132 free AWS SAP-C02 practice questions from the CertStash pack of 529, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 132 free here, all 529 in the pack, and each step includes the one before it.
Get all 529 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A company needs to architect a hybrid DNS solution. This solution will use an Amazon Route 53 private hosted zone for the domain cloud.example.com for the resources stored within VPCs. The company has the following DNS resolution requirements: On-premises systems should be able to resolve and connect to cloud.example.com. All VPCs should be able to resolve cloud.example.com. There is already an AWS Direct Connect connection between the on-premises corporate network and AWS Transit Gateway. Which architecture should the company use to meet these requirements with the HIGHEST performance?
Show answer and explanation
Correct answer: A. Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud.example.com that point to the inbound resolver.
Option A correctly addresses all requirements with highest performance: it associates the private hosted zone to ALL VPCs (enabling all VPCs to resolve cloud.example.com), creates a Route 53 inbound resolver in the shared services VPC (enabling on-premises systems to resolve via the existing Direct Connect), and uses the transit gateway for connectivity. The inbound resolver specifically handles DNS queries coming from on-premises over the Direct Connect connection. Option D fails because it only associates the private hosted zone to the shared services VPC, preventing other VPCs from directly resolving the domain.
Why the other options are wrong
- B. EC2 conditional forwarders are not managed AWS services and require manual maintenance, reducing performance and reliability compared to Route 53 resolvers.
- C. Outbound resolvers are for resolving external/on-premises domains from AWS, not for receiving queries from on-premises systems.
- D. Associating the private hosted zone only to the shared services VPC prevents other VPCs from resolving cloud.example.com directly.
Question 2
A company is providing weather data over a REST-based API to several customers. The API is hosted by Amazon API Gateway and is integrated with different AWS Lambda functions for each API operation. The company uses Amazon Route 53 for DNS and has created a resource record of weather.example.com. The company stores data for the API in Amazon DynamoDB tables. The company needs a solution that will give the API the ability to fail over to a different AWS Region. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Deploy a new API Gateway API and Lambda functions in another Region. Change the Route 53 DNS record to a failover record. Enable target health monitoring. Convert the DynamoDB tables to global tables.
Option C correctly implements a failover solution by deploying a new API Gateway and Lambda functions in another Region, converting DynamoDB tables to global tables for data replication, and using a Route 53 failover routing policy with health monitoring. The failover policy automatically routes traffic to the secondary Region when the primary Region's health check fails, providing the desired failover capability with minimal RTO. Global DynamoDB tables enable data consistency across regions.
Why the other options are wrong
- A. Edge-optimized endpoints with multiple region targets do not provide automatic failover; they perform routing based on geography, not health. This requires manual intervention during outages.
- B. Multivalue answer routing returns multiple healthy records but does not provide automatic failover; clients must retry independently. It's not designed for active-passive failover scenarios.
- D. Lambda functions cannot be made global; they must be deployed in specific regions. The approach is otherwise similar to B, which lacks true automatic failover semantics.
Question 3
A company uses AWS Organizations with a single OU named Production to manage multiple accounts. All accounts are members of the Production OU. Administrators use deny list SCPs in the root of the organization to manage access to restricted services. The company recently acquired a new business unit and invited the new unit’s existing AWS account to the organization. Once onboarded, the administrators of the new business unit discovered that they are not able to update existing AWS Config rules to meet the company’s policies. Which option will allow administrators to make changes and continue to enforce the current policies without introducing additional long-term maintenance?
Show answer and explanation
Correct answer: D. Create a temporary OU named Onboarding for the new account. Apply an SCP to the Onboarding OU to allow AWS Config actions. Move the organization’s root SCP to the Production OU. Move the new account to the Production OU when adjustments to AWS Config are complete.
SCP evaluation means a deny at the organization root applies to every account below it, and an allow SCP on a child OU cannot override it. Moving the root deny SCP down to the Production OU keeps the policy enforced for all existing accounts while the new account in the Onboarding OU can update its AWS Config rules. Once the changes are done, moving the account into Production applies the same policy with nothing extra to maintain.
Why the other options are wrong
- A. Removing the root SCPs and relying on Service Catalog weakens enforcement and adds ongoing product maintenance.
- B. The deny SCP at the root still applies to the Onboarding OU, so an allow SCP there cannot unblock AWS Config actions.
- C. Converting to allow list SCPs requires listing every permitted service and adds long-term maintenance.
Question 4
A company is running a two-tier web-based application in an on-premises data center. The application layer consists of a single server running a stateful application. The application connects to a PostgreSQL database running on a separate server. The application’s user base is expected to grow significantly, so the company is migrating the application and database to AWS. The solution will use Amazon Aurora PostgreSQL, Amazon EC2 Auto Scaling, and Elastic Load Balancing. Which solution will provide a consistent user experience that will allow the application and database tiers to scale?
Show answer and explanation
Correct answer: C. Enable Aurora Auto Scaling for Aurora Replicas. Use an Application Load Balancer with the round robin routing and sticky sessions enabled.
Aurora Auto Scaling adds and removes Aurora Replicas to scale reads, because a cluster has a single writer that cannot be auto scaled. An Application Load Balancer with sticky sessions keeps each user on the same instance, which a stateful application needs for a consistent experience. Round robin routing spreads new sessions across the Auto Scaling group.
Why the other options are wrong
- A. Least outstanding requests is an Application Load Balancer algorithm that a Network Load Balancer does not offer.
- B. Aurora Auto Scaling works only on Aurora Replicas, not on writer instances.
- D. Aurora cannot auto scale writers, and a Network Load Balancer does not support the least outstanding requests algorithm.
Question 5
A company uses a service to collect metadata from applications that the company hosts on premises. Consumer devices such as TVs and internet radios access the applications. Many older devices do not support certain HTTP headers and exhibit errors when these headers are present in responses. The company has configured an on-premises load balancer to remove the unsupported headers from responses sent to older devices, which the company identified by the User-Agent headers. The company wants to migrate the service to AWS, adopt serverless technologies, and retain the ability to support the older devices. The company has already migrated the applications into a set of AWS Lambda functions. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Create an Amazon CloudFront distribution for the metadata service. Create an Application Load Balancer (ALB). Configure the CloudFront distribution to forward requests to the ALB. Configure the ALB to invoke the correct Lambda function for each type of request. Create a CloudFront function to remove the problematic headers based on the value of the User-Agent header.
Option A meets all requirements by using CloudFront with a CloudFront function to remove problematic headers based on User-Agent inspection. CloudFront functions execute at edge locations and can conditionally modify response headers before returning them to clients. This serverless approach integrates with Lambda functions through an ALB and maintains the ability to identify and handle older devices. The solution is cost-effective and requires no server maintenance.
Why the other options are wrong
- B. API Gateway default gateway responses cannot access the User-Agent header for conditional logic in the way described, and this approach doesn't provide the same edge-level response manipulation capability.
- C. HTTP API response mapping templates operate on request/response body data structures, not HTTP headers, and cannot conditionally remove headers based on User-Agent.
- D. Lambda@Edge for viewer responses would work but is more complex and expensive than CloudFront functions for this use case. CloudFront functions are purpose-built for header manipulation at edge locations.
Question 6
A company is running a traditional web application on Amazon EC2 instances. The company needs to refactor the application as microservices that run on containers. Separate versions of the application exist in two distinct environments: production and testing. Load for the application is variable, but the minimum load and the maximum load are known. A solutions architect needs to design the updated application with a serverless architecture that minimizes operational complexity. Which solution will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: B. Upload the container images to Amazon Elastic Container Registry (Amazon ECR). Configure two auto scaled Amazon Elastic Container Service (Amazon ECS) clusters with the Fargate launch type to handle the expected load. Deploy tasks from the ECR images. Configure two separate Application Load Balancers to direct traffic to the ECS clusters.
Option B provides the most cost-effective serverless solution by using Amazon ECS with Fargate launch type, which combines container support with serverless economics (pay-per-use, automatic scaling). ECS with Fargate is specifically designed for containerized microservices and eliminates operational complexity of managing EC2 instances. Two separate auto-scaled ECS clusters handle production and testing environments with known minimum/maximum loads. ALBs route traffic to each cluster. This is more cost-effective than EKS (which adds complexity) and more suitable for this workload than Lambda.
Why the other options are wrong
- A. Lambda has limitations on execution time, memory, and package size that make it unsuitable for traditional web applications. Lambda also cannot efficiently handle continuous variable loads compared to ECS.
- C. EKS adds operational complexity with Kubernetes management overhead compared to ECS, increasing both cost and maintenance burden without proportional benefit for this use case.
- D. Elastic Beanstalk is not a pure serverless offering and still requires infrastructure management. It's less cost-effective than ECS Fargate for variable workloads.
Question 7
A company has a multi-tier web application that runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Auto Scaling group. The ALB and the Auto Scaling group are replicated in a backup AWS Region. The minimum value and the maximum value for the Auto Scaling group are set to zero. An Amazon RDS Multi-AZ DB instance stores the application’s data. The DB instance has a read replica in the backup Region. The application presents an endpoint to end users by using an Amazon Route 53 record. The company needs to reduce its RTO to less than 15 minutes by giving the application the ability to automatically fail over to the backup Region. The company does not have a large enough budget for an active-active strategy. What should a solutions architect recommend to meet these requirements?
Show answer and explanation
Correct answer: B. Create an AWS Lambda function in the backup Region to promote the read replica and modify the Auto Scaling group values. Configure Route 53 with a health check that monitors the web application and sends an Amazon Simple Notification Service (Amazon SNS) notification to the Lambda function when the health check status is unhealthy. Update the application’s Route 53 record with a failover policy that routes traffic to the ALB in the backup Region when a health check failure occurs.
Option B provides automatic failover meeting the sub-15-minute RTO requirement using Route 53 failover routing policy with health checks. When the primary Region's health check fails, Route 53 automatically routes traffic to the backup Region's ALB. A Lambda function triggered by the health check failure promotes the RDS read replica to primary and scales up the Auto Scaling group. This achieves automatic failover without active-active costs. The health check ensures detection of actual application failures within minutes, and Lambda automation handles database promotion and instance scaling.
Why the other options are wrong
- A. Latency-based routing does not provide automatic failover; it balances traffic by latency but continues routing to failing primary Region. CloudWatch alarm-based Lambda invocation adds delay and manual involvement to what should be automatic.
- C. Running identical Auto Scaling groups in both regions violates the budget constraint by requiring active-active architecture. Replacing read replica with standalone instance breaks data consistency and replication.
- D. Global Accelerator with CloudWatch alarms still requires Lambda-based manual failover actions rather than AWS-native automatic failover mechanisms, increasing complexity and RTO.
Question 8
A company is hosting a critical application on a single Amazon EC2 instance. The application uses an Amazon ElastiCache for Redis single-node cluster for an in-memory data store. The application uses an Amazon RDS for MariaDB DB instance for a relational database. For the application to function, each piece of the infrastructure must be healthy and must be in an active state. A solutions architect needs to improve the application's architecture so that the infrastructure can automatically recover from failure with the least possible downtime. Which combination of steps will meet these requirements? (Choose three.)
Show answer and explanation
Correct answer: A, D, F. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances. Ensure that the EC2 instances are part of an Auto Scaling group that has a minimum capacity of two instances; Modify the DB instance to create a Multi-AZ deployment that extends across two Availability Zones; Create a replication group for the ElastiCache for Redis cluster. Enable Multi-AZ on the cluster.
The correct combination addresses each infrastructure component: A ensures EC2 redundancy with multiple instances across AZs in an Auto Scaling group (minimum 2) for automatic recovery from instance failure. D implements Multi-AZ deployment for RDS MariaDB with automatic failover capability. F creates ElastiCache replication group with Multi-AZ to handle Redis node failures. Together, these three options provide automatic recovery for all critical components: compute (A), database (D), and in-memory cache (F), meeting the requirement for least downtime.
Why the other options are wrong
- B. Unlimited mode configures EC2 CPU credit behavior but does not improve availability or enable failover/recovery.
- C. Creating a read replica in the same AZ provides no failover benefit since both instances remain in a single failure domain. Manual promotion negates the automatic recovery requirement.
- E. Using an Auto Scaling group for ElastiCache is not valid; ElastiCache scaling is managed through replication groups, not Auto Scaling groups.
Question 9
A retail company is operating its ecommerce application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses an Amazon RDS DB instance as the database backend. Amazon CloudFront is configured with one origin that points to the ALB. Static content is cached. Amazon Route 53 is used to host all public zones. After an update of the application, the ALB occasionally returns a 502 status code (Bad Gateway) error. The root cause is malformed HTTP headers that are returned to the ALB. The webpage returns successfully when a solutions architect reloads the webpage immediately after the error occurs. While the company is working on the problem, the solutions architect needs to provide a custom error page instead of the standard ALB error page to visitors. Which combination of steps will meet this requirement with the LEAST amount of operational overhead? (Choose two.)
Show answer and explanation
Correct answer: A, E. Create an Amazon S3 bucket. Configure the S3 bucket to host a static webpage. Upload the custom error pages to Amazon S3; Add a custom error response by configuring a CloudFront custom error page. Modify DNS records to point to a publicly accessible web page.
To provide a custom error page with minimal operational overhead, you should use CloudFront's built-in custom error page feature (option E) combined with hosting the error page content in S3 (option A). CloudFront can be configured to serve custom error responses when it detects 502 errors from the origin, eliminating the need for complex Lambda functions or health check monitoring. This approach requires no changes to the ALB or Route 53 configuration and leverages existing services already in the architecture.
Why the other options are wrong
- B. Using CloudWatch alarms to trigger Lambda functions to modify ALB forwarding rules adds unnecessary complexity and operational overhead.
- C. Modifying Route 53 health checks and DNS records creates failover complexity and doesn't directly address CloudFront's ability to serve custom error pages.
- D. The metric 'Elb.InternalError' is not a standard CloudWatch metric, and this approach requires complex automation compared to CloudFront's native error page handling.
Question 10
A company has millions of objects in an Amazon S3 bucket. The objects are in the S3 Standard storage class. All the S3 objects are accessed frequently. The number of users and applications that access the objects is increasing rapidly. The objects are encrypted with server-side encryption with AWS KMS keys (SSE-KMS). A solutions architect reviews the company’s monthly AWS invoice and notices that AWS KMS costs are increasing because of the high number of requests from Amazon S3. The solutions architect needs to optimize costs with minimal changes to the application. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Create a new S3 bucket that has server-side encryption with Amazon S3 managed keys (SSE-S3) as the encryption type. Use S3 Batch Operations to copy the existing objects to the new S3 bucket. Specify SSE-S3.
High KMS costs result from frequent decryption/encryption API calls for frequently accessed objects. Switching to SSE-S3 eliminates KMS API calls entirely since S3-managed keys don't incur per-request charges. Using S3 Batch Operations to migrate objects requires minimal application changes, just a one-time operation. This provides the least operational overhead while directly addressing the cost issue, as the objects are frequently accessed (eliminating archival strategies) and already encrypted (making SSE-C operationally burdensome).
Why the other options are wrong
- A. SSE-C requires clients to manage and transmit keys with every request, increasing operational overhead and not reducing KMS costs.
- C. CloudHSM adds significant operational complexity and cost; it doesn't reduce KMS API calls and requires key management infrastructure.
- D. Intelligent-Tiering with archival contradicts the requirement that objects are frequently accessed; this would harm performance, not reduce costs for active objects.
What people say about the full SAP-C02 pack 4.9 from 13
I am very happy as I just got my SAP-C02 exam result today and I passed with a great score. All the credit goes to this Cert Stash site as it has 100% real questions
Worth every cent. Passed!
This dump is legit. Passed my exam doing most of my study on my phone! Went through the dump during commutes.
Question 11
A solutions architect is auditing the security setup or an AWS Lambda function for a company. The Lambda function retrieves, the latest changes from an Amazon Aurora database. The Lambda function and the database run in the same VPC. Lambda environment variables are providing the database credentials to the Lambda function. The Lambda function aggregates data and makes the data available in an Amazon S3 bucket that is configured for server-side encryption with AWS KMS managed encryption keys (SSE-KMS). The data must not travel across the Internet. If any database credentials become compromised, the company needs a solution that minimizes the impact of the compromise. What should the solutions architect recommend to meet these requirements?
Show answer and explanation
Correct answer: A. Enable IAM database authentication on the Aurora DB cluster. Change the IAM role for the Lambda function to allow the function to access the database by using IAM database authentication. Deploy a gateway VPC endpoint for Amazon S3 in the VPC.
IAM database authentication eliminates the need for storing credentials in environment variables, minimizing compromise impact since there are no static credentials to steal. It uses temporary credentials issued via IAM roles. A gateway VPC endpoint for S3 ensures data doesn't travel across the Internet while keeping Lambda in the VPC. Both requirements are met: security (IAM auth) and data isolation (gateway endpoint), with automatic credential rotation through IAM.
Why the other options are wrong
- B. HTTPS enforcement doesn't prevent internet traversal; a VPC endpoint is required to keep traffic within AWS. This option lacks the gateway endpoint.
- C. Parameter Store requires manual credential management; IAM database authentication is superior with automatic rotation through IAM.
- D. While Secrets Manager is excellent, it still requires retrieving and using credentials, whereas IAM database authentication eliminates the credential altogether. Also lacks the gateway endpoint for S3.
Question 12
A company has an on-premises website application that provides real estate information for potential renters and buyers. The website uses a Java backend and a NoSQL MongoDB database to store subscriber data. The company needs to migrate the entire application to AWS with a similar structure. The application must be deployed for high availability, and the company cannot make changes to the application. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Configure Amazon DocumentDB (with MongoDB compatibility) with appropriately sized instances in multiple Availability Zones as the database for the subscriber data. Deploy Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones for the Java backend application.
Amazon DocumentDB with MongoDB compatibility is purpose-built to replace on-premises MongoDB with minimal application changes since it maintains MongoDB API compatibility. Multi-AZ instances provide high availability. EC2 Auto Scaling across multiple AZs ensures the Java backend is resilient. This solution requires no application code changes while meeting the high availability requirement.
Why the other options are wrong
- A. Aurora is a relational database; MongoDB uses a different data model and would require application changes.
- B. Single Availability Zone deployment fails the high availability requirement.
- D. On-demand capacity mode was added later and may not be necessary; provisioned instances with multi-AZ provide the required high availability.
Question 13
A company has an organization in AWS Organizations that has a large number of AWS accounts. One of the AWS accounts is designated as a transit account and has a transit gateway that is shared with all of the other AWS accounts. AWS Site-to-Site VPN connections are configured between all of the company’s global offices and the transit account. The company has AWS Config enabled on all of its accounts. The company’s networking team needs to centrally manage a list of internal IP address ranges that belong to the global offices. Developers will reference this list to gain access to their applications securely. Which solution meets these requirements with the LEAST amount of operational overhead?
Show answer and explanation
Correct answer: C. In the transit account, create a VPC prefix list with all of the internal IP address ranges. Use AWS Resource Access Manager to share the prefix list with all of the other accounts. Use the shared prefix list to configure security group rules in the other accounts.
VPC prefix lists are purpose-built for sharing IP address ranges across AWS accounts with minimal operational overhead. Option C leverages Resource Access Manager to share a prefix list created in the transit account with all other accounts, allowing developers to reference this single shared list in their security group rules. This approach requires no custom code, no Lambda functions, no AWS Config rules, and automatically provides a single source of truth for IP ranges.
Why the other options are wrong
- A. While functional, this approach requires SNS topics and Lambda functions in every account to monitor and update security groups, creating significant operational overhead compared to using prefix lists.
- B. AWS Config managed rules are designed for compliance checking and remediation, not for serving as a centralized IP range reference; this approach is overly complex for the stated use case.
- D. Security groups cannot be nested across accounts, and this approach does not support centralized management or updates to IP ranges across multiple accounts.
Question 14
A company is using an on-premises Active Directory service for user authentication. The company wants to use the same authentication service to sign in to the company’s AWS accounts, which are using AWS Organizations. AWS Site-to-Site VPN connectivity already exists between the on-premises environment and all the company’s AWS accounts. The company’s security policy requires conditional access to the accounts based on user groups and roles. User identities must be managed in a single location. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Configure AWS IAM Identity Center (AWS Single Sign-On) to connect to Active Directory by using SAML 2.0. Enable automatic provisioning by using the System for Cross-domain Identity Management (SCIM) v2.0 protocol. Grant access to the AWS accounts by using attribute-based access controls (ABACs).
AWS IAM Identity Center connecting to on-premises Active Directory via SAML 2.0 with SCIM v2.0 automatic provisioning provides centralized user management, group-based access control, and conditional access. ABAC enables fine-grained access based on user attributes and group memberships from Active Directory, meeting all requirements including conditional access based on user groups and roles while managing identities in a single location.
Why the other options are wrong
- B. Using IAM Identity Center as the identity source defeats the requirement to manage identities in the single on-premises Active Directory location.
- C. Provisioning IAM users manually and maintaining mappings is not truly centralized identity management and doesn't scale well with user groups and roles.
- D. OIDC is less suitable than SAML for enterprise Active Directory federation, and cross-account roles don't provide the same group-based conditional access capabilities as IAM Identity Center with ABAC.
Question 15
A company is developing and hosting several projects in the AWS Cloud. The projects are developed across multiple AWS accounts under the same organization in AWS Organizations. The company requires the cost for cloud infrastructure to be allocated to the owning project. The team responsible for all of the AWS accounts has discovered that several Amazon EC2 instances are lacking the Project tag used for cost allocation. Which actions should a solutions architect lake to resolve the problem and prevent it from happening in the future? (Choose three.)
Show answer and explanation
Correct answer: A, B, E. Create an AWS Config rule in each account to find resources with missing tags; Create an SCP in the organization with a deny action for ec2:RunInstances if the Project tag is missing; Create an AWS Config aggregator for the organization to collect a list of EC2 instances with the missing Project tag.
To resolve and prevent missing tags: (A) AWS Config rules detect current resources with missing tags across accounts; (B) an SCP with a deny action prevents future launches without the required tag by restricting at the organization level; (E) an AWS Config aggregator collects and reports on compliance across all accounts. Together these address both detection of existing resources and prevention of future non-compliance.
Why the other options are wrong
- C. Amazon Inspector is for vulnerability scanning, not tag compliance checking.
- D. IAM policies attached per-account are less efficient than organization-wide SCPs for preventing tag-less launches across all accounts.
- F. Security Hub is for security findings aggregation, not tag compliance specifically.
Question 16
A company uses a Grafana data visualization solution that runs on a single Amazon EC2 instance to monitor the health of the company's AWS workloads. The company has invested time and effort to create dashboards that the company wants to preserve. The dashboards need to be highly available and cannot be down for longer than 10 minutes. The company needs to minimize ongoing maintenance. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Create an Amazon Managed Grafana workspace. Configure a new Amazon CloudWatch data source. Export dashboards from the existing Grafana instance. Import the dashboards into the new workspace.
Amazon Managed Grafana is a fully managed service that eliminates operational overhead while preserving existing dashboards. It provides built-in high availability across availability zones, meets the 10-minute RTO requirement, integrates seamlessly with CloudWatch data sources, and allows direct import of existing Grafana dashboards without recreation. This requires minimal ongoing maintenance compared to self-managed solutions.
Why the other options are wrong
- A. Recreating dashboards in CloudWatch requires significant effort and loses the company's investment in Grafana dashboard design.
