A developer reports receiving an Error 403: Access Denied message when they try to download an object from an Amazon S3 bucket. The S3 bucket is accessed using an S3 endpoint inside a VPC. and is encrypted with an AWS KMS key. A solutions architect has verified that (he developer is assuming the correct 1AM role in the account that allows the object to be downloaded. The S3 bucket policy and the NACL are also valid.
Which additional step should the solutions architect take to troubleshoot this issue?

• A.Verify that the 1AM role has the correct trust relationship configured.
• B.Verify that the 1AM rote has permission to decrypt the referenced KMS key.
• C.Check that local firewall rules are not preventing access to the S3 endpoint.
• D.Ensure (hat blocking all public access has not been enabled in the S3 bucket.

Comment: *

Name: *

Email: *

Verification: *

A company has a serverless multi-tenant content management system on AWS. The architecture contains a web-based front end that interacts with an Amazon API Gateway API that uses a custom AWS Lambda authorizes The authorizer authenticates a user to its tenant ID and encodes the information in a JSON Web Token (JWT) token. After authentication, each API call through API Gateway targets a Lambda function that interacts with a single Amazon DynamoOB table to fulfill requests.
To comply with security standards, the company needs a stronger isolation between tenants. The company will have hundreds of customers within the first year.
Which solution will meet these requirements with the LEAST operational?

• A.Create a DynamoDB table for each tenant by using the tenant ID in the table name. Create a service that uses the JWT token to retrieve the appropriate Lambda execution role that is tenant-specific. Attach
  1AM policies to the execution role to allow access only to the DynamoDB table for the tenant.
• B.Add tenant ID as a sort key in every DynamoDB table. Add logic to each Lambda function to use the tenant ID that comes from the JWT token as the sort key in every operation on the DynamoDB table.
• C.Create a separate AWS account for each tenant of the application. Use dedicated infrastructure for each tenant. Ensure that no cross-account network connectivity exists.
• D.Add tenant ID information to the partition key of the DynamoDB table. Create a service that uses the JWT token to retrieve the appropriate Lambda execution role that is tenant-specific. Attach 1AM policies to the execution role to allow access to items in the table only when the key matches the tenant ID.

Comment: *

Name: *

Email: *

Verification: *

The company needs to determine which costs on the monthly AWS bill are attributable to each application or team. The company also must be able to create reports to compare costs from the last 12 months and to help forecast costs for the next 12 months. A solutions architect must recommend an AWS Billing and Cost Management solution that provides these cost reports.
Which combination of actions will meet these requirements? (Select THREE.)

• A.Create a cost category for each application in Billing and Cost Management.
• B.Activate the AWS generated cost allocation tags that represent the application and the team.
• C.Enable Cost Explorer.
• D.Activate the user-defined cost allocation tags that represent the application and the team.
• E.Activate IAM access to Billing and Cost Management.
• F.Create a cost budget.

Comment: *

Name: *

Email: *

Verification: *

A company's AWS architecture currently uses access keys and secret access keys stored on each instance to access AWS services. Database credentials are hard-coded on each instance. SSH keys for command-tine remote access are stored in a secured Amazon S3 bucket. The company has asked its solutions architect to improve the security posture of the architecture without adding operational complexity.
Which combination of steps should the solutions architect take to accomplish this? (Select THREE.)

• A.Use Amazon EC2 instance profiles with an 1AM role.
• B.Use AWS Secrets Manager to store access keys and secret access keys.
• C.Use AWS Systems Manager Parameter Store to store database credentials.
• D.Use a secure fleet of Amazon EC2 bastion hosts (or remote access.
• E.Use AWS KMS to store database credentials.
• F.Use AWS Systems Manager Session Manager tor remote access

Comment: *

Name: *

Email: *

Verification: *

A company has created an OU in AWS Organizations for each of its engineering teams Each OU owns multiple AWS accounts. The organization has hundreds of AWS accounts A solutions architect must design a solution so that each OU can view a breakdown of usage costs across its AWS accounts. Which solution meets these requirements?

• A.Create an AWS Cost and Usage Report (CUR) by using AWS Systems Manager Allow each team to visualize the CUR through Systems Manager OpsCenter dashboards
• B.Create an AWS Cost and Usage Report (CUR) from the AWS Organizations management account- Allow each team to visualize the CUR through an Amazon QuickSight dashboard
• C.Create an AWS Cost and Usage Report (CUR) for each OU by using AWS Resource Access Manager Allow each team to visualize the CUR through an Amazon QuickSight dashboard.
• D.Create an AWS Cost and Usage Report (CUR) in each AWS Organizations member account Allow each team to visualize the CUR through an Amazon QuickSight dashboard.

Comment: *

Name: *

Email: *

Verification: *