SAP-C02 Exam Dumps - Amazon Web Services AWS Certified Professional Questions and Answers

A is correct because:

App2Containersupports packaging .NET Framework apps into containers without porting to .NET Core.

ECS with EC2gives full control over the OS and patching.

ALBhandles microservice-level load balancing.

RDS for SQL Serverwith Multi-AZ ensures high availability.

Options B, C, and D involve Aurora MySQL (incompatible with SQL Server features) orrequire .NET Core, which involves more significant application changes.

This option allows the solutions architect to use a private hosted zone to host DNS records that are only accessible within the VPC1. By associating the private hosted zone with the VPC, the solutions architect can ensure that DNS queries from the VPC are routed to the private hosted zone2. By activating the enableDnsSupport attribute and the enableDnsHostnames attribute for the VPC, the solutions architect can enable DNS resolution and hostname assignment for instances in the VPC3. By creating a new VPC DHCP options set, and configuring domain-name-servers=AmazonProvidedDNS, the solutions architect can use Amazon-provided DNS servers to resolve DNS queries from instances in the VPC4. By associating the new DHCP options set with the VPC, the solutions architect can apply the DNS settings to all instances in the VPC5.

What is Amazon Route 53 Resolver?

Associating a private hosted zone with your VPC

Using DNS with your VPC

DHCP options sets

Modifying your DHCP options

https://aws.amazon.com/about-aws/whats-new/2022/02/amazon-cloudfront-managed-prefix-list/

To meet the requirements for automatic key rotation of EC2 SSH key pairs with minimal downtime, storing the keys in AWS Secrets Manager and defining a rotation schedule is the most suitable solution. AWS Secrets Manager supports automatic rotation of secrets, including SSH keys, by invoking a Lambda function that can handle the creation of new key pairs and the replacement of public keys on EC2 instances. Updating the corresponding private keys in Secrets Manager ensures secure and centralized management of SSH keys, complying with the key rotation policy and minimizing operational overhead.

AWS Secrets Manager Documentation: Describes how to store and rotate secrets, including SSH keys, using Secrets Manager and Lambda functions.

AWS Lambda Documentation: Provides information on creating Lambda functions for custom secret rotation logic.

AWS Best Practices for Security: Highlights the importance of key rotation and how AWS services like Secrets Manager can facilitate secure and automated key management.

CORS errors occur when a web page hosted on one domain tries to make a request to a server hosted on another domain. In this scenario, the registration form hosted on the static website is trying to make a request to the API Gateway API endpoint hosted on a different domain, which is causing the error. To resolve this error, the Access-Control-Allow-Origin header needs to be set to the domain from which the request is being made. In this case, the header is already set to www.example.com on the CloudFront distribution origin. Therefore, the solutions architect should enable the CORS setting on the API Gateway API endpoint and ensure that the API endpoint is configured to return all responses that have the Access-Control-Allow-Origin header set to www.example.com. This will allow the API endpoint to respond to requests from the static website without a CORS error.

https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-cors-errors/

Using a DHCP options set in AWS allows EC2 instances to automatically receive network configuration information, including the IP address of the on-premises NTP server.

This ensures that all EC2 instances in the VPC consistently use the on-premises atomic clock as their authoritative time source, maintaining the same time synchronization as the existing environment.

By allowing NTP traffic over the Direct Connect connection and ensuring proper security group and network ACL configurations, this approach eliminates the need to manually configure each EC2 instance’s NTP settings, significantly reducing administrative overhead and ensuring consistent, accurate time across the environment.

This aligns with AWS best practices for extending on-premises time synchronization to EC2 instances in a hybrid environment.

Comprehensive and Detailed in Depth Explanation:

B is correct because RDS Proxy allows for connection pooling and improved management of DB connections. Lambda + RDS often runs into connection exhaustion during high concurrency unless RDS Proxy is used. Provisioned concurrency prevents cold starts.

The best solution is to deploy two firewall appliances into the shared services VPC, each in a separate Availability Zone, and create a new Gateway Load Balancer to distribute traffic to them. A Gateway Load Balancer is designed for high performance and high availability scenarios with third-party network virtual appliances, such as firewalls. It operates at the network layer and maintains flow stickiness and symmetry to a specific appliance instance. It also uses the GENEVE protocol to encapsulate traffic between the load balancer and the appliances. To route traffic from other VPCs to the Gateway Load Balancer, a VPC Gateway Load Balancer endpoint is needed. This is a VPC endpoint that provides private connectivity between the appliances in the shared services VPC and the application servers in other VPCs. The endpoint must be added as the next hop in the route table for the shared services VPC. This solution ensures reliability and minimizes failover time between firewall appliances within a single AWS Region. References: What is a Gateway Load Balancer?, Gateway load balancer - Azure Load Balancer, Introducing Azure Gateway Load Balancer: Deploy and scale network …

The company wants to serve static content from an S3 bucket during the maintenance period. To do this, the following steps are required:

Upload static informational content to the S3 bucket. This will provide the source of the content that will be served to the visitors.