- C. While HA-capable, this solution requires ongoing maintenance of EC2 instances, AMIs, Auto Scaling groups, and load balancers, increasing operational overhead.
- D. Hourly backups and manual restoration from snapshots cannot meet the 10-minute RTO requirement and still require significant manual intervention.
Question 17
A company is migrating its development and production workloads to a new organization in AWS Organizations. The company has created a separate member account for development and a separate member account for production. Consolidated billing is linked to the management account. In the management account, a solutions architect needs to create an IAM user that can stop or terminate resources in both member accounts. Which solution will meet this requirement?
Show answer and explanation
Correct answer: D. Create an IAM user in the management account. In the member accounts, create cross-account roles that have least privilege access. Grant the IAM user access to the roles by using a trust policy.
Option D is correct because it follows AWS best practices for cross-account access. The IAM user is created in the management account, and cross-account roles with least privilege access are created in each member account (development and production). The trust policy in those roles allows the management account user to assume the roles. This approach provides proper isolation, auditability, and follows the principle of least privilege. Option A incorrectly places the cross-account role in the management account instead of member accounts. Option B unnecessarily creates IAM users in member accounts when centralized access from the management account is the requirement. Option C attempts to add a management account user directly to member account groups, which is not how cross-account access works.
Why the other options are wrong
- A. Cross-account role should be in the member accounts (where the resources are), not the management account.
- B. Creates unnecessary IAM users in each member account; central user in management account with assumed roles is the correct pattern.
- C. IAM groups cannot directly include users from other accounts; trust policies and role assumption are required for cross-account access.
Question 18
A video processing company has an application that downloads images from an Amazon S3 bucket, processes the images, stores a transformed image in a second S3 bucket, and updates metadata about the image in an Amazon DynamoDB table. The application is written in Node.js and runs by using an AWS Lambda function. The Lambda function is invoked when a new image is uploaded to Amazon S3. The application ran without incident for a while. However, the size of the images has grown significantly. The Lambda function is now failing frequently with timeout errors. The function timeout is set to its maximum value. A solutions architect needs to refactor the application’s architecture to prevent invocation failures. The company does not want to manage the underlying infrastructure. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, B. Modify the application deployment by building a Docker image that contains the application code. Publish the image to Amazon Elastic Container Registry (Amazon ECR); Create a new Amazon Elastic Container Service (Amazon ECS) task definition with a compatibility type of AWS Fargate. Configure the task definition to use the new image in Amazon Elastic Container Registry (Amazon ECR). Adjust the Lambda function to invoke an ECS task by using the ECS task definition when a new file arrives in Amazon S3.
The timeout failures are caused by Lambda's maximum 15-minute timeout being insufficient for large image processing. The solution requires moving to a service without timeout constraints. Option A (Docker image in ECR) and B (Fargate ECS task invocation) together provide the infrastructure-free solution: the Lambda function becomes a lightweight trigger that invokes a long-running Fargate task, which has no timeout constraints and can process large images without management overhead.
Why the other options are wrong
- C. Step Functions parallel invocation and provisioned concurrency do not solve the fundamental timeout issue; they add complexity without addressing the core problem.
- D. EC2 compatibility requires infrastructure management, violating the requirement to not manage underlying infrastructure.
- E. Switching storage backends (EFS/RDS) does not address the timeout issue; processing still occurs in Lambda with the same 15-minute constraint.
Question 19
A retail company is hosting an ecommerce website on AWS across multiple AWS Regions. The company wants the website to be operational at all times for online purchases. The website stores data in an Amazon RDS for MySQL DB instance. Which solution will provide the HIGHEST availability for the database?
Show answer and explanation
Correct answer: D. Configure read replicas on Amazon RDS. In the case of disruption, promote a cross-Region and read replica to be a standalone DB instance. Direct database traffic to the promoted DB instance. Create a replacement read replica that has the promoted DB instance as its source.
Cross-Region read replicas provide the highest availability for a multi-Region ecommerce platform. Option D correctly describes promoting a cross-Region read replica to a standalone DB instance during disruption and creating a replacement read replica afterward. This approach provides both high availability and disaster recovery. Option A relies only on backups which require manual intervention and time to restore. Option B and C reference non-existent RDS global tables (global tables are for DynamoDB, not RDS MySQL). Option D is the standard AWS pattern for RDS high availability across Regions.
Why the other options are wrong
- A. Backup-based recovery is manual, time-consuming, and lacks automatic failover needed for highest availability.
- B. RDS MySQL does not support global tables; this feature is specific to DynamoDB.
- C. RDS MySQL does not support global tables; this combines a non-existent feature with an incorrect recovery process.
Question 20
A company wants to use a third-party software-as-a-service (SaaS) application. The third-party SaaS application is consumed through several API calls. The third-party SaaS application also runs on AWS inside a VPC. The company will consume the third-party SaaS application from inside a VPC. The company has internal security policies that mandate the use of private connectivity that does not traverse the internet. No resources that run in the company VPC are allowed to be accessed from outside the company’s VPC. All permissions must conform to the principles of least privilege. Which solution meets these requirements?
Show answer and explanation
Correct answer: A. Create an AWS PrivateLink interface VPC endpoint. Connect this endpoint to the endpoint service that the third-party SaaS application provides. Create a security group to limit the access to the endpoint. Associate the security group with the endpoint.
AWS PrivateLink interface VPC endpoints (option A) are specifically designed to provide private connectivity to SaaS applications without traversing the internet. The company creates an interface endpoint connected to the third-party provider's endpoint service, and security groups enforce least-privilege access by limiting which resources can reach the endpoint. This solution meets all requirements: private connectivity, no inbound access to the company VPC, and granular permission control.
Why the other options are wrong
- B. Site-to-Site VPN would work for connectivity but is more complex and doesn't provide the fine-grained security controls that PrivateLink offers for SaaS consumption.
- C. VPC peering requires the third-party provider to manage routing and doesn't prevent the third-party from accessing company resources, violating the security requirement.
- D. This reverses the relationship; the company should be the endpoint consumer, not the provider, since they are consuming the third-party SaaS application.
Question 21
A company uses AWS Organizations to manage its AWS accounts. The company needs a list of all its Amazon EC2 instances that have underutilized CPU or memory usage. The company also needs recommendations for how to downsize these underutilized instances. Which solution will meet these requirements with the LEAST effort?
Show answer and explanation
Correct answer: B. Install the Amazon CloudWatch agent on all the EC2 instances by using AWS Systems Manager. Retrieve the resource optimization recommendations from AWS Cost Explorer in the organization’s management account. Use the recommendations to downsize underutilized instances in all accounts of the organization.
AWS Cost Explorer provides built-in resource optimization recommendations that identify underutilized EC2 instances and suggest downsizing options. By installing CloudWatch agent via Systems Manager and accessing Cost Explorer from the management account, the company gets comprehensive recommendations across all accounts with minimal manual effort. This is the least effort solution as it leverages AWS native tools designed specifically for this purpose.
Why the other options are wrong
- A. Requires building a custom solution with third-party tools and manual scripting, which is significantly more effort than using native AWS recommendations.
- C. Requires checking each member account separately rather than using consolidated organizational view, creating unnecessary operational overhead.
- D. Involves building custom Lambda functions and Athena queries to replicate functionality that Cost Explorer already provides natively.
Question 22
A company has purchased appliances from different vendors. The appliances all have IoT sensors. The sensors send status information in the vendors' proprietary formats to a legacy application that parses the information into JSON. The parsing is simple, but each vendor has a unique format. Once daily, the application parses all the JSON records and stores the records in a relational database for analysis. The company needs to design a new data analysis solution that can deliver faster and optimize costs. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Connect the IoT sensors to AWS IoT Core. Set a rule to invoke an AWS Lambda function to parse the information and save a .csv file to Amazon. S3 Use AWS Glue to catalog the files. Use Amazon Athena and Amazon QuickSight for analysis.
Option A provides the best modern architecture: AWS IoT Core receives sensor data in any format, Lambda functions parse each vendor's proprietary format into JSON, data is stored in S3 for cost-effectiveness, AWS Glue catalogs the data, and Athena/QuickSight provide fast analysis without maintaining a relational database. This is serverless, scales automatically, and optimizes costs by using S3 rather than continuously running databases.
Why the other options are wrong
- B. Running Fargate continuously for daily batch processing is inefficient and expensive; it requires maintaining application infrastructure rather than using serverless solutions.
- C. SFTP requires manual code changes to sensors and creates a separate pipeline; it doesn't leverage AWS IoT capabilities designed for this use case.
- D. Snowball Edge is for bulk data transfer, not real-time IoT sensor integration, and doesn't enable faster analysis compared to cloud-native solutions.
Question 23
A company wants to migrate its data analytics environment from on premises to AWS. The environment consists of two simple Node.js applications. One of the applications collects sensor data and loads it into a MySQL database. The other application aggregates the data into reports. When the aggregation jobs run, some of the load jobs fail to run correctly. The company must resolve the data loading issue. The company also needs the migration to occur without interruptions or changes for the company’s customers. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: C. Set up an Amazon Aurora MySQL database. Use AWS Database Migration Service (AWS DMS) to perform continuous data replication from the on-premises database to Aurora. Create an Aurora Replica for the Aurora MySQL database, and move the aggregation jobs to run against the Aurora Replica. Set up collection endpoints as AWS Lambda functions behind an Application Load Balancer (ALB), and use Amazon RDS Proxy to write to the Aurora MySQL database. When the databases are synced, point the collector DNS record to the ALB. Disable the AWS DMS sync task after the cutover from on premises to AWS.
Option C provides the complete, zero-downtime migration pattern: AWS DMS performs continuous replication from on-premises to Aurora, an Aurora Replica handles read-heavy aggregation jobs to avoid write contention, Lambda functions with RDS Proxy handle data collection with connection pooling, and the ALB endpoint is updated during cutover after databases are synchronized. The DMS task is disabled post-cutover. This ensures no customer interruption.
Why the other options are wrong
- A. Using NLB instead of ALB is suboptimal for application-layer load balancing; the architecture is otherwise similar but less appropriate for HTTP/HTTPS workloads.
- B. Using EC2 instances in an Auto Scaling group instead of Lambda adds operational overhead and doesn't provide the same serverless scalability for collection endpoints.
- D. Kinesis Data Firehose is designed for streaming analytics, not continuous database replication; it doesn't provide the same consistency guarantees as DMS for migration.
Question 24
A solutions architect needs to advise a company on how to migrate its on-premises data processing application to the AWS Cloud. Currently, users upload input files through a web portal. The web server then stores the uploaded files on NAS and messages the processing server over a message queue. Each media file can take up to 1 hour to process. The company has determined that the number of media files awaiting processing is significantly higher during business hours, with the number of files rapidly declining after business hours. What is the MOST cost-effective migration recommendation?
Show answer and explanation
Correct answer: D. Create a queue using Amazon SQS. Configure the existing web server to publish to the new queue. Use Amazon EC2 instances in an EC2 Auto Scaling group to pull requests from the queue and process the files. Scale the EC2 instances based on the SQS queue length. Store the processed files in an Amazon S3 bucket.
SQS queues decouple the web server from processing while Auto Scaling groups scale EC2 instances based on queue depth, processing files only when needed. This perfectly matches the variable workload pattern with high volume during business hours and rapid decline after. S3 storage for processed files is cost-effective. Scaling down instances after business hours minimizes idle compute costs. The 1-hour processing time per file makes EC2 instances more practical than Lambda's 15-minute timeout limit.
Why the other options are wrong
- A. Lambda has a 15-minute maximum execution timeout, but files take up to 1 hour to process, making it unsuitable for this workload.
- B. Creating new EC2 instances for each task incurs startup overhead and delays; using an Auto Scaling group is more efficient. EFS is also unnecessary for temporary processed files.
- C. Lambda's 15-minute timeout is insufficient for 1-hour processing tasks, making this approach fundamentally incompatible with the stated requirements.
Question 25
A company has a latency-sensitive trading platform that uses Amazon DynamoDB as a storage backend. The company configured the DynamoDB table to use on-demand capacity mode. A solutions architect needs to design a solution to improve the performance of the trading platform. The new solution must ensure high availability for the trading platform. Which solution will meet these requirements with the LEAST latency?
Show answer and explanation
Correct answer: B. Create a three-node DynamoDB Accelerator (DAX) cluster. Configure an application to read data by using DAX and to write data directly to the DynamoDB table.
A three-node DAX cluster provides high availability through redundancy and fault tolerance, which is critical for a latency-sensitive trading platform. Configuring reads through DAX and writes directly to DynamoDB achieves the least overall latency because writes bypass the cache (reducing write latency variance) while reads benefit from DAX's sub-millisecond response times. A two-node cluster cannot provide sufficient high availability, and single-node deployments lack redundancy for critical trading systems.
Why the other options are wrong
- A. A two-node cluster does not provide sufficient high availability; three nodes ensures fault tolerance when one node fails.
- C. Writing through DAX introduces unnecessary latency for write operations; direct DynamoDB writes are faster.
- D. A single-node cluster lacks redundancy and cannot guarantee high availability if the node fails.
Question 26
A company is designing its network configuration in the AWS Cloud. The company uses AWS Organizations to manage a multi-account setup. The company has three OUs. Each OU contains more than 100 AWS accounts. Each account has a single VPC, and all the VPCs in each OU are in the same AWS Region. The CIDR ranges for all the AWS accounts do not overlap. The company needs to implement a solution in which VPCs in the same OU can communicate with each other but cannot communicate with VPCs in other OUs. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: C. Provision a transit gateway in an account in each OU. Share the transit gateway across the organization by using AWS Resource Access Manager (AWS RAM). Create transit gateway VPC attachments for each VPC.
Transit Gateway is the optimal solution for connecting multiple VPCs across accounts with minimal operational overhead. By provisioning a transit gateway in each OU and sharing it via AWS RAM, all VPCs in that OU can communicate through a single managed hub. This approach scales efficiently to 100+ accounts per OU without requiring individual peering connections or manual routing configuration, and the network isolation between OUs is naturally enforced by having separate transit gateways per OU.
Why the other options are wrong
- A. VPC peering between 100+ accounts would require hundreds of individual peering connections and manual management, creating excessive operational overhead.
- B. Dedicating a networking account with a shared VPC still requires individual peering connections from each account to the shared VPC, which doesn't scale well for 100+ accounts.
- D. VPN connections with third-party routing software introduces significant complexity and operational overhead compared to native AWS networking services.
Question 27
An online retail company is migrating its legacy on-premises .NET application to AWS. The application runs on load-balanced frontend web servers, load-balanced application servers, and a Microsoft SQL Server database. The company wants to use AWS managed services where possible and does not want to rewrite the application. A solutions architect needs to implement a solution to resolve scaling issues and minimize licensing costs as the application scales. Which solution will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: A. Deploy Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer for the web tier and for the application tier. Use Amazon Aurora PostgreSQL with Babelfish turned on to replatform the SQL Server database.
Option A provides the most cost-effective managed solution: EC2 Auto Scaling groups with ALB maintain compatibility with the existing .NET application, and Aurora PostgreSQL with Babelfish eliminates SQL Server licensing costs (a major expense). This approach requires no application rewrite, uses managed services to minimize overhead, and significantly reduces licensing costs, the primary concern stated in the requirements.
Why the other options are wrong
- B. AWS DMS creates VM images rather than lifting and shifting properly, and DynamoDB is unsuitable for a relational SQL Server workload, requiring application rewrite.
- C. EKS containerization requires significant application modifications and operational overhead, not a non-rewrite solution.
- D. Serverless Lambda requires complete application refactoring, and S3/Athena cannot replace a structured SQL database for a transactional retail application.
Question 28
A company uses a load balancer to distribute traffic to Amazon EC2 instances in a single Availability Zone. The company is concerned about security and wants a solutions architect to re-architect the solution to meet the following requirements: • Inbound requests must be filtered for common vulnerability attacks. • Rejected requests must be sent to a third-party auditing application. • All resources should be highly available. Which solution meets these requirements?
Show answer and explanation
Correct answer: D. Configure a Multi-AZ Auto Scaling group using the application's AMI. Create an Application Load Balancer (ALB) and select the previously created Auto Scaling group as the target. Create an Amazon Kinesis Data Firehose with a destination of the third-party auditing application. Create a web ACL in WAF. Create an AWS WAF using the WebACL and ALB then enable logging by selecting the Kinesis Data Firehose as the destination. Subscribe to AWS Managed Rules in AWS Marketplace, choosing the WAF as the subscriber.
Option D combines all required elements: Multi-AZ Auto Scaling for high availability, Application Load Balancer for traffic distribution, AWS WAF for filtering common vulnerabilities, and Kinesis Data Firehose integration to send rejected requests to a third-party auditing application. AWS Managed Rules subscription provides comprehensive vulnerability protection. This is the most complete and integrated solution.
Why the other options are wrong
- A. Amazon Inspector is a vulnerability assessment tool, not a real-time request filter; does not provide active protection against attacks.
- B. CloudWatch Logs requires additional custom processing to route rejected requests to third-party systems; Kinesis Data Firehose is more direct.
- C. Missing the Multi-AZ Auto Scaling group requirement, reducing availability since it only specifies the current single AZ architecture.
Question 29
Example Corp. has an on-premises data center and a VPC named VPC A in the Example Corp. AWS account. The on-premises network connects to VPC A through an AWS Site-To-Site VPN. The on-premises servers can properly access VPC A. Example Corp. just acquired AnyCompany, which has a VPC named VPC B. There is no IP address overlap among these networks. Example Corp. has peered VPC A and VPC B. Example Corp. wants to connect from its on-premise servers to VPC B. Example Corp. has properly set up the network ACL and security groups. Which solution will meet this requirement with the LEAST operational effort?
Show answer and explanation
Correct answer: A. Create a transit gateway. Attach the Site-to-Site VPN, VPC A, and VPC B to the transit gateway. Update the transit gateway route tables for all networks to add IP range routes for all other networks.
Transit Gateway is the optimal solution for connecting on-premises networks to multiple VPCs with least operational effort. Option A correctly describes creating a transit gateway, attaching the Site-to-Site VPN, VPC A, and VPC B to it, and updating route tables. This single-point-of-management approach scales efficiently and requires minimal ongoing maintenance compared to managing multiple VPN connections. Option B requires creating a second VPN connection to VPC B, which adds complexity. Option C involves manual BGP configuration across three networks with propagation delays. Option D describes modifying virtual private gateway definitions in ways that don't align with AWS architecture.
Why the other options are wrong
- B. Creating a second Site-to-Site VPN connection adds operational complexity instead of reducing it.
- C. Manual route table updates and BGP propagation across three networks requires more operational effort than Transit Gateway automation.
- D. Virtual private gateways cannot be modified to serve multiple VPCs; this approach misunderstands the service's architecture.
Question 30
A company with several AWS accounts is using AWS Organizations and service control policies (SCPs). An administrator created the following SCP and has attached it to an organizational unit (OU) that contains AWS account 1111-1111-1111: Developers working in account 1111-1111-1111 complain that they cannot create Amazon S3 buckets. How should the administrator address this problem?
Show answer and explanation
Correct answer: C. Instruct the developers to add Amazon S3 permissions to their IAM entities.
The SCP shown allows all actions ("*") on all resources ("*") in the AllowsAllActions statement, which means the SCP itself is not blocking S3 bucket creation. SCPs act as permission boundaries and define the maximum permissions available, but they do not grant permissions, IAM policies must still be attached to users, groups, or roles to actually grant those permissions. Since the SCP permits S3 actions, the issue is that developers lack the necessary s3:CreateBucket permission in their IAM entity policies. The administrator should instruct developers to ensure their IAM entities have the appropriate S3 permissions attached.
Why the other options are wrong
- A. The SCP already allows all S3 actions via the wildcard "*" in the AllowsAllActions statement, so adding s3:CreateBucket to the SCP is unnecessary and would not solve the root problem of missing IAM permissions.
- B. Moving the SCP attachment from OU to account level would not change the SCP's effect; the SCP still permits S3 actions, so this does not address the missing IAM permissions.
- D. Removing the SCP entirely is unnecessary and removes a security control; the SCP is already permissive enough and is not the cause of the problem.
Question 31
A solutions architect has developed a web application that uses an Amazon API Gateway Regional endpoint and an AWS Lambda function. The consumers of the web application are all close to the AWS Region where the application will be deployed. The Lambda function only queries an Amazon Aurora MySQL database. The solutions architect has configured the database to have three read replicas. During testing, the application does not meet performance requirements. Under high load, the application opens a large number of database connections. The solutions architect must improve the application’s performance. Which actions should the solutions architect take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, D. Use RDS Proxy to set up a connection pool to the reader endpoint of the Aurora database; Move the code for opening the database connection in the Lambda function outside of the event handler.
Option B (RDS Proxy with reader endpoint) solves the connection pooling problem by limiting the number of database connections and distributing read queries across replicas, improving performance under high load. Option D (moving database connection code outside the event handler) ensures the connection is reused across Lambda invocations instead of creating new connections for each request, significantly reducing connection overhead and improving throughput.
Why the other options are wrong
- A. The cluster endpoint routes to all instances including the writer; it doesn't provide the read scaling benefit that the reader endpoint offers.
- C. Provisioned Concurrency addresses Lambda cold start latency but doesn't solve the database connection exhaustion issue that's causing performance problems.
- E. Edge-optimized endpoints reduce client latency but don't address the database connection bottleneck that's the actual performance issue.
Question 32
A company is building a call center by using Amazon Connect. The company’s operations team is defining a disaster recovery (DR) strategy across AWS Regions. The contact center has dozens of contact flows, hundreds of users, and dozens of claimed phone numbers. Which solution will provide DR with the LOWEST RTO?
Show answer and explanation
Correct answer: D. Provision a new Amazon Connect instance with all existing users and contact flows in a second Region. Create an Amazon Route 53 health check for the URL of the Amazon Connect instance. Create an Amazon CloudWatch alarm for failed health checks. Create an AWS Lambda function to deploy an AWS CloudFormation template that provisions claimed phone numbers. Configure the alarm to invoke the Lambda function.
Provisioning the secondary instance with users and contact flows pre-deployed significantly reduces RTO because these are the most time-consuming components to recreate. Using Route 53 health checks with CloudWatch alarms enables automatic failover detection. The Lambda function only needs to provision claimed phone numbers, which is the fastest remaining component to deploy. This minimizes manual intervention and recovery time compared to other options.
Why the other options are wrong
- A. Requiring manual provisioning and CloudFormation deployment of all components results in the highest RTO and operational overhead.
- B. Deploying contact flows and numbers via Lambda after a failure still involves deployment time when these should be pre-provisioned.
- C. Provisioning users via Lambda after failure adds unnecessary RTO; users should be pre-configured in the DR instance.
Question 33
A company runs an IoT platform on AWS. IoT sensors in various locations send data to the company’s Node.js API servers on Amazon EC2 instances running behind an Application Load Balancer. The data is stored in an Amazon RDS MySQL DB instance that uses a 4 TB General Purpose SSD volume. The number of sensors the company has deployed in the field has increased over time, and is expected to grow significantly. The API servers are consistently overloaded and RDS metrics show high write latency. Which of the following steps together will resolve the issues permanently and enable growth as new sensors are provisioned, while keeping this platform cost-efficient? (Choose two.)
Show answer and explanation
Correct answer: C, E. Leverage Amazon Kinesis Data Streams and AWS Lambda to ingest and process the raw data; Re-architect the database tier to use Amazon DynamoDB instead of an RDS MySQL DB instance.
