255 free AWS SAA-C03 practice questions from the CertStash pack of 1,019, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 255 free here, all 1,019 in the pack, and each step includes the one before it.
Get all 1,019 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A company collects data for temperature, humidity, and atmospheric pressure in cities across multiple continents. The average volume of data that the company collects from each site daily is 500 GB. Each site has a high-speed Internet connection. The company wants to aggregate the data from all these global sites as quickly as possible in a single Amazon S3 bucket. The solution must minimize operational complexity. Which solution meets these requirements?
Show answer and explanation
Correct answer: A. Turn on S3 Transfer Acceleration on the destination S3 bucket. Use multipart uploads to directly upload site data to the destination S3 bucket.
S3 Transfer Acceleration uses CloudFront's globally distributed edge locations to accelerate uploads to S3, making it ideal for geographically dispersed sites with high-speed internet connections uploading large volumes daily. Multipart uploads further optimize the transfer of large files. This solution minimizes operational complexity by requiring no intermediate infrastructure or cross-region replication logic.
Why the other options are wrong
- B. Requires maintaining multiple S3 buckets and cross-region replication adds latency and complexity compared to direct acceleration.
- C. Snowball Edge is designed for one-time bulk transfers, not daily 500 GB uploads, and introduces significant operational overhead.
- D. Using EC2 instances and EBS snapshots is unnecessarily complex and slower than direct S3 acceleration for this use case.
Question 2
A company needs the ability to analyze the log files of its proprietary application. The logs are stored in JSON format in an Amazon S3 bucket. Queries will be simple and will run on-demand. A solutions architect needs to perform the analysis with minimal changes to the existing architecture. What should the solutions architect do to meet these requirements with the LEAST amount of operational overhead?
Show answer and explanation
Correct answer: C. Use Amazon Athena directly with Amazon S3 to run the queries as needed.
Amazon Athena is purpose-built for running ad-hoc SQL queries directly against data stored in S3 without requiring any infrastructure setup or data movement. It natively supports JSON format and requires minimal operational overhead, making it the least complex solution for on-demand log analysis.
Why the other options are wrong
- A. Redshift requires loading data into a cluster and managing that infrastructure, adding unnecessary complexity and cost for simple on-demand queries.
- B. CloudWatch Logs is not designed for analyzing large volumes of existing S3 data and requires moving data out of S3.
- D. AWS Glue and EMR require significant setup, cluster management, and ongoing operational overhead compared to Athena.
Question 3
A company uses AWS Organizations to manage multiple AWS accounts for different departments. The management account has an Amazon S3 bucket that contains project reports. The company wants to limit access to this S3 bucket to only users of accounts within the organization in AWS Organizations. Which solution meets these requirements with the LEAST amount of operational overhead?
Show answer and explanation
Correct answer: A. Add the aws PrincipalOrgID global condition key with a reference to the organization ID to the S3 bucket policy.
The aws:PrincipalOrgID global condition key restricts access to principals from any account within the specified organization, automatically covering all current and future organization members with a single policy statement. This requires no ongoing maintenance when accounts are added or removed from the organization.
Why the other options are wrong
- B. PrincipalOrgPaths requires tracking and managing specific OU structures in the bucket policy, adding operational overhead.
- C. CloudTrail monitoring requires manual policy updates whenever accounts join or leave, creating significant operational burden.
- D. Manual tagging of users does not scale across an organization and requires continuous updates as users change roles or departments.
Question 4
An application runs on an Amazon EC2 instance in a VPC. The application processes logs that are stored in an Amazon S3 bucket. The EC2 instance needs to access the S3 bucket without connectivity to the internet. Which solution will provide private network connectivity to Amazon S3?
Show answer and explanation
Correct answer: A. Create a gateway VPC endpoint to the S3 bucket.
A gateway VPC endpoint for S3 provides private network connectivity from EC2 instances to S3 without requiring internet access. It uses route table entries to route S3 traffic through AWS's private backbone, and works with IAM roles for access control.
Why the other options are wrong
- B. CloudWatch Logs export is an unnecessary intermediary that adds complexity rather than providing direct private access.
- C. An instance profile grants IAM permissions but does not provide private network connectivity, internet access would still be required.
- D. API Gateway with private link is overly complex for direct S3 access and not the standard approach for this requirement.
Question 5
A company is hosting a web application on AWS using a single Amazon EC2 instance that stores user-uploaded documents in an Amazon EBS volume. For better scalability and availability, the company duplicated the architecture and created a second EC2 instance and EBS volume in another Availability Zone, placing both behind an Application Load Balancer. After completing this change, users reported that, each time they refreshed the website, they could see one subset of their documents or the other, but never all of the documents at the same time. What should a solutions architect propose to ensure users see all of their documents at once?
Show answer and explanation
Correct answer: C. Copy the data from both EBS volumes to Amazon EFS. Modify the application to save new documents to Amazon EFS
Amazon EFS provides a shared, managed NFS file system that both EC2 instances can access simultaneously, ensuring all users see the complete set of documents regardless of which instance handles their request. This is the standard solution for applications requiring shared state across multiple instances.
Why the other options are wrong
- A. Copying data between EBS volumes requires manual synchronization and does not solve the ongoing consistency problem for new uploads.
- B. Session persistence does not work well with distributed uploads and does not address the architectural issue of separate storage per instance.
- D. Request distribution across servers and returning documents from correct servers is complex, error-prone, and does not solve the fundamental shared storage problem.
Question 6
A company uses NFS to store large video files in on-premises network attached storage. Each video file ranges in size from 1 MB to 500 GB. The total storage is 70 TB and is no longer growing. The company decides to migrate the video files to Amazon S3. The company must migrate the video files as soon as possible while using the least possible network bandwidth. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create an AWS Snowball Edge job. Receive a Snowball Edge device on premises. Use the Snowball Edge client to transfer data to the device. Return the device so that AWS can import the data into Amazon S3.
AWS Snowball Edge is purpose-built for migrating large datasets (70 TB fits within device capacity) in a single operation, using the least network bandwidth by physically transporting data. This is significantly faster and more bandwidth-efficient than any network-based approach for one-time bulk transfers of this scale.
Why the other options are wrong
- A. AWS CLI copy over the network would consume enormous bandwidth and take far longer than physical transfer.
- C. S3 File Gateway still transfers data over the network, consuming the same bandwidth as a direct approach without the speed benefits of Snowball.
- D. Direct Connect with S3 File Gateway still uses network bandwidth and adds the complexity and cost of Direct Connect setup without the efficiency of physical data transport.
Question 7
A company has an application that ingests incoming messages. Dozens of other applications and microservices then quickly consume these messages. The number of messages varies drastically and sometimes increases suddenly to 100,000 each second. The company wants to decouple the solution and increase scalability. Which solution meets these requirements?
Show answer and explanation
Correct answer: D. Publish the messages to an Amazon Simple Notification Service (Amazon SNS) topic with multiple Amazon Simple Queue Service (Amazon SOS) subscriptions. Configure the consumer applications to process the messages from the queues.
Amazon SQS provides durable message queuing that decouples producers from consumers, and SNS with multiple SQS subscriptions enables multiple independent consumer applications to process the same messages. This architecture naturally scales to handle sudden spikes to 100,000 messages per second and allows each consumer application to scale independently.
Why the other options are wrong
- A. Kinesis Data Analytics is for stream processing and analysis, not for decoupling and fan-out to multiple independent consumer applications.
- B. Auto Scaling EC2 based on CPU does not decouple the ingestion from consumption and doesn't address the fan-out requirement for multiple consumers.
- C. Single Kinesis shard is a bottleneck for 100,000 messages per second, and DynamoDB adds unnecessary storage complexity when a queue is the appropriate pattern.
Question 8
A company is migrating a distributed application to AWS. The application serves variable workloads. The legacy platform consists of a primary server that coordinates jobs across multiple compute nodes. The company wants to modernize the application with a solution that maximizes resiliency and scalability. How should a solutions architect design the architecture to meet these requirements?
Show answer and explanation
Correct answer: B. Configure an Amazon Simple Queue Service (Amazon SQS) queue as a destination for the jobs. Implement the compute nodes with Amazon EC2 instances that are managed in an Auto Scaling group. Configure EC2 Auto Scaling based on the size of the queue.
SQS serves as a distributed job queue replacing the legacy primary server coordination role, and EC2 Auto Scaling based on queue depth (ApproximateNumberOfMessages) naturally scales compute capacity to match workload demand. This maximizes resiliency by removing the single point of failure of a primary server and provides true elasticity for variable workloads.
Why the other options are wrong
- A. Scheduled scaling does not respond to actual demand and cannot handle unexpected workload spikes characteristic of variable workloads.
- C. Keeping the primary server eliminates the resiliency benefit and contradicts modernization; CloudTrail is an audit tool, not a job destination.
- D. EventBridge is not designed as a job queue, and scaling based on compute node load is reactive rather than proactive like queue-based scaling.
Question 9
A company is running an SMB file server in its data center. The file server stores large files that are accessed frequently for the first few days after the files are created. After 7 days the files are rarely accessed. The total data size is increasing and is close to the company's total storage capacity. A solutions architect must increase the company's available storage space without losing low-latency access to the most recently accessed files. The solutions architect must also provide file lifecycle management to avoid future storage issues. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create an Amazon S3 File Gateway to extend the company's storage space. Create an S3 Lifecycle policy to transition the data to S3 Glacier Deep Archive after 7 days.
Amazon S3 File Gateway provides SMB access to S3 storage while maintaining low-latency caching for frequently accessed files on the local gateway appliance. This extends storage capacity without losing performance on recent files. The S3 Lifecycle policy automatically transitions older data to cheaper storage classes (Glacier Deep Archive after 7 days), preventing future capacity issues. This solution directly addresses the requirement for low-latency access to recent files combined with automatic lifecycle management.
Why the other options are wrong
- A. DataSync copies data but doesn't provide ongoing SMB access or automatic lifecycle policies; it's a one-time migration tool.
- C. FSx for Windows extends storage space but doesn't implement automatic lifecycle management or transition old data to cheaper tiers.
- D. Installing utilities on user computers and using S3 directly removes SMB compatibility and the seamless file server experience; also Glacier Flexible Retrieval still has retrieval delays.
Question 10
A company is building an ecommerce web application on AWS. The application sends information about new orders to an Amazon API Gateway REST API to process. The company wants to ensure that orders are processed in the order that they are received. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Use an API Gateway integration to send a message to an Amazon Simple Queue Service (Amazon SQS) FIFO queue when the application receives an order. Configure the SQS FIFO queue to invoke an AWS Lambda function for processing.
SQS FIFO (First-In-First-Out) queues guarantee that messages are processed in the exact order they are received, which is critical for order processing. When API Gateway sends messages to an SQS FIFO queue and invokes a Lambda function for processing, the ordering guarantee is maintained throughout. FIFO queues are specifically designed for scenarios where message order matters.
Why the other options are wrong
- A. SNS topics do not guarantee message ordering; they distribute messages to subscribers without maintaining order.
- C. API Gateway authorizers cannot block requests during processing; they authenticate/authorize requests but don't manage order processing.
- D. SQS standard queues do not guarantee ordering; messages can be processed out of order, violating the requirement.
What people say about the full SAA-C03 pack 5.0 from 17
I’m relieved to say I passed the SAA-C03 exam! Certstash’s study materials gave me the confidence to tackle the exam with ease. Highly recommend them to anyone preparing!
Pass my AWS Solutions Architect Associate yesterday, And most of questions in real exam were exactly same as you have provided in your SAA-C03 Dumps.
your SAA-C03 dumps are best for AWS CSA exam today I pass exam with 870 scores.
Question 11
A company hosts a website analytics application on a single Amazon EC2 On-Demand Instance. The analytics software is written in PHP and uses a MySQL database. The analytics software, the web server that provides PHP, and the database server are all hosted on the EC2 instance. The application is showing signs of performance degradation during busy times and is presenting 5xx errors. The company needs to make the application scale seamlessly. Which solution will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: D. Migrate the database to an Amazon Aurora MySQL DB instance. Create an AMI of the web application. Apply the AMI to a launch template. Create an Auto Scaling group with the launch template Configure the launch template to use a Spot Fleet. Attach an Application Load Balancer to the Auto Scaling group.
Option D provides the most cost-effective seamless scaling. Aurora MySQL offers superior performance and automatic scaling compared to RDS MySQL. An AMI-based launch template with Auto Scaling group enables automatic horizontal scaling. Using Spot Instances in a Spot Fleet maximizes cost efficiency for web applications that can tolerate interruptions. Application Load Balancer distributes traffic across instances. This combination provides automatic, cost-effective scaling.
Why the other options are wrong
- A. On-Demand instances are more expensive than Spot Instances, and two instances may not scale sufficiently during peaks.
- B. Route 53 weighted routing doesn't automatically scale and still uses only two On-Demand instances.
- C. Manually changing instance types via CloudWatch alarms is reactive, inefficient, and doesn't provide true seamless scaling.
Question 12
A company has an application that processes customer orders. The company hosts the application on an Amazon EC2 instance that saves the orders to an Amazon Aurora database. Occasionally when traffic is high the workload does not process orders fast enough. What should a solutions architect do to write the orders reliably to the database as quickly as possible?
Show answer and explanation
Correct answer: B. Write orders to an Amazon Simple Queue Service (Amazon SQS) queue. Use EC2 instances in an Auto Scaling group behind an Application Load Balancer to read from the SQS queue and process orders into the database.
Option B uses SQS as a decoupling mechanism to absorb order spikes, allowing the web tier to write orders quickly without waiting for database processing. The Auto Scaling group of EC2 instances processes orders from the queue at their own pace, scaling up during high demand. This provides reliability, scalability, and fast writes. The ALB distributes traffic across the processing instances.
Why the other options are wrong
- A. SNS is a pub/sub service, not suitable for order queueing; databases cannot be direct SNS subscribers for write operations.
- C. SNS is for notifications, not reliable message queuing; scheduled scaling is too rigid for variable traffic patterns.
- D. Scheduled scaling is inflexible compared to Auto Scaling based on actual queue depth; writing only when CPU threshold is reached adds latency.
Question 13
A company stores its data objects in Amazon S3 Standard storage. A solutions architect has found that 75% of the data is rarely accessed after 30 days. The company needs all the data to remain immediately accessible with the same high availability and resiliency, but the company wants to minimize storage costs. Which storage solution will meet these requirements?
Show answer and explanation
Correct answer: B. Move the data objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.
S3 Standard-IA (Infrequent Access) is designed for data accessed less frequently but still requires immediate availability with high durability and availability across multiple AZs. It provides cost savings compared to Standard while maintaining the same accessibility and resilience. After 30 days, the 75% of rarely accessed data can be transitioned to Standard-IA, reducing costs without sacrificing immediate access. Glacier Deep Archive requires retrieval requests and is not immediately accessible, violating requirements.
Why the other options are wrong
- A. Glacier Deep Archive requires retrieval operations and does not provide immediate accessibility as required.
- C. One Zone-IA stores data in a single AZ, reducing resiliency compared to the multi-AZ Standard storage currently used.
- D. Moving data immediately to One Zone-IA sacrifices the high availability and resiliency requirement, and the data accessed in the first 30 days should remain in Standard.
Question 14
A company is designing a containerized application that will use Amazon Elastic Container Service (Amazon ECS). The application needs to access a shared file system that is highly durable and can recover data to another AWS Region with a recovery point objective (RPO) of 8 hours. The file system needs to provide a mount target m each Availability Zone within a Region. A solutions architect wants to use AWS Backup to manage the replication to another Region. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Amazon Elastic File System (Amazon EFS) with the Standard storage class
Amazon EFS with Standard storage class meets all requirements: it provides mount targets in each Availability Zone within a region for high durability, and AWS Backup natively supports EFS with cross-region backup capabilities that can achieve the 8-hour RPO requirement. EFS is specifically designed for shared, multi-AZ file access for containerized workloads.
Why the other options are wrong
- A. FSx for Windows File Server is primarily for Windows-based applications and doesn't align as naturally with containerized architectures.
- B. FSx for NetApp ONTAP, while capable, adds unnecessary complexity for this use case compared to the simpler EFS solution.
- D. FSx for OpenZFS is primarily single-AZ in most configurations and does not provide the multi-AZ availability inherently required by the use case.
Question 15
A company wants to improve its ability to clone large amounts of production data into a test environment in the same AWS Region. The data is stored in Amazon EC2 instances on Amazon Elastic Block Store (Amazon EBS) volumes. Modifications to the cloned data must not affect the production environment. The software that accesses this data requires consistently high I/O performance. A solutions architect needs to minimize the time that is required to clone the production data into the test environment. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Take EBS snapshots of the production EBS volumes. Turn on the EBS fast snapshot restore feature on the EBS snapshots. Restore the snapshots into new EBS volumes. Attach the new EBS volumes to EC2 instances in the test environment.
EBS Fast Snapshot Restore (FSR) dramatically reduces the time needed to restore volumes from snapshots by pre-initializing the snapshot data on the new volume. This eliminates the I/O penalty that normally occurs when accessing data that hasn't been restored yet. By enabling FSR on the production snapshots and restoring them to new volumes, the solution achieves the fastest cloning time while maintaining consistently high I/O performance for the test environment, and the cloned data is independent of the production environment.
Why the other options are wrong
- A. EC2 instance store volumes are ephemeral and will lose data when the instance stops, making them unsuitable for persistent test data.
- B. Multi-Attach allows multiple instances to attach the same volume, but modifications would affect the production environment, violating the requirement.
- C. Creating and initializing new volumes before restoring snapshots adds unnecessary steps and does not provide the performance optimization of Fast Snapshot Restore.
Question 16
A company experienced a breach that affected several applications in its on-premises data center. The attacker took advantage of vulnerabilities in the custom applications that were running on the servers. The company is now migrating its applications to run on Amazon EC2 instances. The company wants to implement a solution that actively scans for vulnerabilities on the EC2 instances and sends a report that details the findings. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Turn on Amazon Inspector. Deploy the Amazon Inspector agent to the EC2 instances. Configure an AWS Lambda function to automate the generation and distribution of reports that detail the findings.
Amazon Inspector is the correct service for vulnerability scanning of EC2 instances. It actively scans instances for vulnerabilities, software flaws, and network exposure, which directly addresses the application vulnerability issue that caused the breach. Deploying the Inspector agent to EC2 instances enables detailed assessments, and configuring Lambda to automate report generation and distribution meets the reporting requirement. This solution provides continuous vulnerability monitoring specifically designed for EC2 workloads.
Why the other options are wrong
- A. AWS Shield is designed for DDoS protection, not application vulnerability scanning, making it irrelevant for this use case.
- B. Amazon Macie is designed for data discovery and protection, not vulnerability scanning of applications and systems.
- C. GuardDuty provides threat detection for accounts and networks (not application-level vulnerability scanning), and GuardDuty agents are not deployed to EC2 instances in the same manner as Inspector agents.
Question 17
A company hosts a multi-tier web application on Amazon Linux Amazon EC2 instances behind an Application Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones. The company observes that the Auto Scaling group launches more On-Demand Instances when the application's end users access high volumes of static web content. The company wants to optimize cost. What should a solutions architect do to redesign the application MOST cost-effectively?
Show answer and explanation
Correct answer: C. Create an Amazon CloudFront distribution to host the static web contents from an Amazon S3 bucket.
CloudFront distribution with S3 backend is the most cost-effective solution for static content delivery. It offloads static content serving from EC2 instances, reducing Auto Scaling triggers caused by static file requests. CloudFront's global edge locations provide low-latency delivery while S3 storage is cheaper than EC2 compute, directly addressing the cost optimization goal without requiring application redesign.
Why the other options are wrong
- A. Reserved Instances reduce costs for predictable capacity but don't address the root cause of unnecessary scaling triggered by static content.
- B. Spot Instances reduce costs but don't eliminate the inefficiency of using compute resources for static content delivery.
- D. Lambda and API Gateway add complexity and cost for this use case; they're not designed for efficient static content delivery compared to CloudFront.
Question 18
A company provides an API to its users that automates inquiries for tax computations based on item prices. The company experiences a larger number of inquiries during the holiday season only that cause slower response times. A solutions architect needs to design a solution that is scalable and elastic. What should the solutions architect do to accomplish this?
Show answer and explanation
Correct answer: B. Design a REST API using Amazon API Gateway that accepts the item names. API Gateway passes item names to AWS Lambda for tax computations.
API Gateway combined with AWS Lambda provides true elastic scalability that automatically handles variable load during peak seasons without manual intervention. Lambda scales automatically from zero to handle thousands of concurrent requests, and API Gateway can seamlessly scale to accommodate increased API calls. This serverless approach requires no infrastructure management, offers cost efficiency, and perfectly addresses seasonal spikes without over-provisioning. Options A and C require manual scaling and fixed capacity, while option D adds unnecessary architectural complexity with EC2 instances.
Why the other options are wrong
- A. A single EC2 instance provides no scalability and will bottleneck during holiday season traffic spikes.
- C. Two fixed EC2 instances behind an ALB cannot elastically scale and will be insufficient during peak demand.
- D. Connecting API Gateway to EC2 instances defeats the purpose of API Gateway and adds unnecessary complexity without the benefits of Lambda's elastic scaling.
Question 19
A company is planning to move its data to an Amazon S3 bucket. The data must be encrypted when it is stored in the S3 bucket. Additionally, the encryption key must be automatically rotated every year. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Create an AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Set the S3 bucket’s default encryption behavior to use the customer managed KMS key. Move the data to the S3 bucket.
An AWS KMS customer managed key with automatic key rotation enabled is rotated by AWS every year without any manual work. Setting it as the bucket's default encryption key encrypts all stored data and meets the yearly rotation requirement.
Why the other options are wrong
- A. SSE-S3 keys are managed entirely by AWS with no configurable or auditable yearly rotation, so it cannot be shown to meet the requirement.
- C. Manual yearly rotation adds operational overhead when KMS can rotate the key automatically.
- D. KMS keys with imported key material do not support automatic key rotation, and client-side encryption adds overhead.
Question 20
A company is building a three-tier application on AWS. The presentation tier will serve a static website The logic tier is a containerized application. This application will store data in a relational database. The company wants to simplify deployment and to reduce operational costs. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Use Amazon S3 to host static content. Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate for compute power. Use a managed Amazon RDS cluster for the database.
Option A represents the optimal managed, serverless-friendly architecture for cost and operational simplicity. S3 hosts static content efficiently, ECS with Fargate provides container orchestration without managing EC2 instances, and managed RDS eliminates database administration. This combination minimizes operational overhead while keeping costs low through the pay-as-you-go model and elimination of infrastructure management.
Why the other options are wrong
- B. CloudFront is a content delivery network for edge caching, not a hosting solution; EC2 instances require ongoing operational management compared to Fargate.
- C. EKS (Kubernetes) adds significant operational complexity and cost for a simple three-tier application; Fargate without EKS (option A) is simpler.
- D. EC2 Reserved Instances are not cost-effective for static content; Kubernetes adds unnecessary complexity; reserved instances require long-term commitment unlike managed services.
Question 21
A company needs to store data from its healthcare application. The application’s data frequently changes. A new regulation requires audit access at all levels of the stored data. The company hosts the application on an on-premises infrastructure that is running out of storage capacity. A solutions architect must securely migrate the existing data to AWS while satisfying the new regulation. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Use AWS DataSync to move the existing data to Amazon S3. Use AWS CloudTrail to log data events.
AWS DataSync efficiently migrates on-premises data to S3, and AWS CloudTrail data events provide comprehensive audit access at all levels of stored data changes as required by the regulation. This combination meets both the secure migration and audit requirements.
Why the other options are wrong
- B. AWS Snowcone is designed for offline data transfer and smaller datasets; it's not the most suitable for continuous secure migration, and management events don't audit data-level changes.
- C. S3 Transfer Acceleration is for accelerating uploads but doesn't provide the robust migration capabilities of DataSync for on-premises data.
- D. Storage Gateway is for hybrid cloud scenarios, but CloudTrail management events do not provide data-level audit access required by the regulation.
Question 22
A solutions architect is developing a VPC architecture that includes multiple subnets. The architecture will host applications that use Amazon EC2 instances and Amazon RDS DB instances. The architecture consists of six subnets in two Availability Zones. Each Availability Zone includes a public subnet, a private subnet, and a dedicated subnet for databases. Only EC2 instances that run in the private subnets can have access to the RDS databases. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Create a security group that allows inbound traffic from the security group that is assigned to instances in the private subnets. Attach the security group to the DB instances.
Security groups control inbound traffic based on source identity. Creating a security group that allows inbound traffic from the security group assigned to private subnet EC2 instances, then attaching it to RDS instances, implements the requirement that only EC2 instances in private subnets can access RDS. This leverages security group rule chaining, which is the standard AWS mechanism for restricting database access.
Why the other options are wrong
- A. Route tables control network routing, not access control; they cannot prevent specific instances from accessing databases.
- B. Denying inbound traffic from public subnet security groups still allows other sources to access the database; explicit allow rules are more precise.
- D. VPC peering connections establish network paths but do not control access; they are unnecessary since subnets already communicate within the VPC.
Question 23
A company has a data ingestion workflow that includes the following components: An Amazon Simple Notification Service (Amazon SNS) topic that receives notifications about new data deliveries An AWS Lambda function that processes and stores the data The ingestion workflow occasionally fails because of network connectivity issues. When failure occurs, the corresponding data is not ingested unless the company manually reruns the job. What should a solutions architect do to ensure that all notifications are eventually processed?
Show answer and explanation
Correct answer: D. Configure an Amazon Simple Queue Service (Amazon SQS) queue as the on-failure destination. Modify the Lambda function to process messages in the queue.
Configuring an SQS queue as a Dead Letter Queue destination (or on-failure destination) ensures that failed messages are preserved and can be reprocessed. By having the Lambda function read from this queue, all notifications are guaranteed to eventually be processed, even after network failures. This decouples the SNS topic from Lambda and provides built-in retry and message persistence capabilities.
Why the other options are wrong
- A. Multiple Availability Zones for Lambda deployment does not address notification loss from network failures.
- B. Increasing CPU and memory for Lambda does not solve network connectivity issues causing ingestion failures.
- C. SNS topic retry strategies alone do not prevent data loss if the Lambda function cannot process the message; SNS would continue to fail.
Question 24
A company wants to build a scalable key management infrastructure to support developers who need to encrypt data in their applications. What should a solutions architect do to reduce the operational burden?
Show answer and explanation
Correct answer: B. Use AWS Key Management Service (AWS KMS) to protect the encryption keys.
AWS KMS is the purpose-built service for managing encryption keys at scale. It reduces operational burden by handling key storage, rotation, access control, and compliance requirements automatically, eliminating the need for developers to build and maintain their own key management infrastructure. KMS integrates seamlessly with other AWS services and provides audit logging through CloudTrail.
Why the other options are wrong
- A. MFA protects user access but does not reduce the operational burden of managing encryption keys themselves.
- C. ACM is designed for SSL/TLS certificates for web services, not for general-purpose encryption key management.
- D. IAM policies control access but do not reduce the operational burden of key creation, storage, rotation, and lifecycle management.
Question 25
A company runs multiple Windows workloads on AWS. The company's employees use Windows file shares that are hosted on two Amazon EC2 instances. The file shares synchronize data between themselves and maintain duplicate copies. The company wants a highly available and durable storage solution that preserves how users currently access the files. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: C. Extend the file share environment to Amazon FSx for Windows File Server with a Multi-AZ configuration. Migrate all the data to FSx for Windows File Server.
Amazon FSx for Windows File Server is purpose-built for Windows file sharing workloads and preserves how users currently access files through standard SMB protocol. A Multi-AZ configuration provides high availability and durability while maintaining data synchronization. FSx replaces the need for manually-managed EC2 instances running file shares while providing superior reliability, performance, and operational simplicity compared to self-managed solutions.
Why the other options are wrong
- A. S3 does not provide file share semantics; users would need to change how they access files from standard SMB to S3 APIs or use third-party tools.
- B. S3 File Gateway adds latency and complexity; it does not preserve native Windows file share access patterns and still requires manual EC2 management.
- D. Amazon EFS is for Linux workloads and does not provide Windows file sharing capabilities; it uses NFS protocol, not SMB.
Question 26
A company runs a web application that is backed by Amazon RDS. A new database administrator caused data loss by accidentally editing information in a database table. To help recover from this type of incident, the company wants the ability to restore the database to its state from 5 minutes before any change within the last 30 days. Which feature should the solutions architect include in the design to meet this requirement?
Show answer and explanation
Correct answer: C. Automated backups
Automated backups provide the ability to restore a database to any point in time within the retention period (up to 35 days by default). This meets the requirement of restoring to a state from 5 minutes before any change within the last 30 days. Automated backups use transaction logs to enable point-in-time recovery, allowing granular recovery windows.
Why the other options are wrong
- A. Read replicas provide high availability and read scaling but do not provide point-in-time recovery capability; they replicate current data, not historical snapshots.
- B. Manual snapshots require explicit creation and cannot automatically capture the database state at arbitrary 5-minute intervals; they only capture states when manually triggered.
- D. Multi-AZ deployments provide high availability and failover capability but do not provide point-in-time recovery to past states.
