2017 October Amazon Official New Released AWS Certified Solutions Architect – Associate Dumps in Lead2pass.com!

100% Free Download! 100% Pass Guaranteed!

Are you worrying about the AWS Certified Solutions Architect – Associate exam? Lead2pass provides the latest AWS Certified Solutions Architect – Associate braindumps and guarantees you passing AWS Certified Solutions Architect – Associate exam beyond any doubt.

Following questions and answers are all new published by Amazon Official Exam Center: https://www.lead2pass.com/aws-certified-solutions-architect-associate.html

QUESTION 601
You are using Amazon SES as an email solution but are unsure of what its limitations are. Which statement below is correct in regards to that?

A.    New Amazon SES users who have received production access can send up to 1,000 emails per 24-hour period, at a maximum rate of 10 emails per second.
B.    Every Amazon SES sender has a the same set of sending limits
C.    Sending limits are based on messages rather than on recipients
D.    Every Amazon SES sender has a unique set of sending limits

Answer: D
Explanation:
Amazon Simple Email Service (Amazon SES) is a highly scalable and cost-effective email-sending service for businesses and developers. Amazon SES eliminates the complexity and expense of building an in-house email solution or licensing, installing, and operating a third-party email service for this type of email communication.
Every Amazon SES sender has a unique set of sending limits, which are calculated by Amazon SES on an ongoing basis:
Sending quota — the maximum number of emails you can send in a 24-hour period. Maximum send rate — the maximum number of emails you can send per second. New Amazon SES users who have received production access can send up to 10,000 emails per 24-hour period, at a maximum rate of 5 emails per second. Amazon SES automatically adjusts these limits upward, as long as you send high-quality email. If your existing quota is not adequate for your needs and the system has not automatically increased your quota, you can submit an SES Sending Quota Increase case at any time.
Sending limits are based on recipients rather than on messages. You can check your sending limits at any time by using the Amazon SES console.
Note that if your email is detected to be of poor or questionable quality (e.g., high complaint rates, high bounce rates, spam, or abusive content), Amazon SES might temporarily or permanently reduce your permitted send volume, or take other action as AWS deems appropriate.
Reference: https://aws.amazon.com/ses/faqs/

QUESTION 602
Having just set up your first Amazon Virtual Private Cloud (Amazon VPC) network, which defined a default network interface, you decide that you need to create and attach an additional network interface, known as an elastic network interface (ENI) to one of your instances. Which of the following statements is true regarding attaching network interfaces to your instances in your VPC?

A.    You can attach 5 ENIs per instance type.
B.    You can attach as many ENIs as you want.
C.    The number of ENIs you can attach varies by instance type.
D.    You can attach 100 ENIs total regardless of instance type.

Answer: C
Explanation:
Each instance in your VPC has a default network interface that is assigned a private IP address from the IP address range of your VPC. You can create and attach an additional network interface, known as an elastic network interface (ENI), to any instance in your VPC. The number of ENIs you can attach varies by instance type.

QUESTION 603
A _____ for a VPC is a collection of subnets (typically private) that you may want to designate for your backend RDS DB Instances.

A.    DB Subnet Set
B.    RDS Subnet Group
C.    DB Subnet Group
D.    DB Subnet Collection

Answer: C
Explanation:
DB Subnet Groups are a set of subnets (one per Availability Zone of a particular region) designed for your DB instances that reside in a VPC. They make easy to manage Multi-AZ deployments as well as the conversion from a Single-AZ to a Mutli-AZ one.
Reference: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.RDSVPC.html

QUESTION 604
Amazon Elastic Load Balancing is used to manage traffic on a fleet of Amazon EC2 instances, distributing traffic to instances across all availability zones within a region. Elastic Load Balancing has all the advantages of an on-premises load balancer, plus several security benefits. Which of the following is not an advantage of ELB over an on-premise load balancer?

A.    ELB uses a four-tier, key-based architecture for encryption.
B.    ELB offers clients a single point of contact, and can also serve as the first line of defense against attacks on your network.
C.    ELB takes over the encryption and decryption work from the Amazon EC2 instances and manages it centrally on the load balancer.
D.    ELB supports end-to-end traffic encryption using TLS (previously SSL) on those networks that use secure HTTP (HTTPS) connections.

