Exam: AWS-Certified-Solutions-Architect-Professional-SAP-C01
|
|||||||||||||||||||||||||||
Certkingdom's guidance material includes the maximum exquisite features, prepared with the aid of the identical dedicated specialists who have come collectively to provide an incorporated solution. We provide the maximum outstanding and simple approach to bypass your certification exams on the first strive "assured"
Introduction
The AWS Certified Solutions Architect–Professional (SAP-C01) exam is intended for individuals who perform a Solutions Architect–Professional role. This exam validates advanced technical skills and experience in designing distributed applications and systems on the AWS platform.
It validates an examinee’s ability to:
· Design and deploy dynamically scalable, highly available, fault-tolerant, and reliable applications on AWS
· Select appropriate AWS services to design and deploy an application based on given requirements
· Migrate complex, multi-tier applications on AWS
· Design and deploy enterprise-wide scalable operations on AWS
· Implement cost-control strategies
Recommended AWS and General IT Knowledge and Experience
· Two or more years of hands-on experience designing and deploying cloud architecture on AWS
· Ability to evaluate cloud application requirements and make architectural recommendations for implementation, deployment, and provisioning applications on AWS
· Ability to provide best practice guidance on the architectural design across multiple applications and projects of the enterprise
· Familiarity with a scripting language
· Familiarity with Windows and Linux environments
· Familiarity with AWS CLI, AWS APIs, AWS CloudFormation templates, the AWS Billing Console, and the AWS Management Console
· Explain and apply the five pillars of the AWS Well-Architected Framework
· Map business objectives to application/architecture requirements
· Design a hybrid architecture using key AWS technologies (e.g., VPN, AWS Direct Connect)
· Architect a continuous integration and deployment process
Exam Preparation
These training courses and materials may be helpful for examination preparation:
AWS Training: (aws.amazon.com/training)
· Advanced Architecting on AWS: 3-day instructor-led live or virtual course
· AWS Certification Exam Readiness Workshops: AWS Certified Solutions Architect–Professional: 1-day live course
· AWS Security Fundamentals: 1-day instructor-led live course
· AWS Well-Architected Training: 2-hour online training course
· EC2 Systems Manager: 2-hour online training course
· Migrating to AWS: 2-day instructor-led live or virtual course
· Preview Course: Deep Dive into Amazon Elastic Block Store (EBS): 1-hour online training course
· Preview Course: Deep Dive into Elastic File System (EFS): 65-minute online training course
· Preview Course: Migrating and Tiering Storage to AWS: 1-hour online training course
Suggested AWS Whitepapers (aws.amazon.com/whitepapers) Kindle and .pdf, and Other Materials
· AWS Security Best Practices whitepaper, August 2016
Web Services: Overview of Security Processes whitepaper, May 2017
· Using Amazon Web Services for Disaster Recovery whitepaper, October 2014
· AWS Documentation for services, including but not limited to compute, management tools, storage, networking and content delivery, analytics, database, security, identity and compliance, and application integration web-pages
· AWS Architecture Center web-pages
Exam Content
Response Types
There are two types of questions on the examination:
· Multiple-choice: Has one correct response and three incorrect responses (distractors).
· Multiple-response: Has two or more correct responses out of five or more options.
Select one or more responses that best complete the statement or answer the question. Distractors, or incorrect answers, are response options that an examinee with incomplete knowledge or skill would likely choose. However, they are generally plausible responses that fit in the content area defined by the test objective.
Unanswered questions will be scored as incorrect; there is no penalty for guessing.
Unscored Content
Your examination may include unscored items that are placed on the test to gather statistical information. These questions are not identified on the form, and do not affect your score.
Exam Results
The AWS Certified Solutions Architect–Professional (SAP-C01) is a pass or fail exam. The examination is scored against a minimum standard established by AWS professionals who are guided by certification industry best practices and guidelines.
Your results for the examination are reported as a score from 100 through 1000, with a minimum passing score of 750. Your score shows how you performed on the examination as a whole and whether you passed. Scaled scoring models are used to equate scores across multiple exam forms that may have slightly different difficulty levels.
Your score report contains a table of classifications of your performance at each section level. This information is designed to provide general feedback concerning your examination performance. The examination uses a compensatory scoring model, which means that you do not need to “pass” the individual sections, only the overall examination. Each section of the examination has a specific weighting, so some sections have more questions than others. The table contains general information, highlighting your strengths and weaknesses. Exercise caution when interpreting section-level feedback.