Question 27
A company needs to provide its employees with secure access to confidential and sensitive files. The company wants to ensure that the files can be accessed only by authorized users. The files must be downloaded securely to the employees’ devices. The files are stored in an on-premises Windows file server. However, due to an increase in remote usage, the file server is running out of capacity. . Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Migrate the files to an Amazon FSx for Windows File Server file system. Integrate the Amazon FSx file system with the on-premises Active Directory. Configure AWS Client VPN.
Amazon FSx for Windows File Server is purpose-built for Windows file sharing and integrates seamlessly with on-premises Active Directory, eliminating the need for credential management changes. AWS Client VPN provides secure remote access. This solution maintains the Windows file server experience employees expect while solving capacity issues, requires no application changes, and provides built-in security through AD integration.
Why the other options are wrong
- A. Placing a file server in a public subnet with security group restrictions is insecure and doesn't solve the capacity problem.
- C. S3 with signed URLs works but requires application changes and doesn't provide true file server semantics that employees may depend on.
- D. Public VPC endpoints expose the service publicly, which violates the requirement for secure access limited to authorized users.
Question 28
A company that hosts its web application on AWS wants to ensure all Amazon EC2 instances. Amazon RDS DB instances. and Amazon Redshift clusters are configured with tags. The company wants to minimize the effort of configuring and operating this check. What should a solutions architect do to accomplish this?
Show answer and explanation
Correct answer: A. Use AWS Config rules to define and detect resources that are not properly tagged.
AWS Config with appropriate rules is the minimal-effort solution for ensuring resources are properly tagged. AWS Config provides managed rules specifically for checking tag compliance on EC2 instances, RDS DB instances, and other resources. It automatically evaluates all resources, identifies non-compliant ones, and can trigger remediation actions, requiring minimal configuration and operational effort.
Why the other options are wrong
- B. Cost Explorer displays tagged and untagged resources but requires manual tagging, which doesn't scale and increases operational effort.
- C. Writing custom API code requires development effort, testing, and ongoing maintenance, which is less efficient than using AWS Config.
- D. While Lambda automation is possible, it requires writing and maintaining custom code, whereas AWS Config provides this functionality out of the box.
Question 29
A company is preparing to launch a public-facing web application in the AWS Cloud. The architecture consists of Amazon EC2 instances within a VPC behind an Elastic Load Balancer (ELB). A third-party service is used for the DNS. The company's solutions architect must recommend a solution to detect and protect against large-scale DDoS attacks. Which solution meets these requirements?
Show answer and explanation
Correct answer: D. Enable AWS Shield Advanced and assign the ELB to it.
AWS Shield Advanced provides comprehensive DDoS protection for large-scale attacks and integrates directly with ELB, which is the entry point for the public-facing application. This ensures protection at the network edge where DDoS attacks are most effectively mitigated.
Why the other options are wrong
- A. GuardDuty detects intrusions and malicious activity but does not protect against DDoS attacks.
- B. Inspector performs vulnerability assessments on EC2 instances but does not provide DDoS protection.
- C. While AWS Shield provides DDoS protection, assigning it to Route 53 (a third-party DNS service is used) is not the correct implementation; protection should be at the ELB layer.
Question 30
A company has hired a solutions architect to design a reliable architecture for its application. The application consists of one Amazon RDS DB instance and two manually provisioned Amazon EC2 instances that run web servers. The EC2 instances are located in a single Availability Zone. An employee recently deleted the DB instance, and the application was unavailable for 24 hours as a result. The company is concerned with the overall reliability of its environment. What should the solutions architect do to maximize reliability of the application's infrastructure?
Show answer and explanation
Correct answer: B. Update the DB instance to be Multi-AZ, and enable deletion protection. Place the EC2 instances behind an Application Load Balancer, and run them in an EC2 Auto Scaling group across multiple Availability Zones.
Updating the RDS instance to Multi-AZ with deletion protection prevents database unavailability from accidental deletion, directly addressing the incident. Placing EC2 instances behind an ALB in an Auto Scaling group across multiple AZs provides redundancy, automatic instance replacement, and load distribution. This comprehensive approach maximizes reliability across compute and database layers while maintaining the company's existing setup.
Why the other options are wrong
- A. Deleting one EC2 instance reduces capacity unnecessarily; termination protection on one instance doesn't address redundancy needs.
- C. Adding Lambda and API Gateway introduces unnecessary complexity without improving the reliability of the core infrastructure.
- D. Using Spot Instances reduces reliability due to interruption risk; while other elements are good, Spot Instances contradict the reliability objective.
Question 31
A company hosts its application on AWS. The company uses Amazon Cognito to manage users. When users log in to the application, the application fetches required data from Amazon DynamoDB by using a REST API that is hosted in Amazon API Gateway. The company wants an AWS managed solution that will control access to the REST API to reduce development efforts. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: D. Configure an Amazon Cognito user pool authorizer in API Gateway to allow Amazon Cognito to validate each request.
Option D uses the Amazon Cognito user pool authorizer built into API Gateway, which provides an AWS managed solution with minimal development effort. Since the company already uses Cognito for user management, this leverages existing infrastructure and requires only configuration, not code development. Option A requires writing Lambda authorizer code. Option B requires creating and managing individual API keys. Option C requires custom Lambda validation logic and insecure header-based authentication.
Why the other options are wrong
- A. Requires developing a custom Lambda authorizer function, adding development effort beyond managed solutions.
- B. Manual API key creation and management is operationally overhead-intensive; not a managed solution.
- C. Email headers are easily spoofed and insecure; requires custom validation logic, not a managed solution.
Question 32
A company is implementing a new business application. The application runs on two Amazon EC2 instances and uses an Amazon S3 bucket for document storage. A solutions architect needs to ensure that the EC2 instances can access the S3 bucket. What should the solutions architect do to meet this requirement?
Show answer and explanation
Correct answer: A. Create an IAM role that grants access to the S3 bucket. Attach the role to the EC2 instances.
IAM roles are the proper mechanism for granting AWS permissions to EC2 instances. A role is created with a policy that grants S3 access, then attached to the EC2 instances. When applications on the instances need to access S3, they use the temporary credentials provided by the instance metadata service, eliminating the need to store long-term credentials on the instances.
Why the other options are wrong
- B. Policies cannot be directly attached to EC2 instances; they must be attached to roles, users, or groups.
- C. IAM groups are for organizing users, not for granting permissions to EC2 instances.
- D. IAM users represent individual people or applications with permanent credentials, not the proper way to grant permissions to EC2 instances.
Question 33
A company owns an asynchronous API that is used to ingest user requests and, based on the request type, dispatch requests to the appropriate microservice for processing. The company is using Amazon API Gateway to deploy the API front end, and an AWS Lambda function that invokes Amazon DynamoDB to store user requests before dispatching them to the processing microservices. The company provisioned as much DynamoDB throughput as its budget allows, but the company is still experiencing availability issues and is losing user requests. What should a solutions architect do to address this issue without impacting existing users?
Show answer and explanation
Correct answer: D. Use the Amazon Simple Queue Service (Amazon SQS) queue and Lambda to buffer writes to DynamoDB.
The issue is that DynamoDB write throughput is exhausted and requests are being lost. Using SQS to buffer incoming requests decouples the API from the database, allowing Lambda to write to DynamoDB at a controlled rate that respects provisioned throughput. This prevents request loss by queuing them temporarily and ensures no data is dropped due to throttling.
Why the other options are wrong
- A. API Gateway throttling would reject requests, making the situation worse by dropping them instead of buffering them.
- B. DAX caches reads; it does not address the write throughput bottleneck in DynamoDB for storing user requests.
- C. Secondary indexes improve query performance but do not address the core issue of insufficient write throughput capacity.
Question 34
An online learning company is migrating to the AWS Cloud. The company maintains its student records in a PostgreSQL database. The company needs a solution in which its data is available and online across multiple AWS Regions at all times. Which solution will meet these requirements with the LEAST amount of operational overhead?
Show answer and explanation
Correct answer: C. Migrate the PostgreSQL database to an Amazon RDS for PostgreSQL DB instance. Create a read replica in another Region.
RDS for PostgreSQL with a read replica in another Region provides continuous availability across multiple Regions with automated replication and minimal operational overhead. This approach leverages AWS-managed services to handle failover and synchronization automatically, meeting the multi-Region availability requirement.
Why the other options are wrong
- A. Self-managed PostgreSQL clusters on EC2 require significant operational overhead for patching, backups, failover, and high availability.
- B. Multi-AZ only provides availability within a single Region; it does not meet the multi-Region requirement.
- D. DB snapshots are point-in-time backups and do not provide continuous availability; recovery from snapshots introduces manual steps and data loss risks.
Question 35
A company runs a web application that is deployed on Amazon EC2 instances in the private subnet of a VPC. An Application Load Balancer (ALB) that extends across the public subnets directs web traffic to the EC2 instances. The company wants to implement new security measures to restrict inbound traffic from the ALB to the EC2 instances while preventing access from any other source inside or outside the private subnet of the EC2 instances. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Configure the security group for the EC2 instances to only allow traffic that comes from the security group for the ALB.
Security groups can reference other security groups by ID, allowing traffic only from the ALB's security group to the EC2 instances' security group. This implements the principle of least privilege, restricting inbound access to only the ALB while preventing access from any other source inside or outside the subnet, including other EC2 instances in the same private subnet.
Why the other options are wrong
- A. Route table rules control routing, not access control; they do not restrict traffic from unauthorized sources.
- C. Moving EC2 instances to public subnets defeats the security architecture and exposes them directly to the internet, violating security best practices.
- D. Configuring the ALB security group to allow any TCP traffic does nothing to restrict traffic to the EC2 instances and exposes the ALB unnecessarily.
Question 36
A solutions architect needs to design a new microservice for a company’s application. Clients must be able to call an HTTPS endpoint to reach the microservice. The microservice also must use AWS Identity and Access Management (IAM) to authenticate calls. The solutions architect will write the logic for this microservice by using a single AWS Lambda function that is written in Go 1.x. Which solution will deploy the function in the MOST operationally efficient way?
Show answer and explanation
Correct answer: B. Create a Lambda function URL for the function. Specify AWS_IAM as the authentication type.
Lambda function URLs provide a direct HTTPS endpoint for Lambda functions with built-in support for AWS_IAM authentication, requiring minimal setup and no additional infrastructure. This is simpler and more operationally efficient than creating API Gateway resources, and it is the native AWS solution for Lambda endpoint exposure.
Why the other options are wrong
- A. API Gateway adds unnecessary operational complexity when Lambda function URLs provide the same functionality more directly.
- C. Lambda@Edge requires CloudFront distribution setup and does not simplify authentication logic; it adds latency through edge locations.
- D. CloudFront Functions are lightweight but are not designed for complex authentication; AWS_IAM authentication is not natively supported at the CloudFront Functions level.
Question 37
A business application is hosted on Amazon EC2 and uses Amazon S3 for encrypted object storage. The chief information security officer has directed that no application traffic between the two services should traverse the public internet. Which capability should the solutions architect use to meet the compliance requirements?
Show answer and explanation
Correct answer: B. VPC endpoint
VPC endpoints enable private connectivity between EC2 instances and S3 without traversing the public internet. A VPC endpoint for S3 allows the application to communicate with S3 through AWS's private network, meeting the compliance requirement that no traffic traverse the public internet while maintaining encryption.
Why the other options are wrong
- A. AWS KMS handles encryption key management but does not provide a mechanism to keep traffic off the public internet.
- C. Private subnets alone do not prevent traffic from reaching the public internet; EC2 instances in private subnets still need a way to access S3 privately.
- D. A virtual private gateway is used for Site-to-Site VPN connections to on-premises networks, not for private access between EC2 and S3.
Question 38
A company wants to move its application to a serverless solution. The serverless solution needs to analyze existing and new data by using SL. The company stores the data in an Amazon S3 bucket. The data requires encryption and must be replicated to a different AWS Region. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: C. Load the data into the existing S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Use Amazon Athena to query the data.
Amazon Athena queries data in S3 with SQL and is serverless. Keeping the existing bucket, using SSE-S3 which needs no key management, and enabling Cross-Region Replication meets the encryption and replication needs with the least operational overhead.
Why the other options are wrong
- A. Creating a new bucket and managing KMS multi-Region keys adds work that the requirements do not call for.
- B. Amazon RDS is not serverless and cannot query data in S3, and the new bucket and KMS keys add overhead.
- D. Amazon RDS is not a serverless query service for data stored in S3.
Question 39
A company wants to migrate its existing on-premises monolithic application to AWS. The company wants to keep as much of the front-end code and the backend code as possible. However, the company wants to break the application into smaller applications. A different team will manage each application. The company needs a highly scalable solution that minimizes operational overhead. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Host the application on Amazon Elastic Container Service (Amazon ECS). Set up an Application Load Balancer with Amazon ECS as the target.
Option D best meets the requirements by using ECS for containerized applications with minimal operational overhead. ECS allows different teams to manage separate containerized applications independently while sharing the same orchestration platform. An Application Load Balancer enables communication between microservices and external clients. This approach minimizes operational overhead compared to Lambda (limited runtime flexibility) and maintains deployment simplicity compared to EC2-only solutions.
Why the other options are wrong
- A. Lambda has limitations on runtime languages and execution time unsuitable for monolithic code migration.
- B. AWS Amplify is primarily a frontend/full-stack framework and not ideal for backend microservices architecture.
- C. Direct EC2 management increases operational overhead and doesn't provide the containerization benefits needed for team-based application management.
Question 40
A company has an application that runs on Amazon EC2 instances and uses an Amazon Aurora database. The EC2 instances connect to the database by using user names and passwords that are stored locally in a file. The company wants to minimize the operational overhead of credential management. What should a solutions architect do to accomplish this goal?
Show answer and explanation
Correct answer: A. Use AWS Secrets Manager. Turn on automatic rotation.
AWS Secrets Manager is purpose-built for managing database credentials with automatic rotation capabilities. It natively integrates with RDS databases, automatically rotating credentials without application downtime. This minimizes operational overhead by eliminating manual credential management and reducing the security risk of stored passwords. Secrets Manager's rotation feature is specifically designed for this use case.
Why the other options are wrong
- B. Systems Manager Parameter Store lacks native automatic rotation for RDS database credentials; rotation requires custom Lambda functions.
- C. Storing credentials in S3 requires manual rotation and adds unnecessary operational steps; it's less secure than purpose-built secrets management.
- D. Storing credentials on EBS volumes requires manual rotation, increases operational overhead, and is less secure than centralized secrets management.
Question 41
A company that primarily runs its application servers on premises has decided to migrate to AWS. The company wants to minimize its need to scale its Internet Small Computer Systems Interface (iSCSI) storage on premises. The company wants only its recently accessed data to remain stored locally. Which AWS solution should the company use to meet these requirements?
Show answer and explanation
Correct answer: D. AWS Storage Gateway Volume Gateway cached volumes
AWS Storage Gateway Volume Gateway cached volumes is the correct solution for maintaining on-premises iSCSI storage while keeping only recently accessed data stored locally. Cached volumes store the full dataset in AWS while caching frequently accessed blocks locally, minimizing on-premises storage needs while providing fast access to hot data.
Why the other options are wrong
- A. Amazon S3 File Gateway is for file-based access to S3, not for iSCSI storage or block-level caching of recently accessed data.
- B. Tape Gateway is designed for archival and backup scenarios, not for minimizing on-premises iSCSI storage or caching recently accessed data.
- C. Volume Gateway stored volumes keep all data on-premises and only backup to AWS, which does not minimize on-premises storage needs.
Question 42
A company needs a backup strategy for its three-tier stateless web application. The web application runs on Amazon EC2 instances in an Auto Scaling group with a dynamic scaling policy that is configured to respond to scaling events. The database tier runs on Amazon RDS for PostgreSQL. The web application does not require temporary local storage on the EC2 instances. The company’s recovery point objective (RPO) is 2 hours. The backup strategy must maximize scalability and optimize resource utilization for this environment. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Retain the latest Amazon Machine Images (AMIs) of the web and application tiers. Enable automated backups in Amazon RDS and use point-in-time recovery to meet the RPO.
For a stateless web application with dynamic Auto Scaling, maintaining current AMIs is the most scalable and resource-efficient approach since EC2 instances can be quickly recreated from images without requiring individual EBS snapshots. Combined with automated RDS backups and point-in-time recovery, this solution meets the 2-hour RPO while optimizing resource utilization. Since the application is stateless and does not use local storage, AMIs capture all necessary configuration, eliminating the need to maintain individual EBS snapshots of ephemeral instances.
Why the other options are wrong
- A. Taking EBS snapshots every 2 hours is inefficient for stateless instances that can be recreated from AMIs; this wastes storage resources.
- B. EBS snapshot lifecycle policies for stateless instances add unnecessary complexity and cost when AMIs provide a better solution; snapshots are not optimal for ephemeral compute resources.
- D. Taking individual EBS snapshots of every instance is operationally inefficient and wasteful for stateless workloads that scale dynamically; AMIs are the appropriate mechanism for stateless tiers.
Question 43
A solutions architect is implementing a document review application using an Amazon S3 bucket for storage. The solution must prevent accidental deletion of the documents and ensure that all versions of the documents are available. Users must be able to download, modify, and upload documents. Which combination of actions should be taken to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, D. Enable versioning on the bucket; Enable MFA Delete on the bucket.
Versioning preserves all versions of documents so deleted or modified documents can be recovered. MFA Delete requires multi-factor authentication to permanently delete object versions, adding an extra layer of protection against accidental deletion. Together, these features prevent accidental data loss while still allowing users to download, modify, and upload documents.
Why the other options are wrong
- A. A read-only ACL would prevent users from uploading and modifying documents, violating the requirements.
- C. An IAM policy controls access permissions but does not prevent accidental deletion or preserve versions.
- E. KMS encryption protects data at rest but does not prevent accidental deletion or provide version recovery.
Question 44
A company runs an ecommerce application on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. The Auto Scaling group scales based on CPU utilization metrics. The ecommerce application stores the transaction data in a MySQL 8.0 database that is hosted on a large EC2 instance. The database's performance degrades quickly as application load increases. The application handles more read requests than write transactions. The company wants a solution that will automatically scale the database to meet the demand of unpredictable read workloads while maintaining high availability. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use Amazon Aurora with a Multi-AZ deployment. Configure Aurora Auto Scaling with Aurora Replicas.
Amazon Aurora with Multi-AZ deployment and Aurora Auto Scaling is specifically designed for unpredictable read-heavy workloads. Aurora Auto Scaling automatically adds read replicas based on demand, scaling horizontally to handle variable load. Multi-AZ ensures high availability. Aurora also provides superior performance compared to traditional MySQL, automatically optimizing for read-intensive workloads.
Why the other options are wrong
- A. Redshift is for data warehousing and analytics, not transactional OLTP workloads; it doesn't automatically scale for unpredictable reads.
- B. Standard RDS with read replicas requires manual scaling configuration and doesn't auto-scale based on demand like Aurora does.
- D. ElastiCache is a caching layer, not a database replacement; it doesn't handle transaction data persistence requirements.
Question 45
The customers of a finance company request appointments with financial advisors by sending text messages. A web application that runs on Amazon EC2 instances accepts the appointment requests. The text messages are published to an Amazon Simple Queue Service (Amazon SQS) queue through the web application. Another application that runs on EC2 instances then sends meeting invitations and meeting confirmation email messages to the customers. After successful scheduling, this application stores the meeting information in an Amazon DynamoDB database. As the company expands, customers report that their meeting invitations are taking longer to arrive. What should a solutions architect recommend to resolve this issue?
Show answer and explanation
Correct answer: D. Add an Auto Scaling group for the application that sends meeting invitations. Configure the Auto Scaling group to scale based on the depth of the SQS queue.
The bottleneck is in the application that sends meeting invitations and emails, not in the database or initial request handling. As the company expands, this application cannot keep up with processing messages from the SQS queue. An Auto Scaling group configured to scale based on SQS queue depth will automatically add more instances to process messages faster when the queue grows, directly addressing the performance issue of delayed email delivery.
Why the other options are wrong
- A. DAX improves DynamoDB read performance, but the issue is not with database reads; the problem is slow message processing from the queue.
- B. API Gateway in front of the web application does not address the bottleneck in the email-sending application that processes messages from the queue.
- C. CloudFront caches static content and is not relevant to improving the processing speed of appointment request messages.
Question 46
A solutions architect needs to optimize storage costs. The solutions architect must identify any Amazon S3 buckets that are no longer being accessed or are rarely accessed. Which solution will accomplish this goal with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Analyze bucket access patterns by using the S3 Storage Lens dashboard for advanced activity metrics.
S3 Storage Lens provides advanced activity metrics in a dashboard that automatically tracks access patterns across S3 buckets with minimal operational overhead. It offers built-in insights into bucket usage and activity trends without requiring additional configuration of CloudTrail, CloudWatch metrics, or Athena queries. This managed service approach requires the least operational effort compared to manually setting up and analyzing logs from multiple sources.
Why the other options are wrong
- B. The standard S3 dashboard in AWS Management Console does not provide detailed access pattern analysis needed to identify rarely accessed buckets.
- C. Requires manual setup of CloudWatch metrics and Athena queries, creating significant operational overhead to correlate and analyze the data.
- D. Requires CloudTrail configuration, CloudWatch Logs integration, and manual log analysis, representing much higher operational overhead than Storage Lens.
Question 47
A company uses AWS Organizations to create dedicated AWS accounts for each business unit to manage each business unit's account independently upon request. The root email recipient missed a notification that was sent to the root user email address of one account. The company wants to ensure that all future notifications are not missed. Future notifications must be limited to account administrators. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Configure all AWS account root user email addresses as distribution lists that go to a few administrators who can respond to alerts. Configure AWS account alternate contacts in the AWS Organizations console or programmatically.
Option B addresses the core issue by using distribution lists for root user email addresses (ensuring multiple administrators receive notifications) and configuring alternate contacts in AWS Organizations. AWS Organizations allows setting up billing, security, and operations contacts at the account level, ensuring notifications reach designated administrators rather than relying on a single email. This prevents missed notifications while limiting access to actual account administrators, meeting both requirements with AWS-native organizational features.
Why the other options are wrong
- A. Email server forwarding is an external workaround that lacks the formal AWS account contact management structure.
- C. Routing all alerts through a single administrator creates a bottleneck and single point of failure for critical notifications.
- D. Using the same root email address across multiple accounts defeats the purpose of separate business unit accounts and doesn't leverage AWS Organizations' alternate contact feature properly.
Question 48
A company must migrate 20 TB of data from a data center to the AWS Cloud within 30 days. The company’s network bandwidth is limited to 15 Mbps and cannot exceed 70% utilization. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: A. Use AWS Snowball.
With 20 TB to transfer in 30 days and limited bandwidth of 15 Mbps at 70% utilization (10.5 Mbps effective), transferring over the network would take approximately 457 days, far exceeding the 30-day requirement. AWS Snowball is a physical data transfer device designed exactly for this scenario, large data migrations with limited bandwidth constraints. It allows data to be copied to the device on-premises and shipped to AWS for import.
Why the other options are wrong
- B. AWS DataSync optimizes network data transfers but still relies on network bandwidth; 20 TB over 10.5 Mbps would still exceed 30 days.
- C. A VPN connection would use the same limited 15 Mbps bandwidth, making it infeasible to transfer 20 TB in 30 days.
- D. S3 Transfer Acceleration still relies on internet bandwidth, which is the limiting factor here and insufficient for the 30-day timeframe.
Question 49
A company is developing a real-time multiplayer game that uses UDP for communications between the client and servers in an Auto Scaling group. Spikes in demand are anticipated during the day, so the game server platform must adapt accordingly. Developers want to store gamer scores and other non-relational data in a database solution that will scale without intervention. Which solution should a solutions architect recommend?
Show answer and explanation
Correct answer: B. Use a Network Load Balancer for traffic distribution and Amazon DynamoDB on-demand for data storage.
Network Load Balancer (NLB) is required because it supports UDP protocol for real-time gaming communications, whereas Application Load Balancer only supports HTTP/HTTPS. DynamoDB on-demand automatically scales without capacity planning during demand spikes, making it ideal for storing non-relational gamer scores. This combination requires no manual intervention during traffic spikes.
Why the other options are wrong
- A. Route 53 is a DNS service, not a load balancer; Aurora Serverless requires manual scaling configuration and is optimized for relational data, not ideal for this use case.
- C. NLB is correct but Aurora Global Database is relational and requires provisioning; it's overcomplicated for non-relational gaming data.
- D. Application Load Balancer does not support UDP protocol required for real-time multiplayer game communications.
Question 50
An application running on an Amazon EC2 instance in VPC-A needs to access files in another EC2 instance in VPC-B. Both VPCs are in separate AWS accounts. The network administrator needs to design a solution to configure secure access to EC2 instance in VPC-B from VPC-A. The connectivity should not have a single point of failure or bandwidth concerns. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Set up a VPC peering connection between VPC-A and VPC-B.
VPC peering connections are specifically designed to connect two VPCs, including those in separate AWS accounts, providing secure direct network connectivity without single points of failure or bandwidth constraints. The peering relationship allows direct routing between instances in the two VPCs.
Why the other options are wrong
- B. Gateway endpoints are for AWS services like S3 and DynamoDB, not for EC2 instance-to-instance communication.
- C. A virtual private gateway is used for VPN and Direct Connect connections to on-premises networks, not for VPC-to-VPC connectivity.
- D. Private VIFs are for AWS Direct Connect and on-premises connectivity, not for connecting EC2 instances across VPCs.
Question 51
A company hosts more than 300 global websites and applications. The company requires a platform to analyze more than 30 TB of clickstream data each day. What should a solutions architect do to transmit and process the clickstream data?
Show answer and explanation
Correct answer: D. Collect the data from Amazon Kinesis Data Streams. Use Amazon Kinesis Data Firehose to transmit the data to an Amazon S3 data lake. Load the data in Amazon Redshift for analysis.
Amazon Kinesis Data Streams can ingest high-volume clickstream data in real-time (30+ TB daily), Kinesis Data Firehose reliably transmits and batches the data to Amazon S3 with minimal configuration, and Amazon Redshift provides high-performance analytics on the data lake. This architecture is purpose-built for streaming analytics at scale with minimal operational overhead. Option A lacks real-time streaming capability, option B doesn't efficiently handle 30 TB daily, and option C is inappropriate for continuous high-volume data processing.
Why the other options are wrong
- A. AWS Data Pipeline and EMR are not optimized for continuous real-time streaming of massive clickstream data volumes.
- B. Auto Scaling EC2 instances for 30 TB daily processing is operationally complex and less cost-effective than managed services.
- C. CloudFront caching and Lambda triggering is not designed for continuous high-volume data processing; Lambda has execution time limits.
Question 52
A company has deployed a database in Amazon RDS for MySQL. Due to increased transactions, the database support team is reporting slow reads against the DB instance and recommends adding a read replica. Which combination of actions should a solutions architect take before implementing this change? (Choose two.)
Show answer and explanation
Correct answer: C, E. Allow long-running transactions to complete on the source DB instance; Enable automatic backups on the source instance by setting the backup retention period to a value other than 0.
Before creating an RDS read replica, automatic backups must be enabled on the source instance (backup retention > 0) because read replicas use the binary log to replicate changes. Additionally, long-running transactions should be allowed to complete to ensure consistency and avoid blocking replication. Binlog replication is already enabled by default for RDS, failover priority applies to Multi-AZ not replicas, and global tables are DynamoDB-specific, not MySQL RDS.
Why the other options are wrong
- A. Binlog replication is automatically enabled on RDS MySQL instances by default.
- B. Failover priority is a Multi-AZ feature, not applicable to read replica creation.
- D. Global tables are a DynamoDB feature, not relevant to RDS MySQL read replicas.
Question 53
A company hosts a data lake on AWS. The data lake consists of data in Amazon S3 and Amazon RDS for PostgreSQL. The company needs a reporting solution that provides data visualization and includes all the data sources within the data lake. Only the company's management team should have full access to all the visualizations. The rest of the company should have only limited access. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create an analysis in Amazon QuickSight. Connect all the data sources and create new datasets. Publish dashboards to visualize the data. Share the dashboards with the appropriate users and groups.
Amazon QuickSight is the appropriate service for creating data visualizations from multiple data sources (S3 and RDS). It natively supports dataset creation, analysis, and dashboard publishing. Sharing dashboards with specific users and groups (not just IAM roles) allows granular access control where management can have full access while others have limited access. QuickSight's user and group-based sharing is the standard approach for this requirement.
Why the other options are wrong
- A. QuickSight sharing with IAM roles is less flexible for mixed internal/external user scenarios and doesn't provide the same granular dashboard-level access control as user/group sharing.
- C. Glue and Athena are for ETL and querying; they don't provide interactive visualization dashboards or easy access control granularity.
- D. Glue and Athena-based reporting requires publishing static reports to S3 rather than interactive dashboards, limiting the visualization and real-time capabilities.
Question 54
A company has multiple VPCs across AWS Regions to support and run workloads that are isolated from workloads in other Regions. Because of a recent application launch requirement, the company’s VPCs must communicate with all other VPCs across all Regions. Which solution will meet these requirements with the LEAST amount of administrative effort?
Show answer and explanation
Correct answer: C. Use AWS Transit Gateway to manage VPC communication in a single Region and Transit Gateway peering across Regions to manage VPC communications.
AWS Transit Gateway provides a centralized hub for connecting multiple VPCs within and across regions with Transit Gateway peering, requiring significantly less administrative effort than managing point-to-point peering connections. This scales well as VPCs increase and provides a single management plane, whereas VPC peering requires individual connection management between each pair of VPCs.