Answer: A
Explanation:
Amazon Elastic Load Balancing is used to manage traffic on a fleet of Amazon EC2 instances, distributing traffic to instances across all availability zones within a region. Elastic Load Balancing has all the advantages of an on-premises load balancer, plus several security benefits:
Takes over the encryption and decryption work from the Amazon EC2 instances and manages it centrally on the load balancer
Offers clients a single point of contact, and can also serve as the first line of defense against attacks on your network
When used in an Amazon VPC, supports creation and management of security groups associated with your Elastic Load Balancing to provide additional networking and security options Supports end-to-end traffic encryption using TLS (previously SSL) on those networks that use secure HTTP (HTTPS) connections. When TLS is used, the TLS server certificate used to terminate client connections can be managed centrally on the load balancer, rather than on every individual instance.
Reference: http://d0.awsstatic.com/whitepapers/Security/AWS%20Security%20Whitepaper.pdf

QUESTION 605
You have set up an S3 bucket with a number of images in it and you have decided that you want anybody to be able to access these images, even anonymous users. To accomplish this you create a bucket policy. You will need to use an Amazon S3 bucket policy that specifies a __________ in the principal element, which means anyone can access the bucket.

A.    hash tag (#)
B.    anonymous user
C.    wildcard (*)
D.    S3 user

Answer: C
Explanation:
You can use the AWS Policy Generator to create a bucket policy for your Amazon S3 bucket. You can then use the generated document to set your bucket policy by using the Amazon S3 console, by a number of third-party tools, or via your application.
You use an Amazon S3 bucket policy that specifies a wildcard (*) in the principal element, which means anyone can access the bucket. With anonymous access, anyone (including users without an AWS account) will be able to access the bucket.
Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/iam-troubleshooting.html#d0e20565

QUESTION 606
You have been asked to build AWS infrastructure for disaster recovery for your local applications and within that you should use an AWS Storage Gateway as part of the solution. Which of the following best describes the function of an AWS Storage Gateway?

A.    Accelerates transferring large amounts of data between the AWS cloud and portable storage devices .
B.    A web service that speeds up distribution of your static and dynamic web content.
C.    Connects an on-premises software appliance with cloud-based storage to provide seamless and secure integration between your on-premises IT environment and AWS’s storage infrastructure.
D.    Is a storage service optimized for infrequently used data, or “cold data.”

Answer: C
Explanation:
AWS Storage Gateway connects an on-premises software appliance with cloud-based storage to provide seamless integration with data security features between your on-premises IT environment and the Amazon Web Services (AWS) storage infrastructure. You can use the service to store data in the AWS cloud for scalable and cost-effective storage that helps maintain data security. AWS Storage Gateway offers both volume-based and tape-based storage solutions:
Volume gateways
Gateway-cached volumes
Gateway-stored volumes
Gateway-virtual tape library (VTL)
Reference: http://media.amazonwebservices.com/architecturecenter/AWS_ac_ra_disasterrecovery_07.pdf

QUESTION 607
An organization has a statutory requirement to protect the data at rest for the S3 objects. Which of the below mentioned options need not be enabled by the organization to achieve data security?

A.    MFA delete for S3 objects
B.    Client side encryption
C.    Bucket versioning
D.    Data replication

Answer: D
Explanation:
AWS S3 provides multiple options to achieve the protection of data at REST. The options include Permission (Policy), Encryption (Client and Server Side), Bucket Versioning and MFA based delete. The user can enable any of these options to achieve data protection. Data replication is an internal facility by AWS where S3 replicates each object across all the Availability Zones and the organization need not enable it in this case.
Reference: http://media.amazonwebservices.com/AWS_Security_Best_Practices.pdf

QUESTION 608
In Amazon CloudFront, if you use Amazon EC2 instances and other custom origins with CloudFront, it is recommended to_____.

A.    not use Elastic Load Balancing
B.    restrict Internet communication to private instances while allowing outgoing traffic
C.    enable access key rotation for CloudWatch metrics
D.    specify the URL of the load balancer for the domain name of your origin server

Answer: D
Explanation:
In Amazon CloudFront, you should use an Elastic Load Balancing load balancer to handle traffic across multiple Amazon EC2 instances and to isolate your application from changes to Amazon EC2 instances. When you create your CloudFront distribution, specify the URL of the load balancer for the domain name of your origin server.
Reference: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CustomOriginBestPractices.html

QUESTION 609
What is the time period with which metric data is sent to CloudWatch when detailed monitoring is enabled on an Amazon EC2 instance?

A.    15 minutes
B.    5 minutes
C.    1 minute
D.    45 seconds

Answer: C
Explanation:
By default, Amazon EC2 metric data is automatically sent to CloudWatch in 5-minute periods. However, you can, enable detailed monitoring on an Amazon EC2 instance, which sends data to CloudWatch in 1-minute periods
Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch.html

QUESTION 610
A government client needs you to set up secure cryptographic key storage for some of their extremely confidential data. You decide that the AWS CloudHSM is the best service for this. However, there seem to be a few pre-requisites before this can happen, one of those being a security group that has certain ports open. Which of the following is correct in regards to those security groups?