Set the S3 bucket as a second origin in the original CloudFront distribution. Configure the distribution and the S3 bucket to use an origin access identity (OAI). Thiswill allow CloudFront to access the S3 bucket securely and prevent public access to the bucket.

During the weekly maintenance, edit the default cache behavior to use the S3 origin. Revert the change when the maintenance is complete. This will redirect all web requests to the S3 bucket instead of the Elastic Beanstalk domain name.

The other options are not correct because:

Creating a new CloudFront distribution is not necessary and would require changing the alternate domain name configuration.

Creating a cache behavior for the S3 origin on a new distribution would not work because the visitors would still access the original distribution using the alternate domain name.

Configuring Elastic Beanstalk to serve traffic from the S3 bucket is not possible and would not achieve the desired result.

Answer B (AWS Global Accelerator) best meets both requirements: fastest failover from application failures and the lowest response time for global users. Global Accelerator is designed for global, latency-sensitive, highly available applications. It uses static Anycast IP addresses so users enter the AWS network at the nearest edge location, then traffic is carried over the AWS global backbone to the closest healthy regional endpoint (in this case, each Region’s ALB). It continuously performs health checks and can rapidly shift traffic away from unhealthy endpoints, which helps “handle application failures quickly” without being constrained by DNS caching behavior.

Why the other options are less suitable:

C (Route 53 latency-based routing + health checks) can improve routing and failover, but it is still DNS-based. DNS-based failover can be delayed by DNS resolver caching and TTL propagation, meaning failover may not be as fast or as consistent as Global Accelerator for rapid recovery.

A (CloudFront with origin group) can provide origin failover and performance benefits mainly for cacheable or edge-optimizable content. For a payment processing API (typically dynamic and not cache-friendly), CloudFront is not the primary service for achieving the least response time globally with fast multi-Region failover compared with Global Accelerator’s Anycast + edge routing model.

D (AWS Cloud WAN) addresses private network connectivity and centralized network policy across Regions/VPCs. It does not directly optimize public user-to-application latency or provide the same kind of edge-based, Anycast-driven rapid failover for internet-facing API endpoints.

Using Tag Editor to remediate untagged resources is a Best Practice (Page 14 or AWS Tagging Best Practices WhitePaper). However, that is were answer A stops. It doesn ' t address the requirement of " Management requires cost center numbers and project ID number for all existing and future DynamoDB tables and RDS instances " . That is where Answer C comes in and addresses that requirement with SCPs in the company ' s AWS Organization. AWS Tagging Best Practices -https://d1.awsstatic.com/whitepapers/aws-tagging-best-practices.pdf

Comprehensive and Detailed Explanation:

Option C is the most comprehensive and aligns with AWS best practices for cost optimization without compromising availability or performance:

AWS Compute Optimizer provides recommendations to rightsize EC2 instances, EBS volumes, and Lambda functions based on utilization metrics. By opting in, the company can receive tailored suggestions for optimizing resource configurations.

AWS Trusted Advisor offers cost optimization checks, including identifying idle or underutilized resources, which can be rightsized or terminated to reduce costs.

Implementing recommendations from Compute Optimizer and Trusted Advisor ensures that resources are appropriately sized, leading to cost savings without affecting performance.

Auto Scaling groups help maintain application availability and allow automatic scaling of EC2 instances based on demand, ensuring that compute capacity aligns with workload requirements.

Compute Savings Plans provide flexible pricing for EC2, AWS Lambda, and AWS Fargate usage, offering significant savings over On-Demand pricing in exchange for a commitment to a consistent amount of usage.

This approach ensures cost optimization while maintaining the necessary compute capacity and availability for production workloads.

This solution will meet the requirements of making the application highly available with the least development time. Creating a new AMI that is configured with SSM Agent will enable the company to use AWS Systems Manager to manage and patch the EC2 instances automatically, reducing downtime and human errors. Using a launch template for an Auto Scaling group will allow the company to launch multiple instances of the same configuration and scale them up or down based on demand. Using smaller instances in the Auto Scaling group will reduce the cost and improve the performance of the application tier. Creating an Application Load Balancer to distribute traffic across the instances in the Auto Scaling group will increase the availability and fault tolerance of the application tier. Migrating the database to Amazon Aurora MySQL will provide a fully managed, compatible, and scalable relational database service that can handle high throughput and concurrent connections.

migrating the data processing script to an AWS Lambda function and using an S3 event notification to invoke the Lambda function to process the objects when the company uploads the objects. This solution meets the company ' s requirements of high availability and scalability, as well as reducing long-term management overhead, and is likely to be the most cost-effective option.