Why the other options are wrong
- A. VPC peering would require creating and managing individual peering connections between every VPC pair, which becomes exponentially complex and difficult to maintain with multiple VPCs across regions.
- B. AWS Direct Connect gateways are designed for hybrid cloud connectivity with on-premises networks, not primarily for VPC-to-VPC communication.
- D. PrivateLink is designed for exposing specific services privately, not for general VPC-to-VPC communication at scale.
Question 55
A company runs a photo processing application that needs to frequently upload and download pictures from Amazon S3 buckets that are located in the same AWS Region. A solutions architect has noticed an increased cost in data transfer fees and needs to implement a solution to reduce these costs. How can the solutions architect meet this requirement?
Show answer and explanation
Correct answer: D. Deploy an S3 VPC gateway endpoint into the VPC and attach an endpoint policy that allows access to the S3 buckets.
An S3 VPC gateway endpoint allows the application to access S3 buckets over AWS's private network instead of routing through the internet gateway, eliminating data transfer charges for same-region S3 access. This is the most cost-effective solution as there are no data transfer fees when using gateway endpoints for S3 within the same region.
Why the other options are wrong
- A. API Gateway is designed for REST API management, not S3 optimization, and does not reduce S3 data transfer costs.
- B. NAT gateways route traffic through the internet and still incur data transfer charges; they do not provide the cost benefits of VPC endpoints.
- C. Routing through an internet gateway incurs standard data transfer charges and is the current likely cause of the increased costs.
Question 56
A company uses a payment processing system that requires messages for a particular payment ID to be received in the same order that they were sent. Otherwise, the payments might be processed incorrectly. Which actions should a solutions architect take to meet this requirement? (Choose two.)
Show answer and explanation
Correct answer: B, E. Write the messages to an Amazon Kinesis data stream with the payment ID as the partition key; Write the messages to an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Set the message group to use the payment ID.
Kinesis Data Streams with the payment ID as the partition key ensures messages for the same payment ID are routed to the same shard, preserving order. SQS FIFO queues with message group ID set to payment ID guarantee FIFO ordering per payment ID. Both solutions ensure messages are processed in the exact order they were sent for each payment ID, meeting the strict ordering requirement for payment processing.
Why the other options are wrong
- A. DynamoDB does not preserve message ordering; it is a database for structured data, not a messaging system.
- C. ElastiCache is an in-memory cache, not a messaging system, and does not provide ordered message delivery guarantees.
- D. Standard SQS queues do not guarantee message ordering; they provide at-least-once delivery without FIFO guarantees.
Question 57
A media company collects and analyzes user activity data on premises. The company wants to migrate this capability to AWS. The user activity data store will continue to grow and will be petabytes in size. The company needs to build a highly available data ingestion solution that facilitates on-demand analytics of existing data and new data with SQL. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Send activity data to an Amazon Kinesis Data Firehose delivery stream. Configure the stream to deliver the data to an Amazon Redshift cluster.
Kinesis Data Firehose (option B) is the lowest operational overhead solution. It provides highly available data ingestion, automatically scales to handle petabyte-scale data, delivers directly to Amazon Redshift for SQL analytics, and requires minimal operational management. Redshift is purpose-built for petabyte-scale analytics with SQL, offering better performance and cost-efficiency than S3 alone for this workload. Firehose handles buffering, compression, and delivery automatically.
Why the other options are wrong
- A. Kinesis Data Streams requires manual scaling and management; delivering to S3 alone doesn't support on-demand SQL analytics without additional setup.
- C. Using S3 with Lambda for analytics is operationally complex, requires custom code, and doesn't integrate well with SQL query engines.
- D. Self-managed EC2 ingestion services require operational overhead; RDS is not suitable for petabyte-scale analytics and has limited scalability.
Question 58
A company uses on-premises servers to host its applications. The company is running out of storage capacity. The applications use both block storage and NFS storage. The company needs a high-performing solution that supports local caching without re-architecting its existing applications. Which combination of actions should a solutions architect take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, D. Deploy an AWS Storage Gateway file gateway to replace NFS storage; Deploy an AWS Storage Gateway volume gateway to replace the block storage.
To support both block storage and NFS storage with local caching without re-architecting applications, AWS Storage Gateway provides the ideal solution. Option B deploys a file gateway to handle NFS storage requirements with local caching capability. Option D deploys a volume gateway to replace block storage, also providing local caching. Both gateways support existing application architectures while extending on-premises storage to AWS with performance benefits through caching.
Why the other options are wrong
- A. S3 cannot be mounted as a native file system to on-premises servers without third-party solutions.
- C. Snowball Edge is a one-time data transfer device, not suitable for ongoing storage capacity needs or local caching.
- E. EFS cannot be mounted directly to on-premises servers; it only supports AWS resources within a VPC.
Question 59
A company runs its ecommerce application on AWS. Every new order is published as a massage in a RabbitMQ queue that runs on an Amazon EC2 instance in a single Availability Zone. These messages are processed by a different application that runs on a separate EC2 instance. This application stores the details in a PostgreSQL database on another EC2 instance. All the EC2 instances are in the same Availability Zone. The company needs to redesign its architecture to provide the highest availability with the least operational overhead. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: B. Migrate the queue to a redundant pair (active/standby) of RabbitMQ instances on Amazon MQ. Create a Multi-AZ Auto Scaling group for EC2 instances that host the application. Migrate the database to run on a Multi-AZ deployment of Amazon RDS for PostgreSQL.
Option B provides the best balance of high availability and least operational overhead. Amazon MQ managed service eliminates the need to manage RabbitMQ infrastructure across AZs. A Multi-AZ Auto Scaling group handles the application layer with automatic failover and scaling. Amazon RDS for PostgreSQL with Multi-AZ deployment is a fully managed service that provides automatic failover and backups, minimizing operational overhead compared to managing PostgreSQL on EC2 instances.
Why the other options are wrong
- A. Using Auto Scaling groups for self-managed PostgreSQL on EC2 instances creates significant operational overhead and replication complexity compared to RDS.
- C. Using Auto Scaling groups for RabbitMQ on EC2 requires more operational overhead than managed Amazon MQ.
- D. Managing PostgreSQL in an Auto Scaling group with EC2 instances introduces unnecessary complexity and operational overhead compared to using RDS.
Question 60
A company has a mobile chat application with a data store based in Amazon DynamoDB. Users would like new messages to be read with as little latency as possible. A solutions architect needs to design an optimal solution that requires minimal application changes. Which method should the solutions architect select?
Show answer and explanation
Correct answer: A. Configure Amazon DynamoDB Accelerator (DAX) for the new messages table. Update the code to use the DAX endpoint.
Amazon DynamoDB Accelerator (DAX) is a managed, in-memory cache designed specifically for DynamoDB that dramatically reduces read latency with minimal application changes. It sits between the application and DynamoDB, transparently caching frequently accessed items. Only the endpoint URL needs to be updated in the application code, making it the optimal solution for reducing latency with minimal effort.
Why the other options are wrong
- B. DynamoDB does not support read replicas; this is a misunderstanding of DynamoDB's architecture.
- C. Simply increasing read capacity units improves throughput but does not significantly reduce latency compared to caching.
- D. Adding ElastiCache requires significant application changes and adds architectural complexity; DAX is purpose-built for DynamoDB and requires less modification.
Question 61
A company needs to retain its AWS CloudTrail logs for 3 years. The company is enforcing CloudTrail across a set of AWS accounts by using AWS Organizations from the parent account. The CloudTrail target S3 bucket is configured with S3 Versioning enabled. An S3 Lifecycle policy is in place to delete current objects after 3 years. After the fourth year of use of the S3 bucket, the S3 bucket metrics show that the number of objects has continued to rise. However, the number of new CloudTrail logs that are delivered to the S3 bucket has remained consistent. Which solution will delete objects that are older than 3 years in the MOST cost-effective manner?
Show answer and explanation
Correct answer: B. Configure the S3 Lifecycle policy to delete previous versions as well as current versions.
With S3 Versioning enabled, the S3 bucket retains both current and previous versions of objects. The existing lifecycle policy only deletes current objects after 3 years, leaving previous versions indefinitely. Configuring the S3 Lifecycle policy to delete both current and previous versions will remove all object versions older than 3 years, which is the most cost-effective solution using native S3 features.
Why the other options are wrong
- A. CloudTrail itself has no expiration configuration; it relies on S3 bucket policies for retention management.
- C. Creating a Lambda function adds unnecessary complexity and cost compared to using S3 Lifecycle policies, which are built-in and designed for this purpose.
- D. Changing object ownership does not affect the lifecycle policy behavior or deletion of old versions.
Question 62
An ecommerce company runs an application in the AWS Cloud that is integrated with an on-premises warehouse solution. The company uses Amazon Simple Notification Service (Amazon SNS) to send order messages to an on-premises HTTPS endpoint so the warehouse application can process the orders. The local data center team has detected that some of the order messages were not received. A solutions architect needs to retain messages that are not delivered and analyze the messages for up to 14 days. Which solution will meet these requirements with the LEAST development effort?
Show answer and explanation
Correct answer: C. Configure an Amazon SNS dead letter queue that has an Amazon Simple Queue Service (Amazon SQS) target with a retention period of 14 days.
Configuring an SNS dead letter queue with an SQS target requires minimal development effort and meets all requirements. SNS automatically sends failed delivery messages to the DLQ, SQS retains messages for up to 14 days by default (adjustable), and no custom code is needed to capture and retain undelivered messages. This is the most straightforward AWS-native solution.
Why the other options are wrong
- A. Using Kinesis requires more complex configuration and development effort than SQS, and Kinesis is not a direct DLQ target for SNS.
- B. Placing an SQS queue between the application and SNS adds unnecessary complexity and does not properly handle SNS delivery failures.
- D. DynamoDB with TTL requires custom Lambda code to consume and persist messages, adding significant development effort compared to native SNS-SQS integration.
Question 63
A solutions architect is designing an asynchronous application to process credit card data validation requests for a bank. The application must be secure and be able to process each request at least once. Which solution will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: A. Use AWS Lambda event source mapping. Set Amazon Simple Queue Service (Amazon SQS) standard queues as the event source. Use AWS Key Management Service (SSE-KMS) for encryption. Add the kms:Decrypt permission for the Lambda execution role.
SQS standard queues with SSE-KMS encryption and Lambda event source mapping provides the most cost-effective solution. Standard queues are cheaper than FIFO queues, and while they offer best-effort delivery (not guaranteed), the requirement is 'at least once' processing which standard queues satisfy through retry mechanisms. SSE-KMS with explicit kms:Decrypt permissions provides secure encryption for sensitive credit card data.
Why the other options are wrong
- B. FIFO queues cost more than standard queues, and SSE-SQS lacks the explicit key management needed for sensitive financial data.
- C. FIFO queues are more expensive than standard queues without providing additional security benefits over SSE-KMS.
- D. KMS key invocation permission is not the correct IAM permission; kms:Decrypt is required for Lambda to decrypt messages.
Question 64
A company needs to ingest and handle large amounts of streaming data that its application generates. The application runs on Amazon EC2 instances and sends data to Amazon Kinesis Data Streams, which is configured with default settings. Every other day, the application consumes the data and writes the data to an Amazon S3 bucket for business intelligence (BI) processing. The company observes that Amazon S3 is not receiving all the data that the application sends to Kinesis Data Streams. What should a solutions architect do to resolve this issue?
Show answer and explanation
Correct answer: A. Update the Kinesis Data Streams default settings by modifying the data retention period.
The default Kinesis Data Streams retention period is 24 hours. Since the application consumes and writes data every other day (48-hour cycle), data is being lost after 24 hours before consumption. Extending the retention period to at least 48 hours ensures all data persists until the consumer application can retrieve and process it.
Why the other options are wrong
- B. Kinesis Producer Library improves throughput and reliability but does not address the data retention issue causing data loss.
- C. Increasing shard count handles throughput scaling but does not prevent data loss from expiration; retention period is the issue.
- D. S3 Versioning preserves object versions but does not recover already-lost data from Kinesis streams that expired before consumption.
Question 65
A company hosts multiple production applications. One of the applications consists of resources from Amazon EC2, AWS Lambda, Amazon RDS, Amazon Simple Notification Service (Amazon SNS), and Amazon Simple Queue Service (Amazon SQS) across multiple AWS Regions. All company resources are tagged with a tag name of “application” and a value that corresponds to each application. A solutions architect must provide the quickest solution for identifying all of the tagged components. Which solution meets these requirements?
Show answer and explanation
Correct answer: D. Run a query with the AWS Resource Groups Tag Editor to report on the resources globally with the application tag.
The AWS Resource Groups Tag Editor is purpose-built to search for and manage tagged resources across all AWS services and regions simultaneously. It provides the quickest way to query resources by tags globally without requiring manual CLI queries or understanding of individual service APIs. This directly meets the requirement of identifying all tagged components with minimal effort.
Why the other options are wrong
- A. CloudTrail logs API calls but is not designed for resource discovery or tag-based queries.
- B. Querying each service individually via CLI is time-consuming and requires custom scripting across multiple regions.
- C. CloudWatch Logs Insights is designed for log analysis, not resource discovery or tag queries.
Question 66
A solutions architect is designing a new hybrid architecture to extend a company's on-premises infrastructure to AWS. The company requires a highly available connection with consistent low latency to an AWS Region. The company needs to minimize costs and is willing to accept slower traffic if the primary connection fails. What should the solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: A. Provision an AWS Direct Connect connection to a Region. Provision a VPN connection as a backup if the primary Direct Connect connection fails.
AWS Direct Connect provides consistent low latency and high availability for the primary connection, meeting the performance requirements. A VPN connection serves as a cost-effective backup that, while slower, satisfies the requirement to minimize costs and accept slower traffic during failover. This combination provides the best price-to-performance ratio for the stated requirements.
Why the other options are wrong
- B. Dual VPN connections lack the consistent low latency of Direct Connect and do not meet the requirement for a highly available primary connection with low latency.
- C. Provisioning two Direct Connect connections is significantly more expensive than using a VPN backup and exceeds the requirement to minimize costs.
- D. The failover attribute in AWS CLI is not a real feature; failover between Direct Connect connections must be configured through redundant virtual interfaces and BGP routing.
Question 67
A company uses 50 TB of data for reporting. The company wants to move this data from on premises to AWS. A custom application in the company’s data center runs a weekly data transformation job. The company plans to pause the application until the data transfer is complete and needs to begin the transfer process as soon as possible. The data center does not have any available network bandwidth for additional workloads. A solutions architect must transfer the data and must configure the transformation job to continue to run in the AWS Cloud. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: C. Order an AWS Snowball Edge Storage Optimized device. Copy the data to the device. Create a custom transformation job by using AWS Glue.
AWS Snowball Edge Storage Optimized device transfers 50 TB of data without consuming network bandwidth, allowing immediate transfer despite constrained data center bandwidth. AWS Glue provides serverless ETL for transformation jobs with minimal operational overhead and integrates seamlessly with data imported from Snowball. This solution avoids network bottlenecks, pauses the application minimally, and requires no on-device compute complexity. DataSync requires available bandwidth; Snowcone lacks sufficient capacity for 50 TB; option D adds unnecessary complexity with on-device processing.
Why the other options are wrong
- A. DataSync requires available network bandwidth, but the data center has no additional bandwidth available for this workload.
- B. Snowcone is designed for smaller datasets and lacks the capacity to efficiently handle 50 TB of data.
- D. Running transformation jobs on a Snowball Edge device adds operational complexity and is less efficient than using AWS Glue in the cloud.
Question 68
A company runs a web application on Amazon EC2 instances in multiple Availability Zones. The EC2 instances are in private subnets. A solutions architect implements an internet-facing Application Load Balancer (ALB) and specifies the EC2 instances as the target group. However, the internet traffic is not reaching the EC2 instances. How should the solutions architect reconfigure the architecture to resolve this issue?
Show answer and explanation
Correct answer: D. Create public subnets in each Availability Zone. Associate the public subnets with the ALB. Update the route tables for the public subnets with a route to the private subnets.
An internet-facing ALB requires its own subnets to be public (with routes to IGW) to receive internet traffic. The ALB must be in public subnets while directing traffic to private EC2 instances. The route tables for public subnets must have a route to the private subnets so the ALB can forward requests to the EC2 target group. This is the correct architecture pattern for ALB with private instances.
Why the other options are wrong
- A. NLB and NAT gateway are not necessary; the issue is ALB subnet placement, not load balancer type.
- B. Moving instances to public subnets exposes them unnecessarily; proper architecture keeps them private.
- C. Outbound traffic rule is not the issue; the problem is inbound traffic reaching private instances through the ALB.
Question 69
A company produces batch data that comes from different databases. The company also produces live stream data from network sensors and application APIs. The company needs to consolidate all the data into one place for business analytics. The company needs to process the incoming data and then stage the data in different Amazon S3 buckets. Teams will later run one-time queries and import the data into a business intelligence tool to show key performance indicators (KPIs). Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
Show answer and explanation
Correct answer: A, E. Use Amazon Athena for one-time queries. Use Amazon QuickSight to create dashboards for KPIs; Use blueprints in AWS Lake Formation to identify the data that can be ingested into a data lake. Use AWS Glue to crawl the source, extract the data, and load the data into Amazon S3 in Apache Parquet format.
Option E provides the complete data lake solution: AWS Lake Formation blueprints identify and ingest diverse data sources, AWS Glue crawls and extracts data, and loads it into S3 in Parquet format for efficient querying. Option A then enables one-time queries via Amazon Athena and KPI visualization through QuickSight. This combination minimizes operational overhead by using managed services with minimal configuration, avoiding custom code and unnecessary intermediate transformations.
Why the other options are wrong
- B. Amazon Kinesis Data Analytics is designed for real-time stream processing and continuous analytics, not for one-time historical queries on staged data.
- C. Custom Lambda functions add significant operational overhead and are unnecessary when managed ETL services like Glue are available.
- D. OpenSearch and JSON format add operational complexity and are not optimal for analytics queries; Parquet format in S3 with Athena is more efficient and cost-effective.
Question 70
What should a solutions architect do to ensure that all objects uploaded to an Amazon S3 bucket are encrypted?
Show answer and explanation
Correct answer: D. Update the bucket policy to deny if the PutObject does not have an x-amz-server-side-encryption header set.
A bucket policy that denies PutObject requests without the x-amz-server-side-encryption header ensures that all objects uploaded to the bucket must be encrypted. This header specifies the encryption method and is the standard way to enforce encryption at the S3 API level for all uploads.
Why the other options are wrong
- A. The s3:x-amz-acl header controls object access control lists, not encryption.
- B. The s3:x-amz-acl header with private value controls permissions, not encryption.
- C. The aws:SecureTransport header enforces HTTPS connections but does not enforce encryption of the objects themselves.
Question 71
A company is planning to migrate a commercial off-the-shelf application from its on-premises data center to AWS. The software has a software licensing model using sockets and cores with predictable capacity and uptime requirements. The company wants to use its existing licenses, which were purchased earlier this year. Which Amazon EC2 pricing option is the MOST cost-effective?
Show answer and explanation
Correct answer: A. Dedicated Reserved Hosts
Dedicated Reserved Hosts are the most cost-effective option for software with socket/core-based licensing models. They allow the company to use existing licenses and provide the deepest discounts when combined with the predictable capacity and uptime requirements mentioned. Dedicated Hosts give visibility into physical sockets and cores, which is essential for license compliance with commercial software.
Why the other options are wrong
- B. Dedicated On-Demand Hosts lack the cost savings of reserved capacity and don't optimize for predictable workloads.
- C. Dedicated Reserved Instances do not provide visibility into physical sockets and cores needed for socket/core-based licensing.
- D. Dedicated On-Demand Instances are the most expensive option and don't take advantage of the predictable capacity requirements.
Question 72
A gaming company has a web application that displays scores. The application runs on Amazon EC2 instances behind an Application Load Balancer. The application stores data in an Amazon RDS for MySQL database. Users are starting to experience long delays and interruptions that are caused by database read performance. The company wants to improve the user experience while minimizing changes to the application’s architecture. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: A. Use Amazon ElastiCache in front of the database.
ElastiCache deployed in front of the RDS database reduces read latency by caching frequently accessed data, directly addressing the performance degradation from read-heavy workloads. This solution requires minimal application changes (typically just adding caching logic) and avoids major architectural rewrites.
Why the other options are wrong
- B. RDS Proxy manages database connections but doesn't improve read performance; it addresses connection pooling, not read latency issues.
- C. Migrating to Lambda requires significant architectural changes and doesn't directly solve database read performance problems.
- D. DynamoDB migration requires substantial application rewriting and doesn't preserve the existing MySQL architecture as required.
Question 73
A global company hosts its web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The web application has static data and dynamic data. The company stores its static data in an Amazon S3 bucket. The company wants to improve performance and reduce latency for the static data and dynamic data. The company is using its own domain name registered with Amazon Route 53. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: A. Create an Amazon CloudFront distribution that has the S3 bucket and the ALB as origins. Configure Route 53 to route traffic to the CloudFront distribution.
CloudFront with multiple origins (S3 for static data and ALB for dynamic data) provides optimal performance and reduced latency globally. CloudFront caches static content at edge locations while routing dynamic requests to the ALB origin. Configuring Route 53 to direct traffic to the CloudFront distribution creates a unified entry point. This single-solution approach addresses both static and dynamic content acceleration without requiring multiple domain names or complex routing logic.
Why the other options are wrong
- B. Global Accelerator with S3 as an endpoint is awkward and not its intended use; Global Accelerator is for accelerating ALB/EC2, not S3 directly.
- C. Using Global Accelerator with CloudFront as an endpoint adds unnecessary complexity and cost; CloudFront already handles global distribution.
- D. Splitting static and dynamic content across two domain names creates operational complexity and a fragmented user experience; CloudFront can handle both efficiently.
Question 74
A company recently launched Linux-based application instances on Amazon EC2 in a private subnet and launched a Linux-based bastion host on an Amazon EC2 instance in a public subnet of a VPC. A solutions architect needs to connect from the on-premises network, through the company's internet connection, to the bastion host, and to the application servers. The solutions architect must make sure that the security groups of all the EC2 instances will allow that access. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: C, D. Replace the current security group of the bastion host with one that only allows inbound access from the external IP range for the company; Replace the current security group of the application instances with one that allows inbound SSH access from only the private IP address of the bastion host.
The bastion host must allow inbound SSH from the company's external IP range (option C) so on-premises users can connect through the internet. The application instances must allow inbound SSH from only the bastion host's private IP address (option D) since the bastion is in a private subnet and will use its private IP to connect to application servers. This creates a secure two-hop connection: on-premises → bastion (external IP) → application servers (bastion private IP).
Why the other options are wrong
- A. Bastion hosts must allow inbound access from external sources, not just application instances.
- B. The internal IP range rule would block external connections from on-premises users through the internet.
- E. Application instances should use the bastion's private IP, not public IP, since both are within the VPC.
Question 75
A solutions architect must create a disaster recovery (DR) plan for a high-volume software as a service (SaaS) platform. All data for the platform is stored in an Amazon Aurora MySQL DB cluster. The DR plan must replicate data to a secondary AWS Region. Which solution will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: B. Set up an Aurora global database for the DB cluster. When setup is complete, remove the DB instance from the secondary Region.
An Aurora global database replicates the storage layer to the secondary Region with low lag. The secondary cluster can run headless, with its DB instance removed, so storage replication continues without paying for compute until a DB instance is added during recovery, which is the most cost-effective option.
Why the other options are wrong
- A. Binary log replication adds load on the primary and is less reliable, and it still requires a running DB instance in the secondary Region.
- C. AWS DMS adds replication instance costs and management, and it cannot replicate into a cluster with no DB instance.
- D. Keeping a DB instance running in the secondary Region adds compute cost that a headless secondary avoids.
Question 76
A company’s reporting system delivers hundreds of .csv files to an Amazon S3 bucket each day. The company must convert these files to Apache Parquet format and must store the files in a transformed data bucket. Which solution will meet these requirements with the LEAST development effort?
Show answer and explanation
Correct answer: B. Create an AWS Glue crawler to discover the data. Create an AWS Glue extract, transform, and load (ETL) job to transform the data. Specify the transformed data bucket in the output step.
AWS Glue is a fully managed ETL service that requires the least development effort. The Glue crawler automatically discovers CSV file schemas, and the Glue ETL job provides built-in support for CSV-to-Parquet transformation with minimal custom code. This serverless approach eliminates the need to manage infrastructure, making it the lowest-effort solution compared to manually writing Spark applications, configuring Batch jobs with Bash scripts, or creating custom Lambda functions.
Why the other options are wrong
- A. EMR requires creating and managing a cluster and writing custom Spark code, involving more operational overhead and development effort.
- C. AWS Batch requires writing Bash scripts and managing job definitions; it's more complex than Glue's managed ETL approach.
- D. Lambda has a 15-minute execution timeout, which may be insufficient for 2-5 GB files, and requires custom transformation code rather than built-in ETL capabilities.
Question 77
A company’s web application is running on Amazon EC2 instances behind an Application Load Balancer. The company recently changed its policy, which now requires the application to be accessed from one specific country only. Which configuration will meet this requirement?
Show answer and explanation
Correct answer: C. Configure AWS WAF on the Application Load Balancer in a VPC.
AWS WAF (Web Application Firewall) can be attached to an Application Load Balancer and configured with geo-blocking rules to restrict access by country. This provides application-layer filtering based on geographic location. Security groups operate at the network layer and cannot filter by country, while NACLs lack geo-awareness capabilities. WAF is the only AWS service designed specifically for this type of content-based access control.
Why the other options are wrong
- A. Security groups operate at the network layer and cannot filter traffic based on geographic location or country.
- B. While security groups can be applied to the ALB, they work at the network layer and cannot perform country-based filtering.
- D. Network ACLs function at the network layer and lack the ability to identify or filter traffic based on country of origin.
Question 78
An image-hosting company stores its objects in Amazon S3 buckets. The company wants to avoid accidental exposure of the objects in the S3 buckets to the public. All S3 objects in the entire AWS account need to remain private. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Use the S3 Block Public Access feature on the account level. Use AWS Organizations to create a service control policy (SCP) that prevents IAM users from changing the setting. Apply the SCP to the account.
S3 Block Public Access at the account level is the most effective and least administratively overhead solution to prevent all objects in S3 buckets from being publicly exposed. Using an SCP through AWS Organizations to prevent users from disabling this setting provides additional enforcement. This is a proactive prevention mechanism that automatically blocks any configuration that would make objects public, requiring no monitoring, remediation Lambda functions, or manual intervention.
Why the other options are wrong
- A. GuardDuty is designed for threat detection and security monitoring, not S3 policy management; it lacks native S3 bucket policy monitoring capabilities.
- B. Trusted Advisor only provides recommendations and requires manual remediation, which doesn't scale and introduces human error.
- C. AWS Resource Access Manager (RAM) is for resource sharing across accounts, not for detecting or remediating public access on S3 buckets.
Question 79
A company hosts a three-tier ecommerce application on a fleet of Amazon EC2 instances. The instances run in an Auto Scaling group behind an Application Load Balancer (ALB). All ecommerce data is stored in an Amazon RDS for MariaDB Multi-AZ DB instance. The company wants to optimize customer session management during transactions. The application must store session data durably. Which solutions will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, D. Use an Amazon DynamoDB table to store customer session information; Deploy an Amazon ElastiCache for Redis cluster to store customer session information.
DynamoDB and ElastiCache are both suitable for storing durable session data in a distributed application. DynamoDB provides a managed, serverless database with durability guarantees and automatic scaling. ElastiCache with Redis provides an in-memory data store with persistence options and high performance for session data. Both solutions allow session data to be shared across EC2 instances in the Auto Scaling group, enabling stateless horizontal scaling while maintaining session state durably.
Why the other options are wrong
- A. Sticky sessions on the ALB tie customers to specific instances, which defeats the purpose of Auto Scaling and creates availability issues if an instance is replaced.
- C. Amazon Cognito manages user authentication and authorization, not application session data storage; it does not solve the session durability requirement for transaction data.
- E. AWS Systems Manager Application Manager is for operational insights and management, not for storing session data.
Question 80
A transaction processing company has weekly scripted batch jobs that run on Amazon EC2 instances. The EC2 instances are in an Auto Scaling group. The number of transactions can vary, but the baseline CPU utilization that is noted on each run is at least 60%. The company needs to provision the capacity 30 minutes before the jobs run. Currently, engineers complete this task by manually modifying the Auto Scaling group parameters. The company does not have the resources to analyze the required capacity trends for the Auto Scaling group counts. The company needs an automated way to modify the Auto Scaling group’s desired capacity. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: C. Create a predictive scaling policy for the Auto Scaling group. Configure the policy to scale based on forecast. Set the scaling metric to CPU utilization. Set the target value for the metric to 60%. In the policy, set the instances to pre-launch 30 minutes before the jobs run.
Predictive scaling analyzes historical load to forecast recurring patterns such as a weekly batch job, and it can pre-launch instances ahead of the forecast. This automates the desired capacity without the company having to work out the capacity itself, which it has no resources to do.
Why the other options are wrong
- A. Dynamic target tracking reacts only after CPU rises, so it cannot provide capacity 30 minutes before the jobs start.