Options C and E together solve the permanent scalability issues. Option C (Kinesis Data Streams with Lambda) decouples sensor ingestion from database writes, providing elastic ingestion capacity that scales automatically with sensor growth and reduces direct database load. Option E (DynamoDB) replaces the RDBMS bottleneck with a service optimized for high write throughput and horizontal scalability, eliminating write latency issues. DynamoDB's pay-per-request or provisioned capacity models are cost-efficient for IoT workloads. Option A (storage resize) does not improve IOPS for General Purpose volumes. Option B (Aurora) still uses relational database constraints. Option D (X-Ray and more servers) addresses symptoms rather than root causes and doesn't solve database write latency.
Why the other options are wrong
- A. Resizing GP2 storage does not improve IOPS; this does not address the fundamental database write latency problem.
- B. Aurora still uses relational constraints; it does not fundamentally solve high-volume write throughput issues like DynamoDB does.
- D. X-Ray is diagnostic only; adding more API servers does not solve the RDS write latency bottleneck that is constraining the system.
Question 34
A company is running several workloads in a single AWS account. A new company policy states that engineers can provision only approved resources and that engineers must use AWS CloudFormation to provision these resources. A solutions architect needs to create a solution to enforce the new restriction on the IAM role that the engineers use for access. What should the solutions architect do to create the solution?
Show answer and explanation
Correct answer: C. Update the IAM policy for the engineers’ IAM role with permissions to only allow AWS CloudFormation actions. Create a new IAM policy with permission to provision approved resources, and assign the policy to a new IAM service role. Assign the IAM service role to AWS CloudFormation during stack creation.
The correct approach uses IAM service roles (also called CloudFormation execution roles). Engineers get permissions only for CloudFormation actions, and a separate service role with permissions to provision approved resources is assigned to CloudFormation stacks. This separation ensures engineers can only create resources through CloudFormation with approved permissions, preventing unauthorized resource creation while maintaining proper access control boundaries.
Why the other options are wrong
- A. This approach requires S3 access permissions for engineers, which extends beyond CloudFormation and doesn't properly separate concerns between who can create stacks and what those stacks can provision.
- B. Giving engineers direct IAM permissions to approved resources defeats the purpose; they could provision resources outside CloudFormation using direct API calls.
- D. Restricting access to individual stacks doesn't enforce the requirement that only approved resources be created; engineers could still create unapproved resources within their stack.
Question 35
A solutions architect needs to define a reference architecture for a solution for three-tier applications with web. application, and NoSQL data layers. The reference architecture must meet the following requirements: • High availability within an AWS Region • Able to fail over in 1 minute to another AWS Region for disaster recovery • Provide the most efficient solution while minimizing the impact on the user experience Which combination of steps will meet these requirements? (Choose three.)
Show answer and explanation
Correct answer: B, C, E. Use an Amazon Route 53 failover routing policy for failover from the primary Region to the disaster recovery Region. Set Time to Live (TTL) to 30 seconds; Use a global table within Amazon DynamoDB so data can be accessed in the two selected Regions; Implement a hot standby model using Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use zonal Reserved Instances for the minimum number of servers and On-Demand Instances for any additional resources.
Option B provides failover with TTL of 30 seconds enabling sub-minute failover between regions. Option C uses DynamoDB global tables for active-active replication with sub-second latency, meeting the data layer requirement without additional complexity. Option E implements a hot standby across multiple AZs with Reserved Instances for baseline capacity and On-Demand for elasticity, ensuring high availability within a region while minimizing costs. Together these achieve 1-minute RTO, multi-region resilience, and efficient resource utilization.
Why the other options are wrong
- A. Weighted routing at 100/0 is not a failover policy and doesn't support automatic regional failover for disaster recovery.
- D. Hourly backups to S3 with manual import scripts cannot meet the 1-minute RTO requirement and introduces significant recovery complexity.
- F. Spot Instances lack the reliability required for production three-tier applications; they can be interrupted without warning, violating RTO and availability requirements.
Question 36
A company runs a microservice as an AWS Lambda function. The microservice writes data to an on-premises SQL database that supports a limited number of concurrent connections. When the number of Lambda function invocations is too high, the database crashes and causes application downtime. The company has an AWS Direct Connect connection between the company's VPC and the on-premises data center. The company wants to protect the database from crashes. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Write the data to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the Lambda function to read from the queue and write to the existing database. Set a reserved concurrency limit on the Lambda function that is less than the number of connections that the database supports.
Option A addresses the root cause of database crashes by implementing a queue-based pattern with reserved concurrency limits. The Lambda function reads from SQS at a controlled rate and writes to the database, with reserved concurrency set below the database's maximum concurrent connection limit. This prevents connection exhaustion and database crashes while maintaining data durability through the queue, using Direct Connect for secure on-premises connectivity.
Why the other options are wrong
- B. Aurora Serverless requires data migration and application reconfiguration, which changes the solution architecture unnecessarily when the issue is connection control.
- C. RDS Proxy is designed for RDS databases managed within AWS, not for on-premises SQL databases accessed via Direct Connect.
- D. SNS is a pub-sub service not designed for sequential processing; provisioned concurrency for Lambda cannot limit database connections effectively since SNS pushes all messages immediately.
Question 37
A company has 10 accounts that are part of an organization in AWS Organizations. AWS Config is configured in each account. All accounts belong to either the Prod OU or the NonProd OU. The company has set up an Amazon EventBridge rule in each AWS account to notify an Amazon Simple Notification Service (Amazon SNS) topic when an Amazon EC2 security group inbound rule is created with 0.0.0.0/0 as the source. The company’s security team is subscribed to the SNS topic. For all accounts in the NonProd OU, the security team needs to remove the ability to create a security group inbound rule that includes 0.0.0.0/0 as the source. Which solution will meet this requirement with the LEAST operational overhead?
Show answer and explanation
Correct answer: D. Configure an SCP to deny the ec2:AuthorizeSecurityGroupIngress action when the value of the aws:SourceIp condition key is 0.0.0.0/0. Apply the SCP to the NonProd OU.
Option D uses a Service Control Policy (SCP) to deny the ec2:AuthorizeSecurityGroupIngress action when the source is 0.0.0.0/0, preventing the creation of such rules at the API level with the least operational overhead. This is a proactive preventive control that blocks the action before it occurs, requiring no monitoring, Lambda functions, or detective controls.
Why the other options are wrong
- A. Using Lambda to remove rules is reactive and requires ongoing Lambda maintenance, monitoring, and operational overhead to manage exceptions.
- B. AWS Config managed rules are detective controls that identify non-compliance but don't prevent the action from occurring, requiring reactive remediation.
- C. An allow SCP for non-0.0.0.0/0 sources is overly complex and doesn't directly prevent the problematic action as effectively as a deny statement.
Question 38
A company wants to containerize a multi-tier web application and move the application from an on-premises data center to AWS. The application includes web. application, and database tiers. The company needs to make the application fault tolerant and scalable. Some frequently accessed data must always be available across application servers. Frontend web servers need session persistence and must scale to meet increases in traffic. Which solution will meet these requirements with the LEAST ongoing operational overhead?
Show answer and explanation
Correct answer: D. Deploy the application on Amazon Elastic Kubernetes Service (Amazon EKS). Configure Amazon EKS to use managed node groups. Run the web servers and application as Kubernetes deployments in the EKS cluster. Store the frontend web server session data in an Amazon DynamoDB table. Create an Amazon Elastic File System (Amazon EFS) volume that all applications will mount at the time of deployment.
EKS with managed node groups provides operational simplicity without cluster management overhead. Kubernetes deployments handle automatic scaling and fault tolerance natively. DynamoDB provides scalable, managed session storage without operational overhead. EFS provides shared file system access across all pods for frequently accessed data. This combination delivers fault tolerance, scalability, and session persistence with minimal ongoing operational requirements.
Why the other options are wrong
- A. ECS Fargate is simpler but SQS is inappropriate for session data storage; this misses proper caching for session persistence.
- B. ECS on EC2 requires managing EC2 instances; EBS Multi-Attach is complex and doesn't scale as well as managed solutions.
- C. Using EFS to store session data in Kubernetes is unconventional and less efficient than dedicated session storage like DynamoDB or ElastiCache.
Question 39
A company is designing an AWS Organizations structure. The company wants to standardize a process to apply tags across the entire organization. The company will require tags with specific values when a user creates a new resource. Each of the company's OUs will have unique tag values. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Use an SCP to deny the creation of resources that do not have the required tags. Create a tag policy that includes the tag values that the company has assigned to each OU. Attach the tag policies to the OUs.
Option A is correct because it combines SCPs and tag policies appropriately. The SCP denies resource creation without required tags (enforcement mechanism), while tag policies define allowed tag values per OU, providing both standardization and OU-specific flexibility. Attaching tag policies to OUs ensures each OU gets its unique tag values. This two-layer approach enforces tagging at the service control level while enabling differentiation across organizational units. Option B attaches policies to management account only, missing OU-specific requirements. Option C's "allow" SCP is weaker than "deny"; Option D lacks the tag policy mechanism needed to enforce specific values per OU.
Why the other options are wrong
- B. Attaching tag policies only to the management account does not allow different tag values for different OUs.
- C. Allow-based SCPs are less secure and harder to maintain than deny-based; tag policies must be attached to OUs to enforce OU-specific values.
- D. Lacks the tag policy mechanism to enforce specific tag values; SCPs alone cannot enforce particular tag values per OU.
Question 40
A company runs a processing engine in the AWS Cloud. The engine processes environmental data from logistics centers to calculate a sustainability index. The company has millions of devices in logistics centers that are spread across Europe. The devices send information to the processing engine through a RESTful API. The API experiences unpredictable bursts of traffic. The company must implement a solution to process all data that the devices send to the processing engine. Data loss is unacceptable. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create an Amazon API Gateway HTTP API that implements the RESTful API. Create an Amazon Simple Queue Service (Amazon SQS) queue. Create an API Gateway service integration with the SQS queue. Create an AWS Lambda function to process messages in the SQS queue.
API Gateway with SQS integration decouples the API from processing, ensuring no data loss during traffic bursts. Messages are reliably stored in SQS queue, and Lambda processes them asynchronously at whatever rate is feasible. API Gateway provides high availability and automatic scaling for the RESTful API endpoint, while SQS guarantees message persistence and Lambda provides unlimited concurrent processing capacity.
Why the other options are wrong
- A. ALB cannot directly integrate with SQS as a target group; this architecture doesn't properly decouple the API from processing.
- C. EC2 instances don't provide the same automatic scaling capabilities as serverless solutions for unpredictable burst traffic.
- D. CloudFront is a CDN for content delivery, not suitable for RESTful APIs; Kinesis Data Streams doesn't provide the same guaranteed delivery as SQS for non-loss requirements.
Question 41
A large company is running a popular web application. The application runs on several Amazon EC2 Linux instances in an Auto Scaling group in a private subnet. An Application Load Balancer is targeting the instances in the Auto Scaling group in the private subnet. AWS Systems Manager Session Manager is configured, and AWS Systems Manager Agent is running on all the EC2 instances. The company recently released a new version of the application. Some EC2 instances are now being marked as unhealthy and are being terminated. As a result, the application is running at reduced capacity. A solutions architect tries to determine the root cause by analyzing Amazon CloudWatch logs that are collected from the application, but the logs are inconclusive. How should the solutions architect gain access to an EC2 instance to troubleshoot the issue?
Show answer and explanation
Correct answer: D. Suspend the Auto Scaling group’s Terminate process. Use Session Manager to log in to an instance that is marked as unhealthy.
To troubleshoot an unhealthy instance without it being terminated, the solutions architect should suspend the Auto Scaling group's Terminate process. This prevents the Auto Scaling group from terminating instances marked as unhealthy while allowing Session Manager access for investigation. Once suspended, the architect can use Session Manager to connect to the unhealthy instance and analyze logs or application state. After troubleshooting, the process can be resumed.
Why the other options are wrong
- A. Suspending HealthCheck only stops health checks but doesn't prevent termination of already-marked unhealthy instances.
- B. Termination protection on individual instances is a manual workaround, not a systematic solution for ongoing troubleshooting.
- C. Changing the termination policy does not prevent termination; it only changes the order in which instances are terminated.
Question 42
A company has built a high performance computing (HPC) cluster in AWS for a tightly coupled workload that generates a large number of shared files stored in Amazon EFS. The cluster was performing well when the number of Amazon EC2 instances in the cluster was 100. However, when the company increased the cluster size to 1.000 EC2 instances, overall performance was well below expectations. Which collection of design choices should a solutions architect make to achieve the maximum performance from the HPC cluster? (Choose three.)
Show answer and explanation
Correct answer: A, C, F. Ensure the HPC cluster is launched within a single Availability Zone; Select EC2 instance types with an Elastic Fabric Adapter (EFA) enabled; Replace Amazon EFS with Amazon FSx for Lustre.
Options A, C, and F address the performance bottleneck when scaling from 100 to 1,000 instances. Option A (single AZ) minimizes latency between tightly coupled compute nodes. Option C (Elastic Fabric Adapter) provides high-bandwidth, low-latency interconnect essential for HPC workloads. Option F (FSx for Lustre) is a high-performance parallel file system designed for HPC, replacing EFS which becomes a bottleneck at scale. Together these optimize both compute interconnect and storage I/O. Option B (network interfaces in multiples of four) lacks technical basis for HPC performance. Option D (multiple AZs) increases latency for tightly coupled workloads. Option E (RAID EBS) cannot match FSx for Lustre's parallel performance.
Why the other options are wrong
- B. Attaching network interfaces in multiples of four has no technical basis for HPC performance optimization.
- D. Multiple Availability Zones introduce unacceptable latency for tightly coupled HPC workloads; single AZ is optimal.
- E. RAID EBS arrays cannot provide the parallel I/O throughput and performance of FSx for Lustre designed for HPC.
Question 43
A finance company is running its business-critical application on current-generation Linux EC2 instances. The application includes a self-managed MySQL database performing heavy I/O operations. The application is working fine to handle a moderate amount of traffic during the month. However, it slows down during the final three days of each month due to month-end reporting, even though the company is using Elastic Load Balancers and Auto Scaling within its infrastructure to meet the increased demand. Which of the following actions would allow the database to handle the month-end load with the LEAST impact on performance?
Show answer and explanation
Correct answer: B. Performing a one-time migration of the database cluster to Amazon RDS, and creating several additional read replicas to handle the load during end of month.
Option B addresses the root cause by migrating to Amazon RDS, which is a managed service designed for high-availability and performance, and creating read replicas to distribute the reporting load. This provides better performance, easier maintenance, automatic backups, and built-in scaling capabilities. RDS with read replicas handles month-end reporting spikes more effectively than EBS volume tuning or load balancer adjustments, which don't address the database I/O bottleneck.
Why the other options are wrong
- A. Prewarming load balancers and changing EBS volume types doesn't address the core database I/O bottleneck causing the slowdown.
- C. Using CloudWatch and Lambda to dynamically change EBS volume properties is overly complex and doesn't solve the underlying database performance limitation.
- D. Swapping EBS volumes before month-end is operationally cumbersome and doesn't provide the managed scaling and read replica benefits of RDS.
Question 44
A company is running applications on AWS in a multi-account environment. The company's sales team and marketing team use separate AWS accounts in AWS Organizations. The sales team stores petabytes of data in an Amazon S3 bucket. The marketing team uses Amazon QuickSight for data visualizations. The marketing team needs access to data that the sates team stores in the S3 bucket. The company has encrypted the S3 bucket with an AWS Key Management Service (AWS KMS) key. The marketing team has already created the IAM service role for QuickSight to provide QuickSight access in the marketing AWS account. The company needs a solution that will provide secure access to the data in the S3 bucket across AWS accounts. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: C. Update the S3 bucket policy in the marketing account to grant access to the QuickSight role. Create a KMS grant for the encryption key that is used in the S3 bucket. Grant decrypt access to the QuickSight role. Update the QuickSight permissions in the marketing account to grant access to the S3 bucket.
Option C provides the most direct and least operationally overhead solution. It leverages the existing QuickSight service role already created in the marketing account by updating the S3 bucket policy to grant access to that role and creating a KMS grant for decryption permissions. This avoids data replication, unnecessary IAM role assumptions, or complex SCP configurations. The S3 bucket policy and KMS grant directly authorize the QuickSight role to access the data where it resides.
Why the other options are wrong
- A. Replicating petabytes of data across accounts introduces significant operational overhead and ongoing synchronization complexity, defeating the least overhead requirement.
- B. SCPs control permissions but don't grant access; AWS RAM is designed for sharing resources like subnets and transit gateways, not KMS keys in this context, and the KMS key sharing approach is more complex than necessary.
- D. Creating an IAM role in the sales account and requiring cross-account role assumption adds unnecessary complexity when direct S3 bucket policy and KMS grant permissions are simpler.
Question 45
A life sciences company is using a combination of open source tools to manage data analysis workflows and Docker containers running on servers in its on-premises data center to process genomics data. Sequencing data is generated and stored on a local storage area network (SAN), and then the data is processed. The research and development teams are running into capacity issues and have decided to re-architect their genomics analysis platform on AWS to scale based on workload demands and reduce the turnaround time from weeks to days. The company has a high-speed AWS Direct Connect connection. Sequencers will generate around 200 GB of data for each genome, and individual jobs can take several hours to process the data with ideal compute capacity. The end result will be stored in Amazon S3. The company is expecting 10-15 job requests each day. Which solution meets these requirements?
Show answer and explanation
Correct answer: C. Use AWS DataSync to transfer the sequencing data to Amazon S3. Use S3 events to trigger an AWS Lambda function that starts an AWS Step Functions workflow. Store the Docker images in Amazon Elastic Container Registry (Amazon ECR) and trigger AWS Batch to run the container and process the sequencing data.
AWS DataSync efficiently transfers 200GB sequencing data over the existing Direct Connect connection to S3. S3 events trigger a Lambda function that starts an AWS Step Functions workflow, which orchestrates AWS Batch jobs running Docker containers stored in ECR. This solution handles multi-hour processing jobs, scales based on demand (10-15 jobs daily), stores results in S3, and uses Docker containers as required.
Why the other options are wrong
- A. Snowball Edge is unnecessary with Direct Connect already in place; Lambda cannot run multi-hour genomics processing jobs.
- B. Data Pipeline is deprecated; EC2 Auto Scaling with custom AMIs requires more operational overhead than Batch.
- D. Storage Gateway adds latency; direct S3 with DataSync is more efficient for high-speed data transfer.
Question 46
A company recently completed the migration from an on-premises data center to the AWS Cloud by using a replatforming strategy. One of the migrated servers is running a legacy Simple Mail Transfer Protocol (SMTP) service that a critical application relies upon. The application sends outbound email messages to the company’s customers. The legacy SMTP server does not support TLS encryption and uses TCP port 25. The application can use SMTP only. The company decides to use Amazon Simple Email Service (Amazon SES) and to decommission the legacy SMTP server. The company has created and validated the SES domain. The company has lifted the SES limits. What should the company do to modify the application to send email messages from Amazon SES?
Show answer and explanation
Correct answer: B. Configure the application to connect to Amazon SES by using STARTTLS. Obtain Amazon SES SMTP credentials. Use the credentials to authenticate with Amazon SES.
Option B correctly identifies STARTTLS as the appropriate encryption method for legacy SMTP applications migrating to Amazon SES. STARTTLS upgrades an existing TCP connection to encrypted communication, maintaining SMTP compatibility while adding TLS encryption. The company must obtain SES SMTP credentials for authentication. Option A mentions TLS Wrapper which is not standard AWS terminology for SES. Option C requires code changes to use the API instead of SMTP. Option D requires SDK integration and IAM user management rather than simple SMTP credential-based authentication. For a legacy SMTP service requiring minimal application changes, STARTTLS with SMTP credentials is the correct approach.
Why the other options are wrong
- A. TLS Wrapper is not a standard AWS SES feature; STARTTLS is the correct encryption protocol for legacy SMTP.
- C. Changing to the SES API requires significant application code modifications when SMTP is a strict requirement.
- D. Using SDKs requires more extensive application changes than using SMTP credentials with STARTTLS protocol.
Question 47
A company is hosting a monolithic REST-based API for a mobile app on five Amazon EC2 instances in public subnets of a VPC. Mobile clients connect to the API by using a domain name that is hosted on Amazon Route 53. The company has created a Route 53 multivalue answer routing policy with the IP addresses of all the EC2 instances. Recently, the app has been overwhelmed by large and sudden increases to traffic. The app has not been able to keep up with the traffic. A solutions architect needs to implement a solution so that the app can handle the new and varying load. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: D. Create an Application Load Balancer (ALB) in front of the API. Move the EC2 instances to private subnets in the VPC. Add the EC2 instances as targets for the ALB. Update the Route 53 record to point to the ALB.
An Application Load Balancer placed in front of the EC2 instances provides automatic load distribution across the instances with health checks, eliminating the need for manual Route 53 updates when instances change. Moving instances to private subnets improves security. The ALB integrates seamlessly with Auto Scaling groups for automatic scaling based on demand, meeting the requirement to handle varying loads with minimal operational overhead compared to refactoring the API.
Why the other options are wrong
- A. Refactoring a monolithic REST API into Lambda functions is a significant architectural change requiring substantial development effort and risk.
- B. Containerizing and setting up EKS introduces operational complexity with container orchestration management compared to simple ALB + Auto Scaling.
- C. This requires manual Lambda function creation to update Route 53 records, adding operational overhead when instances scale; it's more complex than using an ALB.
Question 48
A company is running a containerized application in the AWS Cloud. The application is running by using Amazon Elastic Container Service (Amazon ECS) on a set of Amazon EC2 instances. The EC2 instances run in an Auto Scaling group. The company uses Amazon Elastic Container Registry (Amazon ECR) to store its container images. When a new image version is uploaded, the new image version receives a unique tag. The company needs a solution that inspects new image versions for common vulnerabilities and exposures. The solution must automatically delete new image tags that have Critical or High severity findings. The solution also must notify the development team when such a deletion occurs. Which solution meets these requirements?
Show answer and explanation
Correct answer: A. Configure scan on push on the repository. Use Amazon EventBridge to invoke an AWS Step Functions state machine when a scan is complete for images that have Critical or High severity findings. Use the Step Functions state machine to delete the image tag for those images and to notify the development team through Amazon Simple Notification Service (Amazon SNS).
ECR's scan on push feature automatically scans images when uploaded, providing immediate vulnerability detection. EventBridge captures scan completion events and triggers a Step Functions state machine, which can evaluate severity levels, delete non-compliant image tags, and send SNS notifications. This event-driven approach is automated, scalable, and requires minimal manual intervention.
Why the other options are wrong
- B. ECR scan results are not directly pushed to SQS; this option misrepresents how ECR scan integration works.
- C. Scheduling manual scans every hour introduces unnecessary delays and is less efficient than real-time scan-on-push detection.
- D. Periodic scans lack the immediacy of scan-on-push; SQS is unnecessary when EventBridge can directly trigger on scan completion events.
