A benefits enrollment company is hosting a 3-tier web application running in a VPC on AWS which includes a NAT (Network Address Translation) instance in the public Web tier. There is enough provisioned capacity for the expected workload tor the new fiscal year benefit enrollment period plus some extra overhead Enrollment proceeds nicely for two days and then the web tier becomes unresponsive, upon investigation using CloudWatch and other monitoring tools it is discovered that there is an extremely large and unanticipated amount of inbound traffic coming from a set of 15 specific IP addresses over port 80 from a country where the benefits company has no customers. The web tier instances are so overloaded that benefit enrollment administrators cannot even SSH into them. Which activity would be useful in defending against this attack?

• A.Change the EIP (Elastic IP Address) of the NAT instance in the web tier subnet and update the Main Route Table with the new EIP
• B.Create a custom route table associated with the web tier and block the attacking IP addresses from the IGW (internet Gateway)
• C.Create 15 Security Group rules to block the attacking IP addresses over port 80
• D.Create an inbound NACL (Network Access control list) associated with the web tier subnet with deny rules to block the attacking IP addresses

Comment: *

Name: *

Email: *

Verification: *

An image-hosting company stores its objects in Amazon S3 buckets. The company wants to avoid accidental exposure of the objects in the S3 buckets to the public. All S3 objects in the entire AWS account need to remain private Which solution will meal these requirements?

• A.Use AWS Resource Access Manager to find publicly accessible S3 buckets Use Amazon Simple Notification Service (Amazon SNS) to invoke an AWS Lambda function when a change it detected.
  Deploy a Lambda function that programmatically remediates the change.
• B.Use the S3 Block Public Access feature on the account level. Use AWS Organizations to create a service control policy (SCP) that prevents IAM users from changing the setting Apply tie SCP to tie account
• C.Use Amazon GuardDuty to monitor S3 bucket policies Create an automatic remediation action rule that uses an AWS Lambda function to remediate any change that makes the objects public
• D.Use AWS Trusted Advisor to find publicly accessible S3 Dockets Configure email notifications In Trusted Advisor when a change is detected manually change the S3 bucket policy if it allows public access

Comment: *

Name: *

Email: *

Verification: *

A company has a production web application in which users upload documents through a web interlace or a mobile app. According to a new regulatory requirement, new documents cannot be modified or deleted after they are stored.
What should a solutions architect do to meet this requirement?

• A.Store the uploaded documents in an Amazon S3 bucket. Configure an S3 Lifecycle policy to archive the documents periodically.
• B.Store the uploaded documents on an Amazon Elastic File System (Amazon EFS) volume. Access the data by mounting the volume in read-only mode.
• C.Store the uploaded documents in an Amazon S3 bucket with S3 Versioning enabled Configure an ACL to restrict all access to read-only.
• D.Store the uploaded documents in an Amazon S3 bucket with S3 Versioning and S3 Object Lock enabled

Comment: *

Name: *

Email: *

Verification: *

A company is. moving its on-premises applications to Amazon EC2 instances. However as a result of fluctuating compute requirements, the EC2 instances must always be ready to use between 8 AM and 5 PM in specific Availability Zones.
Which EC2 instances should the company choose to run the applications?

• A.On-Demand Instances
• B.Scheduled Reserved I Instances
• C.Spot Instances as part of a Spot Fleet
• D.EC2 instances in an Auto Scaling group

Comment: *

Name: *

Email: *

Verification: *

An AWS account owner has setup multiple IAM users. One of these IAM users, named John, has CloudWatch access, but no access to EC2 services. John has setup an alarm action which stops EC2 instances when their CPU utilization is below the threshold limit.
When an EC2 instance's CPU Utilization rate drops below the threshold John has set, what will happen and why?

• A.CloudWatch will stop the instance when the action is executed
• B.Nothing will happen. John cannot set an alarm on EC2 since he does not have the permission.
• C.Nothing will happen. John can setup the action, but it will not be executed because he does not have EC2 access through IAM policies.
• D.Nothing will happen because it is not possible to stop the instance using the CloudWatch alarm

Comment: *

Name: *

Email: *

Verification: *