- B. Scheduled scaling needs someone to decide the desired, minimum, and maximum capacity, and the company cannot analyze the required capacity.
- D. A Lambda function triggered at 60 percent CPU reacts after load arrives and adds custom code to maintain.
Question 81
A company uses Amazon EC2 instances and AWS Lambda functions to run its application. The company has VPCs with public subnets and private subnets in its AWS account. The EC2 instances run in a private subnet in one of the VPCs. The Lambda functions need direct network access to the EC2 instances for the application to work. The application will run for at least 1 year. The company expects the number of Lambda functions that the application uses to increase during that time. The company wants to maximize its savings on all application resources and to keep network latency between the services low. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Purchase a Compute Savings Plan. Optimize the Lambda functions’ duration and memory usage, the number of invocations, and the amount of data that is transferred. Connect the Lambda functions to the private subnet that contains the EC2 instances.
A Compute Savings Plan provides the best discount across both EC2 instances and Lambda functions, crucial since both resource types are increasing. Lambda functions must connect to the private subnet containing EC2 instances for direct network access, which requires the functions to have VPC access configured. Optimizing duration, memory, invocations, and data transfer all contribute to cost savings. This approach maximizes savings across all resources while maintaining low network latency through direct private network connectivity.
Why the other options are wrong
- A. EC2 Instance Savings Plan only covers EC2, not Lambda, missing savings opportunities on growing Lambda usage. Connecting to a private subnet is correct, but savings coverage is incomplete.
- B. EC2 Instance Savings Plan lacks Lambda coverage and connecting Lambda to a public subnet adds unnecessary latency and complexity compared to private subnet access.
- D. Keeping Lambda in the Lambda service VPC prevents direct network access to EC2 instances in the private subnet, violating the requirement for direct network access.
Question 82
A company uses high block storage capacity to runs its workloads on premises. The company's daily peak input and output transactions per second are not more than 15,000 IOPS. The company wants to migrate the workloads to Amazon EC2 and to provision disk performance independent of storage capacity. Which Amazon Elastic Block Store (Amazon EBS) volume type will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: C. GP3 volume type
GP3 volumes allow independent provisioning of IOPS (up to 16,000) and throughput separate from storage capacity, meeting the requirement of 15,000 IOPS with high capacity while being the most cost-effective option. GP3 provides better price-to-performance than io1/io2 for this workload.
Why the other options are wrong
- A. GP2 couples IOPS to storage capacity (3 IOPS per GB), requiring excessive storage to reach 15,000 IOPS and increasing costs unnecessarily.
- B. io2 is optimized for mission-critical workloads requiring extreme durability and highest IOPS; it's more expensive than necessary for this requirement.
- D. io1 is more expensive than GP3 and also couples IOPS to storage in a less favorable ratio than GP3 for this use case.
Question 83
A company wants to move a multi-tiered application from on premises to the AWS Cloud to improve the application's performance. The application consists of application tiers that communicate with each other by way of RESTful services. Transactions are dropped when one tier becomes overloaded. A solutions architect must design a solution that resolves these issues and modernizes the application. Which solution meets these requirements and is the MOST operationally efficient?
Show answer and explanation
Correct answer: A. Use Amazon API Gateway and direct transactions to the AWS Lambda functions as the application layer. Use Amazon Simple Queue Service (Amazon SQS) as the communication layer between application services.
Option A provides the most operationally efficient solution by using API Gateway for the entry point, Lambda for business logic, and SQS as an asynchronous messaging queue. This decouples services, prevents dropped transactions through SQS buffering, and eliminates the operational overhead of managing EC2 instances. Auto-scaling occurs automatically, and Lambda scales inherently with demand. Options B and D still require EC2 management, and option C uses SNS (a pub/sub service) rather than SQS (a queue service) which is less suitable for preventing message loss during spikes.
Why the other options are wrong
- B. Manual instance sizing based on historical metrics doesn't address unpredictable spikes and requires ongoing operational management.
- C. SNS is a publish-subscribe service that does not provide message persistence like queues, risking message loss during overload.
- D. EC2-based solutions with SQS still require managing instance groups and auto-scaling policies, adding operational overhead compared to serverless.
Question 84
A company is designing a shared storage solution for a gaming application that is hosted in the AWS Cloud. The company needs the ability to use SMB clients to access data. The solution must be fully managed. Which AWS solution meets these requirements?
Show answer and explanation
Correct answer: C. Create an Amazon FSx for Windows File Server file system. Attach the file system to the origin server. Connect the application server to the file system.
Amazon FSx for Windows File Server is a fully managed Windows file sharing solution that natively supports SMB protocol access. It provides enterprise-grade file sharing without requiring manual configuration or management of Windows servers, meeting the requirements for SMB client access and full management.
Why the other options are wrong
- A. DataSync is a data transfer service, not a file sharing solution, and does not provide SMB protocol access.
- B. Using an EC2 Windows instance requires operational overhead for patching, maintenance, and administration, while the requirement specifies a fully managed solution.
- D. S3 buckets do not support SMB protocol access; they require S3-specific access methods and are not suitable for SMB client requirements.
Question 85
A security audit reveals that Amazon EC2 instances are not being patched regularly. A solutions architect needs to provide a solution that will run regular security scans across a large fleet of EC2 instances. The solution should also patch the EC2 instances on a regular schedule and provide a report of each instance’s patch status. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Turn on Amazon Inspector in the account. Configure Amazon Inspector to scan the EC2 instances for software vulnerabilities. Set up AWS Systems Manager Patch Manager to patch the EC2 instances on a regular schedule.
Amazon Inspector is AWS's native vulnerability assessment tool that scans EC2 instances for software vulnerabilities and provides detailed reports. AWS Systems Manager Patch Manager is the purpose-built solution for scheduling automated patching across EC2 fleets and generating compliance reports. Together, they fully satisfy the security scanning, regular patching, and reporting requirements.
Why the other options are wrong
- A. Amazon Macie is designed for data discovery and protection, not vulnerability scanning; cron jobs lack centralized management and reporting for fleet-wide patching.
- B. GuardDuty detects threats and anomalies, not software vulnerabilities; Session Manager is for interactive access, not automated scheduled patching.
- C. Detective is for security investigations after threats are detected, not vulnerability scanning; EventBridge scheduled rules are not the proper mechanism for patch management.
Question 86
A company is designing an application. The application uses an AWS Lambda function to receive information through Amazon API Gateway and to store the information in an Amazon Aurora PostgreSQL database. During the proof-of-concept stage, the company has to increase the Lambda quotas significantly to handle the high volumes of data that the company needs to load into the database. A solutions architect must recommend a new design to improve scalability and minimize the configuration effort. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Set up two Lambda functions. Configure one function to receive the information. Configure the other function to load the information into the database. Integrate the Lambda functions by using an Amazon Simple Queue Service (Amazon SQS) queue.
Using SQS as a message queue between two Lambda functions decouples the receive and database load operations, allowing each to scale independently. The first function receives API requests and places them in the queue, while the second function processes them asynchronously. This eliminates the need to increase Lambda quotas significantly and naturally handles traffic spikes by queuing messages. SQS provides built-in retry logic and durability, making it ideal for this scenario.
Why the other options are wrong
- A. Refactoring to EC2 with Tomcat increases operational overhead and doesn't improve scalability compared to the proposed queue-based solution.
- B. Switching to DynamoDB fundamentally changes the application's architecture and doesn't solve the underlying scalability issue of the single Lambda function bottleneck.
- C. SNS is designed for broadcasting notifications to multiple subscribers rather than queuing work for sequential processing; it doesn't provide the same decoupling and backpressure handling as SQS.
Question 87
A company’s web application consists of an Amazon API Gateway API in front of an AWS Lambda function and an Amazon DynamoDB database. The Lambda function handles the business logic, and the DynamoDB table hosts the data. The application uses Amazon Cognito user pools to identify the individual users of the application. A solutions architect needs to update the application so that only users who have a subscription can access premium content. Which solution will meet this requirement with the LEAST operational overhead?
Show answer and explanation
Correct answer: D. Implement API usage plans and API keys to limit the access of users who do not have a subscription.
API usage plans and API keys provide a straightforward mechanism to control access based on subscription status with minimal operational overhead. API Gateway can enforce usage plans tied to API keys, allowing the application to differentiate between users with and without subscriptions. This approach leverages native API Gateway features without requiring modifications to Lambda business logic or DynamoDB permissions, and requires less operational management than IAM policies on DynamoDB.
Why the other options are wrong
- A. API caching and throttling manage performance and rate limiting but do not control access based on subscription status.
- B. AWS WAF can filter requests but is not the typical or least-overhead way to implement subscription-based access control; it requires custom rule logic rather than native subscription management.
- C. Fine-grained IAM permissions on DynamoDB would require complex Lambda logic to assume different IAM roles per user and would require managing IAM policies for each user, creating significant operational overhead.
Question 88
A company has multiple AWS accounts for development work. Some staff consistently use oversized Amazon EC2 instances, which causes the company to exceed the yearly budget for the development accounts. The company wants to centrally restrict the creation of AWS resources in these accounts. Which solution will meet these requirements with the LEAST development effort?
Show answer and explanation
Correct answer: B. Use AWS Organizations to organize the accounts into organizational units (OUs). Define and attach a service control policy (SCP) to control the usage of EC2 instance types.
Using AWS Organizations with service control policies (SCPs) provides the least development effort and most scalable solution. SCPs can be attached to OUs to centrally restrict EC2 instance types across multiple accounts without any custom code. This is a native AWS feature designed specifically for this use case of enforcing organization-wide controls.
Why the other options are wrong
- A. Systems Manager templates require development effort and do not prevent staff from using other provisioning methods.
- C. EventBridge with Lambda requires custom code development and only reacts after resource creation, allowing temporary over-budget spending.
- D. Service Catalog setup requires significant configuration and development effort, and staff could bypass it using other provisioning methods.
Question 89
A company is using a SQL database to store movie data that is publicly accessible. The database runs on an Amazon RDS Single-AZ DB instance. A script runs queries at random intervals each day to record the number of new movies that have been added to the database. The script must report a final total during business hours. The company's development team notices that the database performance is inadequate for development tasks when the script is running. A solutions architect must recommend a solution to resolve this issue. Which solution will meet this requirement with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Create a read replica of the database. Configure the script to query only the read replica.
Creating a read replica isolates the script's read-heavy queries from the production database, eliminating performance degradation for development tasks without requiring database modifications or operational complexity. Read replicas are specifically designed for this use case and require minimal configuration. The script queries only the replica, leaving the primary instance unaffected by the script's workload.
Why the other options are wrong
- A. Multi-AZ improves availability and failover but doesn't separate read/write traffic or reduce contention.
- C. Manual exports are operationally intensive and don't solve the real-time performance issue.
- D. ElastiCache adds caching complexity and overhead; read replicas directly solve the problem with less operational burden.
Question 90
A company wants to securely exchange data between its software as a service (SaaS) application Salesforce account and Amazon S3. The company must encrypt the data at rest by using AWS Key Management Service (AWS KMS) customer managed keys (CMKs). The company must also encrypt the data in transit. The company has enabled API access for the Salesforce account.
Show answer and explanation
Correct answer: C. Create Amazon AppFlow flows to transfer the data securely from Salesforce to Amazon S3.
Amazon AppFlow is the purpose-built AWS service for securely integrating SaaS applications like Salesforce with AWS services. It natively supports encryption in transit (TLS) and encryption at rest using AWS KMS customer managed keys. AppFlow provides a managed, no-code solution that requires minimal operational overhead compared to building custom Lambda functions, Step Functions workflows, or custom connectors.
Why the other options are wrong
- A. Lambda functions require custom code development to handle encryption, key management, and error handling, adding operational complexity.
- B. Step Functions is an orchestration service, not a data transfer service, and would require additional components for secure transfer.
- D. Custom connectors require significant development and maintenance effort compared to using AppFlow's native Salesforce integration.
Question 91
An application runs on an Amazon EC2 instance that has an Elastic IP address in VPC A. The application requires access to a database in VPC B. Both VPCs are in the same AWS account. Which solution will provide the required access MOST securely?
Show answer and explanation
Correct answer: B. Configure a VPC peering connection between VPC A and VPC B.
VPC peering establishes a private network connection between VPC A and VPC B, allowing EC2 instances and databases to communicate securely without exposing resources to the public internet. This maintains network isolation and is the most secure approach for intra-account VPC communication, as traffic never leaves the AWS private network.
Why the other options are wrong
- A. Allowing public IP addresses in security groups exposes the database to potential internet-based attacks and is a security anti-pattern.
- C. Making the database publicly accessible and assigning a public IP defeats the purpose of VPC isolation and exposes the database to the internet.
- D. Proxying through an additional EC2 instance adds complexity and a single point of failure without improving security compared to VPC peering.
Question 92
A solutions architect must design a highly available infrastructure for a website. The website is powered by Windows web servers that run on Amazon EC2 instances. The solutions architect must implement a solution that can mitigate a large-scale DDoS attack that originates from thousands of IP addresses. Downtime is not acceptable for the website. Which actions should the solutions architect take to protect the website from such an attack? (Choose two.)
Show answer and explanation
Correct answer: A, C. Use AWS Shield Advanced to stop the DDoS attack; Configure the website to use Amazon CloudFront for both static and dynamic content.
AWS Shield Advanced provides advanced DDoS protection and mitigation capabilities for large-scale attacks originating from thousands of IP addresses, protecting against Layer 3, 4, and 7 attacks. Amazon CloudFront distributes content across a global network of edge locations, providing built-in DDoS protection by absorbing attack traffic at the edge and caching content to reduce load on origin servers. Together, these solutions provide comprehensive DDoS mitigation while maintaining availability.
Why the other options are wrong
- B. GuardDuty is a threat detection service that identifies suspicious activity but cannot automatically block attackers at scale.
- D. Lambda-based solutions for adding IPs to NACLs are reactive, have rate limits, and cannot handle thousands of IPs in real-time attacks.
- E. Spot Instances and Auto Scaling based on CPU utilization do not directly mitigate DDoS attacks; they may increase costs and are not a protective measure against volumetric attacks.
Question 93
A company runs a stateless web application in production on a group of Amazon EC2 On-Demand Instances behind an Application Load Balancer. The application experiences heavy usage during an 8-hour period each business day. Application usage is moderate and steady overnight. Application usage is low during weekends. The company wants to minimize its EC2 costs without affecting the availability of the application. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Use Reserved Instances for the baseline level of usage. Use Spot instances for any additional capacity that the application needs.
Reserved Instances provide significant cost savings for the baseline level of usage (moderate and steady overnight, plus the consistent minimum needed during peak hours), while Spot Instances handle the additional capacity needed during the 8-hour heavy usage period. This combination minimizes costs while maintaining availability, as the baseline is always covered by RIs and only temporary excess demand uses cheaper Spot Instances.
Why the other options are wrong
- A. Using only Spot Instances risks application interruption due to Spot Instance termination, affecting availability.
- C. On-Demand Instances for baseline are more expensive than Reserved Instances for predictable, continuous usage.
- D. Dedicated Instances are significantly more expensive and are for compliance/licensing needs, not cost optimization.
Question 94
A company needs to store contract documents. A contract lasts for 5 years. During the 5-year period, the company must ensure that the documents cannot be overwritten or deleted. The company needs to encrypt the documents at rest and rotate the encryption keys automatically every year. Which combination of steps should a solutions architect take to meet these requirements with the LEAST operational overhead? (Choose two.)
Show answer and explanation
Correct answer: B, D. Store the documents in Amazon S3. Use S3 Object Lock in compliance mode; Use server-side encryption with AWS Key Management Service (AWS KMS) customer managed keys. Configure key rotation.
S3 Object Lock in compliance mode (B) ensures that documents cannot be overwritten or deleted for the specified retention period of 5 years, meeting the immutability requirement. AWS KMS customer managed keys (D) with automatic key rotation configured satisfies the encryption at rest and annual key rotation requirements while minimizing operational overhead. Compliance mode is mandatory for regulatory requirements as it prevents even administrators from bypassing the lock. KMS customer managed keys provide automatic annual rotation without manual intervention.
Why the other options are wrong
- A. Governance mode allows privileged users to remove retention, failing the immutability requirement for compliance.
- C. SSE-S3 uses AWS-managed keys that rotate automatically, but the solution doesn't specify customer control or meet requirements for key management visibility.
- E. Customer-provided (imported) keys cannot be automatically rotated; they require manual re-import and rotation management, increasing operational overhead.
Question 95
A company wants to run an in-memory database for a latency-sensitive application that runs on Amazon EC2 instances. The application processes more than 100,000 transactions each minute and requires high network throughput. A solutions architect needs to provide a cost-effective network design that minimizes data transfer charges. Which solution meets these requirements?
Show answer and explanation
Correct answer: A. Launch all EC2 instances in the same Availability Zone within the same AWS Region. Specify a placement group with cluster strategy when launching EC2 instances.
Launching all EC2 instances in the same Availability Zone with a cluster placement group strategy provides the lowest latency and highest network throughput between instances. Cluster placement groups are specifically designed for tightly-coupled, latency-sensitive applications requiring high network performance, and having all instances in the same AZ eliminates cross-AZ data transfer charges while maximizing inter-instance bandwidth.
Why the other options are wrong
- B. Partition strategy placement groups are for distributed applications; different AZs introduce latency and cross-AZ data transfer costs, not suitable for low-latency, high-throughput requirements.
- C. Auto Scaling groups across multiple AZs increase latency and incur data transfer charges; the application needs fixed, tightly-coupled resources.
- D. Spreading instances across AZs increases latency and transfer charges; step scaling policies add complexity without addressing the low-latency requirement.
Question 96
A solutions architect is creating a new VPC design. There are two public subnets for the load balancer, two private subnets for web servers, and two private subnets for MySQL. The web servers use only HTTPS. The solutions architect has already created a security group for the load balancer allowing port 443 from 0.0.0.0/0. Company policy requires that each resource has the least access required to still be able to perform its tasks. Which additional configuration strategy should the solutions architect use to meet these requirements?
Show answer and explanation
Correct answer: C. Create a security group for the web servers and allow port 443 from the load balancer. Create a security group for the MySQL servers and allow port 3306 from the web servers security group.
Creating security groups for web servers to allow port 443 specifically from the load balancer (not from 0.0.0.0/0) and a separate security group for MySQL allowing port 3306 from the web servers security group implements least privilege correctly. Traffic flows from load balancer to web servers to MySQL, with each resource receiving only the minimum required access. Security groups are the proper stateful mechanism for this architecture.
Why the other options are wrong
- A. Allowing port 443 to web servers from 0.0.0.0/0 violates least privilege; traffic should only come from the load balancer.
- B. Network ACLs are stateless and require bidirectional rules, making them unnecessarily complex; security groups are the appropriate choice here.
- D. Network ACLs add unnecessary complexity and are not the best practice for this layered architecture compared to security groups.
Question 97
A company is running a batch application on Amazon EC2 instances. The application consists of a backend with multiple Amazon RDS databases. The application is causing a high number of reads on the databases. A solutions architect must reduce the number of database reads while ensuring high availability. What should the solutions architect do to meet this requirement?
Show answer and explanation
Correct answer: A. Add Amazon RDS read replicas.
Amazon RDS read replicas reduce database reads by distributing read traffic across multiple database instances while maintaining high availability. This is the most direct solution for reducing the number of reads on the primary database while ensuring data consistency and HA capabilities. Replicas can be promoted to primaries if needed. Caching solutions like ElastiCache are secondary and require application code changes to implement cache invalidation, whereas read replicas transparently serve read requests.
Why the other options are wrong
- B. ElastiCache for Redis requires application code changes to implement caching logic and cache invalidation, adding complexity.
- C. Route 53 DNS caching is not relevant for application-level database read optimization.
- D. ElastiCache for Memcached, like Redis, requires application changes and is a secondary caching layer, not a primary solution for database scaling.
Question 98
A company has a static website that is hosted on Amazon CloudFront in front of Amazon S3. The static website uses a database backend. The company notices that the website does not reflect updates that have been made in the website’s Git repository. The company checks the continuous integration and continuous delivery (CI/CD) pipeline between the Git repository and Amazon S3. The company verifies that the webhooks are configured properly and that the CI/CD pipeline is sending messages that indicate successful deployments. A solutions architect needs to implement a solution that displays the updates on the website. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Invalidate the CloudFront cache.
The CI/CD pipeline is successfully deploying updates to S3, but CloudFront is caching the old content and serving stale versions. Invalidating the CloudFront cache will force it to fetch the latest content from the S3 origin, immediately reflecting the updates on the website.
Why the other options are wrong
- A. An Application Load Balancer addresses traffic distribution and load balancing concerns, not content freshness from CloudFront cache.
- B. ElastiCache is used for database query caching; it does not affect CloudFront's caching of static website content.
- D. SSL certificate validation is relevant to HTTPS security, not to serving outdated cached content to users.
Question 99
A company wants to migrate its MySQL database from on premises to AWS. The company recently experienced a database outage that significantly impacted the business. To ensure this does not happen again, the company wants a reliable database solution on AWS that minimizes data loss and stores every transaction on at least two nodes. Which solution meets these requirements?
Show answer and explanation
Correct answer: B. Create an Amazon RDS MySQL DB instance with Multi-AZ functionality enabled to synchronously replicate the data.
Amazon RDS MySQL with Multi-AZ functionality enabled provides synchronous replication to a standby instance in a separate Availability Zone, meeting the requirement of storing every transaction on at least two nodes. Multi-AZ automatically handles failover, ensures high reliability, and minimizes data loss through synchronous replication. This is the standard, managed solution for MySQL high availability on AWS.
Why the other options are wrong
- A. RDS does not support synchronous replication to three nodes in three Availability Zones; RDS Multi-AZ uses one primary and one standby in two AZs.
- C. Read replicas in separate regions use asynchronous replication, which does not guarantee zero data loss and does not meet the requirement of synchronous replication to at least two nodes.
- D. Managing MySQL on EC2 and using Lambda to trigger synchronous replication to RDS is overly complex, requires significant operational overhead, and does not provide the managed reliability of RDS Multi-AZ.
Question 100
A company is building an application that consists of several microservices. The company has decided to use container technologies to deploy its software on AWS. The company needs a solution that minimizes the amount of ongoing effort for maintenance and scaling. The company cannot manage additional infrastructure. Which combination of actions should a solutions architect take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, D. Deploy an Amazon Elastic Container Service (Amazon ECS) cluster; Deploy an Amazon Elastic Container Service (Amazon ECS) service with a Fargate launch type. Specify a desired task number level of greater than or equal to 2.
Two actions are needed. First, the company must have somewhere for the containers to run, so a solutions architect deploys an Amazon ECS cluster (option A). An ECS cluster is only a logical grouping of resources, so on its own it adds no servers to maintain and it provides the managed orchestration layer for the microservices. Second, the workload is placed on that cluster as an ECS service with the Fargate launch type and a desired task count of two or more (option D). Fargate is serverless, so AWS provisions, patches, and scales the underlying compute, and the desired count of 2 or more keeps multiple tasks running for availability and lets the service scale out. Together, A and D give managed container orchestration with no infrastructure for the company to manage.
Why the other options are wrong
- B. Managing Kubernetes control plane on EC2 instances requires significant operational overhead and infrastructure management, contradicting the requirement to minimize effort.
- C. ECS with EC2 launch type requires managing EC2 instances, patching, scaling, and capacity planning, which increases operational burden.
- E. Managing Kubernetes worker nodes on EC2 requires operational management of infrastructure, defeating the goal of minimizing maintenance effort.
Question 101
A company runs an application on Amazon EC2 instances. The company needs to implement a disaster recovery (DR) solution for the application. The DR solution needs to have a recovery time objective (RTO) of less than 4 hours. The DR solution also needs to use the fewest possible AWS resources during normal operations. Which solution will meet these requirements in the MOST operationally efficient way?
Show answer and explanation
Correct answer: B. Create Amazon Machine Images (AMIs) to back up the EC2 instances. Copy the AMIs to a secondary AWS Region. Automate infrastructure deployment in the secondary Region by using AWS CloudFormation.
Creating AMIs and copying them to a secondary region with CloudFormation automation meets the sub-4-hour RTO requirement while using minimal resources during normal operations. CloudFormation is more operationally efficient than custom Lambda scripts for infrastructure orchestration, providing templated, repeatable deployments with less maintenance burden.
Why the other options are wrong
- A. Lambda with custom scripts requires custom code maintenance and is less reliable than infrastructure-as-code solutions like CloudFormation.
- C. Keeping EC2 instances active in a secondary region continuously wastes resources during normal operations.
- D. Secondary Availability Zone is not true DR; it doesn't protect against regional failures and doesn't meet the cross-region requirement implied by 'disaster recovery.'
Question 102
A company has a service that reads and writes large amounts of data from an Amazon S3 bucket in the same AWS Region. The service is deployed on Amazon EC2 instances within the private subnet of a VPC. The service communicates with Amazon S3 over a NAT gateway in the public subnet. However, the company wants a solution that will reduce the data output costs. Which solution will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: C. Provision a VPC gateway endpoint. Configure the route table for the private subnet to use the gateway endpoint as the route for all S3 traffic.
A VPC gateway endpoint for S3 eliminates data transfer costs for S3 access from EC2 instances in private subnets by routing traffic directly to S3 without traversing the NAT gateway. This is the most cost-effective solution because NAT gateway data transfer charges are eliminated entirely for S3 traffic, which is being charged at both the NAT gateway egress rate and S3 data transfer rate. Gateway endpoints are free and provide direct routing via the route table.
Why the other options are wrong
- A. A dedicated NAT instance still incurs data transfer costs for S3 traffic and adds operational overhead.
- B. NAT instances cannot be placed in private subnets without additional routing complexity and still incur data transfer costs.
- D. Adding a second NAT gateway does not reduce data transfer costs; it only adds redundancy at additional expense.
Question 103
A solutions architect configured a VPC that has a small range of IP addresses. The number of Amazon EC2 instances that are in the VPC is increasing, and there is an insufficient number of IP addresses for future workloads. Which solution resolves this issue with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Add an additional IPv4 CIDR block to increase the number of IP addresses and create additional subnets in the VPC. Create new resources in the new subnets by using the new CIDR.
Adding an additional IPv4 CIDR block to the existing VPC is the least operationally intensive solution. It requires no additional infrastructure management, no peering or transit gateway configuration, and no VPN setup. The company simply expands the VPC's address space and creates new subnets within the same VPC, allowing all instances to communicate natively without additional routing or connectivity layers.
Why the other options are wrong
- B. VPC peering requires managing peering connections, updating route tables in both VPCs, and introduces operational complexity.
- C. Transit Gateway adds unnecessary infrastructure and operational overhead when a simple CIDR expansion within one VPC suffices.
- D. Site-to-Site VPN with EC2-hosted solutions introduces the most complexity with VPN management, EC2 instance maintenance, and encryption overhead.
Question 104
A company has deployed a Java Spring Boot application as a pod that runs on Amazon Elastic Kubernetes Service (Amazon EKS) in private subnets. The application needs to write data to an Amazon DynamoDB table. A solutions architect must ensure that the application can interact with the DynamoDB table without exposing traffic to the internet. Which combination of steps should the solutions architect take to accomplish this goal? (Choose two.)
Show answer and explanation
Correct answer: A, D. Attach an IAM role that has sufficient privileges to the EKS pod; Create a VPC endpoint for DynamoDB.
To access DynamoDB without exposing traffic to the internet, attach an IAM role to the EKS pod (via service accounts and IRSA) to grant necessary permissions. Additionally, create a VPC endpoint for DynamoDB within the VPC so traffic to DynamoDB stays within AWS infrastructure and never traverses the public internet. Together, these provide secure, private access with proper authentication and authorization.
Why the other options are wrong
- B. IAM users are for human users, not pods; pods use IAM roles through service accounts (IRSA).
- C. Network ACLs don't restrict access to DynamoDB; VPC endpoints are the proper mechanism for private service access.
- E. Embedding access keys in code is a severe security anti-pattern; IAM roles are the proper, secure approach.
Question 105
A company’s website provides users with downloadable historical performance reports. The website needs a solution that will scale to meet the company’s website demands globally. The solution should be cost-effective, limit the provisioning of infrastructure resources, and provide the fastest possible response time. Which combination should a solutions architect recommend to meet these requirements?
Show answer and explanation
Correct answer: A. Amazon CloudFront and Amazon S3
CloudFront and S3 together provide the optimal solution for serving static files globally. S3 stores the historical reports cost-effectively, while CloudFront's edge locations cache content near users, delivering the fastest response times with minimal latency. This serverless approach requires no infrastructure provisioning and scales automatically to handle global demand. Lambda and DynamoDB are for dynamic workloads, EC2 Auto Scaling requires operational overhead, and Route 53 alone doesn't serve content.
Why the other options are wrong
- B. Lambda and DynamoDB are designed for dynamic applications with compute requirements, not static file distribution.
- C. Application Load Balancer with EC2 Auto Scaling requires significant operational overhead and doesn't leverage edge caching for global performance.
- D. Route 53 is a DNS service and doesn't serve content or provide the edge caching benefits needed for global static file delivery.
Question 106
An ecommerce company is building a distributed application that involves several serverless functions and AWS services to complete order-processing tasks. These tasks require manual approvals as part of the workflow. A solutions architect needs to design an architecture for the order-processing application. The solution must be able to combine multiple AWS Lambda functions into responsive serverless applications. The solution also must orchestrate data and services that run on Amazon EC2 instances, containers, or on-premises servers. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Use AWS Step Functions to build the application.