A.    A security group that has port 22 (for SSH) or port 3389 (for RDP) open to your network.
B.    A security group that has no ports open to your network.
C.    A security group that has only port 3389 (for RDP) open to your network.
D.    A security group that has only port 22 (for SSH) open to your network.

Answer: A
Explanation:
AWS CloudHSM provides secure cryptographic key storage to customers by making hardware security modules (HSMs) available in the AWS cloud.
AWS CloudHSM requires the following environment before an HSM appliance can be provisioned. A virtual private cloud (VPC) in the region where you want the AWS CloudHSM service. One private subnet (a subnet with no Internet gateway) in the VPC. The HSM appliance is provisioned into this subnet.
One public subnet (a subnet with an Internet gateway attached). The control instances are attached to this subnet.
An AWS Identity and Access Management (IAM) role that delegates access to your AWS resources to AWS CloudHSM.
An EC2 instance, in the same VPC as the HSM appliance, that has the SafeNet client software installed. This instance is referred to as the control instance and is used to connect to and manage the HSM appliance.
A security group that has port 22 (for SSH) or port 3389 (for RDP) open to your network. This security group is attached to your control instances so you can access them remotely.

QUESTION 611
Which of the following features are provided by Amazon EC2?

A.    Exadata Database Machine, Optimized Storage Management, Flashback Technology, and Data Warehousing
B.    Instances, Amazon Machine Images (AMIs), Key Pairs, Amazon EBS Volumes, Firewall, Elastic IP address, Tags, and Virtual Private Clouds (VPCs)
C.    Real Application Clusters (RAC), Elasticache Machine Images (EMIs), Data Warehousing, Flashback Technology, Dynamic IP address
D.    Exadata Database Machine, Real Application Clusters (RAC), Data Guard, Table and Index Partitioning, and Data Pump Compression

Answer: B
Explanation:
Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/concepts.html

QUESTION 612
In Amazon Elastic Compute Cloud, which of the following is used for communication between instances in the same network (EC2-Classic or a VPC)?

A.    Private IP addresses
B.    Elastic IP addresses
C.    Static IP addresses
D.    Public IP addresses

Answer: A
Explanation:
A private IP address is an IP address that’s not reachable over the Internet. You can use private IP addresses for communication between instances in the same network (EC2-Classic or a VPC).
Reference: http://docs.amazonwebservices.com/AWSEC2/latest/UserGuide/using-instance-addressing.html

QUESTION 613
A friend tells you he is being charged $100 a month to host his WordPress website, and you tell him you can move it to AWS for him and he will only pay a fraction of that, which makes him very happy. He then tells you he is being charged $50 a month for the domain, which is registered with the same people that set it up, and he asks if it’s possible to move that to AWS as well. You tell him you aren’t sure, but will look into it. Which of the following statements is true in regards to transferring domain names to AWS?

A.    You can’t transfer existing domains to AWS.
B.    You can transfer existing domains into Amazon Route 53’s management.
C.    You can transfer existing domains via AWS Direct Connect.
D.    You can transfer existing domains via AWS Import/Export.

Answer: B
Explanation:
With Amazon Route 53, you can create and manage your public DNS records with the AWS Management Console or with an easy-to-use API. If you need a domain name, you can find an available name and register it using Amazon Route 53. You can also transfer existing domains into Amazon Route 53’s management.
Reference: http://aws.amazon.com/route53/

QUESTION 614
Are penetration tests allowed as long as they are limited to the customer’s instances?

A.    Yes, they are allowed but only for selected regions.
B.    No, they are never allowed.
C.    Yes, they are allowed without any permission.
D.    Yes, they are allowed but only with approval.

Answer: D
Explanation:
Penetration tests are allowed after obtaining permission from AWS to perform them.
Reference: http://aws.amazon.com/security/penetration-testing/

QUESTION 615
A user has created an ELB with the availability zone US-East-1A. The user wants to add more zones to ELB to achieve High Availability. How can the user add more zones to the existing ELB?

A.    The user should stop the ELB and add zones and instances as required
B.    The only option is to launch instances in different zones and add to ELB
C.    It is not possible to add more zones to the existing ELB
D.    The user can add zones on the fly from the AWS console

Answer: D
Explanation:
The user has created an Elastic Load Balancer with the availability zone and wants to add more zones to the existing ELB. The user can do so in two ways:
From the console or CLI, add new zones to ELB;
Launch instances in a separate AZ and add instances to the existing ELB.
Reference: http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/enable-disable-az.html

QUESTION 616
What happens to data on an ephemeral volume of an EBS-backed EC2 instance if it is terminated or if it fails?

