An operations team has an application running on EC2 instances inside two custom VPCs. The VPCs are located in the Ohio and N.Virginia Region respectively. The team wants to transfer data between the instances without traversing the public internet.
Which combination of steps will achieve this? (Select TWO.)

• A.Launch a NAT Gateway in the public subnet of each VPC.
• B.Create an Egress-only Internet Gateway.
• C.Deploy a VPC endpoint on each region to enable a private connection.
• D.Set up a VPC peering connection between the VPCs.
• E.Re-configure the route table's target and destination of the instances' subnet.

Correct Answer: D,E

A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses. Instances in either VPC can communicate with each other as if they are within the same network. You can create a VPC peering connection between your own VPCs, or with a VPC in another AWS account. The VPCs can be in different regions (also known as an inter-region VPC peering connection).

Inter-Region VPC Peering provides a simple and cost-effective way to share resources between regions or replicate data for geographic redundancy. Built on the same horizontally scaled, redundant, and highly available technology that powers VPC today, Inter-Region VPC Peering encrypts inter-region traffic with no single point of failure or bandwidth bottleneck. Traffic using Inter-Region VPC Peering always stays on the global AWS backbone and never traverses the public internet, thereby reducing threat vectors, such as common exploits and DDoS attacks.
Hence, the correct answers are:
- Set up a VPC peering connection between the VPCs.
- Re-configure the route table's target and destination of the instances' subnet.
The option that says: Create an Egress only Internet Gateway is incorrect because this will just enable outbound IPv6 communication from instances in a VPC to the internet. Take note that the scenario requires private communication to be enabled between VPCs from two different regions.
The option that says: Launch a NAT Gateway in the public subnet of each VPC is incorrect because NAT Gateways are used to allow instances in private subnets to access the public internet. Note that the requirement is to make sure that communication between instances will not traverse the internet.
The option that says: Deploy a VPC endpoint on each region to enable private connection is incorrect.
VPC endpoints are region-specific only and do not support inter-region communication.
References:
https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html
https://aws.amazon.com/about-aws/whats-new/2017/11/announcing-support-for-inter-region-vpc-peering
/
Check out this Amazon VPC Cheat Sheet:
https://tutorialsdojo.com/amazon-vpc/

Comment: *

Name: *

Email: *

Verification: *

A company used an Amazon RDS for MySQL DB instance during application testing. Before terminating the DB instance at the end of the test cycle, a solutions architect created two backups. The solutions architect created the first backup by using the mysqldump utility to create a database dump. The solutions architect created the second backup by enabling the final DB snapshot option on RDS termination.
The company is now planning for a new test cycle and wants to create a new DB instance from the most recent backup. The company has chosen a MySQL-compatible edition of Amazon Aurora to host the DB instance.
Which solutions will create the new DB instance? (Select TWO.)

• A.Import the RDS snapshot directly into Aurora.
• B.Upload the RDS snapshot to Amazon S3. Then import the RDS snapshot into Aurora.
• C.Upload the database dump to Amazon S3. Then import the database dump into Aurora.
• D.Use AWS Database Migration Service (AWS DMS) to import the RDS snapshot into Aurora.
• E.Upload the database dump to Amazon S3. Then use AWS Database Migration Service (AWS DMS) to import the database dump into Aurora.

Comment: *

Name: *

Email: *

Verification: *

A company's data platform uses an Amazon Aurora MySQL database. The database has multiple read replicas and multiple DB instances across different Availability Zones. Users have recently reported errors from the database that indicate that there are too many connections. The company wants to reduce the failover time by
20% when a read replica is promoted to primary writer.
Which solution will meet this requirement?

• A.Switch from Aurora to Amazon RDS with Multi-AZ cluster deployment.
• B.Use Amazon RDS Proxy in front of the Aurora database.
• C.Switch to Amazon DynamoDB with DynamoDB Accelerator (DAX) for read connections.
• D.Switch to Amazon Redshift with relocation capability.

Comment: *

Name: *

Email: *

Verification: *

A Solutions Architect created a brand new IAM User with a default setting using AWS CLI. This is intended to be used to send API requests to Amazon S3, DynamoDB, Lambda, and other AWS resources of the company's cloud infrastructure.
Which of the following must be done to allow the user to make API calls to the AWS resources?

• A.Create a set of Access Keys for the user and attach the necessary permissions.
• B.Do nothing as the IAM User is already capable of sending API calls to your AWS resources.
• C.Enable Multi-Factor Authentication for the user.
• D.Assign an IAM Policy to the user to allow it to send API calls.

Correct Answer: A

You can choose the credentials that are right for your IAM user. When you use the AWS Management Console to create a user, you must choose to at least include a console password or access keys. By default, a brand new IAM user created using the AWS CLI or AWS API has no credentials of any kind.
You must create the type of credentials for an IAM user based on the needs of your user.
Access keys are long-term credentials for an IAM user or the AWS account root user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK).
Users need their own access keys to make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI), Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs for individual AWS services.
To fill this need, you can create, modify, view, or rotate access keys (access key IDs and secret access keys) for IAM users. When you create an access key, IAM returns the access key ID and secret access key. You should save these in a secure location and give them to the user.

The option that says: Do nothing as the IAM User is already capable of sending API calls to your AWS resources is incorrect because by default, a brand new IAM user created using the AWS CLI or AWS API has no credentials of any kind. Take note that in the scenario, you created the new IAM user using the AWS CLI and not via the AWS Management Console, where you must choose to at least include a console password or access keys when creating a new IAM user.
Enabling Multi-Factor Authentication for the user is incorrect because this will still not provide the required Access Keys needed to send API calls to your AWS resources. You have to grant the IAM user with Access Keys to meet the requirement.
Assigning an IAM Policy to the user to allow it to send API calls is incorrect because adding a new IAM policy to the new user will not grant the needed Access Keys needed to make API calls to the AWS resources.
References:
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html#id_users_creds Check out this AWS IAM Cheat Sheet:
https://tutorialsdojo.com/aws-identity-and-access-management-iam/

Comment: *

Name: *

Email: *

Verification: *

A company is planning to store data on Amazon RDS DB instances. The company must encrypt the data at rest.
What should a solutions architect do to meet this requirement?

• A.Create a customer master key (CMK) in AWS Key Management Service (AWS KMS) Enable encryption for the DB instances
• B.Create an encryption key and store the key in AWS Secrets Manager Use the key to encrypt the DB instances
• C.Generate a certificate in AWS Certificate Manager (ACM). Enable SSL/TLS on the DB instances by using the certificate
• D.Generate a certificate in AWS Identity and Access Management {IAM) Enable SSUTLS on the DB instances by using the certificate

Comment: *

Name: *

Email: *

Verification: *