AWS Step Functions is purpose-built for orchestrating complex serverless workflows that combine multiple Lambda functions with manual approval steps. It natively supports workflow states, error handling, retries, and human approval tasks without requiring custom logic. This results in the least operational overhead compared to alternatives that require manual integration logic.
Why the other options are wrong
- B. AWS Glue is designed for ETL data processing, not for orchestrating service-to-service workflows or handling manual approvals in application logic.
- C. Amazon SQS is a message queue that does not provide workflow orchestration, state management, or built-in approval mechanisms; it would require significant custom coding.
- D. Lambda + EventBridge requires substantial custom code to implement workflow logic, state management, and approval handling that Step Functions provides natively.
Question 107
A company needs to connect several VPCs in the us-east-1 Region that span hundreds of AWS accounts. The company's networking team has its own AWS account to manage the cloud network. What is the MOST operationally efficient solution to connect the VPCs?
Show answer and explanation
Correct answer: C. Create an AWS Transit Gateway in the networking team’s AWS account. Configure static routes from each VPC.
AWS Transit Gateway is the most operationally efficient solution for connecting hundreds of VPCs across multiple accounts. It provides a centralized hub in the networking team's account, eliminates the need for complex mesh peering configurations, and supports dynamic routing. Static routes can be configured from each VPC to the transit gateway, making it scalable and maintainable as new VPCs are added.
Why the other options are wrong
- A. VPC peering requires a mesh of connections (n² relationships) and manual route table updates, becoming unmanageable with hundreds of VPCs.
- B. Routing traffic through the internet is insecure and inefficient for inter-VPC communication.
- D. VPN gateways with a transit VPC is more complex and less efficient than native Transit Gateway functionality.
Question 108
A company is using a centralized AWS account to store log data in various Amazon S3 buckets. A solutions architect needs to ensure that the data is encrypted at rest before the data is uploaded to the S3 buckets. The data also must be encrypted in transit. Which solution meets these requirements?
Show answer and explanation
Correct answer: A. Use client-side encryption to encrypt the data that is being uploaded to the S3 buckets.
Client-side encryption encrypts data before transmission to S3, ensuring encryption both in transit (encrypted data being sent) and at rest (already encrypted when stored). Server-side encryption only protects data at rest but requires HTTPS/TLS separately for transit encryption, and bucket policies cannot enforce in-transit encryption.
Why the other options are wrong
- B. Server-side encryption only protects data at rest; transit encryption must be configured separately and is not inherently guaranteed.
- C. Bucket policies with SSE-S3 enforce at-rest encryption but do not control transit encryption requirements.
- D. KMS default encryption only addresses at-rest encryption; transit encryption requires separate configuration and cannot be enforced via bucket encryption settings alone.
Question 109
A company needs to export its database once a day to Amazon S3 for other teams to access. The exported object size varies between 2 GB and 5 GB. The S3 access pattern for the data is variable and changes rapidly. The data must be immediately available and must remain accessible for up to 3 months. The company needs the most cost-effective solution that will not increase retrieval time. Which S3 storage class should the company use to meet these requirements?
Show answer and explanation
Correct answer: A. S3 Intelligent-Tiering
S3 Intelligent-Tiering is the most cost-effective solution for data with variable and rapidly changing access patterns. It automatically moves objects between frequent-access and infrequent-access tiers based on actual access patterns, eliminating the need to predict usage. Since the access pattern changes rapidly and is variable, this class optimizes costs without manual intervention or retrieval time penalties. The data must remain immediately available (ruling out Glacier), and the variable access pattern makes Intelligent-Tiering more cost-effective than Standard or Standard-IA.
Why the other options are wrong
- B. Glacier Instant Retrieval is designed for infrequent access and has retrieval fees; it's not suitable for variable, rapidly changing access patterns.
- C. S3 Standard is more expensive than Intelligent-Tiering for this variable access pattern over 3 months.
- D. Standard-IA assumes infrequent access; with variable and rapid changes in access patterns, there would be retrieval fees that Intelligent-Tiering avoids.
Question 110
A company has an application that places hundreds of .csv files into an Amazon S3 bucket every hour. The files are 1 GB in size. Each time a file is uploaded, the company needs to convert the file to Apache Parquet format and place the output file into an S3 bucket. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Create an AWS Lambda function to download the .csv files, convert the files to Parquet format, and place the output files in an S3 bucket. Invoke the Lambda function for each S3 PUT event.
Lambda is the least operationally overhead solution for this use case. Lambda functions triggered by S3 PUT events can download small CSV files, convert them to Parquet format, and upload results directly. For 1 GB files with hundreds per hour, Lambda's generous free tier and pay-per-invocation model provide simplicity. This is more straightforward than Glue ETL job management.
Why the other options are wrong
- B. Invoking Spark jobs from Lambda adds unnecessary complexity; Spark is overkill for CSV-to-Parquet conversion.
- C. This solution is overly complex, requiring Glue crawlers, Athena queries, and scheduled Lambda functions when direct file conversion is simpler.
- D. While Glue ETL works, it requires job creation and management overhead. Lambda with direct conversion libraries is simpler and more cost-effective for this straightforward transformation.
Question 111
A company’s application is having performance issues. The application is stateful and needs to complete in-memory tasks on Amazon EC2 instances. The company used AWS CloudFormation to deploy infrastructure and used the M5 EC2 instance family. As traffic increased, the application performance degraded. Users are reporting delays when the users attempt to access the application. Which solution will resolve these issues in the MOST operationally efficient way?
Show answer and explanation
Correct answer: D. Modify the CloudFormation templates. Replace the EC2 instances with R5 EC2 instances. Deploy the Amazon CloudWatch agent on the EC2 instances to generate custom application latency metrics for future capacity planning.
The application is memory-intensive (in-memory tasks) and performance is degrading with increased traffic. R5 instances are memory-optimized with significantly more RAM than M5 instances, directly addressing the performance bottleneck. Modifying CloudFormation templates (infrastructure as code) is more operationally efficient than console changes. The CloudWatch agent enables custom application latency metrics for proper monitoring and future capacity planning, fulfilling all operational efficiency requirements.
Why the other options are wrong
- A. T3 instances are burstable and have less memory than M5; using the console bypasses infrastructure-as-code practices.
- B. Manual scaling defeats operational efficiency and doesn't address the root cause of memory constraints.
- C. Built-in EC2 memory metrics are insufficient; custom application metrics are needed for proper performance tracking and capacity planning.
Question 112
A hospital needs to store patient records in an Amazon S3 bucket. The hospital’s compliance team must ensure that all protected health information (PHI) is encrypted in transit and at rest. The compliance team must administer the encryption key for data at rest. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use the aws:SecureTransport condition on S3 bucket policies to allow only encrypted connections over HTTPS (TLS). Configure default encryption for each S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS). Assign the compliance team to manage the KMS keys.
Option C meets both requirements: using the aws:SecureTransport condition ensures encryption in transit (HTTPS/TLS), and SSE-KMS provides encryption at rest while allowing the compliance team to manage the KMS master keys directly. This gives the compliance team full control over encryption key lifecycle and meets HIPAA requirements for PHI protection. KMS keys can be audited and rotated according to compliance policies.
Why the other options are wrong
- A. AWS Certificate Manager certificates are for public SSL/TLS endpoints and do not directly control S3 encryption; ACM is not the appropriate solution for managing encryption keys at rest.
- B. SSE-S3 uses AWS-managed keys, not customer-managed keys, so the compliance team cannot administer the encryption keys as required.
- D. Macie detects and classifies sensitive data but does not provide encryption at rest; it does not meet the encryption and key management requirements.
Question 113
A company needs to review its AWS Cloud deployment to ensure that its Amazon S3 buckets do not have unauthorized configuration changes. What should a solutions architect do to accomplish this goal?
Show answer and explanation
Correct answer: A. Turn on AWS Config with the appropriate rules.
AWS Config is specifically designed to monitor and record AWS resource configurations and compliance. It can detect unauthorized configuration changes to S3 buckets through predefined managed rules and custom rules. AWS Config continuously evaluates configurations against desired settings and sends notifications when changes occur, making it the ideal solution for ensuring S3 bucket configuration governance.
Why the other options are wrong
- B. Trusted Advisor provides best practice recommendations but doesn't continuously monitor for unauthorized configuration changes in real-time.
- C. Amazon Inspector is focused on vulnerability assessment of EC2 instances and applications, not configuration compliance monitoring.
- D. S3 server access logging records access patterns but doesn't detect or prevent unauthorized configuration changes to buckets themselves.
Question 114
An ecommerce company needs to run a scheduled daily job to aggregate and filter sales records for analytics. The company stores the sales records in an Amazon S3 bucket. Each object can be up to 10 GB in size. Based on the number of sales events, the job can take up to an hour to complete. The CPU and memory usage of the job are constant and are known in advance. A solutions architect needs to minimize the amount of operational effort that is needed for the job to run. Which solution meets these requirements?
Show answer and explanation
Correct answer: C. Create an Amazon Elastic Container Service (Amazon ECS) cluster with an AWS Fargate launch type. Create an Amazon EventBridge scheduled event that launches an ECS task on the cluster to run the job.
AWS Fargate with ECS is the optimal choice for this use case. The job requires up to one hour of execution time, which exceeds Lambda's 15-minute timeout limit. Fargate eliminates the operational overhead of managing EC2 instances while providing the necessary compute capacity for the known resource requirements. EventBridge can trigger the ECS task on a daily schedule, and this approach requires minimal operational effort.
Why the other options are wrong
- A. Lambda has a maximum timeout of 15 minutes, which is insufficient for a job that can take up to one hour.
- B. Using API Gateway adds unnecessary complexity and does not resolve the Lambda timeout limitation for hour-long jobs.
- D. EC2 launch type with Auto Scaling requires more operational overhead for instance management compared to Fargate's serverless approach.
Question 115
A company hosts an application on AWS Lambda functions that are invoked by an Amazon API Gateway API. The Lambda functions save customer data to an Amazon Aurora MySQL database. Whenever the company upgrades the database, the Lambda functions fail to establish database connections until the upgrade is complete. The result is that customer data is not recorded for some of the event. A solutions architect needs to design a solution that stores customer data that is created during database upgrades. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Store the customer data in an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Create a new Lambda function that polls the queue and stores the customer data in the database.
Writing customer data to an SQS queue decouples the API from the database, so records are stored durably even while the database is being upgraded. A separate Lambda function polls the queue and writes the data once the database is available, so nothing is lost.
Why the other options are wrong
- A. RDS Proxy pools connections and shortens failover interruptions, but it cannot store writes while the database is unavailable during an upgrade.
- B. Lambda has a 15-minute maximum run time, so in-code retries cannot reliably outlast a database upgrade.
- C. Lambda local storage is temporary and tied to the execution environment, so it is not a durable place to keep customer data.
Question 116
A company has an on-premises application that generates a large amount of time-sensitive data that is backed up to Amazon S3. The application has grown and there are user complaints about internet bandwidth limitations. A solutions architect needs to design a long-term solution that allows for both timely backups to Amazon S3 and with minimal impact on internet connectivity for internal users. Which solution meets these requirements?
Show answer and explanation
Correct answer: B. Establish a new AWS Direct Connect connection and direct backup traffic through this new connection.
AWS Direct Connect provides a dedicated network connection with consistent, high bandwidth for backup traffic, bypassing internet limitations without impacting user connectivity. This is a long-term solution that solves both the bandwidth constraint and the timing issue for time-sensitive backups.
Why the other options are wrong
- A. VPN connections still use internet bandwidth and don't resolve the underlying connectivity limitations for large backups.
- C. Snowball is a data migration service, not ideal for continuous, time-sensitive backup operations that require daily device returns.
- D. AWS doesn't remove service limits through support tickets; S3 is designed to handle high throughput without artificial limits being the constraint here.
Question 117
A company runs an application on a large fleet of Amazon EC2 instances. The application reads and writes entries into an Amazon DynamoDB table. The size of the DynamoDB table continuously grows, but the application needs only data from the last 30 days. The company needs a solution that minimizes cost and development effort. Which solution meets these requirements?
Show answer and explanation
Correct answer: D. Extend the application to add an attribute that has a value of the current timestamp plus 30 days to each new item that is created in the table. Configure DynamoDB to use the attribute as the TTL attribute.
Option D uses DynamoDB Time-To-Live (TTL), which automatically deletes items after a specified duration with minimal operational overhead and no custom code. By setting a TTL attribute to current timestamp plus 30 days, items older than 30 days are automatically removed. This is the most cost-effective and development-efficient solution. Options A and B require manual intervention or additional infrastructure. Option C requires Lambda invocations and custom logic.
Why the other options are wrong
- A. CloudFormation stack redeployment every 30 days is operationally complex and error-prone.
- B. Requires an additional EC2 instance for monitoring, adding operational overhead and cost.
- C. Requires Lambda function development and DynamoDB Streams setup; TTL is simpler and more efficient.
Question 118
A company runs a highly available image-processing application on Amazon EC2 instances in a single VPC. The EC2 instances run inside several subnets across multiple Availability Zones. The EC2 instances do not communicate with each other. However, the EC2 instances download images from Amazon S3 and upload images to Amazon S3 through a single NAT gateway. The company is concerned about data transfer charges. What is the MOST cost-effective way for the company to avoid Regional data transfer charges?
Show answer and explanation
Correct answer: C. Deploy a gateway VPC endpoint for Amazon S3.
A gateway VPC endpoint for S3 allows EC2 instances to access S3 through a private connection within AWS without traversing the internet or NAT gateway, eliminating Regional data transfer charges entirely. This is the most cost-effective solution as VPC endpoints incur no data transfer fees for S3 communication.
Why the other options are wrong
- A. Multiple NAT gateways per AZ still incur Regional data transfer charges and increase costs rather than reducing them.
- B. NAT instances also incur Regional data transfer charges and require more operational overhead than a gateway endpoint.
- D. Dedicated Hosts don't reduce data transfer charges and are more expensive than standard instances.
Question 119
A research company runs experiments that are powered by a simulation application and a visualization application. The simulation application runs on Linux and outputs intermediate data to an NFS share every 5 minutes. The visualization application is a Windows desktop application that displays the simulation output and requires an SMB file system. The company maintains two synchronized file systems. This strategy is causing data duplication and inefficient resource usage. The company needs to migrate the applications to AWS without making code changes to either application. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Migrate the simulation application to Linux Amazon EC2 instances. Migrate the visualization application to Windows EC2 instances. Configure Amazon FSx for NetApp ONTAP for storage.
Amazon FSx for NetApp ONTAP is the ideal solution because it natively supports both NFS (for the Linux simulation application) and SMB (for the Windows visualization application) protocols simultaneously on a single file system. This eliminates data duplication, requires no application code changes, and allows both EC2 instances to access the same shared storage with their respective protocol requirements met. The solution maintains the existing Linux and Windows application architecture while consolidating to a single synchronized file system.
Why the other options are wrong
- A. Lambda is unsuitable for long-running simulation applications and S3 does not natively support NFS or SMB protocols that the applications require.
- B. ECS does not address the fundamental protocol requirement mismatch; FSx File Gateway is designed for on-premises access to FSx, not for inter-application communication within AWS.
- C. SQS is a message queue service unsuitable for exchanging intermediate simulation data files; it does not provide the shared file system access that both applications need.
Question 120
A company is storing 700 terabytes of data on a large network-attached storage (NAS) system in its corporate data center. The company has a hybrid environment with a 10 Gbps AWS Direct Connect connection. After an audit from a regulator, the company has 90 days to move the data to the cloud. The company needs to move the data efficiently and without disruption. The company still needs to be able to access and update the data during the transfer window. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Create an AWS DataSync agent in the corporate data center. Create a data transfer task Start the transfer to an Amazon S3 bucket.
AWS DataSync is purpose-built for large-scale data transfers with a direct network connection. It automatically optimizes throughput over the Direct Connect connection, provides scheduling and monitoring capabilities, allows ongoing access and updates during transfer, and securely transfers data to S3. DataSync is efficient, reliable, and maintains data consistency without disruption, meeting all requirements within the 90-day window.
Why the other options are wrong
- B. Snowball Edge introduces shipping delays and doesn't allow concurrent access during transfer, limiting the requirement to update data in-flight.
- C. rsync lacks optimization features and monitoring capabilities; it's not designed for efficient large-scale cloud transfers of this magnitude.
- D. Tape backup adds significant delay, doesn't allow concurrent access during transfer, and is outdated for cloud migration scenarios.
Question 121
A company has multiple AWS accounts that use consolidated billing. The company runs several active high performance Amazon RDS for Oracle On-Demand DB instances for 90 days. The company’s finance team has access to AWS Trusted Advisor in the consolidated billing account and all other AWS accounts. The finance team needs to use the appropriate AWS account to access the Trusted Advisor check recommendations for RDS. The finance team must review the appropriate Trusted Advisor check to reduce RDS costs. Which combination of steps should the finance team take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, C. Use the Trusted Advisor recommendations from the consolidated billing account to see all RDS instance checks at the same time.; Review the Trusted Advisor check for Amazon RDS Reserved Instance Optimization.
Trusted Advisor Reserved Instance recommendations are produced for the consolidated billing (paying) account, so reviewing that account (B) shows the RDS checks for all linked accounts at the same time instead of opening each account one by one. The instances are active On-Demand DB instances that have run for 90 days, which is exactly the pattern the Amazon RDS Reserved Instance Optimization check (C) looks for. That check recommends purchasing reserved DB instances for steady usage, and this is the Trusted Advisor check that reduces the cost of these RDS instances.
Why the other options are wrong
- A. The member account only shows its own instances, while the Reserved Instance recommendations are generated for the consolidated billing account.
- D. The Idle DB Instances check flags unused instances to be stopped or deleted, but the instances in this scenario are active and in use.
- E. The Redshift Reserved Node Optimization check covers Amazon Redshift nodes, so it does not apply to the RDS for Oracle instances.
Question 122
The following IAM policy is attached to an IAM group. This is the only policy applied to the group. What are the effective IAM permissions of this policy for group members?
Show answer and explanation
Correct answer: D. Group members are allowed the ec2:StopInstances and ec2:TerminateInstances permissions for the us-east-1 Region only when logged in with multi-factor authentication (MFA). Group members are permitted any other Amazon EC2 action within the us-east-1 Region.
Statement 1 allows all EC2 actions (ec2:*) only in the us-east-1 Region with a StringEquals condition. Statement 2 denies ec2:StopInstances and ec2:TerminateInstances actions on all resources, but only when MFA is NOT present (BoolIfExists with false condition). Since Deny statements override Allow statements in IAM, members cannot stop or terminate instances without MFA in us-east-1. However, when MFA IS present, the Deny condition is false, so the Allow statement permits those actions. Members can perform any other EC2 actions within us-east-1 under Statement 1. The key insight is that the Deny is conditional on MFA being absent, effectively requiring MFA for stop/terminate actions while allowing other EC2 actions in us-east-1.
Why the other options are wrong
- A. Incorrect because Statement 2 is a Deny that does apply; it restricts StopInstances and TerminateInstances when MFA is not present.
- B. Incorrect because the Deny in Statement 2 only applies when MFA is absent (BoolIfExists is false); with MFA present, these actions are permitted.
- C. Incorrect because the permissions are region-specific to us-east-1 only (Statement 1 has StringEquals condition), not for all Regions, and the Deny condition only affects stop/terminate actions.
Question 123
A company uses AWS Organizations. A member account has purchased a Compute Savings Plan. Because of changes in the workloads inside the member account, the account no longer receives the full benefit of the Compute Savings Plan commitment. The company uses less than 50% of its purchased compute power.
Show answer and explanation
Correct answer: B. Turn on discount sharing from the Billing Preferences section of the account console in the company's Organizations management account.
In AWS Organizations, Compute Savings Plan discounts can be shared across member accounts when discount sharing is enabled at the management account level, not the individual member account level. Enabling this in the management account console allows the underutilized Savings Plan in one member account to benefit other accounts in the organization, maximizing discount utilization.
Why the other options are wrong
- A. Discount sharing must be enabled at the management account level, not in the member account that purchased the plan.
- C. Migrating workloads is a workaround that doesn't solve the underlying issue; discount sharing achieves the same benefit across accounts.
- D. Reserved Instance Marketplace is for selling Reserved Instances, not Savings Plans; Savings Plans cannot be sold in the Marketplace.
Question 124
A company has thousands of edge devices that collectively generate 1 TB of status alerts each day. Each alert is approximately 2 KB in size. A solutions architect needs to implement a solution to ingest and store the alerts for future analysis. The company wants a highly available solution. However, the company needs to minimize costs and does not want to manage additional infrastructure. Additionally, the company wants to keep 14 days of data available for immediate analysis and archive any data older than 14 days. What is the MOST operationally efficient solution that meets these requirements?
Show answer and explanation
Correct answer: A. Create an Amazon Kinesis Data Firehose delivery stream to ingest the alerts. Configure the Kinesis Data Firehose stream to deliver the alerts to an Amazon S3 bucket. Set up an S3 Lifecycle configuration to transition data to Amazon S3 Glacier after 14 days.
Kinesis Data Firehose automatically ingests alerts at scale with high availability, delivers to S3 for storage, and requires no infrastructure management. S3 Lifecycle policies automatically transition data older than 14 days to Glacier for archival, meeting all cost and operational efficiency requirements without manual intervention.
Why the other options are wrong
- B. EC2 instances require management, patching, and scaling logic; this adds significant operational overhead and complexity.
- C. OpenSearch clusters require manual snapshot management and cluster tuning; this is more operationally complex and expensive than automated S3 lifecycle policies.
- D. SQS is not designed for long-term data storage; consumers must actively manage message age and perform manual archival, adding operational complexity and latency.
Question 125
A media company is evaluating the possibility of moving its systems to the AWS Cloud. The company needs at least 10 TB of storage with the maximum possible I/O performance for video processing, 300 TB of very durable storage for storing media content, and 900 TB of storage to meet requirements for archival media that is not in use anymore. Which set of services should a solutions architect recommend to meet these requirements?
Show answer and explanation
Correct answer: A. Amazon EBS for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage
Amazon EBS provides the maximum I/O performance needed for the 10 TB video processing requirement. Amazon S3 offers highly durable storage (11 nines of durability) suitable for the 300 TB media content. Amazon S3 Glacier provides cost-effective archival storage for the 900 TB of infrequently accessed media. This combination optimally matches performance, durability, and cost requirements for each workload tier.
Why the other options are wrong
- B. Amazon EFS is a shared file system optimized for scalable file access, not for the massive 300 TB storage or the durability guarantees that S3 provides for media archival.
- C. EC2 instance store provides high performance but is ephemeral and lacks durability; EFS does not match the archival storage needs as well as S3 Glacier.
- D. EC2 instance store is ephemeral and unreliable for persistent storage; S3 should be used for the 300 TB durable storage requirement, not for archival alone.
Question 126
A company is building a containerized application on premises and decides to move the application to AWS. The application will have thousands of users soon after it is deployed. The company is unsure how to manage the deployment of containers at scale. The company needs to deploy the containerized application in a highly available architecture that minimizes operational overhead. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Store container images in an Amazon Elastic Container Registry (Amazon ECR) repository. Use an Amazon Elastic Container Service (Amazon ECS) cluster with the AWS Fargate launch type to run the containers. Use target tracking to scale automatically based on demand.
AWS Fargate with Amazon ECS provides serverless container orchestration that minimizes operational overhead by eliminating the need to manage EC2 instances. It offers high availability by default, integrates with ECR for image storage, and supports automatic target tracking scaling based on demand. This meets all requirements without requiring infrastructure management.
Why the other options are wrong
- B. EC2 launch type requires managing EC2 instances, increasing operational overhead compared to Fargate's serverless approach.
- C. Running a repository on an EC2 instance creates a single point of failure and manual scaling based on CloudWatch monitoring is not as efficient as target tracking.
- D. Manual AMI-based approach requires managing infrastructure and scaling policies, adding unnecessary operational complexity.
Question 127
A company is deploying a two-tier web application in a VPC. The web tier is using an Amazon EC2 Auto Scaling group with public subnets that span multiple Availability Zones. The database tier consists of an Amazon RDS for MySQL DB instance in separate private subnets. The web tier requires access to the database to retrieve product information. The web application is not working as intended. The web application reports that it cannot connect to the database. The database is confirmed to be up and running. All configurations for the network ACLs, security groups, and route tables are still in their default states. What should a solutions architect recommend to fix the application?
Show answer and explanation
Correct answer: D. Add an inbound rule to the security group of the database tier’s RDS instance to allow traffic from the web tiers security group.
The issue is that the RDS database security group is in its default state, which denies all inbound traffic by default. The web tier EC2 instances cannot connect to the database because there is no security group rule allowing traffic from the web tier to the database tier. Adding an inbound rule to the RDS security group that allows traffic from the web tier's security group solves this connectivity problem. Network ACLs and route tables are already configured correctly since they are in their default permissive states for traffic between subnets.
Why the other options are wrong
- A. Network ACLs are in their default state, which already allows all traffic between subnets; this is not the blocking factor.
- B. Route tables are in their default state and already have the necessary routes for VPC traffic; this is not required.
- C. VPC peering is unnecessary since both tiers are already in the same VPC; the issue is simply a security group rule.
Question 128
A company wants to create a mobile app that allows users to stream slow-motion video clips on their mobile devices. Currently, the app captures video clips and uploads the video clips in raw format into an Amazon S3 bucket. The app retrieves these video clips directly from the S3 bucket. However, the videos are large in their raw format. Users are experiencing issues with buffering and playback on mobile devices. The company wants to implement solutions to maximize the performance and scalability of the app while minimizing operational overhead. Which combination of solutions will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, C. Deploy Amazon CloudFront for content delivery and caching; Use Amazon Elastic Transcoder to convert the video files to more appropriate formats.
CloudFront (A) is essential for content delivery and caching to reduce buffering and improve playback performance on mobile devices by distributing content geographically and caching at edge locations. Amazon Elastic Transcoder (C) converts large raw video files into mobile-optimized formats, reducing file sizes and enabling smooth playback on mobile devices. Together, these solutions maximize performance and scalability while minimizing operational overhead.
Why the other options are wrong
- B. DataSync is for data replication between storage systems, not for optimizing video delivery or format conversion for mobile playback.
- D. EC2 instances in Local Zones are unnecessary and create operational overhead; CloudFront is the managed solution for content delivery.
- E. Using EC2 instances for transcoding creates significant operational overhead; Elastic Transcoder is the managed service designed specifically for this purpose.
Question 129
A company has an on-premises volume backup solution that has reached its end of life. The company wants to use AWS as part of a new backup solution and wants to maintain local access to all the data while it is backed up on AWS. The company wants to ensure that the data backed up on AWS is automatically and securely transferred. Which solution meets these requirements?
Show answer and explanation
Correct answer: D. Use AWS Storage Gateway and configure a stored volume gateway. Run the Storage Gateway software appliance on premises and map the gateway storage volumes to on-premises storage. Mount the gateway storage volumes to provide local access to the data.
A stored volume gateway maintains a copy of the entire dataset on-premises while asynchronously backing up to S3, providing local access at all times. The Storage Gateway software appliance runs on-premises and maps gateway volumes to local storage, ensuring data is always available locally while being securely transferred to AWS. This meets the requirement of maintaining local access while backing up to AWS.
Why the other options are wrong
- A. Snowball is a one-time migration tool, not suitable for ongoing backup solutions with local access requirements.
- B. Snowball Edge is also a migration device, not designed for continuous local access during backup operations.
- C. A cached volume gateway only keeps a percentage of data cached locally, not all data as required for maintaining full local access.
Question 130
A company hosts a multi-tier web application that uses an Amazon Aurora MySQL DB cluster for storage. The application tier is hosted on Amazon EC2 instances. The company’s IT security guidelines mandate that the database credentials be encrypted and rotated every 14 days. What should a solutions architect do to meet this requirement with the LEAST operational effort?
Show answer and explanation
Correct answer: A. Create a new AWS Key Management Service (AWS KMS) encryption key. Use AWS Secrets Manager to create a new secret that uses the KMS key with the appropriate credentials. Associate the secret with the Aurora DB cluster. Configure a custom rotation period of 14 days.
AWS Secrets Manager is purpose-built for storing, encrypting, and automatically rotating database credentials. It integrates directly with Aurora, handles KMS encryption transparently, and provides built-in rotation scheduling at the specified 14-day interval with minimal operational effort, just configure and forget.
Why the other options are wrong
- B. Parameter Store requires custom Lambda functions for rotation logic, adding operational overhead compared to Secrets Manager's native rotation.
- C. Storing credentials in EFS and using Lambda for rotation is operationally complex and requires file system management.
- D. Storing credentials in S3 with Lambda rotation adds unnecessary complexity and requires downloading files regularly, introducing security and consistency risks.
Question 131
An application runs on Amazon EC2 instances in private subnets. The application needs to access an Amazon DynamoDB table. What is the MOST secure way to access the table while ensuring that the traffic does not leave the AWS network?
Show answer and explanation
Correct answer: A. Use a VPC endpoint for DynamoDB.