A.    Data is automatically copied to another volume.
B.    The volume snapshot is saved in S3.
C.    Data persists.
D.    Data is deleted.

Answer: D
Explanation:
Any data on the instance store volumes persists as long as the instance is running, but this data is deleted when the instance is terminated or if it fails (such as if an underlying drive has issues). After an instance store-backed instance fails or terminates, it cannot be restored.
Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/RootDeviceStorage.html

QUESTION 617
A user is sending bulk emails using AWS SES. The emails are not reaching some of the targeted audience because they are not authorized by the ISPs. How can the user ensure that the emails are all delivered?

A.    Send an email using DKIM with SES.
B.    Send an email using SMTP with SES.
C.    Open a ticket with AWS support to get it authorized with the ISP.
D.    Authorize the ISP by sending emails from the development account.

Answer: A
Explanation:
Domain Keys Identified Mail (DKIM) is a standard that allows senders to sign their email messages and ISPs, and use those signatures to verify that those messages are legitimate and have not been modified by a third party in transit.
Reference: http://docs.aws.amazon.com/ses/latest/DeveloperGuide/dkim.html

QUESTION 618
In AWS CloudHSM, in addition to the AWS recommendation that you use two or more HSM appliances in a high-availability configuration to prevent the loss of keys and data, you can also perform a remote backup/restore of a Luna SA partition if you have purchased a:

A.    Luna Restore HSM.
B.    Luna Backup HSM.
C.    Luna HSM.
D.    Luna SA HSM.

Answer: B
Explanation:
In AWS CloudHSM, you can perform a remote backup/restore of a Luna SA partition if you have purchased a Luna Backup HSM.
Reference: http://docs.aws.amazon.com/cloudhsm/latest/userguide/cloud-hsm-backup-restore.html

QUESTION 619
A user has launched a large EBS backed EC2 instance in the US-East-1a region. The user wants to achieve Disaster Recovery (DR) for that instance by creating another small instance in Europe. How can the user achieve DR?

A.    Copy the instance from the US East region to the EU region
B.    Use the “Launch more like this” option to copy the instance from one region to another
C.    Copy the running instance using the “Instance Copy” command to the EU region
D.    Create an AMI of the instance and copy the AMI to the EU region. Then launch the instance from the EU AMI

Answer: D
Explanation:
To launch an EC2 instance it is required to have an AMI in that region. If the AMI is not available in that region, then create a new AMI or use the copy command to copy the AMI from one region to the other region.
Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/CopyingAMIs.html

QUESTION 620
AWS Identity and Access Management is a web service that enables Amazon Web Services (AWS) customers to manage users and user permissions in AWS. In addition to supporting IAM user policies, some services support resource-based permissions. Which of the following services are supported by resource-based permissions?

A.    Amazon SNS, and Amazon SQS and AWS Direct Connect.
B.    Amazon S3 and Amazon SQS and Amazon ElastiCache.
C.    Amazon S3, Amazon SNS, Amazon SQS, Amazon Glacier and Amazon EBS.
D.    Amazon Glacier, Amazon SNS, and Amazon CloudWatch

Answer: C
Explanation:
In addition to supporting IAM user policies, some services support resource-based permissions, which let you attach policies to the service’s resources instead of to IAM users or groups. Resource-based permissions are supported by Amazon S3, Amazon SNS, Amazon SQS, Amazon Glacier and Amazon EBS.
Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_SpecificProducts.html

QUESTION 621
Content and Media Server is the latest requirement that you need to meet for a client. The client has been very specific about his requirements such as low latency, high availability, durability, and access control. Potentially there will be millions of views on this server and because of “spiky” usage patterns, operations teams will need to provision static hardware, network, and management resources to support the maximum expected need. The Customer base will be initially low but is expected to grow and become more geographically distributed.
Which of the following would be a good solution for content distribution?

A.    Amazon S3 as both the origin server and for caching
B.    AWS Storage Gateway as the origin server and Amazon EC2 for caching
C.    AWS CloudFront as both the origin server and for caching
D.    Amazon S3 as the origin server and Amazon CloudFront for caching

Answer: D
Explanation:
As your customer base grows and becomes more geographically distributed, using a high- performance edge cache like Amazon CloudFront can provide substantial improvements in latency, fault tolerance, and cost.
By using Amazon S3 as the origin server for the Amazon CloudFront distribution, you gain the advantages of fast in-network data transfer rates, simple publishing/caching workflow, and a unified security framework.
Amazon S3 and Amazon CloudFront can be configured by a web service, the AWS Management Console, or a host of third-party management tools.
Reference: http://media.amazonwebservices.com/architecturecenter/AWS_ac_ra_media_02.pdf

QUESTION 622
You are setting up your first Amazon Virtual Private Cloud (Amazon VPC) network so you decide you should probably use the AWS Management Console and the VPC Wizard. Which of the following is not an option for network architectures after launching the “Start VPC Wizard” in Amazon VPC page on the AWS Management Console?