Question 49
A company runs a content management application on a single Windows Amazon EC2 instance in a development environment. The application reads and writes static content to a 2 TB Amazon Elastic Block Store (Amazon EBS) volume that is attached to the instance as the root device. The company plans to deploy this application in production as a highly available and fault-tolerant solution that runs on at least three EC2 instances across multiple Availability Zones. A solutions architect must design a solution that joins all the instances that run the application to an Active Directory domain. The solution also must implement Windows ACLs to control access to file contents. The application always must maintain exactly the same content on all running instances at any given point in time. Which solution will meet these requirements with the LEAST management overhead?
Show answer and explanation
Correct answer: C. Create an Amazon FSx for Windows File Server file system. Create an Auto Scaling group that extends across three Availability Zones and maintains a minimum size of three instances. Implement a user data script to install the application and mount the FSx for Windows File Server file system. Perform a seamless domain join to join the instance to the AD domain.
Amazon FSx for Windows File Server is purpose-built for this use case because it natively supports Active Directory domain join, Windows ACLs, and multi-AZ deployment with automatic synchronization. This provides the least management overhead compared to alternatives. The seamless domain join feature eliminates scripting complexity, and FSx handles content synchronization across instances automatically.
Why the other options are wrong
- A. EFS does not support Windows ACLs or native Active Directory integration required by the solution.
- B. FSx for Lustre is designed for high-performance computing, not Windows file sharing; it doesn't support Windows ACLs or AD integration.
- D. EFS lacks Windows ACL support and AD integration; manual domain join scripting adds overhead.
Question 50
A solutions architect is creating an application that stores objects in an Amazon S3 bucket. The solutions architect must deploy the application in two AWS Regions that will be used simultaneously. The objects in the two S3 buckets must remain synchronized with each other. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)
Show answer and explanation
Correct answer: A, B, E. Create an S3 Multi-Region Access Point Change the application to refer to the Multi-Region Access Point; Configure two-way S3 Cross-Region Replication (CRR) between the two S3 buckets; Enable S3 Versioning for each S3 bucket
S3 Multi-Region Access Point provides a single endpoint that routes requests to the nearest region for low latency and allows simultaneous application use in both regions. Two-way Cross-Region Replication automatically synchronizes objects between buckets in both directions. S3 Versioning must be enabled on both buckets as a prerequisite for CRR and protects against accidental deletion or overwrites. Together, these three solutions provide transparent synchronization with minimal application changes and no manual intervention.
Why the other options are wrong
- C. Modifying the application to write to each bucket separately introduces application complexity and race conditions, increasing operational overhead.
- D. Lifecycle rules are designed for transitioning objects to different storage classes, not for replicating between regions, and create unnecessary complexity.
- F. Lambda-based replication requires custom code, error handling, and ongoing maintenance, creating significant operational overhead compared to native CRR.
Question 51
A company is planning to store a large number of archived documents and make the documents available to employees through the corporate intranet. Employees will access the system by connecting through a client VPN service that is attached to a VPC. The data must not be accessible to the public. The documents that the company is storing are copies of data that is held on physical media elsewhere. The number of requests will be low. Availability and speed of retrieval are not concerns of the company. Which solution will meet these requirements at the LOWEST cost?
Show answer and explanation
Correct answer: D. Create an Amazon S3 bucket. Configure the S3 bucket to use the S3 Glacier Deep Archive storage class as default. Configure the S3 bucket for website hosting. Create an S3 interface endpoint. Configure the S3 bucket to allow access only through that endpoint.
S3 Glacier Deep Archive provides the lowest cost for infrequently accessed archived data that doesn't require fast retrieval. The question explicitly states low request volume and that availability/speed are not concerns. S3 Glacier Deep Archive costs significantly less than One Zone-IA, EFS One Zone-IA, or EBS Cold HDD. The S3 interface endpoint ensures data isn't publicly accessible while maintaining private access through the VPN.
Why the other options are wrong
- A. S3 One Zone-IA is more expensive than Glacier Deep Archive for archival use cases with very low request rates.
- B. EFS One Zone-IA requires ongoing EC2 instance costs and is more expensive than Glacier Deep Archive for archived documents.
- C. EC2 instance plus EBS Cold HDD still requires the operational overhead and cost of running an instance continuously, making it more expensive overall.
Question 52
A company is building an electronic document management system in which users upload their documents. The application stack is entirely serverless and runs on AWS in the eu-central-1 Region. The system includes a web application that uses an Amazon CloudFront distribution for delivery with Amazon S3 as the origin. The web application communicates with Amazon API Gateway Regional endpoints. The API Gateway APIs call AWS Lambda functions that store metadata in an Amazon Aurora Serverless database and put the documents into an S3 bucket. The company is growing steadily and has completed a proof of concept with its largest customer. The company must improve latency outside of Europe. Which combination of actions will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, C. Enable S3 Transfer Acceleration on the S3 bucket. Ensure that the web application uses the Transfer Acceleration signed URLs; Change the API Gateway Regional endpoints to edge-optimized endpoints.
Options A and C together optimize latency globally. Option A (S3 Transfer Acceleration) reduces upload latency for users worldwide by routing uploads through CloudFront edge locations before reaching S3, significantly improving performance for document ingestion. Option C (edge-optimized API Gateway endpoints) caches API requests at CloudFront edge locations globally, reducing latency for metadata operations from distant regions. Together these optimize the inbound request path (API Gateway) and upload path (S3). Option B (Global Accelerator) is redundant with CloudFront already in use. Option D (multi-region provisioning) is operationally complex and unnecessary when edge optimization is available. Option E (RDS proxy) addresses connection pooling, not global latency.
Why the other options are wrong
- B. Global Accelerator overlaps with CloudFront functionality already deployed and adds unnecessary complexity.
- D. Provisioning entire stacks in multiple regions introduces significant operational overhead beyond what edge optimization provides.
- E. RDS proxy improves connection management but does not address global latency issues for users in distant regions.
Question 53
A company’s factory and automation applications are running in a single VPC. More than 20 applications run on a combination of Amazon EC2, Amazon Elastic Container Service (Amazon ECS), and Amazon RDS. The company has software engineers spread across three teams. One of the three teams owns each application, and each time is responsible for the cost and performance of all of its applications. Team resources have tags that represent their application and team. The teams use IAM access for daily activities. The company needs to determine which costs on the monthly AWS bill are attributable to each application or team. The company also must be able to create reports to compare costs from the last 12 months and to help forecast costs for the next 12 months. A solutions architect must recommend an AWS Billing and Cost Management solution that provides these cost reports. Which combination of actions will meet these requirements? (Choose three.)
Show answer and explanation
Correct answer: A, C, F. Activate the user-define cost allocation tags that represent the application and the team; Create a cost category for each application in Billing and Cost Management; Enable Cost Explorer.
Option A activates user-defined tags (the application and team tags already applied to resources) as cost allocation tags, enabling cost attribution. Option C creates cost categories in Billing and Cost Management to organize costs by application and team dimensions. Option F enables Cost Explorer, which is the tool that generates historical reports comparing the last 12 months and forecasting the next 12 months based on allocated costs and categories.
Why the other options are wrong
- B. AWS-generated cost allocation tags are AWS-defined tags like aws:cloudformation:stack-name; the company needs their custom application and team tags activated instead.
- D. IAM access to Billing and Cost Management is an access control measure, not a reporting solution; it does not generate cost reports.
- E. Cost budgets set spending limits and alerts but do not generate comparative historical reports or forecasting analysis.
Question 54
A company has hundreds of AWS accounts. The company recently implemented a centralized internal process for purchasing new Reserved Instances and modifying existing Reserved Instances. This process requires all business units that want to purchase or modify Reserved Instances to submit requests to a dedicated team for procurement. Previously, business units directly purchased or modified Reserved Instances in their own respective AWS accounts autonomously. A solutions architect needs to enforce the new process in the most secure way possible. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, D. Ensure that all AWS accounts are part of an organization in AWS Organizations with all features enabled; Create an SCP that denies the ec2:PurchaseReservedInstancesOffering action and the ec2:ModifyReservedInstances action. Attach the SCP to each OU of the organization.
To enforce centralized procurement: (A) AWS Organizations with all features enabled is required to enforce policies across accounts; (D) Service Control Policies (SCPs) deny the specific Reserved Instance actions (PurchaseReservedInstancesOffering and ModifyReservedInstances) across all OUs, preventing bypass at any level. SCPs are the most secure enforcement mechanism as they apply to all principals and override IAM permissions.
Why the other options are wrong
- B. AWS Config reports on non-compliance but doesn't prevent actions; it's a detection tool, not an enforcement mechanism.
- C. Individual IAM policies in each account can be circumvented by IAM admins; SCPs are more secure as they cannot be overridden by account-level permissions.
- E. Consolidated billing is only for cost management and doesn't enforce policy restrictions on actions.
Question 55
A company wants to migrate to AWS. The company is running thousands of VMs in a VMware ESXi environment. The company has no configuration management database and has little knowledge about the utilization of the VMware portfolio. A solutions architect must provide the company with an accurate inventory so that the company can plan for a cost-effective migration. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: C. Deploy the Migration Evaluator agentless collector to the ESXi hypervisor. Review the collected data in Migration Evaluator. Identify inactive servers. Remove the inactive servers from the migration list. Import the data to AWS Migration Hub.
Migration Evaluator's agentless collector is specifically designed to discover and assess VMware environments without requiring agent deployment on thousands of VMs. Option C provides an accurate inventory with minimal operational overhead by deploying a single agentless collector at the hypervisor level, identifying inactive servers to optimize migration scope, and integrating with AWS Migration Hub for migration planning, exactly matching the stated requirements.
Why the other options are wrong
- A. Systems Manager Patch Manager is not designed for discovery; it requires agents on each VM and adds complexity without providing the agentless discovery benefit.
- B. Manual .csv exports are error-prone and do not provide comprehensive utilization data; DMS and SMS are migration tools, not discovery tools.
- D. Application Migration Service Agent requires deployment on each VM (operational overhead), and Redshift is not the right tool for discovery data analysis compared to Migration Evaluator.
Question 56
A company has IoT sensors that monitor traffic patterns throughout a large city. The company wants to read and collect data from the sensors and perform aggregations on the data. A solutions architect designs a solution in which the IoT devices are streaming to Amazon Kinesis Data Streams. Several applications are reading from the stream. However, several consumers are experiencing throttling and are periodically encountering a ReadProvisionedThroughputExceeded error. Which actions should the solutions architect take to resolve this issue? (Choose three.)
Show answer and explanation
Correct answer: A, C, E. Reshard the stream to increase the number of shards in the stream; Use consumers with the enhanced fan-out feature; Use an error retry and exponential backoff mechanism in the consumer logic.
Resharding to increase shards (A) increases read capacity to eliminate throttling. Enhanced fan-out consumers (C) provide dedicated throughput per consumer, preventing throttling from multiple readers. Error retry with exponential backoff (E) handles throttling gracefully when it occurs. Together these address both the root cause (insufficient throughput) and transient throttling with resilient client logic.
Why the other options are wrong
- B. KPL is a producer library for optimizing writes; polling frequency adjustment does not resolve read-side throttling of consumers.
- D. Reducing shards worsens the throttling problem by further decreasing read capacity.
- F. Dynamic partitioning is not a Kinesis Data Streams feature; this applies to Kinesis Data Firehose.
Question 57
A company has migrated a legacy application to the AWS Cloud. The application runs on three Amazon EC2 instances that are spread across three Availability Zones. One EC2 instance is in each Availability Zone. The EC2 instances are running in three private subnets of the VPC and are set up as targets for an Application Load Balancer (ALB) that is associated with three public subnets. The application needs to communicate with on-premises systems. Only traffic from IP addresses in the company's IP address range are allowed to access the on-premises systems. The company’s security team is bringing only one IP address from its internal IP address range to the cloud. The company has added this IP address to the allow list for the company firewall. The company also has created an Elastic IP address for this IP address. A solutions architect needs to create a solution that gives the application the ability to communicate with the on-premises systems. The solution also must be able to mitigate failures automatically. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Deploy a single NAT gateway in a public subnet. Assign the Elastic IP address to the NAT gateway. Use Amazon CloudWatch with a custom metric to monitor the NAT gateway. If the NAT gateway is unhealthy, invoke an AWS Lambda function to create a new NAT gateway in a different subnet. Assign the Elastic IP address to the new NAT gateway.
Option C meets all requirements by deploying a single NAT gateway with the allowed Elastic IP address and implementing automated failover through CloudWatch monitoring and Lambda-triggered recreation. When the NAT gateway becomes unhealthy, the Lambda function automatically creates a new gateway in a different subnet and reassigns the Elastic IP address, ensuring automatic failure mitigation without manual intervention.
Why the other options are wrong
- A. Deploying three NAT gateways would require three different IP addresses, but only one IP address is allowed on the company firewall.
- B. NLBs cannot be assigned a single Elastic IP and cannot be deployed behind an existing ALB; this solution creates architectural conflicts with the existing setup.
- D. ALBs cannot be assigned Elastic IP addresses directly, and Route 53 health checks do not automatically recreate failed infrastructure.
Question 58
A company is running an application that uses an Amazon ElastiCache for Redis cluster as a caching layer. A recent security audit revealed that the company has configured encryption at rest for ElastiCache. However, the company did not configure ElastiCache to use encryption in transit. Additionally, users can access the cache without authentication. A solutions architect must make changes to require user authentication and to ensure that the company is using end-to-end encryption. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create an AUTH token. Store the token in AWS Secrets Manager. Configure the existing cluster to use the AUTH token, and configure encryption in transit. Update the application to retrieve the AUTH token from Secrets Manager when necessary and to use the AUTH token for authentication.
Creating an AUTH token and storing it in AWS Secrets Manager, then configuring the existing cluster with encryption in transit and AUTH, provides the required authentication and end-to-end encryption. Secrets Manager is the appropriate service for dynamic secret management with automatic rotation capabilities, superior to Parameter Store for this use case.
Why the other options are wrong
- A. Parameter Store is less suitable for managing credentials compared to Secrets Manager, which has built-in rotation capabilities.
- C. SSL certificates are not the authentication mechanism for ElastiCache; AUTH tokens are the proper method.
- D. Certificates are not appropriate for Redis authentication; AUTH tokens are the correct mechanism.
Question 59
A video processing company wants to build a machine learning (ML) model by using 600 TB of compressed data that is stored as thousands of files in the company's on-premises network attached storage system. The company does not have the necessary compute resources on premises for ML experiments and wants to use AWS. The company needs to complete the data transfer to AWS within 3 weeks. The data transfer will be a one-time transfer. The data must be encrypted in transit. The measured upload speed of the company's internet connection is 100 Mbps. and multiple departments share the connection. Which solution will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: A. Order several AWS Snowball Edge Storage Optimized devices by using the AWS Management Console. Configure the devices with a destination S3 bucket. Copy the data to the devices. Ship the devices back to AWS.
AWS Snowball Edge Storage Optimized devices are the most cost-effective solution for transferring 600 TB within 3 weeks. With only 100 Mbps internet connection shared across departments, network transfer would take months. Snowball devices handle encryption in transit, avoid congesting the internet connection, and provide one-time transfer efficiency. Snowball Edge includes built-in encryption, eliminating VPN overhead.
Why the other options are wrong
- B. Direct Connect setup requires significant lead time and setup costs; it's overkill for a one-time transfer and would take weeks to establish.
- C. VPN over 100 Mbps would require approximately 48+ days of continuous transfer, exceeding the 3-week deadline.
- D. Storage Gateway would still rely on the 100 Mbps connection, resulting in the same timeframe problem as direct network transfer.
Question 60
A company uses an on-premises data analytics platform. The system is highly available in a fully redundant configuration across 12 servers in the company’s data center. The system runs scheduled jobs, both hourly and daily, in addition to one-time requests from users. Scheduled jobs can take between 20 minutes and 2 hours to finish running and have tight SLAs. The scheduled jobs account for 65% of the system usage. User jobs typically finish running in less than 5 minutes and have no SLA. The user jobs account for 35% of system usage. During system failures, scheduled jobs must continue to meet SLAs. However, user jobs can be delayed. A solutions architect needs to move the system to Amazon EC2 instances and adopt a consumption-based model to reduce costs with no long-term commitments. The solution must maintain high availability and must not affect the SLAs. Which solution will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: D. Split the 12 instances across three Availability Zones in the chosen AWS Region. Run three instances in each Availability Zone as OnDemand Instances with Capacity Reservations. Run one instance in each Availability Zone as a Spot Instance.
Spreading the instances across three Availability Zones keeps high availability, and running three On-Demand instances with Capacity Reservations in each zone guarantees capacity for the SLA-bound scheduled jobs. If one zone fails, reserved capacity remains in the other two zones. On-Demand Capacity Reservations carry no long-term commitment, and the single Spot Instance per zone runs the delay-tolerant user jobs cheaply.
Why the other options are wrong
- A. Only four On-Demand instances cannot cover the 65 percent SLA workload, especially after losing one of just two zones.
- B. Putting all reserved capacity in one zone creates a single point of failure for the SLA-bound jobs.
- C. A Savings Plan requires a one or three year commitment, which violates the no-commitment requirement.
Question 61
A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application. How should a solutions architect configure the web ACLs to meet these requirements?
Show answer and explanation
Correct answer: A. Set the action of the web ACL rules to Count. Enable AWS WAF logging. Analyze the requests for false positives. Modify the rules to avoid any false positive. Over time, change the action of the web ACL rules from Count to Block.
Setting web ACL rules to Count mode first allows analysis of real traffic patterns without blocking legitimate requests. By enabling AWS WAF logging and analyzing requests, the team can identify false positives before changing actions to Block. This phased approach ensures minimal disruption to legitimate traffic while gradually tightening security. Over time, rules are adjusted and switched to Block only after validation.
Why the other options are wrong
- B. Rate-based rules alone don't protect against application layer attacks; setting throttle limits too high defeats protection purposes.
- C. Setting rules to Block immediately risks blocking legitimate traffic; AWS managed rules may have false positives requiring validation first.
- D. Starting with Allow rules defeats the purpose of WAF; this approach provides no initial protection and is unnecessarily complex.
Question 62
A company is running an application in the AWS Cloud. The company's security team must approve the creation of all new IAM users. When a new IAM user is created, all access for the user must be removed automatically. The security team must then receive a notification to approve the user. The company has a multi-Region AWS CloudTrail trail in the AWS account. Which combination of steps will meet these requirements? (Choose three.)
Show answer and explanation
Correct answer: A, D, E. Create an Amazon EventBridge (Amazon CloudWatch Events) rule. Define a pattern with the detail-type value set to AWS API Call via CloudTrail and an eventName of CreateUser; Invoke an AWS Step Functions state machine to remove access; Use Amazon Simple Notification Service (Amazon SNS) to notify the security team.
To meet the requirements, you need: (A) EventBridge rule to detect CreateUser API calls via CloudTrail, which triggers automated responses; (D) AWS Step Functions to orchestrate the removal of access permissions automatically when a user is created; and (E) SNS to notify the security team for approval. This combination detects the creation event, automatically removes access, and notifies the security team in a coordinated workflow.
Why the other options are wrong
- B. CloudTrail itself cannot send notifications; it only logs events. EventBridge is the proper mechanism to detect and react to CloudTrail events.
- C. ECS/Fargate adds unnecessary complexity and operational overhead compared to Step Functions, which is designed for orchestrating AWS service workflows.
- F. Pinpoint is designed for customer engagement and marketing communications, not internal security team notifications; SNS is the appropriate choice.
Question 63
A financial company is planning to migrate its web application from on premises to AWS. The company uses a third-party security tool to monitor the inbound traffic to the application. The company has used the security tool for the last 15 years, and the tool has no cloud solutions available from its vendor. The company's security team is concerned about how to integrate the security tool with AWS technology. The company plans to deploy the application migration to AWS on Amazon EC2 instances. The EC2 instances will run in an Auto Scaling group in a dedicated VPC. The company needs to use the security tool to inspect all packets that come in and out of the VPC. This inspection must occur in real time and must not affect the application's performance. A solutions architect must design a target architecture on AWS that is highly available within an AWS Region. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, D. Deploy the security tool on EC2 instances m a new Auto Scaling group in the existing VPC; Provision a Gateway Load Balancer for each Availability Zone to redirect the traffic to the security tool
To inspect all inbound and outbound traffic for a VPC while maintaining high availability with a third-party tool: (A) Deploy the security tool on EC2 instances in an Auto Scaling group for redundancy and availability; (D) Use a Gateway Load Balancer to redirect traffic through the security appliance instances while preserving source and destination IP information. Gateway Load Balancer is specifically designed for integrating third-party security appliances and maintaining packet-level inspection without performance impact.
Why the other options are wrong
- B. Network Load Balancer is for general load balancing but doesn't provide the packet-level inspection capabilities needed for security appliance integration.
- C. Application Load Balancer operates at Layer 7 and is inappropriate for packet inspection; it also adds unnecessary complexity and latency.
- E. Transit Gateway is not needed when inspecting traffic within a single VPC; it's used for inter-VPC and on-premises communication.
Question 64
A software company hosts an application on AWS with resources in multiple AWS accounts and Regions. The application runs on a group of Amazon EC2 instances in an application VPC located in the us-east-1 Region with an IPv4 CIDR block of 10.10.0.0/16. In a different AWS account, a shared services VPC is located in the us-east-2 Region with an IPv4 CIDR block of 10.10.10.0/24. When a cloud engineer uses AWS CloudFormation to attempt to peer the application VPC with the shared services VPC, an error message indicates a peering failure. Which factors could cause this error? (Choose two.)
Show answer and explanation
Correct answer: A, E. The IPv4 CIDR ranges of the two VPCs overlap; The IAM role in the peer accepter account does not have the correct permissions
Overlapping CIDR ranges (A) prevent VPC peering because routing becomes ambiguous, the system cannot determine which VPC to route traffic to. The application VPC uses 10.10.0.0/16 and the shared services VPC uses 10.10.10.0/24, which overlap. Incorrect IAM permissions (E) in the peer accepter account can cause peering requests to fail during acceptance. Both factors represent actual technical blockers to successful VPC peering.
Why the other options are wrong
- B. VPCs in different regions can peer successfully; cross-region VPC peering is a supported feature in AWS.
- C. Internet Gateways are not required for VPC peering; peering provides direct connectivity between VPCs.
- D. AWS Resource Access Manager is not required for VPC peering; it is used for sharing other resource types across accounts.
Question 65
An adventure company has launched a new feature on its mobile app. Users can use the feature to upload their hiking and rafting photos and videos anytime. The photos and videos are stored in Amazon S3 Standard storage in an S3 bucket and are served through Amazon CloudFront. The company needs to optimize the cost of the storage. A solutions architect discovers that most of the uploaded photos and videos are accessed infrequently after 30 days. However, some of the uploaded photos and videos are accessed frequently after 30 days. The solutions architect needs to implement a solution that maintains millisecond retrieval availability of the photos and videos at the lowest possible cost. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Configure S3 Intelligent-Tiering on the S3 bucket.
S3 Intelligent-Tiering automatically moves objects between access tiers based on actual access patterns, making it ideal when access behavior varies unpredictably after 30 days. Some objects remain frequently accessed while others become infrequent, Intelligent-Tiering handles this automatically without manual intervention. Objects remain in Standard tier initially for millisecond retrieval, and Intelligent-Tiering automatically transitions infrequently accessed objects to lower-cost tiers. This provides the lowest cost while maintaining millisecond availability. Option B (Glacier Deep Archive) would harm frequently-accessed objects with slow retrieval times. Option C (EFS) introduces unnecessary complexity and higher costs than S3. Option D (Cache-Control headers) addresses CloudFront caching, not storage class optimization.
