interface?

  A. In EC2-Classic, you can associate an instance with up to 5 security groups and add up to 50 rules to a security group. In EC2-VPC, you can associate a network interface with up to 500 security groups and add up to 100 rules to a security group.
  B. In EC2-Classic, you can associate an instance with up to 500 security groups and add up to 50 rules to a security group. In EC2-VPC, you can associate a network interface with up to 5 security groups and add up to 100 rules to a security group.
  C. In EC2-Classic, you can associate an instance with up to 5 security groups and add up to 100 rules to a security group. In EC2-VPC, you can associate a network interface with up to 500 security groups and add up to 50 rules to a security group.
  D. In EC2-Classic, you can associate an instance with up to 500 security groups and add up to 100 rules to a security group. In EC2-VPC, you can associate a network interface with up to 5 security groups and add up to 50 rules to a security group.
  D. In EC2-Classic, you can associate an instance with up to 500 security groups and add up to 100 rules to a security group. In EC2-VPC, you can associate a network interface with up to 5 security groups and add up to 50 rules to a security group.

• Question 439:

  A company is migrating to the cloud. It wants to evaluate the configurations of virtual machines in its existing data center environment to ensure that it can size new Amazon EC2 instances accurately. The company wants to collect metrics, such as CPU, memory, and disk utilization, and it needs an inventory of what processes are running on each instance. The company would also like to monitor network connections to map communications between servers.

  Which would enable the collection of this data MOST cost effectively?

  A. Use AWS Application Discovery Service and deploy the data collection agent to each virtual machine in the data center.
  B. Configure the Amazon CloudWatch agent on all servers within the local environment and publish metrics to Amazon CloudWatch Logs.
  C. Use AWS Application Discovery Service and enable agentless discovery in the existing virtualization environment.
  D. Enable AWS Application Discovery Service in the AWS Management Console and configure the corporate firewall to allow scans over a VPN.
  A. Use AWS Application Discovery Service and deploy the data collection agent to each virtual machine in the data center.

• Question 440:

  A company is running its AWS infrastructure across two AWS Regions. The company has four VPCs in the eu-west-1 Region and has two VPCs in the us-east-1 Region. The company also has an on-premises data center in Europe that has two AWS Direct Connect connections in eu-west-1.

  The company needs a solution in which Amazon EC2 instances in each VPC can connect to each other by using private IP addresses. Servers in the on-premises data center also must be able to connect to those VPCs by using private IP addresses.

  What is the MOST cost-effective solution that meets these requirements?

  A. Create an AWS Transit Gateway in each Region, and attach each VPC to the transit gateway in that Region. Create cross-Region peering between the transit gateways. Create two transit VIFs, and attach them to a single Direct Connect gateway. Associate each transit gateway with the Direct Connect gateway.
  B. Create VPC peering between each VPC in the same Region. Create cross-Region peering between each VPC in different Regions. Create two private VIFs, and attach them to a single Direct Connect gateway. Associate each VPC with the Direct Connect gateway.
  C. Create VPC peering between each VPC in the same Region. Create cross-Region peering between each VPC in different Regions. Create two public VIFs that are configured to route AWS IP addresses globally to on-premises servers.
  D. Create an AWS Transit Gateway in each Region, and attach each VPC to the transit gateway in that Region. Create cross-Region peering between the transit gateways. Create two private VIFs, and attach them to a single Direct Connect gateway. Associate each VPC with the Direct Connect gateway.
  C. Create VPC peering between each VPC in the same Region. Create cross-Region peering between each VPC in different Regions. Create two public VIFs that are configured to route AWS IP addresses globally to on-premises servers.