A.    VPC with a Single Public Subnet Only
B.    VPC with a Public Subnet Only and Hardware VPN Access
C.    VPC with Public and Private Subnets and Hardware VPN Access
D.    VPC with a Private Subnet Only and Hardware VPN Access

Answer: B
Explanation:
Amazon VPC enables you to build a virtual network in the AWS cloud – no VPNs, hardware, or physical datacenters required.
Your AWS resources are automatically provisioned in a ready-to-use default VPC. You can choose to create additional VPCs by going to Amazon VPC page on the AWS Management Console and click on the “Start VPC Wizard” button.
You’ll be presented with four basic options for network architectures. After selecting an option, you can modify the size and IP address range of the VPC and its subnets. If you select an option with Hardware VPN Access, you will need to specify the IP address of the VPN hardware on your network. You can modify the VPC to add more subnets or add or remove gateways at any time after the VPC has been created.
The four options are:
VPC with a Single Public Subnet Only
VPC with Public and Private Subnets
VPC with Public and Private Subnets and Hardware VPN Access VPC with a Private Subnet Only and Hardware VPN Access
Reference: https://aws.amazon.com/vpc/faqs/

QUESTION 623
An EC2 instance is connected to an ENI (Elastic Network Interface) in one subnet. What happens when you attach an ENI of a different subnet to this EC2 instance?

A.    The EC2 instance follows the rules of the older subnet
B.    The EC2 instance follows the rules of both the subnets
C.    Not possible, cannot be connected to 2 ENIs
D.    The EC2 instance follows the rules of the newer subnet

Answer: B
Explanation:
AWS allows you create an elastic network interface (ENI), attach an ENI to an EC2 instance, detach an ENI from an EC2 instance and attach this ENI to another EC2 instance. The attributes of a network traffic follow the ENI which is attached to an EC2 instance or detached from an EC2 instance. When you move an ENI from one EC2 instance to another, network traffic is redirected to the new EC2 instance. You can create and attach additional ENIs to an EC2 instance.
Attaching multiple network interfaces (ENIs) to an EC2 instance is useful to:
Create a management network.
Use network and security appliances in your VPC.
Create dual-homed instances with workloads/roles on distinct subnets Create a low-budget, high-availability solution.
Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

QUESTION 624
Which one of the below doesn’t affect Amazon CloudFront billing?

A.    Distribution Type
B.    Data Transfer Out
C.    Dedicated IP SSL Certificates
D.    Requests

Answer: A
Explanation:
Amazon CloudFront is a web service for content delivery. CloudFront delivers your content using a global network of edge locations and works seamlessly with Amazon S3 which durably stores the original and definitive versions of your files.
Amazon CloudFront billing is maily affected by
Data Transfer Out
Edge Location Traffic Distribution
Requests
Dedicated IP SSL Certificates
Reference: http://calculator.s3.amazonaws.com/index.html

QUESTION 625
A user is trying to launch a similar EC2 instance from an existing instance with the option “Launch More like this”. The AMI of the selected instance is deleted. What will happen in this case?

A.    AWS does not need an AMI for the “Launch more like this” option
B.    AWS will launch the instance but will not create a new AMI
C.    AWS will create a new AMI and launch the instance
D.    AWS will throw an error saying that the AMI is deregistered

Answer: D
Explanation:
If the user has deregistered the AMI of an EC2 instance and is trying to launch a similar instance with the option “Launch more like this”, AWS will throw an error saying that the AMI is deregistered or not available.
Reference: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/launching-instance.html

Lead2pass offers the latest AWS Certified Solutions Architect – Associate PDF and VCE dumps with new version VCE player for free download, and the new AWS Certified Solutions Architect – Associate dump ensures your exam 100% pass.

More AWS Certified Solutions Architect – Associate new questions on Google Drive: https://drive.google.com/open?id=0B3Syig5i8gpDVm1nMUwwQ1pkRE0

2017 Amazon AWS Certified Solutions Architect – Associate exam dumps (All 796 Q&As) from Lead2pass:

https://www.lead2pass.com/aws-certified-solutions-architect-associate.html [100% Exam Pass Guaranteed]