Why the other options are wrong
- B. Glacier Deep Archive has retrieval latency measured in hours, violating the millisecond availability requirement for frequently accessed objects.
- C. EFS with EC2 instances is more expensive and complex than S3 Intelligent-Tiering for this use case.
- D. Cache-Control headers optimize CloudFront caching behavior, not S3 storage class transitions or cost.
Question 66
A company is migrating an application to AWS. It wants to use fully managed services as much as possible during the migration. The company needs to store large important documents within the application with the following requirements: 1. The data must be highly durable and available 2. The data must always be encrypted at rest and in transit 3. The encryption key must be managed by the company and rotated periodically Which of the following solutions should the solutions architect recommend?
Show answer and explanation
Correct answer: B. Use Amazon S3 with a bucket policy to enforce HTTPS for connections to the bucket and to enforce server-side encryption and AWS KMS for object encryption.
Amazon S3 with bucket policy enforcement is the optimal fully managed solution for storing important documents. S3 provides high durability (99.999999999%) and availability, automatically handles encryption in transit via HTTPS enforcement, and supports customer-managed KMS keys for encryption at rest with automatic key rotation. This approach requires no infrastructure management and is fully compliant with all stated requirements.
Why the other options are wrong
- A. Storage Gateway is not a fully managed service, it requires on-premises or EC2 infrastructure management and is not ideal for document storage.
- C. DynamoDB is designed for structured key-value data, not large document storage, and would be inefficient and costly for this use case.
- D. Deploying EC2 instances with EBS eliminates the managed service benefit and introduces significant operational overhead for infrastructure management.
Question 67
A company built an application based on AWS Lambda deployed in an AWS CloudFormation stack. The last production release of the web application introduced an issue that resulted in an outage lasting several minutes. A solutions architect must adjust the deployment process to support a canary release. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Create an alias for every new deployed version of the Lambda function. Use the AWS CLI update-alias command with the routing-config parameter to distribute the load.
AWS Lambda aliases support canary deployments through the routing-config parameter, which allows gradual traffic shifting between versions. This enables canary releases where a small percentage of traffic is routed to the new version while monitoring for issues before full rollout. The update-alias command with routing-config is the standard AWS mechanism for implementing this pattern.
Why the other options are wrong
- B. CloudFormation stack switching with Route 53 weighted routing creates an all-or-nothing deployment, not a gradual canary release suitable for testing new versions.
- C. The update-function-configuration command does not support routing-config parameters; versions alone do not provide traffic shifting capabilities.
- D. CodeDeploy is designed for EC2/on-premises deployments and does not provide the native traffic-shifting capabilities Lambda aliases offer for canary deployments.
Question 68
A company is planning a one-time migration of an on-premises MySQL database to Amazon Aurora MySQL in the us-east-1 Region. The company's current internet connection has limited bandwidth. The on-premises MySQL database is 60 TB in size. The company estimates that it will take a month to transfer the data to AWS over the current internet connection. The company needs a migration solution that will migrate the database more quickly. Which solution will migrate the database in the LEAST amount of time?
Show answer and explanation
Correct answer: C. Order an AWS Snowball Edge device. Load the data into an Amazon S3 bucket by using the S3 interface. Use AWS Database Migration Service (AWS DMS) to migrate the data from Amazon S3 to Aurora MySQL.
AWS Snowball Edge (C) is purpose-built for transferring large datasets (60 TB) offline, arriving within days rather than a month. Loading data into S3 via the Snowball interface and then using AWS DMS to migrate from S3 to Aurora MySQL is faster than any network-based solution. This approach is significantly quicker than establishing new network connectivity or using DataSync with limited bandwidth.
Why the other options are wrong
- A. Establishing a Direct Connect connection and using DMS still takes weeks for 60 TB transfer, slower than physical device delivery.
- B. DataSync does not accelerate transfer over limited bandwidth; the bandwidth constraint remains the bottleneck.
- D. Application Migration Service is for migrating applications, not databases; AWS DMS is the correct service for database migration from Snowball.
Question 69
A company is running a critical application that uses an Amazon RDS for MySQL database to store data. The RDS DB instance is deployed in Multi-AZ mode. A recent RDS database failover test caused a 40-second outage to the application. A solutions architect needs to design a solution to reduce the outage time to less than 20 seconds. Which combination of steps should the solutions architect take to meet these requirements? (Choose three.)
Show answer and explanation
Correct answer: C, D, E. Use RDS Proxy in front of the database; Migrate the database to Amazon Aurora MySQL; Create an Amazon Aurora Replica.
RDS Proxy (C) reduces failover time by maintaining persistent connections and managing connection pooling, minimizing reconnection overhead. Aurora MySQL (D) provides faster failover than standard RDS MySQL due to its distributed architecture and replica promotion capabilities, typically achieving sub-20 second failover. An Aurora Replica (E) enables read replicas that can be promoted quickly during failover. Together, these solutions directly address reducing failover time below 20 seconds. ElastiCache solutions (A, B) and read replicas (F) add caching/read capacity but don't directly reduce failover time.
Why the other options are wrong
- A. ElastiCache for Memcached does not reduce database failover time; it only caches query results.
- B. ElastiCache for Redis does not reduce database failover time; it only caches data.
- F. RDS read replicas require manual promotion and don't automatically reduce failover time for the primary database.
Question 70
A solutions architect needs to implement a client-side encryption mechanism for objects that will be stored in a new Amazon S3 bucket. The solutions architect created a CMK that is stored in AWS Key Management Service (AWS KMS) for this purpose. The solutions architect created the following IAM policy and attached it to an IAM role: During tests, the solutions architect was able to successfully get existing test objects in the S3 bucket. However, attempts to upload a new object resulted in an error message. The error message stated that the action was forbidden. Which action must the solutions architect add to the IAM policy to meet all the requirements?
Show answer and explanation
Correct answer: A. kms:GenerateDataKey
For client-side encryption with S3 and KMS, the application needs to decrypt existing objects (which requires kms:Decrypt, already present) and encrypt new objects. To encrypt data with KMS, the kms:GenerateDataKey action is required. This action generates a unique data key that is encrypted under the CMK, allowing the client to encrypt the object locally before uploading it to S3. Without this permission, the upload operation fails with a forbidden error because the client cannot generate the necessary encryption key.
Why the other options are wrong
- B. kms:GetKeyPolicy is used to retrieve the key policy itself, not for encryption operations.
- C. kms:GetPublicKey is used to retrieve the public key from an asymmetric CMK, not needed for symmetric encryption in client-side S3 encryption.
- D. kms:Sign is used for cryptographic signing operations, not for generating data keys needed for encryption.
Question 71
A company has registered 10 new domain names. The company uses the domains for online marketing. The company needs a solution that will redirect online visitors to a specific URL for each domain. All domains and target URLs are defined in a JSON document. All DNS records are managed by Amazon Route 53. A solutions architect must implement a redirect service that accepts HTTP and HTTPS requests. Which combination of steps should the solutions architect take to meet these requirements with the LEAST amount of operational effort? (Choose three.)
Show answer and explanation
Correct answer: C, E, F. Create an AWS Lambda function that uses the JSON document in combination with the event message to look up and respond with a redirect URL; Create an Amazon CloudFront distribution. Deploy a Lambda@Edge function; Create an SSL certificate by using AWS Certificate Manager (ACM). Include the domains as Subject Alternative Names.
Lambda@Edge (Option E) running in CloudFront (Option C) provides edge-location redirects for the lowest latency with LEAST operational overhead. An ACM certificate (Option F) with Subject Alternative Names covers all 10 domains with a single certificate, avoiding operational complexity of managing multiple certificates. CloudFront natively handles HTTP/HTTPS, and Lambda@Edge eliminates the need for managing servers or load balancers.
Why the other options are wrong
- A. EC2 instances require operational overhead for patching, scaling, and maintenance.
- B. Application Load Balancer requires managing infrastructure and doesn't provide edge-location optimization that Lambda@Edge offers.
- D. API Gateway adds unnecessary complexity for simple redirects; CloudFront with Lambda@Edge is more cost-effective and operationally simpler.
Question 72
A team collects and routes behavioral data for an entire company. The company runs a Multi-AZ VPC environment with public subnets, private subnets, and in internet gateway. Each public subnet also contains a NAT gateway. Most of the company’s applications read from and write to Amazon Kinesis Data Streams. Most of the workloads run in private subnets. A solutions architect must review the infrastructure. The solution architect needs to reduce costs and maintain the function of the applications. The solutions architect uses Cost Explorer and notices that the cost in the EC2-Other category is consistently high. A further review shows that NatGateway-Bytes charges are increasing the cost in the EC2-Other category. What should the solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: D. Add an interface VPC endpoint for Kinesis Data Streams to the VPC. Ensure that the VPC endpoint policy allows traffic from the applications.
NAT gateway charges stem from data processed through the gateway. Since applications need to access Kinesis Data Streams from private subnets, deploying an interface VPC endpoint for Kinesis allows traffic to route directly to the service without traversing the NAT gateway, eliminating associated costs. The endpoint policy must permit the necessary traffic from the application's IAM role.
Why the other options are wrong
- A. VPC Flow Logs help identify traffic patterns but don't solve the problem; applications need Kinesis access, so blocking traffic isn't viable.
- B. While an interface endpoint is correct, this option doesn't mention the endpoint policy, which is required for proper operation.
- C. Detective analysis is overkill for a known issue; the Kinesis traffic causing NAT gateway charges is legitimate and necessary application traffic.
Question 73
A company is creating a sequel for a popular online game. A large number of users from all over the world will play the game within the first week after launch. Currently, the game consists of the following components deployed in a single AWS Region: • Amazon S3 bucket that stores game assets • Amazon DynamoDB table that stores player scores A solutions architect needs to design a multi-Region solution that will reduce latency, improve reliability, and require the least effort to implement. What should the solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: C. Create another S3 bucket in a new Region, and configure S3 Cross-Region Replication between the buckets. Create an Amazon CloudFront distribution and configure origin failover with two origins accessing the S3 buckets in each Region. Configure DynamoDB global tables by enabling Amazon DynamoDB Streams, and add a replica table in a new Region.
A second bucket in another Region with Cross-Region Replication, fronted by a CloudFront distribution with an origin group, gives low-latency edge delivery plus automatic failover if one Region's bucket is unavailable. DynamoDB global tables, which rely on DynamoDB Streams, add a replica table in the new Region with fully managed multi-active replication. This is a true multi-Region design built only from managed features.
Why the other options are wrong
- A. Replication is configured but CloudFront still points at a single origin, so there is no failover path if that Region's bucket becomes unavailable.
- B. Same-Region Replication gives no Regional resilience, and DMS with CDC is far more effort than DynamoDB global tables.
- D. Both buckets sit in the same Region, so a Regional outage still takes out the game assets.
Question 74
A company has many AWS accounts and uses AWS Organizations to manage all of them. A solutions architect must implement a solution that the company can use to share a common network across multiple accounts. The company’s infrastructure team has a dedicated infrastructure account that has a VPC. The infrastructure team must use this account to manage the network. Individual accounts cannot have the ability to manage their own networks. However, individual accounts must be able to create AWS resources within subnets. Which combination of actions should the solutions architect perform to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, D. Enable resource sharing from the AWS Organizations management account; Create a resource share in AWS Resource Access Manager in the infrastructure account. Select the specific AWS Organizations OU that will use the shared network. Select each subnet to associate with the resource share.
A shared VPC is built by sharing subnets from the infrastructure account with other accounts through AWS Resource Access Manager. Sharing with an OU first requires enabling resource sharing with AWS Organizations from the management account. Participant accounts can then launch resources in the shared subnets but cannot manage the VPC itself.
Why the other options are wrong
- A. A transit gateway connects separate VPCs; it does not let other accounts create resources in the infrastructure account's subnets.
- C. Separate VPCs with the same CIDR range cannot be peered and would let each account manage its own network.
- E. Prefix lists hold CIDR blocks for route tables and security groups; sharing them does not give accounts access to subnets.
Question 75
A security engineer determined that an existing application retrieves credentials to an Amazon RDS for MySQL database from an encrypted file in Amazon S3. For the next version of the application, the security engineer wants to implement the following application design changes to improve security: The database must use strong, randomly generated passwords stored in a secure AWS managed service. The application resources must be deployed through AWS CloudFormation. The application must rotate credentials for the database every 90 days. A solutions architect will generate a CloudFormation template to deploy the application. Which resources specified in the CloudFormation template will meet the security engineer’s requirements with the LEAST amount of operational overhead?
Show answer and explanation
Correct answer: A. Generate the database password as a secret resource using AWS Secrets Manager. Create an AWS Lambda function resource to rotate the database password. Specify a Secrets Manager RotationSchedule resource to rotate the database password every 90 days.
AWS Secrets Manager is the AWS managed service purpose-built for storing and rotating database credentials. It provides native support for RDS password rotation through the RotationSchedule resource, which automatically handles Lambda function creation and invocation at specified intervals. This requires the LEAST operational overhead compared to manually managing Lambda functions and EventBridge rules, and it's more appropriate for secrets than Parameter Store.
Why the other options are wrong
- B. Parameter Store is designed for configuration management, not secrets rotation; it lacks native rotation scheduling capabilities for databases.
- C. While this works, using EventBridge with a custom Lambda function requires more operational overhead than using Secrets Manager's built-in RotationSchedule.
- D. AppSync DataSource is for GraphQL APIs and does not provide automatic database password rotation capabilities.
Question 76
A manufacturing company is building an inspection solution for its factory. The company has IP cameras at the end of each assembly line. The company has used Amazon SageMaker to train a machine learning (ML) model to identify common defects from still images. The company wants to provide local feedback to factory workers when a defect is detected. The company must be able to provide this feedback even if the factory’s internet connectivity is down. The company has a local Linux server that hosts an API that provides local feedback to the workers. How should the company deploy the ML model to meet these requirements?
Show answer and explanation
Correct answer: B. Deploy AWS IoT Greengrass on the local server. Deploy the ML model to the Greengrass server. Create a Greengrass component to take still images from the cameras and run inference. Configure the component to call the local API when a defect is detected.
AWS IoT Greengrass is purpose-built for deploying ML models to edge devices and running inference locally without internet connectivity. It can capture images from IP cameras, run the SageMaker model for inference, and call the local API when defects are detected. This meets all requirements: local processing, offline capability, and integration with factory systems.
Why the other options are wrong
- A. Requires constant internet connectivity to send streams to AWS Kinesis, defeating the offline requirement.
- C. Snowball is designed for data migration, not real-time ML inference at the edge.
- D. Amazon Monitron is designed for equipment monitoring (vibration, temperature), not visual defect detection from IP cameras.
Question 77
A company consists or two separate business units. Each business unit has its own AWS account within a single organization in AWS Organizations. The business units regularly share sensitive documents with each other. To facilitate sharing, the company created an Amazon S3 bucket in each account and configured low-way replication between the S3 buckets. The S3 buckets have millions of objects. Recently, a security audit identified that neither S3 bucket has encryption at rest enabled. Company policy requires that all documents must be stored with encryption at rest. The company wants to implement server-side encryption with Amazon S3 managed encryption keys (SSE-S3). What is the MOST operationally efficient solution that meets these requirements?
Show answer and explanation
Correct answer: A. Turn on SSE-S3 on both S3 buckets. Use S3 Batch Operations to copy and encrypt the objects in the same location.
S3 Batch Operations is the most operationally efficient solution for encrypting millions of existing objects at scale. By enabling SSE-S3 on both buckets and using S3 Batch Operations to copy and encrypt all objects in place, the company avoids the operational overhead of managing KMS keys across accounts while still meeting the encryption requirement. This approach is simpler, more cost-effective (no KMS key management costs), and designed specifically for large-scale object operations.
Why the other options are wrong
- B. Using KMS keys requires additional key management complexity and cross-account key policy configuration, which is operationally less efficient than SSE-S3 for this scenario.
- C. Using CLI copy commands for millions of objects is operationally inefficient and does not scale well compared to S3 Batch Operations.
- D. KMS adds unnecessary complexity and cost when SSE-S3 meets the encryption requirement, and is less efficient than the batch operations approach even if KMS were needed.
Question 78
A company is hosting an image-processing service on AWS in a VPC. The VPC extends across two Availability Zones. Each Availability Zone contains one public subnet and one private subnet. The service runs on Amazon EC2 instances in the private subnets. An Application Load Balancer in the public subnets is in front of the service. The service needs to communicate with the internet and does so through two NAT gateways. The service uses Amazon S3 for image storage. The EC2 instances retrieve approximately 1 TB of data from an S3 bucket each day. The company has promoted the service as highly secure. A solutions architect must reduce cloud expenditures as much as possible without compromising the service’s security posture or increasing the time spent on ongoing operations. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Set up an S3 gateway VPC endpoint in the VPC. Attach an endpoint policy to the endpoint to allow the required actions on the S3 bucket.
An S3 gateway VPC endpoint allows EC2 instances to access S3 without traversing NAT gateways, eliminating approximately 1 TB daily of NAT gateway data transfer costs while maintaining security through the endpoint policy. Gateway endpoints are free, making this the most cost-effective solution. The endpoint policy restricts access to required S3 operations, preserving the security posture. This requires no operational changes beyond endpoint configuration.
Why the other options are wrong
- A. NAT instances require manual management, patching, and monitoring, increasing operational overhead significantly compared to the current NAT gateway setup.
- B. Moving EC2 instances to public subnets exposes them directly to the internet, compromising the security posture the company has promoted.
- D. EFS is inappropriate for image storage and would likely cost more than S3 while introducing complexity; it doesn't address the root cause of high NAT gateway costs.
Question 79
A retail company has structured its AWS accounts to be part of an organization in AWS Organizations. The company has set up consolidated billing and has mapped its departments to the following OUs: Finance, Sales, Human Resources (HR), Marketing, and Operations. Each OU has multiple AWS accounts, one for each environment within a department. These environments are development, test, pre-production, and production. The HR department is releasing a new system that will launch in 3 months. In preparation, the HR department has purchased several Reserved Instances (RIs) in its production AWS account. The HR department will install the new application on this account. The HR department wants to make sure that other departments cannot share the RI discounts. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. In the AWS Billing and Cost Management console. use the organization’s management account 10 turn off RI Sharing for the HR departments production AWS account.
Option C is correct because RI sharing is managed at the organization level through the AWS Billing and Cost Management console by the management account. The management account administrator can disable RI sharing for specific member accounts (the HR production account), preventing other departments' accounts from benefiting from those RIs. This is the proper AWS Organizations-based approach to restrict RI benefits to specific accounts.
Why the other options are wrong
- A. Individual member accounts cannot turn off RI sharing; this setting is controlled centrally by the organization's management account.
- B. Removing the account from the organization would break consolidated billing and cost management structure the company established.
- D. SCPs control API permissions and actions but don't directly restrict RI benefit sharing, which is a billing configuration not governed by SCPs.
Question 80
A company has created an OU in AWS Organizations for each of its engineering teams. Each OU owns multiple AWS accounts. The organization has hundreds of AWS accounts. A solutions architect must design a solution so that each OU can view a breakdown of usage costs across its AWS accounts. Which solution meets these requirements?
Show answer and explanation
Correct answer: B. Create an AWS Cost and Usage Report (CUR) from the AWS Organizations management account. Allow each team to visualize the CUR through an Amazon QuickSight dashboard.
Creating a single Cost and Usage Report from the AWS Organizations management account consolidates all usage data from all member accounts in all OUs. Each OU team can then visualize this data through QuickSight dashboards filtered or grouped by their accounts or cost centers. This is the standard approach for multi-account organizations and requires no per-account CUR configuration.
Why the other options are wrong
- A. Resource Access Manager doesn't create or manage Cost and Usage Reports; CUR is not a shareable resource in that sense.
- C. Creating separate CURs in each member account duplicates configuration and creates operational overhead; the management account CUR already covers all accounts.
- D. AWS Systems Manager is not a cost reporting tool; it's for operational management. OpsCenter dashboards are not designed for cost analysis.
Question 81
A company is planning to migrate its business-critical applications from an on-premises data center to AWS. The company has an on-premises installation of a Microsoft SQL Server Always On cluster. The company wants to migrate to an AWS managed database service. A solutions architect must design a heterogeneous database migration on AWS. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use the AWS Schema Conversion Tool to translate the database schema to Amazon RDS for MySQL. Then use AWS Database Migration Service (AWS DMS) to migrate the data from on-premises databases to Amazon RDS.
Option C is the correct approach for heterogeneous database migration (SQL Server to MySQL). AWS Schema Conversion Tool translates database schemas between different database engines, handling structural differences like stored procedures and data types. AWS DMS then performs the actual data migration, supporting both homogeneous and heterogeneous migrations with minimal downtime. This two-step process is specifically designed for migrating between different database platforms.
Why the other options are wrong
- A. Simple backup and restore cannot handle schema translation between different database engines; MySQL has different schema syntax and features than SQL Server.
- B. Using Snowball Edge with BULK INSERT on RDS MySQL doesn't address schema conversion needs and is unnecessarily complex for this scenario.
- D. DataSync transfers data to S3 but doesn't address the critical schema conversion needed for heterogeneous migration, leaving structural incompatibilities unresolved.
Question 82
A company has a serverless application comprised of Amazon CloudFront, Amazon API Gateway, and AWS Lambda functions. The current deployment process of the application code is to create a new version number of the Lambda function and run an AWS CLI script to update. If the new function version has errors, another CLI script reverts by deploying the previous working version of the function. The company would like to decrease the time to deploy new versions of the application logic provided by the Lambda functions, and also reduce the time to detect and revert when errors are identified. How can this be accomplished?
Show answer and explanation
Correct answer: B. Use AWS SAM and built-in AWS CodeDeploy to deploy the new Lambda version, gradually shift traffic to the new version, and use pre-traffic and post-traffic test functions to verify code. Rollback if Amazon CloudWatch alarms are triggered.
AWS SAM with CodeDeploy provides built-in traffic shifting capabilities through canary, linear, or all-at-once deployments, along with pre-traffic and post-traffic hooks for automated testing. CloudWatch alarms trigger automatic rollback without manual intervention. This significantly reduces both deployment time and error detection/remediation time compared to manual CLI scripts.
Why the other options are wrong
- A. CloudFormation change sets and reversions are slower processes and don't provide automated testing or gradual traffic shifting capabilities.
- C. Simply refactoring CLI scripts into a single script doesn't provide the automation, gradual deployment, or built-in testing that SAM/CodeDeploy offers.
- D. Creating new API Gateway endpoints and changing CloudFront origins is a complex process that doesn't automate testing or provide true canary deployments.
Question 83
A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization. The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company’s on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts when changes are made to the allow list. The solutions architect must design a solution that distributes the common set of CIDR ranges across all accounts. Which solution meets these requirements with the LEAST amount of operational overhead?
Show answer and explanation
Correct answer: C. Create a new customer-managed prefix list in the security team’s AWS account. Populate the customer-managed prefix list with all internal CIDR ranges. Share the customer-managed prefix list with the organization by using AWS Resource Access Manager. Notify the owner of each AWS account to allow the new customer-managed prefix list ID in their security groups.
Creating a customer-managed prefix list in the security team's account and sharing it via AWS Resource Access Manager (RAM) provides the least operational overhead. The prefix list is a single source of truth that all accounts reference, updates are automatically reflected across the organization, and no custom automation or manual notification processes are required. This approach is scalable and requires minimal ongoing maintenance.