Content Outline
This exam guide includes weightings, test domains, and objectives only. It is not a comprehensive listing of the content on this examination. The table below lists the main content domains and their weightings.
for Existing Solutions 29%
TOTAL 100%
Domain 1: Design for Organizational Complexity
1.1. Determine cross-account authentication and access strategy for complex organizations (for example, an organization with varying compliance requirements, multiple business units, and varying scalability requirements).
1.2. Determine how to design networks for complex organizations (for example, an organization with varying compliance requirements, multiple business units, and varying scalability requirements).
1.3. Determine how to design a multi-account AWS environment for complex organizations (for example, an organization with varying compliance requirements, multiple business units, and varying scalability requirements).
Domain 2: Design for New Solutions
2.1. Determine security requirements and controls when designing and implementing a solution.
2.2. Determine a solution design and implementation strategy to meet reliability requirements.
2.3. Determine a solution design to ensure business continuity.
2.4. Determine a solution design to meet performance objectives.
2.5. Determine a deployment strategy to meet business requirements when designing and implementing a solution.
Domain 3: Migration Planning
3.1. Select existing workloads and processes for potential migration to the cloud.
3.2. Select migration tools and/or services for new and migrated solutions based on detailed AWS knowledge.
3.3. Determine a new cloud architecture for an existing solution.
3.4. Determine a strategy for migrating existing on-premises workloads to the cloud.
Domain 4: Cost Control
4.1. Select a cost-effective pricing model for a solution.
4.2. Determine which controls to design and implement that will ensure cost optimization.
4.3. Identify opportunities to reduce cost in an existing solution.
Domain 5: Continuous Improvement for Existing Solutions
5.1. Troubleshoot solution architectures.
5.2. Determine a strategy to improve an existing solution for operational excellence.
5.3. Determine a strategy to improve the reliability of an existing solution.
5.4. Determine a strategy to improve the performance of an existing solution.
5.5. Determine a strategy to improve the security of an existing solution.
5.6. Determine how to improve the deployment of an existing solution.
QUESTION 1
Your company policies require encryption of sensitive data at rest. You are considering the possible options for protecting data while storing it at rest on an EBS data volume, attached to an EC2 instance.
Which of these options would allow you to encrypt your data at rest? (Choose 3)
A. Implement third party volume encryption tools
B. Implement SSL/TLS for all services running on the server
C. Encrypt data inside your applications before storing it on EBS
D. Encrypt data using native data encryption drivers at the file system level
E. Do nothing as EBS volumes are encrypted by default
Correct Answer: A,C,D
QUESTION 2
A customer is deploying an SSL enabled web application to AWS and would like to implement a separation of
roles between the EC2 service administrators that are entitled to login to instances as well as making API calls
and the security officers who will maintain and have exclusive access to the application’s X.509 certificate that contains the private key.
A. Upload the certificate on an S3 bucket owned by the security officers and accessible only by EC2 Role of the web servers.
B. Configure the web servers to retrieve the certificate upon boot from an CloudHSM is managed by the security officers.
C. Configure system permissions on the web servers to restrict access to the certificate only to the authority security officers
D. Configure IAM policies authorizing access to the certificate store only to the security officers and terminate SSL on an ELB.
Correct Answer: D
QUESTION 3
You have recently joined a startup company building sensors to measure street noise and air quality in urban
areas. The company has been running a pilot deployment of around 100 sensors for 3 months each sensor
uploads 1KB of sensor data every minute to a backend hosted on AWS.
During the pilot, you measured a peak or 10 IOPS on the database, and you stored an average of 3GB of
sensor data per month in the database.
The current deployment consists of a load-balanced auto scaled Ingestion layer using EC2 instances and a
PostgreSQL RDS database with 500GB standard storage.
The pilot is considered a success and your CEO has managed to get the attention or some potential investors.
The business plan requires a deployment of at least 100K sensors which needs to be supported by the
backend. You also need to store sensor data for at least two years to be able to compare year over year Improvements.
To secure funding, you have to make sure that the platform meets these requirements and leaves room for further scaling.
Which setup win meet the requirements?
A. Add an SQS queue to the ingestion layer to buffer writes to the RDS instance
B. Ingest data into a DynamoDB table and move old data to a Redshift cluster
C. Replace the RDS instance with a 6 node Redshift cluster with 96TB of storage
D. Keep the current architecture but upgrade RDS storage to 3TB and 10K provisioned IOPS Correct Answer: C
Correct Answer: B
QUESTION 4
A web company is looking to implement an intrusion detection and prevention system into their deployed VPC.
