A fitness tracking company serves users around the world, with its primary markets in North America and Asia. The company needs to design an infrastructure for its read heavy user authorization application with the following requirements:
* Be resilient to problem with the application in any region.
* Write to a database In a single Region.
* Read from multiple regions.
* Support resiliency across application tiers in each Region.
* Support the relational database semantics reflected in the application.
Which combination of steps should a solution architect take? (Select TWO.)

• A.Use an Amazon Route 53 geoproximity routing policy combined with a multivalue answer routing policy.
• B.Use an Amazon Route 53 geolocation routing combined with a failover routing policy.
• C.Set up web, application, and Amazon RDS for MySQL instances in each Region. Set up the application so that reads are local and writes are partitioned based on the user. Set up a Multi-AZ failover for the web, application, and database servers, Set up cross-Region replication for the database layer.
• D.Set up active-active web and application servers in each Region. Deploy an Amazon Aurora global database with clusters in each Region. Set up the application to use the in-Region Aurora database endpoints. Create snapshots of the web application servers and store them in an Amazon S3 bucket in both Region
• E.Deploy web, application, and MySQL database servers to Amazon EC2 instance in each Region. Set up the application so that reads and writes are local to the Region. Create snapshots of the web, application, and database servers and store the snapshots in an Amazon S3 bucket in both Regions. Set up cross- Region replication for database layer.

Comment: *

Name: *

Email: *

Verification: *

A company has an internal AWS Elastic Beanstalk worker environment inside a VPC that must access an external payment gateway API available on an HTTPS endpoint the public internet Because of security policies, the payment gateway's Application team can grant access to only one public IP address.
Which architecture will set up an Elastic Beanstalk environment to access the company's application without making multiple changes on the company's end?

• A.Configure the Elastic Beanstalk application to place Amazon EC2 instances in a private subnet with an outbound route to a NAT gateway in a public subnet Associate an Elastic IP address to the NAT gateway that can be whitelisted on the payment gateway application side
• B.Configure the Elastic Beanstalk application to place Amazon EC2 instances in a public subnet with an internet gateway Associate an Elastic IP address to the internet gateway that can be whitelisted on the payment gateway application side
• C.Configure the Elastic Beanstalk application to place Amazon EC2 instances in a private subnet Set an
  https_proxy application parameter to send outbound HTTPS connections to an EC2 proxy server deployed in a public subnet Associate an Elastic IP address to the EC2 proxy host that can be whitelisted on the payment gateway application side
• D.Configure the Elastic Beanstalk application to place Amazon EC2 instances in a public subnet Set the
  https_proxy and no_proxy application parameters to send non-VPC outbound HTTPS connections to an EC2 proxy server deployed in a public subnet Associate an Elastic IP address to the EC2 proxy host that can be whitelisted on the payment gateway application side

Comment: *

Name: *

Email: *

Verification: *

A company's CISO has asked a Solutions Architect to re-engineer the company's current CI/CD practices to make sure patch deployments to its applications can happen as quickly as possible with minimal downtime if vulnerabilities are discovered. The company must also be able to quickly roll back a change in case of errors. The web application is deployed in a fleet of Amazon EC2 instances behind an Application Load Balancer. The company is currently using GitHub to host the application source code and has configured an AWS CodeBuild project to build the application. The company also intends to use AWS CodePipeLine to trigger builds form GitHub commits using the existing CodeBuild project.
What CI/CD configuration meets all of the requirements?

• A.Configure CodePipeline with a deploy stage using AWS CodeDeploy configure for blue/green deployments. Monitor the new deployed code and if there are any issues, trigger a manual rollback using CodeDeploy.
• B.Configure CodePipeline with a deploy stage using AWS CodeDeploy configured for in-place deployment. Monitor the newly deployed code, and if there are any issues, push another code update.
• C.Configure the CodePipeline with a deploy stage using AWS OpsWorks and in-place deployments. Monitor the newly deployed code and if there are any issues, push another code update.
• D.Configure CodePipeline with a deploy stage using AWS CloudFormation to create a pipeline for test and production stacks. Monitor the newly deployed cod and if there are any issues push another code update.

Comment: *

Name: *

Email: *

Verification: *

A solutions architect is implementing infrastructure as code for a two-tier web application in an AWS Cloud Formation template. The web frontend application will be deployed on Amazon EC2 instances m an Auto Scaling group The backend database will be an Amazon RDS fa MySQL DB instance The database password will be rotated every 60 days How can the solutions architect MOST securely manage the configuration of the application's database credentials?

• A.Create a new AWS Secrets Manager secret resource in the CloudFormation template to be used as the database password Configure the application to retrieve the password from Secrets Manager when needed Reference the secret resource for the value of the MasterUserPassword property in the AWS RDS DBlnstance resource using a dynamic reference
• B.Provide the database password as a parameter in the CloudFormation template Create an initialization script in the Auto Scaling group's launch configuration UserData property to reference the password parameter using the Ret intrinsic function Store the password on the EC2 instances Reference the parameter for the value of the MasterUserPassword property in the AWS RDS DBlnstance resource using the Ref intrinsic function
• C.Create a new AWS Secrets Manager secret resource in the CloudFormation template to be used as the database password Create an initialization script in the Auto Scaling group's launch configuration UserData property to reference the secret resource using the Ref intrinsic function Reference the secret resource for the value of the MasterUserPassword property in the AWS::RDS::DBlnstance resource using the Ref intrinsic function
• D.Create a new AWS Systems Manager Parameter Store parameter in the CloudFormabon template to be used as the database password Create an initialization script in the Auto Scaling group's launch configuration UserData property to reference the parameter Reference the parameter for the value of the MasterUserPassword property in the AWS::RDS::DBlnstance resource using the Fn::GetAtt intrinsic function

Comment: *

Name: *

Email: *

Verification: *

A company has an organization in AWS Organizations that has a large number of AWS accounts. One of the AWS accounts is designated as a transit account and has a transit gateway that is shared with all of the other AWS accounts AWS Site-to-Site VPN connections are configured between ail of the company's global offices and the transit account The company has AWS Config enabled on all of its accounts.
The company's networking team needs to centrally manage a list of internal IP address ranges that belong to the global offices Developers Will reference this list to gain access to applications securely.
Which solution meets these requirements with the LEAST amount of operational overhead?

• A.Create a JSON file that is hosted in Amazon S3 and that lists all of the internal IP address ranges Configure an Amazon Simple Notification Service (Amazon SNS) topic in each of the accounts that can be involved when the JSON file is updated. Subscribe an AWS Lambda function to the SNS topic to update all relevant security group rules with Vie updated IP address ranges.
• B.In the transit account, create a VPC prefix list with all of the internal IP address ranges. Use AWS Resource Access Manager to share the prefix list with all of the other accounts. Use the shared prefix list to configure security group rules is the other accounts.
• C.In the transit account create a security group with all of the internal IP address ranges. Configure the security groups in me other accounts to reference the transit account's security group by using a nested security group reference of *<transit-account-id>./sg-1a2b3c4d".
• D.Create a new AWS Config managed rule that contains all of the internal IP address ranges Use the rule to check the security groups in each of the accounts to ensure compliance with the list of IP address ranges. Configure the rule to automatically remediate any noncompliant security group that is detected.

Comment: *

Name: *

Email: *

Verification: *