Why the other options are wrong
- A. SNS with Lambda functions requires setting up triggers in every account and managing Lambda function updates across accounts, adding operational complexity.
- B. Creating separate prefix lists in each account requires manual synchronization and doesn't create a single source of truth for updates.
- D. Deploying Lambda functions with cross-account IAM roles requires significant permission management and assumes roles across accounts, adding complexity.
Question 84
A company has developed a hybrid solution between its data center and AWS. The company uses Amazon VPC and Amazon EC2 instances that send application logs to Amazon CloudWatch. The EC2 instances read data from multiple relational databases that are hosted on premises. The company wants to monitor which EC2 instances are connected to the databases in near-real time. The company already has a monitoring solution that uses Splunk on premises. A solutions architect needs to determine how to send networking traffic to Splunk. How should the solutions architect meet these requirements?
Show answer and explanation
Correct answer: B. Create an Amazon Kinesis Data Firehose delivery stream with Splunk as the destination. Configure a pre-processing AWS Lambda function with a Kinesis Data Firehose stream processor that extracts individual log events from records sent by CloudWatch Logs subscription filters. Enable VPC flows logs, and send them to CloudWatch. Create a CloudWatch Logs subscription that sends log events to the Kinesis Data Firehose delivery stream.
Kinesis Data Firehose with Splunk as a native destination provides direct, real-time log delivery without intermediate storage. The Lambda preprocessor extracts individual log events from CloudWatch Logs subscription filter records (which batch multiple logs), and the subscription filter streams VPC flow logs to Firehose in near-real-time. Splunk receives formatted events directly, enabling immediate analysis of EC2-to-database connections. This is the most efficient path with native integration.
Why the other options are wrong
- A. Periodic CloudWatch exports to S3 introduce significant latency and don't meet the near-real-time monitoring requirement; credentials stored for S3 access are a security concern.
- C. Requiring database-side logging changes is operationally complex; Athena queries are batch-based, not near-real-time; multiple S3 buckets add pipeline complexity.
- D. Kinesis Data Analytics for SQL is designed for metric anomaly detection over time windows, not for streaming logs; a 1-minute window is slower than direct Firehose delivery.
Question 85
A company is using AWS Organizations to manage multiple AWS accounts. For security purposes, the company requires the creation of an Amazon Simple Notification Service (Amazon SNS) topic that enables integration with a third-party alerting system in all the Organizations member accounts. A solutions architect used an AWS CloudFormation template to create the SNS topic and stack sets to automate the deployment of CloudFormation stacks. Trusted access has been enabled in Organizations. What should the solutions architect do to deploy the CloudFormation StackSets in all AWS accounts?
Show answer and explanation
Correct answer: C. Create a stack set in the Organizations management account. Use service-managed permissions. Set deployment options to deploy to the organization. Enable CloudFormation StackSets automatic deployment.
StackSets must be created in the Organizations management account to deploy across member accounts. Service-managed permissions leverage the trusted access already enabled in Organizations, allowing automated deployment without manual role creation. Setting deployment options to deploy to the organization enables automatic deployment to all member accounts. Automatic deployment ensures the SNS topic is created in all current and future member accounts without repeated manual interventions.
Why the other options are wrong
- A. StackSets cannot be created in member accounts; they must originate from the management account for organization-wide deployment.
- B. Self-service permissions require manual role creation in each member account, which is not appropriate when trusted access is already enabled; service-managed permissions are the correct choice here.
- D. Drift detection is a monitoring tool, not a deployment mechanism; automatic deployment is what enables proactive creation across all accounts.
Question 86
A financial services company in North America plans to release a new online web application to its customers on AWS. The company will launch the application in the us-east-1 Region on Amazon EC2 instances. The application must be highly available and must dynamically scale to meet user traffic. The company also wants to implement a disaster recovery environment for the application in the us-west-1 Region by using active-passive failover. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Create a VPC in us-east-1 and a VPC in us-west-1. In the us-east-1 VPC, create an Application Load Balancer (ALB) that extends across multiple Availability Zones in that VPC. Create an Auto Scaling group that deploys the EC2 instances across the multiple Availability Zones in the us-east-1 VPC. Place the Auto Scaling group behind the ALB. Set up the same configuration in the us-west-1 VPC. Create an Amazon Route 53 hosted zone. Create separate records for each ALB. Enable health checks and configure a failover routing policy for each record.
Option C correctly implements active-passive failover with disaster recovery. It creates separate ALBs in each region with Auto Scaling groups for high availability within each region, then uses Route 53 with health checks and failover routing policy to direct traffic to the primary us-east-1 region while standing ready to fail over to us-west-1 if needed. This meets the requirements of dynamic scaling, high availability, and active-passive failover architecture.
Why the other options are wrong
- A. VPC peering cannot extend an ALB across multiple VPCs or regions; ALBs operate within a single VPC.
- B. While it creates the correct infrastructure, it uses separate records without failover routing policy, which doesn't implement true active-passive failover, it only provides health checks.
- D. VPC peering cannot extend an ALB across VPCs; additionally, this configuration doesn't implement failover routing policy needed for active-passive failover.
Question 87
A solutions architect must analyze a company’s Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS) volumes to determine whether the company is using resources efficiently. The company is running several large, high-memory EC2 instances to host database clusters that are deployed in active/passive configurations. The utilization of these EC2 instances varies by the applications that use the databases, and the company has not identified a pattern. The solutions architect must analyze the environment and take action based on the findings. Which solution meets these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: C. Install the Amazon CloudWatch agent on each of the EC2 instances. Turn on AWS Compute Optimizer, and let it run for at least 12 hours. Review the recommendations from Compute Optimizer, and rightsize the EC2 instances as directed.
AWS Compute Optimizer is purpose-built for analyzing EC2 instance utilization and providing rightsizing recommendations based on CloudWatch metrics collected over time (minimum 12 hours). It uses machine learning to analyze workload patterns and recommends appropriate instance types, directly addressing the requirement to right-size large instances with variable utilization. The CloudWatch agent gathers detailed performance metrics, and Compute Optimizer processes this data to generate cost-effective recommendations with minimal manual analysis required.
Why the other options are wrong
- A. OpsCenter dashboards provide visualization but require manual pattern identification and manual decision-making, adding significant ongoing effort.
- B. Manual CloudWatch monitoring and pattern identification requires extensive human review and analysis rather than automated recommendations.
- D. Enterprise Support and Trusted Advisor focus on broader best practices rather than providing specific EC2 rightsizing analysis, and require manual interpretation.
Question 88
A solutions architect is designing an AWS account structure for a company that consists of multiple teams. All the teams will work in the same AWS Region. The company needs a VPC that is connected to the on-premises network. The company expects less than 50 Mbps of total traffic to and from the on-premises network. Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
Show answer and explanation
Correct answer: B, D. Create an AWS CloudFormation template that provisions a VPC and the required subnets. Deploy the template to a shared services account. Share the subnets by using AWS Resource Access Manager; Use AWS Site-to-Site VPN for connectivity to the on-premises network.
Deploying one VPC in a shared services account and sharing its subnets with each team's account through AWS Resource Access Manager gives every team a place to run workloads while all traffic uses a single VPC. A single AWS Site-to-Site VPN connection to that VPC easily handles less than 50 Mbps and is far cheaper than Direct Connect. This avoids paying for a separate on-premises connection per account.
Why the other options are wrong
- A. A separate VPC in every account would need its own on-premises connection or extra networking, which costs more than one shared VPC.
- C. Transit Gateway adds hourly attachment and data processing charges that are unnecessary when all teams can share one VPC.
- E. Direct Connect has port and provisioning costs that are not justified for less than 50 Mbps of traffic.
Question 89
A delivery company needs to migrate its third-party route planning application to AWS. The third party supplies a supported Docker image from a public registry. The image can run in as many containers as required to generate the route map. The company has divided the delivery area into sections with supply hubs so that delivery drivers travel the shortest distance possible from the hubs to the customers. To reduce the time necessary to generate route maps, each section uses its own set of Docker containers with a custom configuration that processes orders only in the section's area. The company needs the ability to allocate resources cost-effectively based on the number of running containers. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: D. Create an Amazon Elastic Container Service (Amazon ECS) cluster on AWS Fargate. Use the AWS CLI run-task command and set enableECSManagedTags to true to launch the planning application. Use the --tags option to assign a custom tag to the task.
ECS on AWS Fargate (option D) provides the least operational overhead by eliminating EC2 instance management. Fargate handles infrastructure provisioning, scaling, and patching automatically. The run-task command with enableECSManagedTags allows cost allocation and resource tracking by section, enabling cost-effective resource allocation based on container count. This serverless approach minimizes operational burden while meeting the requirement for section-based resource allocation and cost optimization.
Why the other options are wrong
- A. EKS on EC2 requires managing EC2 instances, Kubernetes cluster administration, and node scaling, increasing operational overhead.
- B. EKS on Fargate still requires Kubernetes expertise and cluster management, adding operational complexity compared to ECS.
- C. ECS on EC2 requires managing underlying EC2 instances, including patching, scaling, and maintenance, increasing operational overhead.
Question 90
A company plans to refactor a monolithic application into a modern application design deployed on AWS. The CI/CD pipeline needs to be upgraded to support the modern design for the application with the following requirements: • It should allow changes to be released several times every hour. • It should be able to roll back the changes as quickly as possible. Which design will meet these requirements?
Show answer and explanation
Correct answer: B. Specify AWS Elastic Beanstalk to stage in a secondary environment as the deployment target for the CI/CD pipeline of the application. To deploy, swap the staging and production environment URLs.
AWS Elastic Beanstalk with environment swapping is the ideal solution for rapid, frequent deployments with quick rollback capabilities. By staging changes in a secondary environment and then swapping URLs between staging and production, deployments can occur in seconds, and rollback is as simple as swapping back to the previous environment. This meets the requirement of releasing changes several times per hour with rapid rollback capability.
Why the other options are wrong
- A. AMI-based deployments with EC2 instance replacement are slower than environment swapping and don't provide the rapid rollback capability needed.
- C. Systems Manager re-provisioning and Route 53 weighted routing add complexity and are slower than Elastic Beanstalk environment swapping.
- D. Auto Scaling with AMI replacement is slow and doesn't provide the rapid rollback capability compared to Elastic Beanstalk environment swapping.
Question 91
A company wants to change its internal cloud billing strategy for each of its business units. Currently, the cloud governance team shares reports for overall cloud spending with the head of each business unit. The company uses AWS Organizations to manage the separate AWS accounts for each business unit. The existing tagging standard in Organizations includes the application, environment, and owner. The cloud governance team wants a centralized solution so each business unit receives monthly reports on its cloud spending. The solution should also send notifications for any cloud spending that exceeds a set threshold. Which solution is the MOST cost-effective way to meet these requirements?
Show answer and explanation
Correct answer: B. Configure AWS Budgets in the organization's management account and configure budget alerts that are grouped by application, environment, and owner. Add each business unit to an Amazon SNS topic for each alert. Use Cost Explorer in the organization's management account to create monthly reports for each business unit.
Configuring AWS Budgets in the organization's management account is the most cost-effective centralized solution. This approach allows the cloud governance team to set up budgets grouped by existing tags (application, environment, owner) and configure alerts that route to SNS topics for business units. Using Cost Explorer in the management account provides consolidated spending visibility across all member accounts. This is more efficient and cost-effective than configuring budgets in each individual account.
Why the other options are wrong
- A. Configuring budgets in each account requires duplication of effort and doesn't provide true centralization for the governance team.
- C. The Billing and Cost Management dashboard in individual accounts doesn't provide the consolidated view needed for organization-wide governance.
- D. While Cost and Usage Reports can work, creating a Lambda function to process reports and send alerts is more operationally complex and costly than using AWS Budgets.
Question 92
A global manufacturing company plans to migrate the majority of its applications to AWS. However, the company is concerned about applications that need to remain within a specific country or in the company's central on-premises data center because of data regulatory requirements or requirements for latency of single-digit milliseconds. The company also is concerned about the applications that it hosts in some of its factory sites, where limited network infrastructure exists. The company wants a consistent developer experience so that its developers can build applications once and deploy on premises, in the cloud, or in a hybrid architecture. The developers must be able to use the same tools, APIs, and services that are familiar to them. Which solution will provide a consistent hybrid experience to meet these requirements?
Show answer and explanation
Correct answer: C. Install AWS Outposts for the applications that have data regulatory requirements or requirements for latency of single-digit milliseconds. Use AWS Snowball Edge Compute Optimized devices to host the workloads in the factory sites.
AWS Outposts extends AWS infrastructure, APIs, and services to on-premises environments, meeting single-digit millisecond latency and data sovereignty requirements while providing a consistent developer experience. Snowball Edge Compute Optimized devices deployed at factory sites with limited network infrastructure enable running AWS services locally with the same developer tools and APIs. Together, these solutions address data residency, latency, and connectivity constraints while maintaining the consistency that allows developers to write once and deploy anywhere, cloud, on-premises, or hybrid.
Why the other options are wrong
- A. Direct Connect provides network connectivity but doesn't address the need to keep applications on-premises; it doesn't provide a consistent development experience across hybrid environments.
- B. Snowball Edge Storage Optimized is for data transfer and edge storage, not application hosting; Wavelength requires carrier infrastructure which isn't mentioned as available.
- D. Local Zones are still AWS regions and don't solve on-premises data residency requirements; Wavelength deployment is incomplete without addressing the central data center constraint.
Question 93
A company recently acquired several other companies. Each company has a separate AWS account with a different billing and reporting method. The acquiring company has consolidated all the accounts into one organization in AWS Organizations. However, the acquiring company has found it difficult to generate a cost report that contains meaningful groups for all the teams. The acquiring company’s finance team needs a solution to report on costs for all the companies through a self-managed application. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Create an AWS Cost and Usage Report for the organization. Define tags and cost categories in the report. Create a table in Amazon Athena. Create an Amazon QuickSight dataset based on the Athena table. Share the dataset with the finance team.
Option A provides the complete solution for self-managed cost reporting with meaningful groupings. AWS Cost and Usage Reports with tags and cost categories create detailed billing data. Storing this in Athena enables flexible querying, and QuickSight datasets on top of Athena allow the finance team to build custom reports independently. This approach supports meaningful cost groups for multiple companies in an organization. Option B relies on AWS Cost Explorer templates which provide less flexibility for self-managed application reporting. Option C uses the Price List Query API which provides pricing information, not actual spending data. Option D similarly uses Price List Query API which cannot track actual organizational spending.
Why the other options are wrong
- B. AWS Cost Explorer templates provide pre-built views but limit the flexibility needed for self-managed application reporting.
- C. Price List Query API provides pricing information only, not actual spending data from the organization's accounts.
- D. Price List Query API provides pricing data, not actual spending; Cost Explorer templates are less flexible than the Athena + QuickSight approach.
Question 94
A company runs its application in the eu-west-1 Region and has one account for each of its environments: development, testing, and production. All the environments are running 24 hours a day, 7 days a week by using stateful Amazon EC2 instances and Amazon RDS for MySQL databases. The databases are between 500 GB and 800 GB in size. The development team and testing team work on business days during business hours, but the production environment operates 24 hours a day, 7 days a week. The company wants to reduce costs. All resources are tagged with an environment tag with either development, testing, or production as the key. What should a solutions architect do to reduce costs with the LEAST operational effort?
Show answer and explanation
Correct answer: B. Create an Amazon EventBridge rule that runs every business day in the evening. Configure the rule to invoke an AWS Lambda function that stops instances based on the tag. Create a second EventBridge rule that runs every business day in the morning. Configure the second rule lo invoke another Lambda function that starts instances based on the tag.
Development and testing only need to run during business hours, so the instances must be stopped every business evening and started every business morning. Two scheduled EventBridge rules, each invoking a simple Lambda function that stops or starts instances by environment tag, do exactly that with little code to maintain. Stopping rather than terminating keeps the stateful EC2 instances and large RDS databases intact.
Why the other options are wrong
- A. A rule that fires only once a day cannot both stop resources in the evening and start them again in the morning.
- C. Terminating instances and restoring 500 GB to 800 GB databases from backup every day is slow, risky and far more operational work than stopping them.
- D. Hourly terminate and restore cycles from backups add needless complexity and restore time compared with simply stopping and starting instances.
Question 95
A solutions architect needs to review the design of an Amazon EMR cluster that is using the EMR File System (EMRFS). The cluster performs tasks that are critical to business needs. The cluster is running Amazon EC2 On-Demand Instances at all times for all task, primary, and core nodes. The EMR tasks run each morning, starting at 1:00 AM. and take 6 hours to finish running. The amount of time to complete the processing is not a priority because the data is not referenced until late in the day. The solutions architect must review the architecture and suggest a solution to minimize the compute costs. Which solution should the solutions architect recommend to meet these requirements?
Show answer and explanation
Correct answer: B. Launch the primary and core nodes on On-Demand Instances. Launch the task nodes on Spot Instances in an instance fleet. Terminate the cluster, including all instances, when the processing is completed. Purchase Compute Savings Plans to cover the On-Demand Instance usage.
Option B minimizes compute costs by using On-Demand Instances only for primary and core nodes (which require stability for EMRFS metadata) while using cost-effective Spot Instances for task nodes that can tolerate interruptions. The Compute Savings Plans cover the predictable On-Demand usage of primary and core nodes. Terminating the entire cluster after processing completes avoids unnecessary costs.
Why the other options are wrong
- A. Using Spot Instances for primary and core nodes risks data loss and cluster instability since EMRFS requires persistent metadata nodes.
- C. Continuing with all On-Demand Instances ignores the opportunity to use cheaper Spot Instances for task nodes, and Savings Plans alone do not optimize as effectively.
- D. Terminating only task nodes leaves primary and core nodes running idle and billed, wasting money on infrastructure that is no longer needed.
Question 96
A company is creating a REST API to share information with six of its partners based in the United States. The company has created an Amazon API Gateway Regional endpoint. Each of the six partners will access the API once per day to post daily sales figures. After initial deployment, the company observes 1,000 requests per second originating from 500 different IP addresses around the world. The company believes this traffic is originating from a botnet and wants to secure its API while minimizing cost. Which approach should the company take to secure its API?
Show answer and explanation
Correct answer: D. Create an AWS WAF web ACL with a rule to allow access to the IP addresses used by the six partners. Associate the web ACL with the API. Create a usage plan with a request limit and associate it with the API. Create an API key and add it to the usage plan.
Option D combines IP whitelisting and usage plans for cost-effective protection. The WAF rule allows only the six partner IP addresses, blocking all botnet traffic at the edge. The usage plan with API key creates a second layer of protection and enables request throttling to prevent abuse from legitimate but misbehaving clients. This minimizes both security risks and costs by filtering at multiple levels while supporting the known partner access pattern.
Why the other options are wrong
- A. OAI is for controlling CloudFront access to origins, not for validating API requests; it doesn't address the API Gateway layer or provide meaningful bot protection.
- B. A five-requests-per-day limit is too restrictive for a daily access pattern with unpredictable timing and doesn't leverage the known partner IP addresses.
- C. Resource policies cannot enforce request limits; API Gateway does not support request limit policies, making this technically incorrect.
Question 97
A company is processing videos in the AWS Cloud by Using Amazon EC2 instances in an Auto Scaling group. It takes 30 minutes to process a video Several EC2 instances scale in and out depending on the number of videos in an Amazon Simple Queue Service (Amazon SQS) queue. The company has configured the SQS queue with a redrive policy that specifies a target dead-letter queue and a maxReceiveCount of 1. The company has set the visibility timeout for the SQS queue to 1 hour. The company has set up an Amazon CloudWatch alarm to notify the development team when there are messages in the dead-letter queue. Several times during the day. the development team receives notification that messages are in the dead-letter queue and that videos have not been processed property. An investigation finds no errors m the application logs. How can the company solve this problem?
Show answer and explanation
Correct answer: C. Configure scale-in protection for the instances during processing
The problem occurs because EC2 instances are being terminated while processing 30-minute video jobs, causing messages to be returned to the queue and eventually moved to the dead-letter queue after maxReceiveCount=1 is exceeded. Configuring scale-in protection prevents instances from being terminated during active processing, allowing videos to complete successfully. While increasing visibility timeout (Option B) might seem helpful, it doesn't address the root cause of instances being scaled in mid-process. The maxReceiveCount of 1 is appropriate for identifying failed messages.
Why the other options are wrong
- A. Termination protection on instances doesn't address the auto-scaling mechanism that removes instances during high load.
- B. Extending visibility timeout doesn't prevent the instance from being terminated while processing, which is the actual cause of message redelivery.
- D. Setting maxReceiveCount to 0 would immediately move any message to the dead-letter queue on first failure, making error handling worse.
Question 98
A company runs a proprietary stateless ETL application on an Amazon EC2 Linux instances. The application is a Linux binary, and the source code cannot be modified. The application is single-threaded, uses 2 GB of RAM, and is highly CPU intensive. The application is scheduled to run every 4 hours and runs for up to 20 minutes. A solutions architect wants to revise the architecture for the solution. Which strategy should the solutions architect use?
Show answer and explanation
Correct answer: C. Use AWS Fargate to run the application. Use Amazon EventBridge (Amazon CloudWatch Events) to invoke the Fargate task every 4 hours.
AWS Fargate with EventBridge is the correct choice because the application is a stateless Linux binary that runs periodically (every 4 hours for up to 20 minutes). Fargate can run Docker containers without managing infrastructure, EventBridge can trigger the task on a schedule, and this requires minimal operational overhead. Lambda cannot run arbitrary Linux binaries without modification, Batch is overkill for simple scheduled tasks, and EC2 Spot Instances require more management.
Why the other options are wrong
- A. Lambda has limitations on runtime, package size, and cannot directly run arbitrary Linux binaries without modification.
- B. AWS Batch is designed for batch computing workloads but adds unnecessary complexity for a simple scheduled task.
- D. EC2 Spot Instances require manual deployment setup and operational overhead versus serverless alternatives.
Question 99
A company is developing a gene reporting device that will collect genomic information to assist researchers with collecting large samples of data from a diverse population. The device will push 8 KB of genomic data every second to a data platform that will need to process and analyze the data and provide information back to researchers. The data platform must meet the following requirements: • Provide near-real-time analytics of the inbound genomic data • Ensure the data is flexible, parallel, and durable • Deliver results of processing to a data warehouse Which strategy should a solutions architect use to meet these requirements?
Show answer and explanation
Correct answer: B. Use Amazon Kinesis Data Streams to collect the inbound sensor data, analyze the data with Kinesis clients, and save the results to an Amazon Redshift cluster using Amazon EMR.
Amazon Kinesis Data Streams is designed for continuous, high-throughput data ingestion (8 KB/second scales easily) with near-real-time analytics capabilities. Kinesis clients can process data in parallel for flexible analysis. Amazon EMR provides the compute framework to analyze Kinesis streams and load results into Redshift, meeting all requirements: near-real-time processing, parallel/durable architecture, and data warehouse delivery.
Why the other options are wrong
- A. Kinesis Data Firehose is optimized for batch delivery to storage, not near-real-time analytics, and RDS is not suitable as a data warehouse for this scale.
- C. S3 is not designed for continuous streaming ingestion and introduces latency; this architecture lacks the streaming processing capability required.
- D. API Gateway with SQS and Lambda introduces unnecessary latency and doesn't provide the streaming architecture needed for continuous 8 KB/second data at scale.