This platform should have the ability to scale to thousands of instances running inside of the VPC.
How should they architect their solution to achieve these goals?
A. Configure an instance with monitoring software and the elastic network interface (ENI) set to promiscuous mode packet sniffing to see an traffic across the VPC.
B. Create a second VPC and route all traffic from the primary application VPC through the second VPC where the scalable virtualized IDS/IPS platform resides.
C. Configure servers running in the VPC using the host-based 'route' commands to send all traffic through the platform to a scalable virtualized IDS/IPS.
D. Configure each host with an agent that collects all network traffic and sends that traffic to the IDS/IPS platform for inspection.
Correct Answer: D
QUESTION 5
A company is storing data on Amazon Simple Storage Service (S3). The company's security policy mandates that data is encrypted at rest.
Which of the following methods can achieve this? (Choose 3)
A. Use Amazon S3 server-side encryption with AWS Key Management Service managed keys.
B. Use Amazon S3 server-side encryption with customer-provided keys.
C. Use Amazon S3 server-side encryption with EC2 key pair.
D. Use Amazon S3 bucket policies to restrict access to the data at rest.
E. Encrypt the data on the client-side before ingesting to Amazon S3 using their own master key.
F. Use SSL to encrypt the data while in transit to Amazon S3.
Correct Answer: A,B,E
AWS-Certified-Solutions-Architect-Professional-SAP-C01 Brain Dumps Exam + Online / Offline and Android Testing Engine & 4500+ other exams included
$50 - $25 (you save $25)
Buy Now
QUESTION 1
Your company policies require encryption of sensitive data at rest. You are
considering the possible options for protecting data while storing it at rest on
an EBS data volume, attached to an EC2 instance.
Which of these options would allow you to encrypt your data at rest? (Choose
three.)
A. Implement third party volume encryption tools
B. Implement SSL/TLS for all services running on the server
C. Encrypt data inside your applications before storing it on EBS
D. Encrypt data using native data encryption drivers at the file system level
E. Do nothing as EBS volumes are encrypted by default
Answer: A,C,D
QUESTION 2
A customer is deploying an SSL enabled web application to AWS and would like
to implement a separation of roles between the EC2 service administrators that
are entitled to login to instances as well as making API calls
and the security officers who will maintain and have exclusive access to the
application's X.509 certificate that contains the private key.
A. Upload the certificate on an S3 bucket owned by the security officers and
accessible only by EC2 Role of the web servers.
B. Configure the web servers to retrieve the certificate upon boot from an
CloudHSM is managed by the security officers.
C. Configure system permissions on the web servers to restrict access to the
certificate only to the authority security officers
D. Configure IAM policies authorizing access to the certificate store only to
the security officers and terminate SSL on an ELB.
Answer: D
Explanation:
You'll terminate the SSL at ELB. and the web request will get unencrypted to the
EC2 instance, even if the certs are stored in S3, it has to be configured on the
web servers or load balancers somehow, which becomes
difficult if the keys are stored in S3. However, keeping the keys in the cert
store and using IAM to restrict access gives a clear separation of concern
between security officers and developers. Developer's personnel
can still configure SSL on ELB without actually handling the keys.
QUESTION 3
You have recently joined a startup company building sensors to measure
street noise and air quality in urban areas. The company has been running a
pilot deployment of around 100 sensors for 3 months each sensor
uploads 1KB of sensor data every minute to a backend hosted on AWS. During the
pilot, you measured a peak or 10 IOPS on the database, and you stored an average
of 3GB of sensor data per month in the database.
The current deployment consists of a load-balanced auto scaled Ingestion layer
using EC2 instances and a PostgreSQL RDS database with 500GB standard storage.
The pilot is considered a success and your CEO has managed to get the attention
or some potential investors. The business plan requires a deployment of at least
100K sensors which needs to be supported by the
backend. You also need to store sensor data for at least two years to be able to
compare year over year Improvements.
To secure funding, you have to make sure that the platform meets these
requirements and leaves room for further scaling.
Which setup win meet the requirements?
A. Add an SQS queue to the ingestion layer to buffer writes to the RDS instance
B. Ingest data into a DynamoDB table and move old data to a Redshift cluster
C. Replace the RDS instance with a 6 node Redshift cluster with 96TB of storage
D. Keep the current architecture but upgrade RDS storage to 3TB and 10K
provisioned IOPS
Answer: C
Explanation:
The POC solution is being scaled up by 1000, which means it will require 72TB of
Storage to retain 24 months'''? worth of data. This rules out RDS as a possible
DB solution which leaves you with Redshift.