A VPC endpoint for DynamoDB allows EC2 instances in private subnets to access DynamoDB without requiring internet gateway or NAT gateway connectivity. Traffic stays entirely within the AWS network, never traversing the public internet, which is the most secure approach. This provides private, secure access to DynamoDB with no additional infrastructure or operational overhead. NAT gateways and NAT instances route traffic through the internet, while internet gateways require public routes, all violating the requirement that traffic not leave the AWS network.
Why the other options are wrong
- B. NAT gateways route traffic through the internet, causing data to leave the AWS network.
- C. NAT instances similarly route traffic through the internet, and instances in private subnets cannot host NAT instances securely.
- D. Internet gateways enable internet routing, causing traffic to leave the AWS network and violating security requirements.
Question 132
A company has applications hosted on Amazon EC2 instances with IPv6 addresses. The applications must initiate communications with other external applications using the internet. However the company’s security policy states that any external service cannot initiate a connection to the EC2 instances. What should a solutions architect recommend to resolve this issue?
Show answer and explanation
Correct answer: D. Create an egress-only internet gateway and make it the destination of the subnet's route table
An egress-only internet gateway (EOIGW) is specifically designed for IPv6 traffic in VPCs, allowing instances to initiate outbound connections to the internet while preventing inbound connections from being initiated externally. This perfectly matches the requirement of allowing EC2 instances to communicate outbound while blocking external inbound initiations. The EOIGW functions as the IPv6 equivalent of NAT, providing one-way communication control.
Why the other options are wrong
- A. NAT gateways work with IPv4 addresses and would not be appropriate for IPv6-only communication requirements.
- B. An internet gateway allows bidirectional traffic, which violates the security policy preventing external services from initiating connections.
- C. A virtual private gateway is used for VPN connections to on-premises networks, not for controlling outbound-only internet access for IPv6.
Question 133
A company uses a three-tier web application to provide training to new employees. The application is accessed for only 12 hours every day. The company is using an Amazon RDS for MySQL DB instance to store information and wants to minimize costs. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: D. Create AWS Lambda functions to start and stop the DB instance. Create Amazon EventBridge (Amazon CloudWatch Events) scheduled rules to invoke the Lambda functions. Configure the Lambda functions as event targets for the rules.
Lambda functions combined with EventBridge scheduled rules provide a serverless, low-overhead solution to automatically start and stop the RDS instance on a schedule. Since the application is only accessed 12 hours per day, stopping the DB instance during the remaining 12 hours significantly reduces costs while maintaining the ability to restart it automatically before users need it.
Why the other options are wrong
- A. Systems Manager Session Manager is for interactive shell access to instances, not for database automation; this approach is unnecessarily complex.
- B. ElastiCache cannot replace a stopped database for read/write operations; invalidating cache when the DB starts still requires the database to be running.
- C. Using an EC2 instance with a cron job for scheduling is operationally heavier than serverless Lambda and EventBridge, increasing operational overhead.
Question 134
A company that uses AWS is building an application to transfer data to a product manufacturer. The company has its own identity provider (IdP). The company wants the IdP to authenticate application users while the users use the application to transfer data. The company must use Applicability Statement 2 (AS2) protocol. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use AWS Transfer Family to transfer the data. Create an AWS Lambda function for IdP authentication.
AWS Transfer Family is the AWS service that natively supports AS2 protocol for secure B2B data exchange. It can be configured with a Lambda function for custom IdP authentication, allowing the company to use its own identity provider while maintaining AS2 protocol compliance. DataSync (A) does not support AS2, AppFlow (B) does not support AS2 and uses ECS tasks, and Storage Gateway (D) does not support AS2 and is designed for hybrid storage scenarios, not B2B data transfer.
Why the other options are wrong
- A. AWS DataSync does not support the AS2 protocol and is designed for on-premises to AWS synchronization.
- B. Amazon AppFlow does not support AS2 protocol and is designed for cloud application integrations like Salesforce.
- D. AWS Storage Gateway does not support AS2 protocol and is designed for hybrid storage, not external B2B data transfer.
Question 135
A company collects data from a large number of participants who use wearable devices. The company stores the data in an Amazon DynamoDB table and uses applications to analyze the data. The data workload is constant and predictable. The company wants to stay at or below its forecasted budget for DynamoDB. Which solution will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: B. Use provisioned mode. Specify the read capacity units (RCUs) and write capacity units (WCUs).
For a constant, predictable workload, provisioned mode with set RCUs and WCUs is cheaper than on-demand and keeps spending fixed and within budget. Reserved capacity is available only for the DynamoDB Standard table class, so it cannot be combined with Standard-IA.
Why the other options are wrong
- A. DynamoDB reserved capacity cannot be purchased for Standard-IA tables, and Standard-IA suits storage-heavy tables with rare access, not constant analysis.
- C. On-demand mode does not use configured RCUs and WCUs and costs more per request for steady workloads.
- D. On-demand mode does not use configured capacity units and cannot use reserved capacity.
Question 136
A company is migrating an application from on-premises servers to Amazon EC2 instances. As part of the migration design requirements, a solutions architect must implement infrastructure metric alarms. The company does not need to take action if CPU utilization increases to more than 50% for a short burst of time. However, if the CPU utilization increases to more than 50% and read IOPS on the disk are high at the same time, the company needs to act as soon as possible. The solutions architect also must reduce false alarms. What should the solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: A. Create Amazon CloudWatch composite alarms where possible.
CloudWatch composite alarms allow you to create a single alarm that monitors multiple metrics together using logical operators (AND/OR). This enables alarming only when CPU utilization exceeds 50% AND read IOPS are high simultaneously, directly addressing the requirement to act only when both conditions occur and reducing false alarms from transient CPU spikes.
Why the other options are wrong
- B. Dashboards are for visualization and manual monitoring, not for automated alerting that takes action.
- C. CloudWatch Synthetics canaries are for synthetic monitoring of application endpoints, not infrastructure metric correlation.
- D. Single metric alarms with multiple thresholds cannot create AND/OR logic between different metrics the way composite alarms do.
Question 137
A company is planning to use an Amazon DynamoDB table for data storage. The company is concerned about cost optimization. The table will not be used on most mornings. In the evenings, the read and write traffic will often be unpredictable. When traffic spikes occur, they will happen very quickly. What should a solutions architect recommend?
Show answer and explanation
Correct answer: A. Create a DynamoDB table in on-demand capacity mode.
On-demand capacity mode is optimal for this scenario because the table has unpredictable evening traffic with rapid spikes and unused mornings. On-demand automatically scales without capacity planning, charges only for actual usage, and handles sudden spikes without provisioning delays. Provisioned capacity would require either over-provisioning to handle spikes (wasting money during low-usage mornings) or under-provisioning (causing throttling during spikes). Global secondary indexes and global tables address different concerns (queries and replication), not cost optimization for variable demand patterns.
Why the other options are wrong
- B. Global secondary indexes improve query flexibility but don't address cost optimization for variable traffic.
- C. Provisioned capacity with auto-scaling still requires minimum provisioned units and has scaling delays during sudden spikes.
- D. Global tables add complexity and cost through multi-region replication without addressing the core cost optimization need.
Question 138
A survey company has gathered data for several years from areas in the United States. The company hosts the data in an Amazon S3 bucket that is 3 TB in size and growing. The company has started to share the data with a European marketing firm that has S3 buckets. The company wants to ensure that its data transfer costs remain as low as possible. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Configure S3 Cross-Region Replication from the company's S3 bucket to one of the marketing firm's S3 buckets.
S3 Cross-Region Replication automatically replicates objects from the US bucket to the European marketing firm's bucket. The firm then accesses their local copy, avoiding data transfer charges for egress from the US and reducing overall transfer costs. Once replicated, the firm's local access is free, minimizing ongoing transfer expenses.
Why the other options are wrong
- A. Requester Pays shifts costs to the marketing firm but doesn't reduce overall data transfer costs; it merely changes who pays for the expensive cross-region egress.
- C. Cross-account access still requires data to traverse from US to Europe on every access, incurring the same data transfer charges without cost reduction.
- D. Intelligent-Tiering optimizes storage costs but does not reduce data transfer costs; syncing to the marketing firm's bucket is a one-time initial transfer but lacks the automatic ongoing replication benefits of CRR.
Question 139
A company runs its infrastructure on AWS and has a registered base of 700,000 users for its document management application. The company intends to create a product that converts large .pdf files to .jpg image files. The .pdf files average 5 MB in size. The company needs to store the original files and the converted files. A solutions architect must design a scalable solution to accommodate demand that will grow rapidly over time. Which solution meets these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: A. Save the .pdf files to Amazon S3. Configure an S3 PUT event to invoke an AWS Lambda function to convert the files to .jpg format and store them back in Amazon S3.
Amazon S3 with Lambda is the most cost-effective serverless solution for this use case. S3 is ideal for storing large files (5 MB PDFs), S3 PUT events trigger Lambda functions automatically to convert files to JPG format, and the solution scales automatically with demand at minimal cost. Option B is inappropriate because DynamoDB has item size limits (400 KB) unsuitable for 5 MB files. Options C and D require managing EC2 instances and storage, adding operational and cost overhead.
Why the other options are wrong
- B. DynamoDB has a maximum item size of 400 KB, making it unsuitable for storing and processing 5 MB PDF files.
- C. EBS storage is not automatically scalable across instances and requires manual capacity management; Elastic Beanstalk adds operational overhead.
- D. EFS for a file conversion pipeline with EC2 instances adds unnecessary operational complexity and cost compared to serverless S3/Lambda approach.
Question 140
A company recently started using Amazon Aurora as the data store for its global ecommerce application. When large reports are run, developers report that the ecommerce application is performing poorly. After reviewing metrics in Amazon CloudWatch, a solutions architect finds that the ReadIOPS and CPUUtilizalion metrics are spiking when monthly reports run. What is the MOST cost-effective solution?
Show answer and explanation
Correct answer: B. Migrate the monthly reporting to an Aurora Replica.
Option B is the most cost-effective solution. Aurora read replicas allow reporting queries to run against a separate replica, isolating the heavy reporting workload from the production application without affecting ecommerce performance. This leverages Aurora's built-in read scaling capability at minimal additional cost. It addresses the root cause (resource contention from reporting) without unnecessary database upgrades.
Why the other options are wrong
- A. Migrating to Redshift introduces significant cost and operational complexity when Aurora read replicas provide an elegant built-in solution.
- C. Upgrading the instance class increases cost and doesn't address the real issue of workload isolation.
- D. Increasing Provisioned IOPS adds cost without solving the fundamental problem of resource competition between application and reporting queries.
Question 141
A company runs an online marketplace web application on AWS. The application serves hundreds of thousands of users during peak hours. The company needs a scalable, near-real-time solution to share the details of millions of financial transactions with several other internal applications. Transactions also need to be processed to remove sensitive data before being stored in a document database for low-latency retrieval. What should a solutions architect recommend to meet these requirements?
Show answer and explanation
Correct answer: C. Stream the transactions data into Amazon Kinesis Data Streams. Use AWS Lambda integration to remove sensitive data from every transaction and then store the transactions data in Amazon DynamoDB. Other applications can consume the transactions data off the Kinesis data stream.
Kinesis Data Streams provides near-real-time ingestion of millions of transactions, AWS Lambda integration allows processing to remove sensitive data before storage, and other applications can consume data directly from the stream. This meets all requirements: scalability, near-real-time processing, data sanitization, and multi-consumer support.
Why the other options are wrong
- A. DynamoDB does not have native rules to remove sensitive data on write, and DynamoDB Streams are not designed for external application consumption at scale.
- B. Kinesis Data Firehose is batch-oriented and not designed for near-real-time sharing; it's better for periodic delivery rather than continuous stream consumption.
- D. Batch processing with S3 files introduces significant latency and does not meet near-real-time requirements; it also requires managing Lambda trigger logic for file processing.
Question 142
A solutions architect has created two IAM policies: Policy1 and Policy2. Both policies are attached to an IAM group. A cloud engineer is added as an IAM user to the IAM group. Which action will the cloud engineer be able to perform?
Show answer and explanation
Correct answer: C. Deleting Amazon EC2 instances
Policy1 allows multiple read/list/get actions (iam:Get, iam:List, kms:List, ec2:*, ds:*, logs:Get, logs:Describe) on all resources (*), while Policy2 explicitly denies ds:Delete on all resources. When policies are combined, the Allow statements grant permissions and the Deny explicitly blocks actions. The wildcard in Policy1's Action for 'ec2:*' grants all EC2 actions including deletion of EC2 instances. Since there is no explicit Deny for EC2 actions, and the Allow with ec2:* covers all EC2 operations, the cloud engineer can delete Amazon EC2 instances.
Why the other options are wrong
- A. Policy1 allows 'iam:Get' and 'iam:List' but not delete actions; deleting IAM users is not permitted
- B. Policy2 explicitly denies 'ds:Delete' (Directory Service delete) on all resources, blocking directory deletion
- D. Policy1 only allows 'logs:Get' and 'logs:Describe' but not delete actions; deleting CloudWatch Logs is not permitted
Question 143
A company wants to use the AWS Cloud to make an existing application highly available and resilient. The current version of the application resides in the company's data center. The application recently experienced data loss after a database server crashed because of an unexpected power outage. The company needs a solution that avoids any single points of failure. The solution must give the application the ability to scale to meet user demand. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Deploy the application servers by using Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones. Use an Amazon RDS DB instance in a Multi-AZ configuration.
This solution eliminates single points of failure by deploying EC2 instances across multiple Availability Zones with Auto Scaling for elasticity, and using RDS Multi-AZ for automatic database failover with synchronous replication. RDS Multi-AZ provides automatic failover without manual intervention, addresses the original database crash concern, and is the standard AWS best practice for database high availability.
Why the other options are wrong
- B. Single Availability Zone deployment creates a point of failure, and EC2-hosted databases lack the automated failover and data protection of RDS.
- C. Read replicas in a single Availability Zone do not provide high availability; they require manual promotion and cannot prevent data loss from the primary instance failure.
- D. EBS Multi-Attach is designed for shared storage clusters, not traditional database failover, and EC2-hosted databases lack automated recovery mechanisms.
Question 144
A company has hired an external vendor to perform work in the company’s AWS account. The vendor uses an automated tool that is hosted in an AWS account that the vendor owns. The vendor does not have IAM access to the company’s AWS account. How should a solutions architect grant this access to the vendor?
Show answer and explanation
Correct answer: A. Create an IAM role in the company’s account to delegate access to the vendor’s IAM role. Attach the appropriate IAM policies to the role for the permissions that the vendor requires.
The standard AWS pattern for granting access to an external vendor's AWS account is to create an IAM role in your account and configure a trust relationship that allows the vendor's role to assume it. This approach uses cross-account role assumption, is secure (no shared credentials), and allows you to grant least-privilege permissions through attached IAM policies. The vendor's automated tool uses its own IAM role to assume the company's delegated role.
Why the other options are wrong
- B. Creating an IAM user with a password is insecure for automated tools and violates the principle of not sharing credentials across organizations.
- C. IAM groups cannot be assumed by external accounts; groups are for organizing users within an account, not for cross-account access.
- D. The identity provider feature is for external SAML/OpenID providers, not for cross-AWS-account access; this doesn't align with the vendor's use case.
Question 145
A company has a web application for travel ticketing. The application is based on a database that runs in a single data center in North America. The company wants to expand the application to serve a global user base. The company needs to deploy the application to multiple AWS Regions. Average latency must be less than 1 second on updates to the reservation database. The company wants to have separate deployments of its web platform across multiple Regions. However, the company must maintain a single primary reservation database that is globally consistent. Which solution should a solutions architect recommend to meet these requirements?
Show answer and explanation
Correct answer: A. Convert the application to use Amazon DynamoDB. Use a global table for the center reservation table. Use the correct Regional endpoint in each Regional deployment.
DynamoDB Global Tables provide sub-second latency for both reads and writes with automatic multi-region replication and strong global consistency. This meets the <1 second latency requirement for updates while maintaining a single primary database. Global Tables handle the global distribution elegantly without requiring manual replication management.
Why the other options are wrong
- B. Aurora read replicas have replication lag on writes to non-primary regions, making them unsuitable for <1 second write latency requirements across regions.
- C. RDS read replicas have similar replication lag issues and are less suited for global consistency requirements than Aurora.
- D. Aurora Serverless with Lambda-based synchronization is overly complex and cannot guarantee sub-second write latency across regions due to application-level synchronization.
Question 146
A company is running a multi-tier ecommerce web application in the AWS Cloud. The application runs on Amazon EC2 instances with an Amazon RDS for MySQL Multi-AZ DB instance. Amazon RDS is configured with the latest generation DB instance with 2,000 GB of storage in a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume. The database performance affects the application during periods of high demand. A database administrator analyzes the logs in Amazon CloudWatch Logs and discovers that the application performance always degrades when the number of read and write IOPS is higher than 20,000. What should a solutions architect do to improve the application performance?
Show answer and explanation
Correct answer: C. Replace the volume with a Provisioned IOPS SSD (io2) volume.
The gp3 volume has a maximum baseline of 16,000 IOPS, but the application requires over 20,000 IOPS during peak demand. A Provisioned IOPS SSD (io2) volume supports up to 64,000 IOPS and is specifically designed for high-performance database workloads requiring more than gp3 can provide. This addresses the root cause of the performance degradation by providing sufficient IOPS capacity.
Why the other options are wrong
- A. Magnetic volumes are legacy storage with much lower performance than gp3; this would severely worsen the performance problem.
- B. While gp3 allows increasing IOPS, the maximum is 16,000 IOPS, which is still insufficient for the required 20,000+ IOPS; io2 is necessary.
- D. Splitting into multiple volumes does not increase total IOPS capacity and adds operational complexity; a single higher-performance volume is the correct solution.
Question 147
A company stores data in PDF format in an Amazon S3 bucket. The company must follow a legal requirement to retain all new and existing data in Amazon S3 for 7 years. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: D. Turn on S3 Object Lock with compliance retention mode for the S3 bucket. Set the retention period to expire after 7 years. Use S3 Batch Operations to bring the existing data into compliance.
S3 Object Lock with compliance retention mode prevents deletion or modification of objects during the retention period, meeting legal requirements. Compliance mode is stricter than governance mode and cannot be overridden. Option D is correct because S3 Batch Operations is the proper method to apply Object Lock retention to existing objects at scale, minimizing operational overhead compared to manually recopying all data. This solution ensures both new and existing data comply with the 7-year retention requirement without requiring extensive manual intervention.
Why the other options are wrong
- A. Versioning with lifecycle deletion does not prevent object modification and does not meet legal compliance requirements for immutability.
- B. Governance mode allows authorized users to modify retention settings, which does not adequately meet strict legal requirements; recopy is also less efficient than batch operations.
- C. While compliance mode is correct, manually recopying all objects is operationally inefficient compared to using S3 Batch Operations.
Question 148
A company needs to store its accounting records in Amazon S3. The records must be immediately accessible for 1 year and then must be archived for an additional 9 years. No one at the company, including administrative users and root users, can be able to delete the records during the entire 10-year period. The records must be stored with maximum resiliency. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use an S3 Lifecycle policy to transition the records from S3 Standard to S3 Glacier Deep Archive after 1 year. Use S3 Object Lock in compliance mode for a period of 10 years.
S3 Object Lock in compliance mode provides legally enforceable write-once-read-many (WORM) protection that cannot be bypassed by any user, including root, meeting the non-deletable requirement. Using S3 Lifecycle policies to transition from S3 Standard to S3 Glacier Deep Archive after 1 year achieves immediate accessibility followed by archival. This combination ensures records are immediately accessible for 1 year, archived for 9 years, and protected from deletion for the full 10-year period with maximum resiliency.
Why the other options are wrong
- A. IAM policies can be changed by root users with sufficient permissions, so they do not provide true non-deletable protection; S3 Glacier lacks the immediate accessibility requirement.
- B. S3 Intelligent-Tiering does not provide immediate accessibility for 1 year with archival after; IAM policies can be modified, not providing true compliance protection.
- D. S3 One Zone-IA provides only single-AZ resiliency, not maximum resiliency; governance mode allows root users to override retention, failing the compliance requirement.
Question 149
A company uses Amazon S3 as its data lake. The company has a new partner that must use SFTP to upload data files. A solutions architect needs to implement a highly available SFTP solution that minimizes operational overhead. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Use AWS Transfer Family to configure an SFTP-enabled server with a publicly accessible endpoint. Choose the S3 data lake as the destination.
AWS Transfer Family is a fully managed service that provides SFTP endpoints with direct integration to S3, eliminating the need to manage servers or build custom solutions. It automatically handles SFTP protocol compliance, scalability, and high availability with minimal operational overhead. Option B uses S3 File Gateway which is designed for on-premises access. Options C and D require managing EC2 instances and cron jobs, adding significant operational complexity and manual intervention.
Why the other options are wrong
- B. S3 File Gateway is designed for on-premises file access patterns, not for exposing SFTP endpoints to external partners.
- C. Manually managing EC2 instances and cron job scripts adds significant operational overhead and doesn't provide the managed SFTP service the requirement demands.
- D. Manually running SFTP on EC2 instances with cron jobs for S3 uploads requires excessive operational overhead compared to managed solutions.
Question 150
A company is concerned that two NAT instances in use will no longer be able to support the traffic needed for the company’s application. A solutions architect wants to implement a solution that is highly available, fault tolerant, and automatically scalable. What should the solutions architect recommend?
Show answer and explanation
Correct answer: C. Remove the two NAT instances and replace them with two NAT gateways in different Availability Zones.
NAT Gateways are fully managed AWS services that automatically scale without operational overhead. Deploying them in different Availability Zones ensures high availability and fault tolerance, if one Availability Zone fails, traffic can route through the NAT Gateway in the other AZ. This is the recommended AWS architecture for replacing NAT instances with automatic scaling and redundancy.
Why the other options are wrong
- A. Placing both NAT Gateways in the same Availability Zone eliminates fault tolerance; an AZ failure would cause complete loss of NAT functionality.
- B. Using Auto Scaling groups with NLBs for NAT instances requires ongoing operational management of instances and doesn't match the automatic scalability of NAT Gateways.
- D. Spot Instances are not suitable for NAT functions as they can be terminated with little warning, causing service disruption and data loss.
Question 151
A company is migrating a Linux-based web server group to AWS. The web servers must access files in a shared file store for some content. The company must not make any changes to the application. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: C. Create an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system on all web servers.
Amazon EFS provides a managed NFS file system that can be mounted on multiple Linux EC2 instances simultaneously, allowing them to access shared files transparently. This requires no application changes since the file system is mounted like any standard network file share, meeting the core requirement of not modifying the application.
Why the other options are wrong
- A. S3 is an object store, not a file system; applications would need to be modified to use S3 APIs instead of standard file system calls.
- B. CloudFront is a CDN for content delivery; it does not provide shared file storage and would require application changes to use.
- D. EBS volumes can only be attached to a single instance at a time, so they cannot serve as shared storage for a web server group.
Question 152
A bicycle sharing company is developing a multi-tier architecture to track the location of its bicycles during peak operating hours. The company wants to use these data points in its existing analytics platform. A solutions architect must determine the most viable multi-tier option to support this architecture. The data points must be accessible from the REST API. Which action meets these requirements for storing and retrieving location data?
Show answer and explanation
Correct answer: B. Use Amazon API Gateway with AWS Lambda.
API Gateway with Lambda provides the most viable solution for a multi-tier architecture that exposes location data through REST API endpoints. Lambda can process incoming location data points in real-time and integrate with the existing analytics platform, while API Gateway provides the REST interface for data accessibility. Athena requires batch queries on S3; QuickSight is visualization-focused; Kinesis Data Analytics is designed for streaming analytics rather than REST API exposure.
Why the other options are wrong
- A. Athena is optimized for batch SQL queries on S3 data, not for real-time REST API access to location tracking data.
- C. QuickSight is a business intelligence and visualization tool, not a data retrieval mechanism; Redshift requires complex setup.
- D. Kinesis Data Analytics is for stream processing and analytics, not for providing REST API endpoints for data retrieval.
Question 153
A company is launching an application on AWS. The application uses an Application Load Balancer (ALB) to direct traffic to at least two Amazon EC2 instances in a single target group. The instances are in an Auto Scaling group for each environment. The company requires a development environment and a production environment. The production environment will have periods of high traffic. Which solution will configure the development environment MOST cost-effectively?
Show answer and explanation
Correct answer: A. Reconfigure the target group in the development environment to have only one EC2 instance as a target.
Development environments require lower cost than production. Reducing the development environment's minimum instances from two to one is the most cost-effective approach since development typically doesn't need HA. This directly reduces compute costs while maintaining functionality. The ALB's balancing algorithm change doesn't affect cost, reducing instance size affects both environments equally, and reducing max instances doesn't affect the minimum running instances that incur cost.
Why the other options are wrong
- B. Changing the ALB balancing algorithm does not affect costs and doesn't address the requirement.
- C. Reducing instance size affects both development and production equally, not cost-effective targeting.
- D. Reducing maximum instances doesn't reduce costs if minimum instances remain at two per requirement.
Question 154
A company hosts its multi-tier applications on AWS. For compliance, governance, auditing, and security, the company must track configuration changes on its AWS resources and record a history of API calls made to these resources. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: B. Use AWS Config to track configuration changes and AWS CloudTrail to record API calls.
AWS Config tracks configuration changes to AWS resources over time, while AWS CloudTrail records all API calls made to those resources. This combination provides comprehensive compliance, governance, and auditing capabilities as required.
Why the other options are wrong
- A. This reverses the correct services; CloudTrail is for API logging, not configuration tracking.
- C. CloudWatch is for monitoring and metrics, not for API call recording; AWS Config is correct for tracking configuration changes.
- D. CloudWatch does not record API calls; CloudTrail is the correct service for that purpose.
Question 155
A serverless application uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The Lambda function needs permissions to read and write to the DynamoDB table. Which solution will give the Lambda function access to the DynamoDB table MOST securely?
Show answer and explanation
Correct answer: B. Create an IAM role that includes Lambda as a trusted service. Attach a policy to the role that allows read and write access to the DynamoDB table. Update the configuration of the Lambda function to use the new role as the execution role.
Creating an IAM role with Lambda as a trusted service and attaching a policy for DynamoDB access, then assigning it as the Lambda execution role, follows AWS best practices by using temporary credentials managed automatically by IAM without storing secrets.
Why the other options are wrong
- A. Storing access keys in Lambda environment variables exposes credentials and violates security best practices; IAM users are not appropriate for service-to-service access.
- C. While Parameter Store is more secure than environment variables, it still requires managing long-term credentials; IAM roles are the proper solution.
- D. DynamoDB cannot be a trusted service for Lambda; the trust relationship must be from Lambda to DynamoDB, not the reverse.
Question 156
A company has an application that provides marketing services to stores. The services are based on previous purchases by store customers. The stores upload transaction data to the company through SFTP, and the data is processed and analyzed to generate new marketing offers. Some of the files can exceed 200 GB in size. Recently, the company discovered that some of the stores have uploaded files that contain personally identifiable information (PII) that should not have been included. The company wants administrators to be alerted if PII is shared again. The company also wants to automate remediation. What should a solutions architect do to meet these requirements with the LEAST development effort?
Show answer and explanation
Correct answer: B. Use an Amazon S3 bucket as a secure transfer point. Use Amazon Macie to scan the objects in the bucket. If objects contain PII, use Amazon Simple Notification Service (Amazon SNS) to trigger a notification to the administrators to remove the objects that contain PII.
Amazon Macie is a managed service specifically designed to discover and protect sensitive data including PII with minimal development effort. It automatically scans S3 objects, identifies PII, and can trigger SNS notifications for administrator action. This requires no custom code development while meeting both alerting and the intent for remediation.
Why the other options are wrong
- A. Amazon Inspector is designed for EC2 vulnerability scanning, not PII detection in S3 objects.
- C. Custom Lambda scanning requires significant development effort to accurately identify all PII types compared to using a managed service.
- D. Custom Lambda scanning requires development effort; while SES and S3 Lifecycle could work, this approach lacks the automated PII detection sophistication of Macie.
Question 157
A gaming company uses Amazon DynamoDB to store user information such as geographic location, player data, and leaderboards. The company needs to configure continuous backups to an Amazon S3 bucket with a minimal amount of coding. The backups must not affect availability of the application and must not affect the read capacity units (RCUs) that are defined for the table. Which solution meets these requirements?
Show answer and explanation
Correct answer: B. Export the data directly from DynamoDB to Amazon S3 with continuous backups. Turn on point-in-time recovery for the table.
Exporting data directly from DynamoDB to S3 with continuous backups combined with point-in-time recovery (PITR) is the most efficient solution requiring minimal coding. DynamoDB's export feature is a built-in, fully managed capability that does not consume RCUs or affect application availability, and PITR provides continuous backup capability with no additional configuration needed.
Why the other options are wrong
- A. EMR with Hive requires significant setup, maintenance, and development effort compared to native DynamoDB export functionality.
- C. DynamoDB Streams with Lambda requires custom code development and ongoing Lambda maintenance, adding unnecessary complexity.
- D. Lambda-based scheduled exports require custom code development and ongoing maintenance, making it less efficient than the native export feature.
Question 158
A company is building a new web-based customer relationship management application. The application will use several Amazon EC2 instances that are backed by Amazon Elastic Block Store (Amazon EBS) volumes behind an Application Load Balancer (ALB). The application will also use an Amazon Aurora database. All data for the application must be encrypted at rest and in transit. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use AWS Key Management Service (AWS KMS) to encrypt the EBS volumes and Aurora database storage at rest. Attach an AWS Certificate Manager (ACM) certificate to the ALB to encrypt data in transit.