Question 100
A company has an organization in AWS Organizations. The company is using AWS Control Tower to deploy a landing zone for the organization. The company wants to implement governance and policy enforcement. The company must implement a policy that will detect Amazon RDS DB instances that are not encrypted at rest in the company’s production OU. Which solution will meet this requirement?
Show answer and explanation
Correct answer: B. Enable the appropriate guardrail from the list of strongly recommended guardrails in AWS Control Tower. Apply the guardrail to the production OU.
AWS Control Tower provides a library of pre-built guardrails for common compliance and governance requirements. Strongly recommended guardrails include one that detects unencrypted RDS instances. These guardrails are designed specifically for Control Tower and can be applied to OUs. This is the purpose-built Control Tower solution rather than creating custom rules elsewhere.
Why the other options are wrong
- A. Mandatory guardrails are baseline controls; they do not include RDS encryption detection and cannot be customized for specific requirements.
- C. AWS Config rules can detect RDS encryption, but Control Tower guardrails are the proper integrated mechanism within the landing zone framework.
- D. SCPs control IAM permissions but cannot detect resource configuration states like encryption status; guardrails are the correct mechanism for compliance detection.
Question 101
A company wants to use AWS to create a business continuity solution in case the company's main on-premises application fails. The application runs on physical servers that also run other applications. The on-premises application that the company is planning to migrate uses a MySQL database as a data store. All the company's on-premises applications use operating systems that are compatible with Amazon EC2. Which solution will achieve the company's goal with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Install the AWS Replication Agent on the source servers, including the MySQL servers. Initialize AWS Elastic Disaster Recovery in the target AWS Region. Define the launch settings. Frequently perform failover and fallback from the most recent point in time.
AWS Elastic Disaster Recovery is purpose-built for continuous replication of on-premises servers to AWS with minimal operational overhead. It handles both the application servers and MySQL database in a unified approach, requires only agent installation on source servers, and supports frequent failover drills with point-in-time recovery. This is specifically designed for business continuity scenarios and requires less operational complexity than manual alternatives.
Why the other options are wrong
- A. While agents provide replication, launching and managing test instances manually for drills is operationally intensive compared to Elastic Disaster Recovery's built-in capabilities.
- C. Using DMS for the database and EC2 for applications splits the recovery process into two separate solutions, increasing operational overhead and complexity.
- D. Storage Gateway adds unnecessary complexity and doesn't provide the integrated disaster recovery capabilities needed for a complete business continuity solution.
Question 102
A company's solutions architect is analyzing costs of a multi-application environment. The environment is deployed across multiple Availability Zones in a single AWS Region. After a recent acquisition, the company manages two organizations in AWS Organizations. The company has created multiple service provider applications as AWS PrivateLink-powered VPC endpoint services in one organization. The company has created multiple service consumer applications in the other organization. Data transfer charges are much higher than the company expected, and the solutions architect needs to reduce the costs. The solutions architect must recommend guidelines for developers to follow when they deploy services. These guidelines must minimize data transfer charges for the whole environment. Which guidelines meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: C, D. Turn off cross-zone load balancing for the Network Load Balancer in all service provider application deployments; Ensure that service consumer compute resources use the Availability Zone-specific endpoint service by using the endpoint's local DNS name.
Cross-AZ data transfer is what drives the extra charges in a PrivateLink setup. Turning off cross-zone load balancing on the provider's Network Load Balancer keeps each endpoint's traffic on targets in the same Availability Zone, and having consumers call the AZ-specific endpoint DNS name keeps their requests in their own zone. With both in place traffic stays within one AZ end to end.
Why the other options are wrong
- A. Sharing subnets with RAM changes who can deploy into them but does nothing to keep traffic within an Availability Zone.
- B. Data transfer pricing does not depend on which organization an account belongs to, so merging organizations does not reduce the charges.
- E. Savings Plans do not apply to data transfer charges, so they cannot reduce this cost.
Question 103
A solutions architect is planning to migrate critical Microsoft SQL Server databases to AWS. Because the databases are legacy systems, the solutions architect will move the databases to a modern data architecture. The solutions architect must migrate the databases with near-zero downtime. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use native database high availability tools. Connect the source system to an Amazon RDS for Microsoft SQL Server DB instance. Configure replication accordingly. When data replication is finished, transition the workload to an Amazon RDS for Microsoft SQL Server DB instance.
Option C is correct because it uses native database high availability tools (SQL Server replication or Always On) to connect the source system to an RDS for SQL Server instance, achieving near-zero downtime migration. This approach leverages built-in SQL Server replication mechanisms for CDC-like functionality, ensures full data synchronization before cutover, and allows a clean transition to the managed RDS database. Options A and D unnecessarily complicate the architecture by involving intermediate conversions or EC2 instances. Option B uses S3 as a target which is inefficient for database migration and doesn't provide the seamless transition required.
Why the other options are wrong
- A. SCT is for heterogeneous migrations (e.g., Oracle to PostgreSQL), not SQL Server to SQL Server; involves unnecessary Aurora Serverless conversion instead of staying on SQL Server.
- B. S3 as a database target is inappropriate and inefficient; adds unnecessary complexity compared to direct replication.
- D. AWS Application Migration Service is designed for servers/VMs, not databases; moving database to EC2 then to RDS introduces unnecessary steps and complexity.
Question 104
A company runs a Python script on an Amazon EC2 instance to process data. The script runs every 10 minutes. The script ingests files from an Amazon S3 bucket and processes the files. On average, the script takes approximately 5 minutes to process each file The script will not reprocess a file that the script has already processed. The company reviewed Amazon CloudWatch metrics and noticed that the EC2 instance is idle for approximately 40% of the time because of the file processing speed. The company wants to make the workload highly available and scalable. The company also wants to reduce long-term management overhead. Which solution will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: A. Migrate the data processing script to an AWS Lambda function. Use an S3 event notification to invoke the Lambda function to process the objects when the company uploads the objects.
AWS Lambda with S3 event notifications is the most cost-effective solution for this workload. The script processes files with significant idle time (40%), making it a perfect candidate for serverless execution where you pay only for actual processing time. Lambda automatically scales to handle multiple concurrent file processing tasks, eliminates management overhead of EC2 instances, and S3 event notifications trigger processing immediately when files arrive, ensuring high availability without maintaining idle compute resources.
Why the other options are wrong
- B. SQS with Auto Scaling groups still requires managing EC2 instances and incurs costs during idle periods, adding operational overhead compared to serverless Lambda.
- C. Containerizing the script on EC2 still requires instance management and doesn't solve the idle capacity problem or reduce management overhead.
- D. ECS on Fargate with Lambda orchestration is more complex and expensive than directly using Lambda for processing, adding unnecessary architectural layers.
Question 105
A company has 50 AWS accounts that are members of an organization in AWS Organizations. Each account contains multiple VPCs. The company wants to use AWS Transit Gateway to establish connectivity between the VPCs in each member account. Each time a new member account is created, the company wants to automate the process of creating a new VPC and a transit gateway attachment. Which combination of steps will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, C. From the management account, share the transit gateway with member accounts by using AWS Resource Access Manager; Launch an AWS CloudFormation stack set from the management account that automatically creates a new VPC and a VPC transit gateway attachment in a member account. Associate the attachment with the transit gateway in the management account by using the transit gateway ID.
AWS Resource Access Manager (Option A) from the management account shares the transit gateway with member accounts securely. CloudFormation Stack Sets (Option C) deployed from the management account automatically create VPCs and transit gateway attachments in member accounts, with the attachment associating to the shared transit gateway using its ID. This combination automates the entire process with minimal operational overhead.
Why the other options are wrong
- B. Service Control Policies enforce access rules but do not facilitate resource sharing; RAM is the correct service for sharing Transit Gateway.
- D. Peering attachments create separate relationships between transit gateways; standard attachments directly connect VPCs to a single transit gateway, which is the correct model.
- E. AWS Service Catalog is for self-service IT services and product management, not for sharing specific resources like Transit Gateway.
Question 106
A company has migrated an application from on premises to AWS. The application frontend is a static website that runs on two Amazon EC2 instances behind an Application Load Balancer (ALB). The application backend is a Python application that runs on three EC2 instances behind another ALB. The EC2 instances are large, general purpose On-Demand Instances that were sized to meet the on-premises specifications for peak usage of the application. The application averages hundreds of thousands of requests each month. However, the application is used mainly during lunchtime and receives minimal traffic during the rest of the day. A solutions architect needs to optimize the infrastructure cost of the application without negatively affecting the application availability. Which combination of steps will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, E. Move the application frontend to a static website that is hosted on Amazon S3; Deploy the backend Python application to general purpose burstable EC2 instances that have the same number of cores as the existing EC2 instances.
Option B moves the static frontend to Amazon S3, eliminating the need for EC2 instances for web content and leveraging CloudFront for distribution, a significantly cheaper approach. Option E deploys backend instances on burstable general-purpose instances (like t3), which are cost-effective for variable workloads and can handle the lunchtime peak with burst capacity while remaining cheap during off-peak hours. Together these reduce costs without affecting availability or performance.
Why the other options are wrong
- A. Compute-optimized instances are more expensive and unnecessary for this workload; cost optimization requires right-sizing or different instance types.
- C. Elastic Beanstalk with the same instance types doesn't reduce costs compared to the current setup.
- D. Spot Instances for the backend are unreliable for a production trading platform due to interruption risk, despite cost savings.
Question 107
A company hosts an application on AWS. The application reads and writes objects that are stored in a single Amazon S3 bucket. The company must modify the application to deploy the application in two AWS Regions. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Create a new S3 bucket in a second Region. Set up bidirectional S3 Cross-Region Replication (CRR) between the original S3 bucket and the new S3 bucket. Configure an S3 Multi-Region Access Point that uses both S3 buckets. Deploy a modified application to both Regions.
S3 Multi-Region Access Point with bidirectional Cross-Region Replication provides the least operational overhead for accessing the same data from multiple regions. The Multi-Region Access Point presents a single global endpoint that automatically routes requests to the nearest region, while bidirectional CRR keeps both buckets synchronized. Applications in both regions use the same endpoint without modification. This is AWS's native solution designed specifically for this use case with minimal management.
Why the other options are wrong
- A. CloudFront is read-only and does not support write operations; combining it with Global Accelerator is unnecessarily complex and does not meet the write requirement.
- C. Unidirectional CRR from the original to the new bucket only, with applications using different buckets in each region, requires application modification and manual bucket selection logic.
- D. S3 gateway endpoints are regional and do not provide multi-region access capability; Intelligent-Tiering addresses cost optimization, not multi-region read/write access requirements.
Question 108
A company has an asynchronous HTTP application that is hosted as an AWS Lambda function. A public Amazon API Gateway endpoint invokes the Lambda function. The Lambda function and the API Gateway endpoint reside in the us-east-1 Region. A solutions architect needs to redesign the application to support failover to another AWS Region. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Deploy the Lambda function and an API Gateway endpoint to the us-west-2 Region. Configure Amazon Route 53 to use a failover routing policy to route traffic for the two API Gateway endpoints.
Option D provides true failover capability by deploying the Lambda function and API Gateway endpoint to us-west-2, then using Route 53 failover routing policy to switch between the two regions when one becomes unavailable. This ensures both compute and API layers are replicated and Route 53 automatically routes traffic based on health checks. Option B uses SQS for async processing but doesn't establish true failover since both regions would process the same queue.
Why the other options are wrong
- A. Creating an endpoint in us-west-2 that targets the Lambda in us-east-1 doesn't provide failover; if us-east-1 fails, the backup endpoint still can't invoke the function.
- B. SQS decoupling helps with async processing but doesn't create regional failover; both regions would pull from the same queue without proper geographic redundancy.
- C. AWS Global Accelerator and ALB don't provide simple failover routing for API Gateway endpoints as effectively as Route 53 failover policies.
Question 109
A company is running an application in the AWS Cloud. The application consists of microservices that run on a fleet of Amazon EC2 instances in multiple Availability Zones behind an Application Load Balancer. The company recently added a new REST API that was implemented in Amazon API Gateway. Some of the older microservices that run on EC2 instances need to call this new API. The company does not want the API to be accessible from the public internet and does not want proprietary data to traverse the public internet. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: B. Create an interface VPC endpoint for API Gateway, and set an endpoint policy to only allow access to the specific API. Add a resource policy to API Gateway to only allow access from the VPC endpoint. Change the API Gateway endpoint type to private.
Option B correctly addresses all requirements by creating an interface VPC endpoint for API Gateway, which keeps the API private and ensures data never traverses the public internet. The endpoint policy restricts access to the specific API, the resource policy limits access to only the VPC endpoint, and changing the endpoint type to private ensures the API is not accessible from the public internet. This allows EC2 microservices within the VPC to securely call the API without internet exposure.
Why the other options are wrong
- A. Site-to-Site VPN and API keys do not make the API private or prevent internet traversal; this approach is unnecessarily complex for internal microservice communication.
- C. Moving API Gateway to a new VPC and deploying a transit gateway adds unnecessary complexity and does not properly isolate the API from public internet access as effectively as a VPC endpoint.
- D. AWS Global Accelerator is designed for performance optimization and public internet routing, not for private API access; it would expose the API to the internet, violating the requirement.
Question 110
A retail company has an on-premises data center in Europe. The company also has a multi-Region AWS presence that includes the eu-west-1 and us-east-1 Regions. The company wants to be able to route network traffic from its on-premises infrastructure into VPCs in either of those Regions. The company also needs to support traffic that is routed directly between VPCs in those Regions. No single points of failure can exist on the network. The company already has created two 1 Gbps AWS Direct Connect connections from its on-premises data center. Each connection goes into a separate Direct Connect location in Europe for high availability. These two locations are named DX-A and DX-B, respectively. Each Region has a single AWS Transit Gateway that is configured to route all inter-VPC traffic within that Region. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Create a transit VIF from the DX-A connection into a Direct Connect gateway. Create a transit VIF from the DX-B connection into the same Direct Connect gateway for high availability. Associate both the eu-west-1 and us-east-1 transit gateways with this Direct Connect gateway. Peer the transit gateways with each other to support cross-Region routing.
Both Direct Connect connections (DX-A and DX-B) should connect to the same Direct Connect gateway using transit VIFs for high availability and automatic failover. Both transit gateways (eu-west-1 and us-east-1) associate with this single Direct Connect gateway. The transit gateways must then peer with each other to enable cross-Region traffic between VPCs. This configuration eliminates single points of failure and supports all routing requirements.
Why the other options are wrong
- A. Private VIFs don't support multi-Region routing; only transit VIFs do. Also, separate peering instead of DX gateway routing adds unnecessary complexity.
- B. Two separate Direct Connect gateways create a single point of failure in the peering relationship and don't provide the optimal high-availability design.
- C. A Direct Connect gateway routes traffic only to associated transit gateways within the gateway itself; it doesn't route between peered transit gateways without explicit peering configured.
Question 111
A company runs an IoT application in the AWS Cloud. The company has millions of sensors that collect data from houses in the United States. The sensors use the MQTT protocol to connect and send data to a custom MQTT broker. The MQTT broker stores the data on a single Amazon EC2 instance. The sensors connect to the broker through the domain named iot.example.com. The company uses Amazon Route 53 as its DNS service. The company stores the data in Amazon DynamoDB. On several occasions, the amount of data has overloaded the MQTT broker and has resulted in lost sensor data. The company must improve the reliability of the solution. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Set up AWS IoT Core to receive the sensor data. Create and configure a custom domain to connect to AWS IoT Core. Update the DNS record in Route 53 to point to the AWS IoT Core Data-ATS endpoint. Configure an AWS IoT rule to store the data.
AWS IoT Core is the managed service purpose-built for handling millions of IoT device connections with reliable message ingestion at scale. Option B leverages AWS IoT Core's ability to handle MQTT protocol connections with built-in high availability, custom domain support via Route 53, and IoT Rules to route data to DynamoDB. This eliminates the single point of failure of the EC2 broker and is AWS's recommended pattern for IoT applications.
Why the other options are wrong
- A. Load balancing an MQTT broker with ALB does not solve the fundamental scalability limitations of a single broker architecture and adds operational complexity.
- C. Global Accelerator with NLB still relies on the underlying MQTT broker implementation, not addressing the core scalability and reliability issues.
- D. AWS IoT Greengrass is designed for edge computing and local processing, not for cloud-based centralized data collection from millions of sensors.
Question 112
A solutions architect wants to cost-optimize and appropriately size Amazon EC2 instances in a single AWS account. The solutions architect wants to ensure that the instances are optimized based on CPU, memory, and network metrics. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: C, D. Install the Amazon CloudWatch agent and configure memory metric collection on the EC2 instances; Configure AWS Compute Optimizer in the AWS account to receive findings and optimization recommendations.
AWS Compute Optimizer (D) is specifically designed to analyze EC2 instance metrics including CPU, memory, and network utilization, providing optimization recommendations and right-sizing suggestions. The CloudWatch agent (C) must be installed to collect memory metrics, as CloudWatch does not collect memory data by default, only CPU and network metrics are collected from the hypervisor. Together, these provide comprehensive visibility into instance performance for cost optimization.
Why the other options are wrong
- A. AWS Support plans provide recommendations through Trusted Advisor, but are not necessary when Compute Optimizer is available; support level does not enable the optimization analysis capability.
- B. Trusted Advisor 'Low Utilization' checks provide basic recommendations but lack the detailed analysis of CPU, memory, and network that Compute Optimizer provides; Trusted Advisor is less precise for sizing decisions.
- E. Savings Plans are a purchasing option to reduce costs but do not help analyze or right-size instances; purchasing commitments does not address the optimization requirement.
Question 113
An international delivery company hosts a delivery management system on AWS. Drivers use the system to upload confirmation of delivery. Confirmation includes the recipient’s signature or a photo of the package with the recipient. The driver’s handheld device uploads signatures and photos through FTP to a single Amazon EC2 instance. Each handheld device saves a file in a directory based on the signed-in user, and the file name matches the delivery number. The EC2 instance then adds metadata to the file after querying a central database to pull delivery information. The file is then placed in Amazon S3 for archiving. As the company expands, drivers report that the system is rejecting connections. The FTP server is having problems because of dropped connections and memory issues in response to these problems, a system engineer schedules a cron task to reboot the EC2 instance every 30 minutes. The billing team reports that files are not always in the archive and that the central system is not always updated. A solutions architect needs to design a solution that maximizes scalability to ensure that the archive always receives the files and that systems are always updated. The handheld devices cannot be modified, so the company cannot deploy a new application. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use AWS Transfer Family to create an FTP server that places the files in Amazon S3. Use an S3 event notification through Amazon Simple Notification Service (Amazon SNS) to invoke an AWS Lambda function. Configure the Lambda function to add the metadata and update the delivery system.
AWS Transfer Family provides a fully managed FTP service that scales automatically without memory issues or dropped connections. Placing files directly in S3 eliminates the EC2 bottleneck. S3 event notifications through SNS trigger Lambda functions to process metadata addition and system updates atomically. This solution requires no handheld device changes, is fully scalable, and ensures files always reach archival and systems are always updated.
Why the other options are wrong
- A. An Auto Scaling group of EC2 instances still relies on FTP through load balancers and doesn't eliminate the inherent scaling limitations of FTP protocol.
- B. While Transfer Family is correct, placing files in EFS and mounting to EC2 still requires EC2-based processing, creating the same bottleneck as the original architecture.
- D. Modifying handheld devices is explicitly prohibited by the problem statement, making this solution infeasible.
Question 114
A company recently deployed an application on AWS. The application uses Amazon DynamoDB. The company measured the application load and configured the RCUs and WCUs on the DynamoDB table to match the expected peak load. The peak load occurs once a week for a 4-hour period and is double the average load. The application load is close to the average load for the rest of the week. The access pattern includes many more writes to the table than reads of the table. A solutions architect needs to implement a solution to minimize the cost of the table. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Use AWS Application Auto Scaling to increase capacity during the peak period. Purchase reserved RCUs and WCUs to match the average load.
Application Auto Scaling dynamically adjusts capacity during the weekly 4-hour peak period when load doubles, preventing over-provisioning for the entire week. Purchasing reserved RCUs and WCUs to match the average load (not peak) reduces per-unit costs for baseline capacity. This combination minimizes cost by paying reserved rates for average load and scaling up only when needed for peaks, which is more cost-effective than on-demand pricing for sustained average usage.
Why the other options are wrong
- B. On-demand capacity mode has higher per-request pricing than provisioned mode with reserved capacity; it's more expensive for predictable workloads with known average load.
- C. DAX is a caching layer that reduces read capacity but doesn't address write capacity, which is dominant in this workload. Reducing read capacity arbitrarily would degrade performance.
- D. Combining DAX with on-demand mode layers unnecessary caching costs on top of expensive on-demand pricing; neither component optimizes for this specific workload pattern.
Question 115
A financial services company receives a regular data feed from its credit card servicing partner. Approximately 5,000 records are sent every 15 minutes in plaintext, delivered over HTTPS directly into an Amazon S3 bucket with server-side encryption. This feed contains sensitive credit card primary account number (PAN) data. The company needs to automatically mask the PAN before sending the data to another S3 bucket for additional internal processing. The company also needs to remove and merge specific fields, and then transform the record into JSON format. Additionally, extra feeds are likely to be added in the future, so any design needs to be easily expandable. Which solutions will meet these requirements?
Show answer and explanation
Correct answer: C. Create an AWS Glue crawler and custom classifier based on the data feed formats and build a table definition to match. Invoke an AWS Lambda function on file delivery to start an AWS Glue ETL job to transform the entire record according to the processing and transformation requirements. Define the output format as JSON. Once complete, have the ETL job send the results to another S3 bucket for internal processing.
AWS Glue with a custom classifier handles the plaintext file format, masking PAN data, removing/merging fields, and transforming to JSON in a single, serverless ETL job. Glue is purpose-built for data transformation, easily expandable to new feeds via additional crawlers and job definitions, and requires minimal operational overhead. The Lambda-based approach (A, B) involves multiple invocations and orchestration complexity, while EMR (D) adds unnecessary operational burden for a structured transformation task.
Why the other options are wrong
- A. Multiple Lambda functions require complex orchestration and state management across three separate invocations, adding operational overhead.
- B. Fargate auto-scaling adds operational complexity when Glue can handle the transformation directly without container orchestration.
- D. EMR is overkill for structured data transformation and requires manual cluster management, whereas Glue is serverless and expandable.
Question 116
A company is migrating some of its applications to AWS. The company wants to migrate and modernize the applications quickly after it finalizes networking and security strategies. The company has set up an AWS Direct Connect connection in a central network account. The company expects to have hundreds of AWS accounts and VPCs in the near future. The corporate network must be able to access the resources on AWS seamlessly and also must be able to communicate with all the VPCs. The company also wants to route its cloud resources to the internet through its on-premises data center. Which combination of steps will meet these requirements? (Choose three.)
Show answer and explanation
Correct answer: B, D, F. Create a Direct Connect gateway and a transit gateway in the central network account. Attach the transit gateway to the Direct Connect gateway by using a transit VIF; Share the transit gateway with other accounts. Attach VPCs to the transit gateway; Provision only private subnets. Open the necessary route on the transit gateway and customer gateway to allow outbound internet traffic from AWS to flow through NAT services that run in the data center.