I believe DynamoDB is a more cost effective and scales better for ingest rather
than using EC2 in an auto scaling group.
Also, this example solution from AWS is somewhat similar for reference.
QUESTION 4
A web company is looking to implement an intrusion detection and prevention
system into their deployed VPC.
This platform should have the ability to scale to thousands of instances running
inside of the VPC.
How should they architect their solution to achieve these goals?
A. Configure an instance with monitoring software and the elastic network
interface (ENI) set to promiscuous mode packet sniffing to see an traffic across
the VPC.
B. Create a second VPC and route all traffic from the primary application VPC
through the second VPC where the scalable virtualized IDS/IPS platform resides.
C. Configure servers running in the VPC using the host-based 'route' commands to
send all traffic through the platform to a scalable virtualized IDS/IPS.
D. Configure each host with an agent that collects all network traffic and sends
that traffic to the IDS/IPS platform for inspection.
Answer: D
QUESTION 5
A company is storing data on Amazon Simple Storage Service (S3). The
company's security policy mandates that data is encrypted at rest.
Which of the following methods can achieve this? (Choose three.)
A. Use Amazon S3 server-side encryption with AWS Key Management Service managed
keys.
B. Use Amazon S3 server-side encryption with customer-provided keys.
C. Use Amazon S3 server-side encryption with EC2 key pair.
D. Use Amazon S3 bucket policies to restrict access to the data at rest.
E. Encrypt the data on the client-side before ingesting to Amazon S3 using their
own master key.
F. Use SSL to encrypt the data while in transit to Amazon S3.
Answer: A,B,E
QUESTION 6
Your firm has uploaded a large amount of aerial image data to S3. In the
past, in your on-premises
environment, you used a dedicated group of servers to oaten process this data
and used Rabbit MQ - An open
source messaging system to get job information to the servers. Once processed
the data would go to tape and
be shipped offsite. Your manager told you to stay with the current design, and
leverage AWS archival storage
and messaging services to minimize cost. Which is correct?
A. Use SQS for passing job messages use Cloud Watch alarms to terminate EC2
worker instances when they
become idle. Once data is processed, change the storage class of the S3 objects
to Reduced Redundancy Storage.
B. Setup Auto-Scaled workers triggered by queue depth that use spot instances to
process messages in SOS
Once data is processed, change the storage class of the S3 objects to Reduced
Redundancy Storage.
C. Setup Auto-Scaled workers triggered by queue depth that use spot instances to
process messages in SQS
Once data is processed, change the storage class of the S3 objects to Glacier.
D. Use SNS to pass job messages use Cloud Watch alarms to terminate spot worker
instances when they
become idle. Once data is processed, change the storage class of the S3 object
to Glacier.
Answer: C
QUESTION 7
You've been hired to enhance the overall security posture for a very large
e-commerce site. They have a well
architected multi-tier application running in a VPC that uses ELBs in front of
both the web and the app tier with
static assets served directly from S3. They are using a combination of RDS and
DynamoDB for their dynamic
data and then archiving nightly into S3 for further processing with EMR. They
are concerned because they
found questionable log entries and suspect someone is attempting to gain
unauthorized access.
Which approach provides a cost effective scalable mitigation to this kind of
attack?
A. Recommend that they lease space at a DirectConnect partner location and
establish a 1G DirectConnect
connection to their VPC they would then establish Internet connectivity into
their space, filter the traffic in
hardware Web Application Firewall (WAF). And then pass the traffic through the
DirectConnect connection
into their application running in their VPC.
B. Add previously identified hostile source IPs as an explicit INBOUND DENY NACL
to the web tier subnet.
C. Add a WAF tier by creating a new ELB and an AutoScaling group of EC2
Instances running a host-based
WAF. They would redirect Route 53 to resolve to the new WAF tier ELB. The WAF
tier would their pass the
traffic to the current web tier The web tier Security Groups would be updated to
only allow traffic from the
WAF tier Security Group
D. Remove all but TLS 1.2 from the web tier ELB and enable Advanced Protocol
Filtering. This will enable the
ELB itself to perform WAF functionality.
Answer: C
QUESTION 8
Your company is in the process of developing a next generation pet collar
that collects biometric information to
assist families with promoting healthy lifestyles for their pets. Each collar
will push 30kb of biometric data in
JSON format every 2 seconds to a collection platform that will process and
analyze the data providing health
trending information back to the pet owners and veterinarians via a web portal.
Management has tasked you to
architect the collection platform ensuring the following requirements are met.