AWS KMS is the correct service for encrypting EBS volumes and Aurora database storage at rest, providing managed key rotation and audit logging. AWS Certificate Manager (ACM) certificates are attached to the ALB to enable TLS/SSL encryption for data in transit. This combination meets both encryption requirements without unnecessary complexity.
Why the other options are wrong
- A. ACM is for managing certificates, not encrypting data at rest; KMS certificates do not exist as a distinct product for ALB encryption.
- B. Using the root account is a security anti-pattern; there is no built-in account-level toggle to encrypt all data for a region.
- D. BitLocker is a Windows-specific encryption tool not relevant to AWS services; KMS keys are not attached to ALBs for transit encryption.
Question 159
A company wants to migrate an on-premises data center to AWS. The data center hosts an SFTP server that stores its data on an NFS-based file system. The server holds 200 GB of data that needs to be transferred. The server must be hosted on an Amazon EC2 instance that uses an Amazon Elastic File System (Amazon EFS) file system. Which combination of steps should a solutions architect take to automate this task? (Choose two.)
Show answer and explanation
Correct answer: B, E. Install an AWS DataSync agent in the on-premises data center; Use AWS DataSync to create a suitable location configuration for the on-premises SFTP server.
AWS DataSync is designed to automate large-scale data migrations with minimal operational overhead. Installing a DataSync agent in the on-premises data center allows it to connect to and read from the SFTP/NFS server. Creating a suitable location configuration in DataSync for the on-premises SFTP server completes the automated setup to transfer the 200 GB of data to the EFS file system attached to the EC2 instance. This combination fully automates the migration task.
Why the other options are wrong
- A. While it's good practice to launch EC2 in the same AZ as EFS for optimal performance, this is not required for automation and is not part of the DataSync automation process.
- C. A secondary EBS volume is not needed; the EFS file system directly provides the required storage for the migrated data.
- D. Manual OS copy commands contradict the requirement to automate the task and would require additional operational effort.
Question 160
A company is running a popular social media website. The website gives users the ability to upload images to share with other users. The company wants to make sure that the images do not contain inappropriate content. The company needs a solution that minimizes development effort. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: B. Use Amazon Rekognition to detect inappropriate content. Use human review for low-confidence predictions.
Amazon Rekognition is the AWS service specifically designed to detect inappropriate content, explicit content, and other visual moderation issues in images. It provides confidence scores that allow for human review of low-confidence predictions, minimizing development effort compared to building a custom solution. Amazon Comprehend handles text analysis, not image content detection, making it unsuitable for this use case.
Why the other options are wrong
- A. Amazon Comprehend is designed for text analysis, not image content detection.
- C. SageMaker requires significant development effort to build and train custom models, not minimizing effort as required.
- D. AWS Fargate with a custom model requires substantial development and maintenance overhead, contradicting the minimize effort requirement.
Question 161
An IAM user made several configuration changes to AWS resources in their company's account during a production deployment last week. A solutions architect learned that a couple of security group rules are not configured as desired. The solutions architect wants to confirm which IAM user was responsible for making changes. Which service should the solutions architect use to find the desired information?
Show answer and explanation
Correct answer: C. AWS CloudTrail
AWS CloudTrail records all API calls made in an AWS account, including who made the call, when, what resource was affected, and what changes were made. It is the appropriate service to audit and trace which IAM user made configuration changes to security group rules. CloudTrail logs provide the detailed audit trail needed to identify the specific user responsible for the configuration changes.
Why the other options are wrong
- A. Amazon GuardDuty is a threat detection service that identifies malicious activity and security issues, not a service for tracking configuration changes or identifying which user made them.
- B. Amazon Inspector is a vulnerability assessment service that scans for vulnerabilities in applications and infrastructure, not for auditing user actions or configuration changes.
- D. AWS Config tracks configuration changes to resources but does not identify which IAM user made the changes; CloudTrail is required to see the user responsible.
Question 162
A solutions architect is designing a two-tier web application. The application consists of a public-facing web tier hosted on Amazon EC2 in public subnets. The database tier consists of Microsoft SQL Server running on Amazon EC2 in a private subnet. Security is a high priority for the company. How should security groups be configured in this situation? (Choose two.)
Show answer and explanation
Correct answer: A, C. Configure the security group for the web tier to allow inbound traffic on port 443 from 0.0.0.0/0; Configure the security group for the database tier to allow inbound traffic on port 1433 from the security group for the web tier.
The web tier security group must allow inbound HTTPS traffic on port 443 from 0.0.0.0/0 (option A) to accept requests from internet users. The database tier security group must allow inbound traffic on port 1433 (SQL Server) specifically from the web tier's security group (option C), not from 0.0.0.0/0, restricting database access only to the application layer. This implements proper network segmentation and least privilege access.
Why the other options are wrong
- B. Outbound rules are not specified in the requirements; inbound rules are the security concern here.
- D. Database tier should only allow inbound connections to port 1433, not outbound traffic back to the web tier.
- E. Port 443 is not a SQL Server port; only port 1433 should be allowed for the database tier.
Question 163
A company is running a publicly accessible serverless application that uses Amazon API Gateway and AWS Lambda. The application’s traffic recently spiked due to fraudulent requests from botnets. Which steps should a solutions architect take to block requests from unauthorized users? (Choose two.)
Show answer and explanation
Correct answer: A, C. Create a usage plan with an API key that is shared with genuine users only; Implement an AWS WAF rule to target malicious requests and trigger actions to filter them out.
Option A implements API key-based access control through a usage plan, restricting requests to only legitimate users who possess the shared key, effectively blocking unauthorized botnet traffic. Option C uses AWS WAF integrated with API Gateway to detect and filter malicious requests based on patterns and behavior, providing an additional layer of protection against botnet attacks.
Why the other options are wrong
- B. Logic within Lambda functions would require parsing every request and adds latency; filtering should occur at the API Gateway/WAF layer before reaching compute resources.
- D. Converting to a private API would break legitimate user access unless all users have VPN or private connectivity, which is impractical for a public event.
- E. Requiring IAM roles for each user attempting public API access is operationally impractical and not designed for public applications.
Question 164
A company recently migrated its web application to AWS by rehosting the application on Amazon EC2 instances in a single AWS Region. The company wants to redesign its application architecture to be highly available and fault tolerant. Traffic must reach all running EC2 instances randomly. Which combination of steps should the company take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: C, E. Create an Amazon Route 53 multivalue answer routing policy; Launch four EC2 instances: two instances in one Availability Zone and two instances in another Availability Zone.
For random traffic distribution (load balancing) across multiple instances in multiple Availability Zones, use Route 53 multivalue answer routing policy (option C), which returns multiple IP addresses and distributes traffic randomly among them. Deploy four instances across two AZs with two instances in each (option E) to ensure high availability and fault tolerance; if one AZ fails, the other AZ still has running instances. This configuration provides both redundancy and balanced load distribution.
Why the other options are wrong
- A. Failover routing is for active-passive scenarios, not random traffic distribution to all instances.
- B. Weighted routing is for controlled traffic splitting by percentage, not for random distribution.
- D. Two instances in one AZ and one in another creates unbalanced capacity and doesn't provide equal fault tolerance.
Question 165
A company deploys an application on five Amazon EC2 instances. An Application Load Balancer (ALB) distributes traffic to the instances by using a target group. The average CPU usage on each of the instances is below 10% most of the time, with occasional surges to 65%. A solutions architect needs to implement a solution to automate the scalability of the application. The solution must optimize the cost of the architecture and must ensure that the application has enough CPU resources when surges occur. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create an EC2 Auto Scaling group. Select the existing ALB as the load balancer and the existing target group as the target group. Set a target tracking scaling policy that is based on the ASGAverageCPUUtilization metric. Set the minimum instances to 2, the desired capacity to 3, the maximum instances to 6, and the target value to 50%. Add the EC2 instances to the Auto Scaling group.
An EC2 Auto Scaling group with target tracking scaling policy based on ASGAverageCPUUtilization is the automated, cost-optimized solution. Setting minimum to 2, desired to 3, maximum to 6, and target CPU to 50% ensures the application automatically scales down during low usage (cost optimization) and scales up during surge periods (maintains performance). This requires no manual intervention and uses AWS native automation.
Why the other options are wrong
- A. Terminating instances when CPU is below 20% is backwards logic and would cause application unavailability during surges.
- C. Without a scaling policy, the Auto Scaling group remains at fixed capacity and cannot automatically respond to CPU surges.
- D. Manual CloudWatch alarms requiring email notification and manual intervention do not meet automation requirements and are operationally inefficient.
Question 166
A company needs to run a critical application on AWS. The company needs to use Amazon EC2 for the application’s database. The database must be highly available and must fail over automatically if a disruptive event occurs. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Launch two EC2 instances, each in a different Availability Zone in the same AWS Region. Install the database on both EC2 instances. Configure the EC2 instances as a cluster. Set up database replication.
Option A provides automatic failover within the same region by deploying two EC2 instances across different Availability Zones with database replication and clustering. This ensures high availability and automatic failover when a disruptive event occurs. Option C requires failover to a different region which adds latency and complexity. Option B and D rely on manual intervention or CloudFormation/recovery mechanisms that don't provide true automatic failover at the database level.
Why the other options are wrong
- B. CloudFormation automation requires time to provision and is not automatic failover; it does not meet the automatic failover requirement.
- C. Cross-region failover adds significant latency and complexity; same-region multi-AZ is the standard HA solution.
- D. EC2 automatic recovery only restarts the instance; it does not provide database-level failover or clustering.
Question 167
A company runs a highly available SFTP service. The SFTP service uses two Amazon EC2 Linux instances that run with elastic IP addresses to accept traffic from trusted IP sources on the internet. The SFTP service is backed by shared storage that is attached to the instances. User accounts are created and managed as Linux users in the SFTP servers. The company wants a serverless option that provides high IOPS performance and highly configurable security. The company also wants to maintain control over user permissions. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create an encrypted Amazon Elastic File System (Amazon EFS) volume. Create an AWS Transfer Family SFTP service with elastic IP addresses and a VPC endpoint that has internet-facing access. Attach a security group to the endpoint that allows only trusted IP addresses. Attach the EFS volume to the SFTP service endpoint. Grant users access to the SFTP service.
AWS Transfer Family is a serverless SFTP service, and a VPC endpoint with internet-facing access and Elastic IP addresses lets security groups restrict traffic to trusted IP sources. Amazon EFS gives shared file storage with high IOPS and supports POSIX user permissions, so the company keeps control over user access.
Why the other options are wrong
- A. Transfer Family supports only Amazon S3 and Amazon EFS as storage, so an EBS volume cannot be attached.
- C. A public Transfer Family endpoint cannot be restricted with security groups, so it cannot limit access to trusted IP addresses.
- D. An internal VPC endpoint in a private subnet cannot accept traffic from trusted sources on the internet.
Question 168
A company runs a fleet of web servers using an Amazon RDS for PostgreSQL DB instance. After a routine compliance check, the company sets a standard that requires a recovery point objective (RPO) of less than 1 second for all its production databases. Which solution meets these requirements?
Show answer and explanation
Correct answer: A. Enable a Multi-AZ deployment for the DB instance.
An RPO of less than 1 second requires synchronous replication across Availability Zones, which is provided by RDS Multi-AZ deployments. Multi-AZ maintains a synchronous standby replica that is continuously updated, achieving near-zero data loss in the event of primary failure. This is the only option that meets the sub-1-second RPO requirement.
Why the other options are wrong
- B. Auto scaling within a single AZ does not provide redundancy or replication; it doesn't reduce RPO.
- C. Read replicas are asynchronous by default and cannot guarantee sub-1-second RPO; replication lag typically exceeds 1 second.
- D. DMS CDC tasks are for migration and cross-platform replication, not a standard disaster recovery solution; they do not meet RPO guarantees comparable to Multi-AZ.
Question 169
A rapidly growing ecommerce company is running its workloads in a single AWS Region. A solutions architect must create a disaster recovery (DR) strategy that includes a different AWS Region. The company wants its database to be up to date in the DR Region with the least possible latency. The remaining infrastructure in the DR Region needs to run at reduced capacity and must be able to scale up if necessary. Which solution will meet these requirements with the LOWEST recovery time objective (RTO)?
Show answer and explanation
Correct answer: B. Use an Amazon Aurora global database with a warm standby deployment.
Aurora global database with warm standby deployment maintains read-replicas in the DR region (keeping the database up-to-date with minimal latency), while infrastructure runs at reduced capacity. This provides the lowest RTO because the database is continuously replicated and partially warmed infrastructure can scale up quickly when needed.
Why the other options are wrong
- A. Pilot light deployment requires database spin-up during failover, increasing RTO compared to warm standby with already-running instances.
- C. RDS Multi-AZ is single-region; it doesn't address the requirement for a different AWS Region.
- D. RDS Multi-AZ is single-region and lacks the cross-region replication capabilities required for the stated DR strategy.
Question 170
A company is expecting rapid growth in the near future. A solutions architect needs to configure existing users and grant permissions to new users on AWS. The solutions architect has decided to create IAM groups. The solutions architect will add the new users to IAM groups based on department. Which additional action is the MOST secure way to grant permissions to the new users?
Show answer and explanation
Correct answer: C. Create an IAM policy that grants least privilege permission. Attach the policy to the IAM groups
Creating IAM policies with least privilege permissions and attaching them directly to IAM groups is the standard, most secure approach for granting permissions to multiple users based on their department. This allows group-based permission management while ensuring users only receive the minimum permissions necessary for their role. Policies attached to groups automatically apply to all group members.
Why the other options are wrong
- A. SCPs (Service Control Policies) manage maximum permissions at the organization level and are not the primary mechanism for granting permissions to individual users.
- B. IAM roles are designed for assumable identities and cross-service access, not for direct permission assignment to users in groups; this is an incorrect use of roles.
- D. Permissions boundaries define maximum permissions, not actual permissions; they must be combined with identity-based policies and add unnecessary complexity for this straightforward use case.
Question 171
A company has an Amazon S3 data lake that is governed by AWS Lake Formation. The company wants to create a visualization in Amazon QuickSight by joining the data in the data lake with operational data that is stored in an Amazon Aurora MySQL database. The company wants to enforce column-level authorization so that the company’s marketing team can access only a subset of columns in the database. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: D. Use a Lake Formation blueprint to ingest the data from the database to the S3 data lake. Use Lake Formation to enforce column-level access control for the QuickSight users. Use Amazon Athena as the data source in QuickSight.
AWS Lake Formation provides native column-level access control through its permission model, which integrates directly with QuickSight. Using a Lake Formation blueprint to ingest the Aurora data into S3 and then leveraging Lake Formation's built-in column-level authorization eliminates the need for manual policy configuration. This approach provides the least operational overhead while maintaining governance through a single, unified service that understands both the data lake and access control semantics.
Why the other options are wrong
- A. EMR is overkill for this use case and doesn't provide column-level authorization control.
- B. IAM policies do not enforce column-level access control; this requires custom application logic or other mechanisms.
- C. S3 bucket policies operate at the object level, not the column level, and don't provide fine-grained access control for structured data.
Question 172
A company has a Windows-based application that must be migrated to AWS. The application requires the use of a shared Windows file system attached to multiple Amazon EC2 Windows instances that are deployed across multiple Availability Zone: What should a solutions architect do to meet this requirement?
Show answer and explanation
Correct answer: B. Configure Amazon FSx for Windows File Server. Mount the Amazon FSx file system to each Windows instance.
Amazon FSx for Windows File Server is purpose-built for Windows environments and provides a fully managed shared file system that can be mounted by multiple EC2 instances across multiple Availability Zones. It offers SMB protocol support, Active Directory integration, and automatic failover capabilities. EFS does not support Windows instances natively, Storage Gateway in volume gateway mode is not suitable for shared access across instances, and EBS volumes cannot be shared across multiple instances.
Why the other options are wrong
- A. Storage Gateway volume gateway mode is not designed for shared access across multiple EC2 instances simultaneously.
- C. Amazon EFS does not support Windows instances; it is Linux-only.
- D. EBS volumes can only be attached to a single EC2 instance at a time and cannot provide shared access.
Question 173
A solutions architect is using Amazon S3 to design the storage architecture of a new digital media application. The media files must be resilient to the loss of an Availability Zone. Some files are accessed frequently while other files are rarely accessed in an unpredictable pattern. The solutions architect must minimize the costs of storing and retrieving the media files. Which storage option meets these requirements?
Show answer and explanation
Correct answer: B. S3 Intelligent-Tiering
S3 Intelligent-Tiering automatically moves objects between different access tiers based on actual access patterns, optimizing costs without requiring manual intervention. It provides Availability Zone resilience (unlike One Zone-IA), handles unpredictable access patterns (unlike Standard-IA which assumes infrequent access), and minimizes costs by automatically transitioning rarely-accessed files to cheaper storage tiers while keeping frequently-accessed files in Standard tier.
Why the other options are wrong
- A. S3 Standard is suitable for frequently accessed data but does not optimize costs for rarely accessed files.
- C. S3 Standard-IA requires predictable infrequent access patterns and has a 30-day minimum storage duration; it doesn't automatically adapt to unpredictable access.
- D. S3 One Zone-IA is not resilient to Availability Zone loss, violating the resilience requirement.
Question 174
A company recently launched a variety of new workloads on Amazon EC2 instances in its AWS account. The company needs to create a strategy to access and administer the instances remotely and securely. The company needs to implement a repeatable process that works with native AWS services and follows the AWS Well-Architected Framework. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Attach the appropriate IAM role to each existing instance and new instance. Use AWS Systems Manager Session Manager to establish a remote SSH session.
Session Manager from AWS Systems Manager provides secure, agentless remote access using IAM authentication without requiring SSH keys, bastion hosts, or VPN infrastructure. It integrates natively with AWS, is highly scalable across instances, and aligns with the AWS Well-Architected Framework with minimal operational overhead.
Why the other options are wrong
- A. The EC2 serial console is for debugging boot issues, not for regular administration.
- C. Bastion hosts add complexity and operational overhead; managing SSH keys introduces security risks and is not a scalable native AWS solution.
- D. Site-to-Site VPN requires infrastructure setup and is more operationally complex than Session Manager; it also requires SSH key management.
Question 175
A company is developing a microservices application that will provide a search catalog for customers. The company must use REST APIs to present the frontend of the application to users. The REST APIs must access the backend services that the company hosts in containers in private VPC subnets. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Design a REST API by using Amazon API Gateway. Host the application in Amazon Elastic Container Service (Amazon ECS) in a private subnet. Create a private VPC link for API Gateway to access Amazon ECS.
A REST API (not WebSocket) is required to present the frontend to users. API Gateway must access backend ECS services in private subnets using a VPC Link, which creates a private connection through the VPC and avoids exposing services to the internet. This is the secure, proper way to connect API Gateway to private container workloads.
Why the other options are wrong
- A. WebSocket APIs are for real-time bidirectional communication, not appropriate for a search catalog REST API frontend.
- C. WebSocket is the wrong API type, and security groups cannot be used between API Gateway and VPC resources; VPC Link is required for private access.
- D. While REST API is correct, security groups alone are insufficient; VPC Link must be used to privately connect API Gateway to resources in private subnets.
Question 176
A company is building an application in the AWS Cloud. The application will store data in Amazon S3 buckets in two AWS Regions. The company must use an AWS Key Management Service (AWS KMS) customer managed key to encrypt all data that is stored in the S3 buckets. The data in both S3 buckets must be encrypted and decrypted with the same KMS key. The data and the key must be stored in each of the two Regions. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Create a customer managed multi-Region KMS key. Create an S3 bucket in each Region. Configure replication between the S3 buckets. Configure the application to use the KMS key with client-side encryption.
A customer-managed multi-Region KMS key automatically replicates across regions and maintains the same key material in each region, eliminating the need to manage separate keys per region. Combined with client-side encryption and S3 replication, this provides the least operational overhead while meeting all requirements.
Why the other options are wrong
- A. SSE-S3 uses AWS-managed keys, not customer-managed KMS keys as required.
- C. Uses SSE-S3 which does not meet the requirement for customer-managed KMS keys, and requires managing separate KMS keys in each region.
- D. Requires managing separate customer-managed KMS keys in each region, increasing operational overhead compared to multi-Region keys; replication also requires key policy configuration in each region.
Question 177
A media company hosts its website on AWS. The website application’s architecture includes a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB) and a database that is hosted on Amazon Aurora. The company’s cybersecurity team reports that the application is vulnerable to SQL injection. How should the company resolve this issue?
Show answer and explanation
Correct answer: A. Use AWS WAF in front of the ALB. Associate the appropriate web ACLs with AWS WAF.
AWS WAF (Web Application Firewall) is specifically designed to protect web applications from common attacks including SQL injection. By placing AWS WAF in front of the ALB and configuring appropriate web ACLs with SQL injection protection rules, the company can filter malicious requests before they reach the application. This is the standard AWS solution for application-layer attack prevention.
Why the other options are wrong
- B. ALB listener rules cannot parse and detect SQL injection patterns; they operate at the connection level, not the application content level.
- C. AWS Shield Advanced primarily defends against DDoS attacks, not SQL injection attacks.
- D. Amazon Inspector is a vulnerability assessment tool for scanning resources, not a runtime protection mechanism for blocking attacks.
Question 178
An ecommerce company has noticed performance degradation of its Amazon RDS based web application. The performance degradation is attributed to an increase in the number of read-only SQL queries triggered by business analysts. A solutions architect needs to solve the problem with minimal changes to the existing web application. What should the solutions architect recommend?
Show answer and explanation
Correct answer: C. Create a read replica of the primary database and have the business analysts run their queries.
Creating a read replica of the primary RDS database allows business analysts to run their read-only queries against the replica, offloading them from the primary database without modifying the web application. This provides the minimal-change solution while immediately improving primary database performance.
Why the other options are wrong
- A. Exporting to DynamoDB requires significant application changes and data model restructuring.
- B. ElastiCache helps with frequently accessed data but doesn't provide a complete solution for ad-hoc analyst queries against full datasets.
- D. Redshift requires data pipeline setup and significant operational overhead, whereas read replicas are native RDS functionality.
Question 179
A manufacturing company has machine sensors that upload .csv files to an Amazon S3 bucket. These .csv files must be converted into images and must be made available as soon as possible for the automatic generation of graphical reports. The images become irrelevant after 1 month, but the .csv files must be kept to train machine learning (ML) models twice a year. The ML trainings and audits are planned weeks in advance. Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
Show answer and explanation
Correct answer: B, C. Design an AWS Lambda function that converts the .csv files into images and stores the images in the S3 bucket. Invoke the Lambda function when a .csv file is uploaded; Create S3 Lifecycle rules for .csv files and image files in the S3 bucket. Transition the .csv files from S3 Standard to S3 Glacier 1 day after they are uploaded. Expire the image files after 30 days.
Lambda (B) is the most cost-effective way to process CSV files immediately upon upload, triggering automatic conversion to images without maintaining always-on infrastructure. S3 Lifecycle rules (C) handle both requirements: transitioning CSV files to S3 Standard-IA or Glacier for cost-effective long-term storage (needed for ML training every 6 months), and expiring images after 30 days since they become irrelevant. This combination minimizes costs by using serverless processing and intelligent tiering for storage.
Why the other options are wrong
- A. EC2 Spot Instances require continuous polling and infrastructure overhead, making them less cost-effective than Lambda's event-driven model.
- D. S3 One Zone-IA lacks the redundancy needed for critical ML training data that must be preserved for planned training sessions.
- E. Reduced Redundancy Storage is deprecated and provides less durability than Standard-IA; it's not suitable for data needed for ML training.
Question 180
A company wants to migrate 100 GB of historical data from an on-premises location to an Amazon S3 bucket. The company has a 100 megabits per second (Mbps) internet connection on premises. The company needs to encrypt the data in transit to the S3 bucket. The company will store new data directly in Amazon S3. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Use AWS DataSync to migrate the data from the on-premises location to an S3 bucket
AWS DataSync is purpose-built for large data migrations with built-in encryption in transit, automated scheduling, and minimal operational overhead. With a 100 Mbps connection, the 100 GB transfer would take manageable time, and DataSync handles the entire migration process automatically without requiring manual command execution or complex setup, making it the least operationally intensive solution.
Why the other options are wrong
- A. The s3 sync command requires manual setup and monitoring; with 100 GB on a 100 Mbps connection, it would take significant time and requires ongoing operational management.
- C. AWS Snowball is designed for very large migrations (petabyte scale) and high-latency scenarios; for 100 GB with reasonable connectivity, it introduces unnecessary complexity.
- D. Setting up an IPsec VPN adds operational overhead, and using s3 cp still requires manual management and monitoring compared to the automated DataSync solution.
Question 181
A solutions architect is designing a company’s disaster recovery (DR) architecture. The company has a MySQL database that runs on an Amazon EC2 instance in a private subnet with scheduled backup. The DR design needs to include multiple AWS Regions. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: C. Migrate the MySQL database to an Amazon Aurora global database. Host the primary DB cluster in the primary Region. Host the secondary DB cluster in the DR Region.
Amazon Aurora global database provides the least operational overhead for multi-region MySQL disaster recovery. It automatically handles replication across regions, provides near-zero RTO/RPO, and requires no manual configuration of replication. Unlike RDS Multi-AZ which only covers availability zones within a single region, Aurora global database natively spans multiple AWS Regions with read-only secondary clusters that can be promoted to primary in a DR event.
Why the other options are wrong
- A. Manual EC2 replication setup requires significant operational overhead, custom scripting, and ongoing monitoring.
- B. RDS Multi-AZ only provides high availability within a single region, not multi-region DR capability.
- D. Restoring from S3 backups requires manual intervention and extended recovery time, making it unsuitable for a DR solution.
Question 182
A company wants to ingest customer payment data into the company's data lake in Amazon S3. The company receives payment data every minute on average. The company wants to analyze the payment data in real time. Then the company wants to ingest the data into the data lake. Which solution will meet these requirements with the MOST operational efficiency?
Show answer and explanation
Correct answer: C. Use Amazon Kinesis Data Firehose to ingest data. Use Amazon Kinesis Data Analytics to analyze the data in real time.
Kinesis Data Firehose provides the most operationally efficient solution for this use case. It automatically delivers streaming payment data to S3 (the data lake) with built-in batching and compression, requiring minimal operational management. Kinesis Data Analytics integrates seamlessly with Firehose for real-time analysis of the streaming data before it lands in S3. This combination eliminates the need for custom Lambda code orchestration while providing automatic data delivery to S3 and real-time analytical capabilities.
Why the other options are wrong
- A. While Kinesis Data Streams with Lambda works, it requires custom code development and Lambda management, adding operational complexity.
- B. AWS Glue is primarily a batch ETL service, not designed for real-time minute-by-minute ingestion of streaming data.
- D. API Gateway with Lambda requires building custom ingestion logic and does not natively provide the streaming data pipeline or real-time analytics integration.
Question 183
A company is developing a new mobile app. The company must implement proper traffic filtering to protect its Application Load Balancer (ALB) against common application-level attacks, such as cross-site scripting or SQL injection. The company has minimal infrastructure and operational staff. The company needs to reduce its share of the responsibility in managing, updating, and securing servers for its AWS environment. What should a solutions architect recommend to meet these requirements?
Show answer and explanation
Correct answer: A. Configure AWS WAF rules and associate them with the ALB.
AWS WAF is a managed service that directly protects against application-level attacks like cross-site scripting and SQL injection when associated with an ALB. It requires minimal operational overhead since AWS manages the service, updates, and security, aligning perfectly with the company's need to reduce infrastructure and operational staff responsibility. This is a managed service that directly addresses the stated threat vectors.
Why the other options are wrong
- B. S3 static hosting does not provide ALB protection or address application-level attacks; it's also not suitable for a mobile app requiring dynamic processing.
- C. AWS Shield Advanced protects against DDoS attacks, not application-level attacks like SQL injection or XSS.
- D. Deploying a third-party firewall on EC2 increases operational burden and management overhead, contradicting the requirement to reduce staff responsibility.
Question 184
A company has registered its domain name with Amazon Route 53. The company uses Amazon API Gateway in the ca-central-1 Region as a public interface for its backend microservice APIs. Third-party services consume the APIs securely. The company wants to design its API Gateway URL with the company's domain name and corresponding certificate so that the third-party services can use HTTPS. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Create a Regional API Gateway endpoint. Associate the API Gateway endpoint with the company's domain name. Import the public certificate associated with the company's domain name into AWS Certificate Manager (ACM) in the same Region. Attach the certificate to the API Gateway endpoint. Configure Route 53 to route traffic to the API Gateway endpoint.
This solution creates a Regional API Gateway endpoint in ca-central-1, imports the company's SSL certificate into ACM in the same region, attaches the certificate to create a custom domain name, and uses Route 53 to route traffic to the endpoint. This provides secure HTTPS access using the company's domain name. Regional endpoints are appropriate for ca-central-1, and the certificate must be in the same region as the endpoint for attachment.
Why the other options are wrong
- A. Stage variables cannot override the API Gateway endpoint URL; this approach does not actually create a custom domain name for HTTPS access.
- B. ACM certificates for Regional API Gateway must be imported in the same region (ca-central-1), not us-east-1; alias records alone do not provide custom domain HTTPS support.