The solution requires: (B) Create a Direct Connect gateway and transit gateway in the central account, attaching via transit VIF to connect on-premises networks with AWS; (D) Share the transit gateway across accounts and attach VPCs to enable seamless communication between hundreds of accounts; (F) Use private subnets only and configure routing through the data center's NAT for internet-bound traffic, ensuring all traffic flows through the centralized security checkpoint. This architecture supports the hub-and-spoke model needed for hundreds of accounts.
Why the other options are wrong
- A. Direct Connect gateway associations are made from member accounts to the gateway, but this alone doesn't provide the inter-VPC connectivity needed across hundreds of accounts.
- C. Internet gateways would bypass the on-premises data center routing requirement and the centralized security model.
- E. VPC peering doesn't scale to hundreds of accounts and doesn't integrate with Direct Connect for on-premises connectivity.
Question 117
A company has an application that is deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are part of an Auto Scaling group. The application has unpredictable workloads and frequently scales out and in. The company’s development team wants to analyze application logs to find ways to improve the application's performance. However, the logs are no longer available after instances scale in. Which solution will give the development team the ability to view the application logs after a scale-in event?
Show answer and explanation
Correct answer: B. Configure the EC2 instances to publish logs to Amazon CloudWatch Logs by using the unified CloudWatch agent.
When EC2 instances scale in, local logs are lost. CloudWatch Logs persists application logs to AWS managed storage, making them available after instance termination. The unified CloudWatch agent on EC2 instances automatically collects and sends logs to CloudWatch Logs, enabling developers to analyze historical logs from scaled-in instances. This provides centralized, persistent log storage without modifying application code or requiring manual intervention.
Why the other options are wrong
- A. ALB access logs capture HTTP request/response data, not application-level logs that developers need for performance analysis.
- C. Step scaling policies control scaling behavior but don't solve the log persistence problem; logs still disappear on scale-in.
- D. X-Ray tracing provides distributed request tracing but doesn't persist application logs or provide the detailed logging analysis developers need for performance optimization.
Question 118
A company uses AWS Organizations for a multi-account setup in the AWS Cloud. The company uses AWS Control Tower for governance and uses AWS Transit Gateway for VPC connectivity across accounts. In an AWS application account, the company’s application team has deployed a web application that uses AWS Lambda and Amazon RDS. The company's database administrators have a separate DBA account and use the account to centrally manage all the databases across the organization. The database administrators use an Amazon EC2 instance that is deployed in the DBA account to access an RDS database that is deployed m the application account. The application team has stored the database credentials as secrets in AWS Secrets Manager in the application account. The application team is manually sharing the secrets with the database administrators. The secrets are encrypted by the default AWS managed key for Secrets Manager in the application account. A solutions architect needs to implement a solution that gives the database administrators access to the database and eliminates the need to manually share the secrets. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. In the application account, create an IAM role that is named DBA-Secret. Grant the role the required permissions to access the secrets. In the DBA account, create an IAM role that is named DBA-Admin. Grant the DBA-Admin role the required permissions to assume the DBA-Secret role in the application account. Attach the DBA-Admin role to the EC2 instance for access to the cross-account secrets
Option B uses cross-account IAM role assumption, the standard AWS pattern for secure cross-account access. The DBA account's DBA-Admin role assumes the DBA-Secret role in the application account, which has permissions to access Secrets Manager. This approach requires KMS key policy updates on the default managed key to allow cross-account decryption, handles encryption properly, and implements least privilege without manual secret sharing. AWS RAM (A) doesn't share Secrets Manager resources effectively, and options C and D incorrectly attempt to grant permissions without proper cross-account role assumption patterns.
Why the other options are wrong
- A. AWS RAM does not support sharing Secrets Manager secrets; it is designed for sharing other resource types like subnets and Aurora databases.
- C. Granting IAM permissions directly to another account's role without proper cross-account role assumption is not the standard secure pattern.
- D. SCPs do not grant permissions; they define permission boundaries. This approach does not implement the proper cross-account access pattern.
Question 119
A health insurance company stores personally identifiable information (PII) in an Amazon S3 bucket. The company uses server-side encryption with S3 managed encryption keys (SSE-S3) to encrypt the objects. According to a new requirement, all current and future objects in the S3 bucket must be encrypted by keys that the company’s security team manages. The S3 bucket does not have versioning enabled. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. In the S3 bucket properties, change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS). Set an S3 bucket policy to deny unencrypted PutObject requests. Use the AWS CLI to re-upload all objects in the S3 bucket.
The requirement is to encrypt objects with company-managed keys, which means using AWS KMS with customer-managed keys. Option B correctly specifies changing to SSE-KMS (not SSE-S3, which only uses AWS-managed keys), setting a bucket policy to deny unencrypted requests to protect future objects, and re-uploading existing objects since encryption is not retroactive. This fully meets the requirement of having company-managed encryption for current and future objects.
Why the other options are wrong
- A. SSE-S3 cannot use customer-managed keys; it only supports AWS-managed encryption keys, failing the core requirement.
- C. S3 bucket policies cannot automatically encrypt objects; encryption must be specified at upload time or via default bucket encryption settings.
- D. AES-256 is not a valid S3 encryption option; S3 supports SSE-S3 or SSE-KMS, not standalone AES-256 configurations with customer-managed keys.
Question 120
A company runs a Java application that has complex dependencies on VMs that are in the company's data center. The application is stable. but the company wants to modernize the technology stack. The company wants to migrate the application to AWS and minimize the administrative overhead to maintain the servers. Which solution will meet these requirements with the LEAST code changes?
Show answer and explanation
Correct answer: A. Migrate the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate by using AWS App2Container. Store container images in Amazon Elastic Container Registry (Amazon ECR). Grant the ECS task execution role permission 10 access the ECR image repository. Configure Amazon ECS to use an Application Load Balancer (ALB). Use the ALB to interact with the application.
Option A minimizes code changes by using AWS App2Container to automatically containerize the Java application with its complex dependencies, deploying to ECS on Fargate. This approach preserves the application structure while eliminating server management overhead. ECS with ALB supports traditional application interaction patterns. Lambda (options B and D) would require significant refactoring for a complex Java application with dependencies, defeating the least code changes requirement.
Why the other options are wrong
- B. Migrating complex Java applications with dependencies to Lambda requires extensive code refactoring and isn't designed for applications with heavy interdependencies.
- C. EKS adds orchestration complexity beyond what's needed and requires more operational overhead than managed Fargate for this use case.
- D. Lambda is unsuitable for complex dependent applications and requires rewriting the application architecture to work with ALB integration.
Question 121
A company needs to establish a connection from its on-premises data center to AWS. The company needs to connect all of its VPCs that are located in different AWS Regions with transitive routing capabilities between VPC networks. The company also must reduce network outbound traffic costs, increase bandwidth throughput, and provide a consistent network experience for end users. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create an AWS Direct Connect connection between the on-premises data center and AWS. Provision a transit VIF, and connect it to a Direct Connect gateway. Connect the Direct Connect gateway to all the other VPCs by using a transit gateway in each Region.
Option B is correct because it combines AWS Direct Connect (for reduced costs and consistent bandwidth) with a transit gateway setup that provides transitive routing across multiple VPCs in different regions. The Direct Connect gateway connects to regional transit gateways, enabling multi-region connectivity with native support for transitive routing. This architecture reduces outbound traffic costs compared to VPN, provides higher throughput via Direct Connect, and delivers consistent network performance. Option A lacks multi-region capabilities. Option C uses VPN which is slower and more expensive than Direct Connect. Option D mixes VPN and Direct Connect inefficiently without proper transitive routing architecture.
Why the other options are wrong
- A. VPC peering does not scale well across regions and VPCs; does not provide transitive routing; lacks Direct Connect cost benefits.
- C. Site-to-Site VPN is slower and more expensive than Direct Connect; does not meet throughput and cost reduction requirements.
- D. Combining Direct Connect with VPN between VPCs is redundant and overly complex; does not efficiently leverage Direct Connect for all connections.
Question 122
A company has an on-premises monitoring solution using a PostgreSQL database for persistence of events. The database is unable to scale due to heavy ingestion and it frequently runs out of storage. The company wants to create a hybrid solution and has already set up a VPN connection between its network and AWS. The solution should include the following attributes: • Managed AWS services to minimize operational complexity. • A buffer that automatically scales to match the throughput of data and requires no ongoing administration. • A visualization tool to create dashboards to observe events in near-real time. • Support for semi-structured JSON data and dynamic schemas. Which combination of components will enable the company to create a monitoring solution that will satisfy these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, D. Use Amazon Kinesis Data Firehose to buffer events. Create an AWS Lambda function to process and transform events; Configure Amazon Elasticsearch Service (Amazon ES) to receive events. Use the Kibana endpoint deployed with Amazon ES to create nearreal-time visualizations and dashboards.
Kinesis Data Firehose (A) automatically scales to handle throughput without administration and buffers data efficiently. A Lambda function can transform semi-structured JSON data. Amazon Elasticsearch (D) stores semi-structured data with dynamic schemas natively and provides Kibana for near-real-time visualization and dashboards. Together they satisfy all requirements: managed services, auto-scaling buffer, semi-structured JSON support, and visualization.
Why the other options are wrong
- B. Kinesis Data Streams requires manual scaling configuration, adding operational overhead.
- C. Aurora PostgreSQL doesn't naturally handle semi-structured JSON with dynamic schemas as elegantly as Elasticsearch, and QuickSight is less suited for near-real-time operational dashboards.
- E. Neptune is a graph database, not suited for event data; it's designed for relationship queries, not event streaming and time-series analysis.
Question 123
A solutions architect needs to improve an application that is hosted in the AWS Cloud. The application uses an Amazon Aurora MySQL DB instance that is experiencing overloaded connections. Most of the application’s operations insert records into the database. The application currently stores credentials in a text-based configuration file. The solutions architect needs to implement a solution so that the application can handle the current connection load. The solution must keep the credentials secure and must provide the ability to rotate the credentials automatically on a regular basis. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Deploy an Amazon RDS Proxy layer. In front of the DB instance. Store the connection credentials as a secret in AWS Secrets Manager.
RDS Proxy (A) directly addresses connection overload by implementing connection pooling, reducing the number of database connections needed. Storing credentials in AWS Secrets Manager enables automatic credential rotation. This solution meets all requirements: handles connection load, keeps credentials secure, and provides automatic rotation. RDS Proxy is specifically designed for this use case and integrates seamlessly with Secrets Manager.
Why the other options are wrong
- B. Parameter Store does not support automatic credential rotation like Secrets Manager does.
- C. Aurora Replicas scale read operations but do not address connection pooling or write operation overload; this is the primary issue.
- D. Aurora Replicas do not address connection pooling, and Parameter Store lacks automatic rotation capability.
Question 124
A company is creating a centralized logging service running on Amazon EC2 that will receive and analyze logs from hundreds of AWS accounts. AWS PrivateLink is being used to provide connectivity between the client services and the logging service. In each AWS account with a client, an interface endpoint has been created for the logging service and is available. The logging service running on EC2 instances with a Network Load Balancer (NLB) are deployed in different subnets. The clients are unable to submit logs using the VPC endpoint. Which combination of steps should a solutions architect take to resolve this issue? (Choose two.)
Show answer and explanation
Correct answer: A, C. Check that the NACL is attached to the logging service subnet to allow communications to and from the NLB subnets. Check that the NACL is attached to the NLB subnet to allow communications to and from the logging service subnets running on EC2 instances; Check the security group for the logging service running on the EC2 instances to ensure it allows ingress from the NLB subnets.
On the provider side, traffic from the endpoint arrives at the Network Load Balancer and is forwarded to the EC2 targets in different subnets. The network ACLs on the NLB subnets and the logging service subnets must allow traffic in both directions between them, and the targets' security group must allow ingress from the NLB subnets. These are the components the provider controls that can block the flow.
Why the other options are wrong
- B. The interface endpoint subnets live in each client's VPC, so the provider cannot check or change their network ACLs.
- D. The targets see traffic coming from the NLB's private addresses, not from the clients' addresses, so allowing the clients does not help.
- E. The endpoint subnets are in the clients' accounts and the NLB forwards PrivateLink traffic from its own nodes, so this is not the gap to check.
Question 125
A company has an application that runs on Amazon EC2 instances. A solutions architect is designing VPC infrastructure in an AWS Region where the application needs to access an Amazon Aurora DB Cluster. The EC2 instances are all associated with the same security group. The DB cluster is associated with its own security group. The solutions architect needs to add rules to the security groups to provide the application with least privilege access to the DB Cluster. Which combination of steps will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, C. Add an outbound rule to the EC2 instances' security group. Specify the DB cluster's security group as the destination over the default Aurora port; Add an inbound rule to the DB cluster's security group. Specify the EC2 instances' security group as the source over the default Aurora port.
To provide least privilege access from EC2 instances to an Aurora database, two rules are needed: (B) An outbound rule on the EC2 security group allowing traffic to the DB security group on the Aurora port, which permits the EC2 instances to initiate connections; and (C) An inbound rule on the DB security group allowing traffic from the EC2 security group on the Aurora port, which permits the database to accept those connections. This bidirectional approach ensures the EC2 instances can establish database connections while the database is configured to accept only those connections.
Why the other options are wrong
- A. Inbound rules on the EC2 security group are for accepting traffic from external sources, not for initiating outbound connections to databases.
- D. The database doesn't need to initiate outbound connections to the EC2 instances; the EC2 instances query the database.
- E. Ephemeral ports are used for return traffic, not for the initial database connection requests on the database port.
Question 126
A company runs an unauthenticated static website (www.example.com) that includes a registration form for users. The website uses Amazon S3 for hosting and uses Amazon CloudFront as the content delivery network with AWS WAF configured. When the registration form is submitted, the website calls an Amazon API Gateway API endpoint that invokes an AWS Lambda function to process the payload and forward the payload to an external API call. During testing, a solutions architect encounters a cross-origin resource sharing (CORS) error. The solutions architect confirms that the CloudFront distribution origin has the Access-Control-Allow-Origin header set to www.example.com. What should the solutions architect do to resolve the error?
Show answer and explanation
Correct answer: C. Enable the CORS setting on the API Gateway API endpoint. Ensure that the API endpoint is configured to return all responses that have the Access-Control-Allow-Origin header set to www.example.com.
The CORS error occurs because the browser's preflight request to the API Gateway endpoint fails. While CloudFront and S3 have CORS configured, API Gateway is the actual endpoint receiving cross-origin requests from the browser. API Gateway must return the Access-Control-Allow-Origin header in its responses. Enabling CORS on the API Gateway endpoint and configuring it to return the appropriate header resolves the browser's same-origin policy enforcement.
Why the other options are wrong
- A. S3 CORS configuration doesn't apply here since the origin is CloudFront, not S3; the actual cross-origin request is to API Gateway.
- B. AWS WAF filters requests but doesn't add CORS headers; modifying WAF rules won't enable CORS responses.
- D. Lambda functions don't have a CORS setting; CORS must be configured at the API Gateway layer that receives the browser request.
Question 127
A company is running an application on several Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The load on the application varies throughout the day, and EC2 instances are scaled in and out on a regular basis. Log files from the EC2 instances are copied to a central Amazon S3 bucket every 15 minutes. The security team discovers that log files are missing from some of the terminated EC2 instances. Which set of actions will ensure that log files are copied to the central S3 bucket from the terminated EC2 instances?
Show answer and explanation
Correct answer: B. Create an AWS Systems Manager document with a script to copy log files to Amazon S3. Create an Auto Scaling lifecycle hook and an Amazon EventBridge rule to detect lifecycle events from the Auto Scaling group. Invoke an AWS Lambda function on the autoscaling:EC2_INSTANCE_TERMINATING transition to call the AWS Systems Manager API SendCommand operation to run the document to copy the log files and send CONTINUE to the Auto Scaling group to terminate the instance.
Option B correctly uses Auto Scaling lifecycle hooks to pause the termination process, AWS Systems Manager documents to encapsulate the log copy script, and Lambda to invoke Systems Manager SendCommand to execute the document. When the EC2_INSTANCE_TERMINATING lifecycle transition occurs, the Lambda function runs the Systems Manager document to copy logs, then sends CONTINUE to proceed with termination. This ensures logs are captured before instances are actually terminated.
Why the other options are wrong
- A. Sending ABANDON prevents termination indefinitely, which defeats the Auto Scaling purpose; this would require manual intervention to eventually terminate instances.
- C. Running user-data scripts during termination is not reliable since user-data only executes at instance launch, and EventBridge cannot reliably invoke terminated instances.
- D. SNS notification is asynchronous and doesn't guarantee the log copy completes before termination; ABANDON again prevents proper termination flow.
Question 128
A company runs an application in an on-premises data center. The application gives users the ability to upload media files. The files persist in a file server. The web application has many users. The application server is overutilized, which causes data uploads to fail occasionally. The company frequently adds new storage to the file server. The company wants to resolve these challenges by migrating the application to AWS. Users from across the United States and Canada access the application. Only authenticated users should have the ability to access the application to upload files. The company will consider a solution that refactors the application, and the company needs to accelerate application development. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: D. Use AWS Amplify to create a static website for uploads of media files. Use Amplify Hosting to serve the website through Amazon CloudFront. Use Amazon S3 to store the uploaded media files. Use Amazon Cognito to authenticate users.
AWS Amplify provides the fastest path to refactored cloud-native development with minimal operational overhead. Amplify handles static website hosting through CloudFront, S3 storage integration, authentication via Cognito, and API creation, all with built-in CI/CD and minimal infrastructure management. This serverless approach eliminates the need to manage EC2 instances, Auto Scaling groups, and ALBs that would require operational overhead. For a company that needs to accelerate development, Amplify's integrated environment and pre-built components deliver faster time-to-market than migrating traditional infrastructure.
Why the other options are wrong
- A. Application Migration Service migrates legacy servers rather than refactoring; this increases operational overhead with EC2 management rather than accelerating development.
- B. Identity Center is designed for employee SSO, not unauthenticated user registration; Cognito is appropriate for public user authentication.
- C. AppSync with Lambda resolvers requires more custom development than Amplify's integrated solutions; AppSync is powerful but adds operational complexity vs. Amplify's abstractions.
Question 129
A company has a web application that allows users to upload short videos. The videos are stored on Amazon EBS volumes and analyzed by custom recognition software for categorization. The website contains static content that has variable traffic with peaks in certain months. The architecture consists of Amazon EC2 instances running in an Auto Scaling group for the web application and EC2 instances running in an Auto Scaling group to process an Amazon SQS queue. The company wants to re-architect the application to reduce operational overhead using AWS managed services where possible and remove dependencies on third-party software. Which solution meets these requirements?
Show answer and explanation
Correct answer: C. Host the web application in Amazon S3. Store the uploaded videos in Amazon S3. Use S3 event notification to publish events to the SQS queue. Process the SQS queue with an AWS Lambda function that calls the Amazon Rekognition API to categorize the videos.
Option C best meets the requirements by eliminating operational overhead through AWS managed services. Hosting the static web application in S3, storing videos in S3, using S3 event notifications to trigger SQS, and processing with Lambda functions calling Amazon Rekognition removes the need to manage EC2 instances entirely. This is a fully serverless approach that reduces operational overhead to near zero while removing the custom recognition software dependency.
Why the other options are wrong
- A. Still requires managing EC2 instances in an Auto Scaling group for the web application, maintaining operational overhead.
- B. Still requires EC2 instances for the web application and uses EFS, which are managed services but still involve operational overhead compared to full serverless.
- D. Still requires managing Auto Scaling groups for both the web application and worker environments, though Elastic Beanstalk reduces some overhead.
Question 130
An online gaming company needs to rehost its gaming platform on AWS. The company's gaming application requires high performance computing (HPC) processing and has a leaderboard that changes frequently. An Ubuntu instance that is optimized for compute generation hosts a Node.js application for game display. Game state is tracked in an on-premises Redis instance. The company needs a migration strategy that optimizes application performance. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Create an Auto Scaling group of c5.large Amazon EC2 On-Demand Instances behind an Application Load Balancer. Use an Amazon ElastiCache for Redis cluster to maintain the leaderboard.
C5 instances are compute-optimized and ideal for HPC processing and Node.js applications, providing superior performance for the gaming platform logic. On-Demand instances are required for reliable, consistent performance during leaderboard updates where cost predictability matters. ElastiCache for Redis is the direct replacement for the on-premises Redis instance, maintaining feature parity and performance for the frequently-changing leaderboard. This combination optimizes for both HPC performance and game state management.
Why the other options are wrong
- A. M5 instances are general-purpose, not compute-optimized, and are suboptimal for HPC workloads; Spot Instances have interruption risk unsuitable for game hosting reliability.
- B. OpenSearch Service is a search and analytics engine, not a proper Redis replacement for maintaining game state; it introduces unnecessary complexity and is not designed for real-time leaderboard updates.
- D. M5 instances are not compute-optimized for HPC; DynamoDB is not a drop-in Redis replacement for real-time game state management and introduces additional latency for leaderboard updates.
Question 131
A global media company is planning a multi-Region deployment of an application. Amazon DynamoDB global tables will back the deployment to keep the user experience consistent across the two continents where users are concentrated. Each deployment will have a public Application Load Balancer (ALB). The company manages public DNS internally. The company wants to make the application available through an apex domain. Which solution will meet these requirements with the LEAST effort?
Show answer and explanation
Correct answer: C. Create an AWS Global Accelerator accelerator with multiple endpoint groups that target endpoints in appropriate AWS Regions. Use the accelerator’s static IP address to create a record in public DNS for the apex domain.
AWS Global Accelerator provides static IP addresses and automatic routing based on geolocation to appropriate regional endpoints (ALBs), meeting the requirement to serve an apex domain. It requires only migrating DNS to point to the accelerator's static IPs, making it the least-effort solution. It handles multi-Region failover and performance optimization automatically.
Why the other options are wrong
- A. CNAME records cannot point to an apex domain (only subdomains); geolocation routing with CNAME to ALB doesn't work at the apex.
- B. NLBs don't have static IP addresses by default (though you can assign Elastic IPs, this is more complex than Global Accelerator), and apex domain CNAME issues remain.
- D. API Gateway adds unnecessary complexity and a single Lambda function becomes a bottleneck; this doesn't meet multi-Region requirements efficiently.
Question 132
A company is developing a new serverless API by using Amazon API Gateway and AWS Lambda. The company integrated the Lambda functions with API Gateway to use several shared libraries and custom classes. A solutions architect needs to simplify the deployment of the solution and optimize for code reuse. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Deploy the shared libraries, custom classes, and code for the API's Lambda functions to a Docker image. Upload the image to Amazon Elastic Container Registry (Amazon ECR). Configure the API's Lambda functions to use the Docker image as the deployment package.
Deploying shared libraries and Lambda function code in a single Docker image uploaded to ECR is the modern best practice for Lambda. This approach eliminates the complexity of Lambda layers, simplifies dependency management, and is the native Docker container image format that Lambda natively supports. It provides cleaner code organization and is easier to maintain than managing separate layers.
Why the other options are wrong
- A. Docker images cannot be stored in S3 as Lambda layer sources; Lambda layers require code in a zip or specific structure.
- B. Docker images in ECR cannot be used directly as Lambda layer sources; layers expect code archives, not container images.
- C. ECS Fargate containers are not Lambda layers; this approach conflates container services with Lambda deployment packages.
That was 132 of 529.
The full AWS SAP-C02 pack has all 529 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 264 free as one PDF by email. Get the Half Pack →