Exam AWS Certified Solutions Architect - Professional All Questions

View all questions & answers for the AWS Certified Solutions Architect - Professional exam

Exam AWS Certified Solutions Architect - Professional topic 1 question 10 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional

Question #: 10
Topic #: 1

[All AWS Certified Solutions Architect - Professional Questions]

Your team has a tomcat-based Java application you need to deploy into development, test and production environments. After some research, you opt to use
Elastic Beanstalk due to its tight integration with your developer tools and RDS due to its ease of management. Your QA team lead points out that you need to roll a sanitized set of production data into your environment on a nightly basis. Similarly, other software teams in your org want access to that same restored data via their EC2 instances in your VPC.
The optimal setup for persistence and security that meets the above requirements would be the following.

A. Create your RDS instance as part of your Elastic Beanstalk definition and alter its security group to allow access to it from hosts in your application subnets.
B. Create your RDS instance separately and add its IP address to your application's DB connection strings in your code Alter its security group to allow access to it from hosts within your VPC's IP address block.
C. Create your RDS instance separately and pass its DNS name to your app's DB connection string as an environment variable. Create a security group for client machines and add it as a valid source for DB traffic to the security group of the RDS instance itself.
D. Create your RDS instance separately and pass its DNS name to your's DB connection string as an environment variable Alter its security group to allow access to It from hosts in your application subnets.

Show Suggested Answer

Suggested Answer: C 🗳️

by waliasa at March 12, 2021, 5:28 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

tbolar

Highly Voted 3 years, 8 months ago

As per CG expert It can't be A because the scenario specifically requires persistence. According to http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.managing.db.html "A database instance that is part of your environment is tied to the lifecycle of your environment. If you terminate the environment, the database instance is terminated as well. An integrated database instance also cannot be removed from your environment once added." It can't be B because we never have access to the IP address of any RDS instance. C & D are very similar except that the scenario requirements specifically state that optimal security should be applied. It can't be D because RDS is opened to all "hosts in your application subnets" where C only opens RDS to specific client machines in a specific security group. C is the correct answer.

upvoted 28 times

...

amministrazione

Most Recent 10 months, 2 weeks ago

C. Create your RDS instance separately and pass its DNS name to your app's DB connection string as an environment variable. Create a security group for client machines and add it as a valid source for DB traffic to the security group of the RDS instance itself.

upvoted 1 times

...

devilman222

1 year, 2 months ago

Selected Answer: C

How on Earth is A marked correct. As part of your Beanstalk means when it get terminated, you loose your data. C is the only answer that makes sense. c

upvoted 1 times

...

2cool2touch

1 year, 3 months ago

Selected Answer: C

A cannot be because when you deploy RDS with EB, you dont get to manage the SGs. This is only available when RDS is created independently.

upvoted 1 times

...

Kubernetes

1 year, 3 months ago

C is perfect

upvoted 1 times

...

KevinYao

1 year, 8 months ago

Selected Answer: C

I believe C as the correct answer.

upvoted 1 times

...

gameoflove

2 years, 3 months ago

Selected Answer: C

I believe C as the correct answer.

upvoted 1 times

...

TigerInTheCloud

2 years, 6 months ago

Selected Answer: C

It seems the question is not very clear or missing something. Just compare the answers as below, I choose C. A is not the kind of answer in the group (may not be the right answer) B DNS, not IP should be used (also it is not the kind of answer in the group beside A) C is better than D. As security group are source is more secure than subnet CIDR.

upvoted 1 times

...

hobokabobo

2 years, 7 months ago

Selected Answer: A

we have two requirements: a) roll out sanitized set of production data nightly b) grant access to ec2 instances in our vpc(operated by others) Now a) is a very interesting requirement. It says data should *not* be kept but replaced every night. *This database is not the source of truth*. *It should not be persisted* This means nightly recreation is not only an option but mandatory. Keeping old unsanitized data is against this requirement. The only answer that in some way addresses requirement a) is answer A. The database is recreated with deployment which can happen over night. Requirement b is fulfilled by security group setting.

upvoted 1 times

...