A financial services firm is deploying a real-time analytics platform on Alibaba Cloud to analyze sensitive customer transaction data. The platform must ensure data encryption at rest and in transit, centralized encryption key management, and compliance with internal security policies.
As a Cloud Architect, which Alibaba Cloud services would you recommend for the firm to utilize to meet these requirements? (Correct answers: 3)

• A. Enable Transparent Data Encryption in ApsaraDB RDS for data at rest.
• B. Use SSL/TLS certificates from SSL Certificates Service for encrypting data in transit.
• C. Implement Alibaba Cloud Key Management Service (KMS) to manage encryption keys securely.
• D. Deploy Redis on ECS instances for session management.
• E. Configure Security Groups to restrict inbound traffic to ECS instances.

Keanu uses Elastic Compute Service (ECS) instances to run batch jobs to process data at 00:00 AM and 04:00 AM every day. An Auto Scaling group manages the ECS instances, which run as pay-as-you-go instances. If a batch job fails on one instance, another instance will reprocess the job.
Which of the following solutions provides the MOST cost-effective way to run these jobs?

• A. Create a new launch template for the Auto Scaling group. Configure the launch template to use higher specification instances. Set a policy to scale out based on CPU usage.
• B. Create a new launch template for the Auto Scaling group. Configure the launch template to use preemptible instances. Set a policy to scale out based on CPU usage.
• C. Purchase a 1-year reserved instance for ECS that covers the instance family of the Auto Scaling group that the batch job uses.
• D. Purchase a 1-year Savings Plan for ECS that covers the instance family of the Auto Scaling group that the batch job uses.

A multinational corporation is designing its network architecture on Alibaba Cloud to support its distributed applications. Their requirements include:
* Private and high-speed connectivity between on-premises data centers and Alibaba Cloud VPCs across multiple regions.
* Centralized management and enforcement of network security policies.
* Comprehensive monitoring and logging of all network traffic for compliance and auditing purposes.
Which combination of Alibaba Cloud services should the corporation implement to meet these requirements MOST effectively? (Correct answers: 2)

• A. Deploy Alibaba Cloud Global Accelerator for all inter-region traffic routing.
• B. Implement VPC peering between all regional VPCs and utilize Security Groups for access control.
• C. Use Alibaba Cloud Express Connect with Transit Router and integrate with Security Center.
• D. Deploy multiple VPN Gateways in each region and manage connections individually.
• E. Set up Cloud Enterprise Network (CEN) and integrate with Simple Log Service.

Liam ' s company operates an on-premises data analytics platform across 12 servers. The system runs scheduled jobs (70% of the time, each job taking anywhere from 20 minutes to 2 hours to complete, with tight SLAs) and user jobs (30% of the time, each job taking less than 5 minutes, with no SLA requirements).
Scheduled jobs must continue to meet SLAs during system failures, while user jobs can be delayed.
As a Cloud Architect, you are tasked to migrate the system to Alibaba Cloud ECS using a consumption-based model while maintaining the same high availability and SLA requirements.
Which solution is the MOST cost-effective and flexible?

• A. Choose an Alibaba Cloud region and split the 12 instances across two zones. Use reserved instances to run 2 pay-as-you-go instances in each zone. Run 4 preemptible instances in each zone.
• B. Choose an Alibaba Cloud region and split the 12 instances across three zones. Use a savings plan to run
  3 pay-as-you-go instances in each zone. Run 1 preemptible instance in each zone.
• C. Choose an Alibaba Cloud region and split the 12 instances across three zones. Use reserved instances to run 6 pay-as-you-go instances in a single zone. Run 3 preemptible instances in each of the remaining two zones.
• D. Choose an Alibaba Cloud region and split the 12 instances across three zones. Use reserved instances to run 3 pay-as-you-go instances in each zone. Run 1 preemptible instance in each zone.

A Cloud Architect is designing a two-tiered architecture that includes a public vSwitch and a database vSwitch. The web servers in the public vSwitch must be open to the Internet on port 443. The ApsaraDB RDS for MySQL instance in the database vSwitch must be accessible only to the web servers on port 3306.
Which combination of actions should the Cloud Architect take to meet these requirements? (Correct answers:
2)

• A. Create a network ACL for the public vSwitch. Add a rule to deny outbound traffic to 0.0.0.0/0 on port
  3306.
• B. Create a security group for the RDS instance. Add a rule to allow traffic from the public vSwitch CIDR block on port 3306.
• C. Create a security group for the RDS instance. Add a rule to deny all traffic except traffic from the web servers ' security group on port 3306.
• D. Create a security group for the web servers in the public vSwitch. Add a rule to allow traffic from
  0.0.0.0/0 on port 443.
• E. Create a security group for the RDS instance. Add a rule to allow traffic from the web servers ' security group on port 3306.