Provide the ability for real-time analytics of the inbound biometric data
Ensure processing of the biometric data is highly durable. Elastic and parallel
The results of the analytic processing should be persisted for data mining
Which architecture outlined below win meet the initial requirements for the
collection platform?
A. Utilize S3 to collect the inbound sensor data analyze the data from S3 with a
daily scheduled Data Pipeline and save the results to a Redshift Cluster.
B. Utilize Amazon Kinesis to collect the inbound sensor data, analyze the data
with Kinesis clients and save the results to a Redshift cluster using EMR.
C. Utilize SQS to collect the inbound sensor data analyze the data from SQS with
Amazon Kinesis and save the results to a Microsoft SQL Server RDS instance.
D. Utilize EMR to collect the inbound sensor data, analyze the data from EUR
with Amazon Kinesis and save me results to DynamoDB.
Answer: B
QUESTION 9
You are designing Internet connectivity for your VPC. The Web servers must
be available on the Internet.
The application must have a highly available architecture.
Which alternatives should you consider? (Choose two.)
A. Configure a NAT instance in your VPC. Create a default route via the NAT
instance and associate it with all
subnets. Configure a DNS A record that points to the NAT instance public IP
address.
B. Configure a CloudFront distribution and configure the origin to point to the
private IP addresses of your
Web servers. Configure a Route53 CNAME record to your CloudFront distribution.
C. Place all your web servers behind ELB. Configure a Route53 CNMIE to point to
the ELB DNS name.
D. Assign EIPs to all web servers. Configure a Route53 record set with all EIPs,
with health checks and DNS failover.
E. Configure ELB with an EIP. Place all your Web servers behind ELB. Configure a
Route53 A record that points to the EIP.
Answer: C,D
QUESTION 10
Your team has a tomcat-based Java application you need to deploy into
development, test and production
environments. After some research, you opt to use Elastic Beanstalk due to its
tight integration with your
developer tools and RDS due to its ease of management. Your QA team lead points
out that you need to roll a
sanitized set of production data into your environment on a nightly basis.
Similarly, other software teams in
your org want access to that same restored data via their EC2 instances in your
VPC.
The optimal setup for persistence and security that meets the above requirements
would be the following.
A. Create your RDS instance as part of your Elastic Beanstalk definition and
alter its security group to allow
access to it from hosts in your application subnets.
B. Create your RDS instance separately and add its IP address to your
application's DB connection strings in
your code Alter its security group to allow access to it from hosts within your
VPC's IP address block.
C. Create your RDS instance separately and pass its DNS name to your app's DB
connection string as an
environment variable. Create a security group for client machines and add it as
a valid source for DB traffic
to the security group of the RDS instance itself.
D. Create your RDS instance separately and pass its DNS name to your's DB
connection string as an
environment variable Alter its security group to allow access to It from hosts
in your application subnets.
Answer: A
Buy Complete
Certkingdom Offline Testing Engine Simulator Download
Prepare with yourself how CertKingdom Offline Exam Simulator it is designed specifically for any exam preparation. It allows you to create, edit, and take practice tests in an environment very similar to an actual exam.
Supported Platforms: Windows-7 64bit or later - EULA | How to Install?
FAQ's: Windows-8 / Windows 10 if you face any issue kinldy uninstall and reinstall the Simulator again.
Download Offline Simulator-Beta
Certkingdom Testing Engine Features
- Certkingdom Testing Engine simulates the real exam environment.
- Interactive Testing Engine Included
- Live Web App Testing Engine
- Offline Downloadable Desktop App Testing Engine
- Testing Engine App for Android
- Testing Engine App for iPhone
- Testing Engine App for iPad
- Working with the Certkingdom Testing Engine is just like taking the real tests, except we also give you the correct answers.
- More importantly, we also give you detailed explanations to ensure you fully understand how and why the answers are correct.
Certkingdom Android Testing Engine Simulator Download
Take your learning mobile android device with all the features as desktop offline testing engine. All android devices are supported.
Supported Platforms: All Android OS EULA
Install the Android Testing Engine from google play store and download the app.ck from certkingdom website android testing engine download
Certkingdom Android Testing Engine Features
- CertKingdom Offline Android Testing Engine
- Make sure to enable Root check in Playstore
- Live Realistic practice tests
- Live Virtual test environment
- Live Practice test environment
- Mark unanswered Q&A
- Free Updates
- Save your tests results
- Re-examine the unanswered Q & A
- Make your own test scenario (settings)
- Just like the real tests: multiple choice questions
- Updated regularly, always current