- D. Certificates for Regional API Gateway endpoints must be in the same region; importing to us-east-1 will not work for a ca-central-1 endpoint, and the final A record configuration is incorrect.
Question 185
A company recently deployed a new auditing system to centralize information about operating system versions, patching, and installed software for Amazon EC2 instances. A solutions architect must ensure all instances provisioned through EC2 Auto Scaling groups successfully send reports to the auditing system as soon as they are launched and terminated. Which solution achieves these goals MOST efficiently?
Show answer and explanation
Correct answer: B. Use EC2 Auto Scaling lifecycle hooks to run a custom script to send data to the audit system when instances are launched and terminated.
EC2 Auto Scaling lifecycle hooks are specifically designed to execute custom actions when instances launch or terminate. They provide guaranteed execution of the audit reporting script at the correct lifecycle moments with minimal operational overhead. Lifecycle hooks pause the scaling action briefly to allow the script to complete, ensuring reliable reporting to the auditing system.
Why the other options are wrong
- A. Scheduled Lambda functions add complexity and are not guaranteed to execute when instances are actually launched or terminated.
- C. User data in launch configuration only executes at instance launch, not at termination, and does not support lifecycle hook functionality.
- D. Invoking custom scripts directly from the operating system is unreliable and requires manual agent installation and management on each instance.
Question 186
A media company uses Amazon CloudFront for its publicly available streaming video content. The company wants to secure the video content that is hosted in Amazon S3 by controlling who has access. Some of the company’s users are using a custom HTTP client that does not support cookies. Some of the company’s users are unable to change the hardcoded URLs that they are using for access. Which services or methods will meet these requirements with the LEAST impact to the users? (Choose two.)
Show answer and explanation
Correct answer: A, B. Signed cookies; Signed URLs
Signed URLs and Signed Cookies are CloudFront's native mechanisms for controlling access to content. Signed URLs work without requiring cookie support and can be embedded in hardcoded URLs (meeting the requirement for users unable to change URLs). Signed Cookies also provide access control when URLs are static. Together, these two options accommodate both the custom HTTP client (which doesn't support cookies) and users with hardcoded URLs.
Why the other options are wrong
- C. AWS AppSync is a GraphQL service designed for API query acceleration and is not relevant to securing static video content delivery.
- D. JWT (JSON Web Token) is an authentication mechanism but not a CloudFront-native method for controlling access to distribution content; it would require additional application logic.
- E. AWS Secrets Manager is designed for storing and rotating secrets like database passwords, not for controlling access to CloudFront content.
Question 187
A company’s infrastructure consists of Amazon EC2 instances and an Amazon RDS DB instance in a single AWS Region. The company wants to back up its data in a separate Region. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Use AWS Backup to copy EC2 backups and RDS backups to the separate Region.
AWS Backup is a centralized, policy-based service that handles backup and restore for both EC2 instances and RDS databases, with built-in support for cross-region copying. It requires minimal operational overhead as it automates the entire backup lifecycle and cross-region replication without requiring manual management of AMIs, snapshots, or S3 exports. This is simpler and more maintainable than the alternatives.
Why the other options are wrong
- B. Amazon DLM is designed specifically for EBS snapshot lifecycle management and does not support RDS backups or cross-region copying of RDS resources.
- C. This approach requires manual creation of AMIs and manual RDS read replica setup, resulting in significantly higher operational overhead than AWS Backup.
- D. This requires manual EBS snapshot creation, manual RDS snapshot export to S3, and S3 CRR configuration, involving multiple steps and higher operational complexity than AWS Backup.
Question 188
A company has a serverless website with millions of objects in an Amazon S3 bucket. The company uses the S3 bucket as the origin for an Amazon CloudFront distribution. The company did not set encryption on the S3 bucket before the objects were loaded. A solutions architect needs to enable encryption for all existing objects and for all objects that are added to the S3 bucket in the future. Which solution will meet these requirements with the LEAST amount of effort?
Show answer and explanation
Correct answer: B. Turn on the default encryption settings for the S3 bucket. Use the S3 Inventory feature to create a .csv file that lists the unencrypted objects. Run an S3 Batch Operations job that uses the copy command to encrypt those objects.
Option B requires the least effort because it uses native AWS S3 features. Enabling default encryption ensures all future objects are automatically encrypted. The S3 Inventory feature generates a list of existing unencrypted objects, and S3 Batch Operations then applies encryption via copy commands to those objects in bulk without manual intervention. This approach avoids migrating millions of objects to a new bucket and requires no custom code.
Why the other options are wrong
- A. Creating a new bucket and downloading/uploading millions of objects is extremely time-consuming and operationally expensive.
- C. Changing encryption settings alone doesn't encrypt existing objects; KMS adds complexity without solving the core requirement more efficiently.
- D. Manually browsing and modifying individual objects in the console is impractical for millions of objects.
Question 189
A company wants to use an Amazon RDS for PostgreSQL DB cluster to simplify time-consuming database administrative tasks for production database workloads. The company wants to ensure that its database is highly available and will provide automatic failover support in most scenarios in less than 40 seconds. The company wants to offload reads off of the primary instance and keep costs as low as possible. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Use an Amazon RDS Multi-AZ DB cluster deployment Point the read workload to the reader endpoint.
RDS Multi-AZ DB cluster deployment provides automatic failover in less than 40 seconds and includes reader endpoints that distribute read traffic across reader nodes, meeting all requirements while maintaining cost efficiency. This is superior to Multi-AZ instance deployments which offer only two instances (primary and standby) where the standby cannot serve reads, and better than managing separate read replicas.
Why the other options are wrong
- A. Multi-AZ instance deployment cannot offload reads to a read replica without additional cost, and failover timing may exceed 40 seconds.
- B. Multi-AZ instance deployment with multiple read replicas adds unnecessary cost and complexity; cluster deployment is more cost-effective.
- C. The secondary instance in Multi-AZ pair is not accessible for read traffic during normal operations, only serves as failover target.
Question 190
A company has an application that generates a large number of files, each approximately 5 MB in size. The files are stored in Amazon S3. Company policy requires the files to be stored for 4 years before they can be deleted. Immediate accessibility is always required as the files contain critical business data that is not easy to reproduce. The files are frequently accessed in the first 30 days of the object creation but are rarely accessed after the first 30 days. Which storage solution is MOST cost-effective?
Show answer and explanation
Correct answer: C. Create an S3 bucket lifecycle policy to move files from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) 30 days from object creation. Delete the files 4 years after object creation.
S3 Standard-IA is the most cost-effective solution because it offers immediate accessibility (meeting the critical data requirement) while providing lower storage costs than S3 Standard for infrequently accessed data after 30 days. Since the files must remain accessible throughout the 4-year retention period and are rarely accessed after 30 days, transitioning to Standard-IA provides the best balance of cost and availability without the retrieval fees or accessibility delays of Glacier.
Why the other options are wrong
- A. Glacier requires retrieval time and incurs significant retrieval fees, violating the requirement for immediate accessibility of critical business data.
- B. S3 One Zone-IA lacks the durability of Standard-IA by storing data in only one availability zone, creating unnecessary risk for critical business data.
- D. Transitioning to Glacier after 4 years is unnecessary since files must be deleted at that point; moving to Glacier adds complexity without benefit.
Question 191
A company is launching a new application and will display application metrics on an Amazon CloudWatch dashboard. The company's product manager needs to access this dashboard periodically. The product manager does not have an AWS account. A solutions architect must provide access to the product manager by following the principle of least privilege. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Share the dashboard from the CloudWatch console. Enter the product manager's email address, and complete the sharing steps. Provide a shareable link for the dashboard to the product manager.
CloudWatch supports native dashboard sharing functionality that allows you to generate shareable links without requiring the recipient to have an AWS account. This is the most direct implementation of least privilege since the product manager gains access only to the specific dashboard without any IAM permissions or AWS account credentials. The shareable link can be configured with appropriate expiration and read-only access.
Why the other options are wrong
- B. Creating an IAM user and sharing credentials violates the principle of least privilege and creates unnecessary management overhead for a user who only needs read access to one dashboard.
- C. Using a shared IAM user for multiple employees is not a least-privilege approach and creates potential security and accountability issues.
- D. Deploying a bastion server with cached credentials is unnecessarily complex and introduces additional security risks and operational overhead.
Question 192
A company has a website hosted on AWS. The website is behind an Application Load Balancer (ALB) that is configured to handle HTTP and HTTPS separately. The company wants to forward all requests to the website so that the requests will use HTTPS. What should a solutions architect do to meet this requirement?
Show answer and explanation
Correct answer: C. Create a listener rule on the ALB to redirect HTTP traffic to HTTPS.
Application Load Balancers support listener rules that can redirect HTTP traffic to HTTPS at the ALB layer. This is the native, built-in mechanism for enforcing HTTPS and requires no changes to backend applications or infrastructure. Option A uses network ACLs which block rather than redirect, option B attempts to manipulate URLs which ALBs don't do, and option D unnecessarily replaces the ALB.
Why the other options are wrong
- A. Network ACLs can only block traffic, not redirect HTTP to HTTPS.
- B. Application Load Balancers do not have a rule action to replace URL schemes; they redirect using the redirect action.
- D. Replacing the ALB with a Network Load Balancer is unnecessary and more complex; ALBs natively support HTTP-to-HTTPS redirection.
Question 193
A company hosts a frontend application that uses an Amazon API Gateway API backend that is integrated with AWS Lambda. When the API receives requests, the Lambda function loads many libraries. Then the Lambda function connects to an Amazon RDS database, processes the data, and returns the data to the frontend application. The company wants to ensure that response latency is as low as possible for all its users with the fewest number of changes to the company's operations. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Configure provisioned concurrency for the Lambda function that handles the requests.
Provisioned concurrency for Lambda eliminates cold starts by keeping specified numbers of Lambda executions pre-initialized and ready. Since the bottleneck is Lambda initialization time (loading libraries), not database queries, this directly addresses latency with minimal operational changes, just configuring concurrency settings. Provisioned concurrency maintains warm instances to serve requests instantly.
Why the other options are wrong
- A. Bypassing the API Gateway defeats the architecture and exposes the database directly, creating security and maintenance issues.
- C. S3 caching adds complexity and does not solve the cold start latency issue from Lambda initialization; the primary latency source is Lambda warm-up time.
- D. Increasing database size does not address Lambda cold start latency and wastes resources on database capacity that is not the bottleneck.
Question 194
A solutions architect is implementing a complex Java application with a MySQL database. The Java application must be deployed on Apache Tomcat and must be highly available. What should the solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: B. Deploy the application by using AWS Elastic Beanstalk. Configure a load-balanced environment and a rolling deployment policy.
AWS Elastic Beanstalk automates deployment of Java applications on Apache Tomcat with load balancing and rolling deployment policies, providing high availability and simplifying operational complexity. This is the purpose-built service for this exact scenario.
Why the other options are wrong
- A. Lambda is not suitable for complex Java applications requiring Apache Tomcat; Lambda has limitations on runtime and package size.
- C. ElastiCache is a caching layer, not a replacement for MySQL database management, and doesn't address application deployment or high availability.
- D. Manual EC2 instance setup with AMI and Auto Scaling is significantly more complex than Elastic Beanstalk and requires more operational management.
Question 195
A company is storing sensitive user information in an Amazon S3 bucket. The company wants to provide secure access to this bucket from the application tier running on Amazon EC2 instances inside a VPC. Which combination of steps should a solutions architect take to accomplish this? (Choose two.)
Show answer and explanation
Correct answer: A, C. Configure a VPC gateway endpoint for Amazon S3 within the VPC; Create a bucket policy that limits access to only the application tier running in the VPC.
A VPC gateway endpoint (A) enables private connectivity from EC2 instances to S3 without internet exposure. A restrictive bucket policy (C) limits access to only the application tier's VPC, implementing least privilege. Together, these ensure secure, private access to sensitive data. Option A provides the secure network path, and option C restricts who can access the bucket.
Why the other options are wrong
- B. Making objects public contradicts the requirement to store sensitive user information securely.
- D. Copying IAM credentials to EC2 instances is a security anti-pattern and violates the principle of least privilege.
- E. A NAT instance creates internet-facing routes, which contradicts the security requirement for private access.
Question 196
A company has a Java application that uses Amazon Simple Queue Service (Amazon SQS) to parse messages. The application cannot parse messages that are larger than 256 KB in size. The company wants to implement a solution to give the application the ability to parse messages as large as 50 MB. Which solution will meet these requirements with the FEWEST changes to the code?
Show answer and explanation
Correct answer: A. Use the Amazon SQS Extended Client Library for Java to host messages that are larger than 256 KB in Amazon S3.
The Amazon SQS Extended Client Library for Java is purpose-built to handle exactly this scenario. It transparently offloads messages larger than 256 KB to Amazon S3 while keeping a reference in the SQS message, allowing the application to handle large messages without code changes beyond adding the library dependency. This requires minimal code modification, essentially just adding the library to classpath and using it as a wrapper.
Why the other options are wrong
- B. EventBridge is an event routing service, not a message queue replacement, and doesn't solve the large message problem.
- C. The 256 KB limit in SQS cannot be changed; it is a hard architectural limit of the service.
- D. EFS reference approach would require custom application code to manage file I/O and cleanup, representing significant code changes.
Question 197
A company has created an image analysis application in which users can upload photos and add photo frames to their images. The users upload images and metadata to indicate which photo frames they want to add to their images. The application uses a single Amazon EC2 instance and Amazon DynamoDB to store the metadata. The application is becoming more popular, and the number of users is increasing. The company expects the number of concurrent users to vary significantly depending on the time of day and day of week. The company must ensure that the application can scale to meet the needs of the growing user base. Which solution meats these requirements?
Show answer and explanation
Correct answer: C. Use AWS Lambda to process the photos. Store the photos in Amazon S3. Retain DynamoDB to store the metadata.
Option C provides the optimal solution for handling variable concurrent users with significant fluctuations. AWS Lambda auto-scales seamlessly without requiring instance management, eliminating the operational overhead of managing EC2 instances. Amazon S3 is the ideal service for storing large image files with automatic scaling and cost efficiency, while DynamoDB remains suitable for metadata storage. This combination delivers serverless architecture that scales automatically to match demand patterns throughout the day and week.
Why the other options are wrong
- A. Storing large photo files in DynamoDB is inefficient and costly; DynamoDB is designed for small documents, not binary image data.
- B. Kinesis Data Firehose is designed for streaming data ingestion and log delivery, not for processing and routing image files to multiple storage systems.
- D. Simply adding more EC2 instances doesn't solve the scalability issue for variable demand and doesn't provide the cost efficiency needed for unpredictable traffic patterns.
Question 198
A company needs guaranteed Amazon EC2 capacity in three specific Availability Zones in a specific AWS Region for an upcoming event that will last 1 week. What should the company do to guarantee the EC2 capacity?
Show answer and explanation
Correct answer: D. Create an On-Demand Capacity Reservation that specifies the Region and three Availability Zones needed.
On-Demand Capacity Reservations with specific Region and Availability Zone parameters guarantee compute capacity in the exact locations needed for the 1-week event. This is the only option that provides guaranteed capacity with the granularity required, as Reserved Instances don't guarantee capacity, they only provide pricing discounts.
Why the other options are wrong
- A. Reserved Instances at the Region level don't guarantee specific AZ capacity and provide only billing discounts, not capacity guarantees.
- B. On-Demand Capacity Reservations without AZ specification don't guarantee the three specific AZs required.
- C. Reserved Instances are billing instruments, not capacity guarantees, and don't reserve specific infrastructure.
Question 199
A research laboratory needs to process approximately 8 TB of data. The laboratory requires sub-millisecond latencies and a minimum throughput of 6 GBps for the storage subsystem. Hundreds of Amazon EC2 instances that run Amazon Linux will distribute and process the data. Which solution will meet the performance requirements?
Show answer and explanation
Correct answer: B. Create an Amazon S3 bucket to store the raw data. Create an Amazon FSx for Lustre file system that uses persistent SSD storage. Select the option to import data from and export data to Amazon S3. Mount the file system on the EC2 instances.
FSx for Lustre with persistent SSD storage delivers the sub-millisecond latencies and 6+ GBps throughput required for HPC workloads. The SSD storage option provides optimal performance. The ability to import/export from S3 allows efficient data staging. Lustre is specifically designed for high-performance computing scenarios with hundreds of compute instances.
Why the other options are wrong
- A. FSx for NetApp ONTAP is not optimized for HPC workloads and cannot reliably deliver the required 6 GBps throughput for this use case.
- C. Persistent HDD storage cannot deliver sub-millisecond latencies or the 6 GBps throughput required; HDDs are too slow for these performance tiers.
- D. FSx for NetApp ONTAP is not the correct choice for HPC applications requiring extreme performance; it's better suited for enterprise file sharing.
Question 200
A company is developing an application to support customer demands. The company wants to deploy the application on multiple Amazon EC2 Nitro-based instances within the same Availability Zone. The company also wants to give the application the ability to write to multiple block storage volumes in multiple EC2 Nitro-based instances simultaneously to achieve higher application availability. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use Provisioned IOPS SSD (io2) EBS volumes with Amazon Elastic Block Store (Amazon EBS) Multi-Attach
EBS Multi-Attach is supported only on io2 and io1 volumes (Provisioned IOPS SSDs), not on gp2, gp3, or st1 volumes. The io2 volume type supports simultaneous writes from multiple Nitro-based EC2 instances within the same AZ, meeting the requirement for multi-instance write access and higher availability.
Why the other options are wrong
- A. gp3 volumes do not support EBS Multi-Attach; Multi-Attach is exclusive to Provisioned IOPS SSD types.
- B. st1 (Throughput Optimized HDD) volumes do not support Multi-Attach; Multi-Attach requires Provisioned IOPS SSDs.
- D. gp2 volumes do not support EBS Multi-Attach; only io2 and io1 Provisioned IOPS SSD volumes support this feature.
Question 201
A company has two VPCs named Management and Production. The Management VPC uses VPNs through a customer gateway to connect to a single device in the data center. The Production VPC uses a virtual private gateway with two attached AWS Direct Connect connections. The Management and Production VPCs both use a single VPC peering connection to allow communication between the applications. What should a solutions architect do to mitigate any single point of failure in this architecture?
Show answer and explanation
Correct answer: C. Add a second set of VPNs to the Management VPC from a second customer gateway device.
The Management VPC has a single point of failure with only one customer gateway device connecting via VPN. Adding a second set of VPNs from a second customer gateway device eliminates this single point of failure by providing redundant VPN connections. This approach maintains high availability for the Management VPC's connectivity without requiring architectural changes to the Production VPC or peering connections.
Why the other options are wrong
- A. Adding VPNs between the two VPCs does not address the single point of failure in the Management VPC's connection to the data center.
- B. Adding a virtual private gateway to the Management VPC does not solve the single point of failure of the customer gateway device.
- D. Adding a second VPC peering connection does not address the single point of failure in the Management VPC's data center connectivity.
Question 202
A solutions architect is designing the architecture for a software demonstration environment. The environment will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The system will experience significant increases in traffic during working hours but is not required to operate on weekends. Which combination of actions should the solutions architect take to ensure that the system can scale to meet demand? (Choose two.)
Show answer and explanation
Correct answer: D, E. Use a target tracking scaling policy to scale the Auto Scaling group based on instance CPU utilization; Use scheduled scaling to change the Auto Scaling group minimum, maximum, and desired capacity to zero for weekends. Revert to the default values at the start of the week.
To meet demand during working hours and reduce costs on weekends, two actions are needed: (D) Target tracking scaling policy scales EC2 instances based on CPU utilization to handle traffic spikes during the week, and (E) Scheduled scaling automatically adjusts capacity to zero on weekends when the system is not required, eliminating unnecessary costs. Together, these provide both dynamic scaling for variable weekday demand and scheduled scaling to minimize weekend costs.
Why the other options are wrong
- A. Auto Scaling adjusts EC2 instance counts, not ALB capacity; ALBs scale automatically and do not require separate capacity adjustments.
- B. Internet gateway capacity is not a bottleneck and cannot be scaled separately through Auto Scaling; it handles massive throughput by design.
- C. Multi-region deployment increases costs and complexity without addressing the core requirement of handling traffic spikes with automatic scaling within a region.
Question 203
A company’s order system sends requests from clients to Amazon EC2 instances. The EC2 instances process the orders and then store the orders in a database on Amazon RDS. Users report that they must reprocess orders when the system fails. The company wants a resilient solution that can process orders automatically if a system outage occurs. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: C. Move the EC2 instances into an Auto Scaling group. Configure the order system to send messages to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the EC2 instances to consume messages from the queue.
Option C implements a decoupled architecture using Amazon SQS to queue orders, which prevents message loss during outages. EC2 instances consume from the queue, and Auto Scaling ensures capacity for processing. If instances fail, messages remain in the queue for reprocessing without manual intervention. This provides automatic resilience and prevents order reprocessing issues. Option A doesn't address message persistence. Option B doesn't decouple the system. Option D uses SNS which doesn't provide the guaranteed delivery and queuing needed for critical orders.
Why the other options are wrong
- A. EventBridge and ECS don't address message persistence or automatic reprocessing of failed orders.
- B. An ALB without message queuing still loses orders during outages; there's no persistence mechanism.
- D. SNS is a pub/sub service that doesn't guarantee message persistence for order processing; Lambda execution depends on SNS delivery timing.
Question 204
A company is deploying a new application on Amazon EC2 instances. The application writes data to Amazon Elastic Block Store (Amazon EBS) volumes. The company needs to ensure that all data that is written to the EBS volumes is encrypted at rest. Which solution will meet this requirement?
Show answer and explanation
Correct answer: B. Create the EBS volumes as encrypted volumes. Attach the EBS volumes to the EC2 instances.
EBS encryption is configured at the volume level, not the instance level. The correct approach is to create EBS volumes with encryption enabled and then attach them to EC2 instances. This ensures all data written to those volumes is automatically encrypted at rest using AWS KMS keys. This is the only method that directly controls encryption of the EBS storage itself.
Why the other options are wrong
- A. IAM roles control permissions and access; they do not enable or configure EBS encryption. EBS encryption is a volume-level setting independent of IAM.
- C. EC2 instance tags are metadata labels for resource organization; they do not affect or enable EBS encryption settings.
- D. KMS key policies control key access and usage; while KMS is used for encryption, the actual encryption setting must be enabled on each EBS volume at creation time.
Question 205
An ecommerce company is experiencing an increase in user traffic. The company’s store is deployed on Amazon EC2 instances as a two-tier web application consisting of a web tier and a separate database tier. As traffic increases, the company notices that the architecture is causing significant delays in sending timely marketing and order confirmation email to users. The company wants to reduce the time it spends resolving complex email delivery issues and minimize operational overhead. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: B. Configure the web instance to send email through Amazon Simple Email Service (Amazon SES).
Amazon SES is a dedicated email service that handles the complexity of email delivery, including bounce handling, complaint management, and deliverability optimization. This eliminates the operational overhead of managing email infrastructure on EC2 instances and scales automatically with demand. It reduces time spent on email delivery issues and minimizes operational overhead without requiring additional application tiers or management.
Why the other options are wrong
- A. Creating a separate EC2 tier adds operational overhead and still requires managing email delivery infrastructure manually.
- C. Amazon SNS is a messaging service primarily for notifications and mobile push, not optimized for transactional email delivery.
- D. While Auto Scaling helps with load, it still requires managing EC2 instances for email processing and doesn't address the core complexity of email delivery.
Question 206
A law firm needs to share information with the public. The information includes hundreds of files that must be publicly readable. Modifications or deletions of the files by anyone before a designated future date are prohibited. Which solution will meet these requirements in the MOST secure way?
Show answer and explanation
Correct answer: B. Create a new Amazon S3 bucket with S3 Versioning enabled. Use S3 Object Lock with a retention period in accordance with the designated date. Configure the S3 bucket for static website hosting. Set an S3 bucket policy to allow read-only access to the objects.
S3 Object Lock with a retention period is the most secure solution as it legally prevents any modification or deletion until the designated date, regardless of permissions or ownership. Combined with S3 Versioning, public read-only bucket policy for static website hosting, and AWS Backup for compliance, this provides immutable protection that cannot be circumvented even by administrators with high privileges.
Why the other options are wrong
- A. IAM permissions can be modified or escalated by administrators and do not provide the same level of legal immutability protection as Object Lock.
- C. Lambda function replacement is reactive, not preventive, and relies on detection logic that could be compromised or bypass; it's less secure than Object Lock's immutable protection.
- D. S3 Object Lock must be enabled on bucket creation, not applied after uploading files; this approach would not properly protect files uploaded before enabling Object Lock.
Question 207
A 4-year-old media company is using the AWS Organizations all features feature set to organize its AWS accounts. According to the company's finance team, the billing information on the member accounts must not be accessible to anyone, including the root user of the member accounts. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Create a service control policy (SCP) to deny access to the billing information. Attach the SCP to the root organizational unit (OU).
A service control policy (SCP) attached to the root OU is the only solution that can deny permissions to all users and the root user across all member accounts in AWS Organizations. SCPs are the only policy type that can restrict permissions at the organization level and apply to all principals, including root. Identity-based policies cannot restrict root user access, and the other options do not provide organization-wide enforcement.
Why the other options are wrong
- A. IAM groups and managed policies only apply to specific users and cannot restrict root user access.
- B. Identity-based deny policies cannot restrict root user access, as root always has implicit permissions.
- D. Converting to consolidated billing feature set removes the ability to enforce policies across accounts and does not prevent access.
Question 208
A company maintains a searchable repository of items on its website. The data is stored in an Amazon RDS for MySQL database table that contains more than 10 million rows. The database has 2 TB of General Purpose SSD storage. There are millions of updates against this data every day through the company's website. The company has noticed that some insert operations are taking 10 seconds or longer. The company has determined that the database storage performance is the problem. Which solution addresses this performance issue?
Show answer and explanation
Correct answer: A. Change the storage type to Provisioned IOPS SSD.
The problem is explicitly identified as storage performance with General Purpose SSD at 2 TB capacity. Provisioned IOPS SSD directly addresses storage I/O performance limitations and allows tuning IOPS independently of storage capacity, which resolves the 10+ second insert latency.
Why the other options are wrong
- B. Memory optimization helps with caching and query performance, not storage I/O bottlenecks causing slow inserts.
- C. Burstable instances are cost-conscious but do not provide sustained performance improvement for a high-volume workload.
- D. Read replicas help with read queries but do not improve write performance, which is the stated issue.
Question 209
A company has a legacy data processing application that runs on Amazon EC2 instances. Data is processed sequentially, but the order of results does not matter. The application uses a monolithic architecture. The only way that the company can scale the application to meet increased demand is to increase the size of the instances. The company’s developers have decided to rewrite the application to use a microservices architecture on Amazon Elastic Container Service (Amazon ECS). What should a solutions architect recommend for communication between the microservices?
Show answer and explanation
Correct answer: A. Create an Amazon Simple Queue Service (Amazon SQS) queue. Add code to the data producers, and send data to the queue. Add code to the data consumers to process data from the queue.
Amazon SQS is the ideal solution for this use case because the requirements explicitly state that data is processed sequentially but the order of results does not matter. SQS provides reliable, decoupled communication between producer microservices and consumer microservices, allowing horizontal scaling without tight coupling. Producers send messages to the queue, and consumers process them independently, which perfectly supports the microservices architecture and elastic scaling needed.
Why the other options are wrong
- B. SNS is pub/sub messaging designed for one-to-many notifications; it does not guarantee message retention or provide the queue-based worker pool pattern needed for sequential processing of individual data items.
- C. Lambda functions are not designed as message brokers; routing all inter-service communication through Lambda would create a bottleneck and unnecessary complexity rather than enabling scalable microservices.
- D. DynamoDB Streams is designed for capturing changes to DynamoDB table items, not for general inter-service messaging; it adds unnecessary database overhead and complexity for this communication pattern.
Question 210
A company runs an application on a group of Amazon Linux EC2 instances. For compliance reasons, the company must retain all application log files for 7 years. The log files will be analyzed by a reporting tool that must be able to access all the files concurrently. Which storage solution meets these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: D. Amazon S3
Amazon S3 is the most cost-effective solution for 7-year log retention. S3 can store unlimited data at the lowest per-GB cost, supports concurrent access through proper configuration, and offers lifecycle policies to transition old logs to cheaper storage classes (Glacier, Deep Archive) automatically. S3 is designed for durable, highly available object storage with concurrent read access from multiple sources.
Why the other options are wrong
- A. EBS volumes are block storage tied to instances; they're expensive for long-term archival and don't support concurrent access patterns.
- B. EFS is a file system for active workloads; it's more expensive than S3 and designed for concurrent access of active data, not archived logs.
- C. Instance store is temporary, ephemeral storage that's lost when the instance stops; it cannot meet 7-year retention requirements.
Question 211
An online retail company has more than 50 million active customers and receives more than 25,000 orders each day. The company collects purchase data for customers and stores this data in Amazon S3. Additional customer data is stored in Amazon RDS. The company wants to make all the data available to various teams so that the teams can perform analytics. The solution must provide the ability to manage fine-grained permissions for the data and must minimize operational overhead. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Create a data lake by using AWS Lake Formation. Create an AWS Glue JDBC connection to Amazon RDS. Register the S3 bucket in Lake Formation. Use Lake Formation access controls to limit access.
AWS Lake Formation is purpose-built for creating data lakes with fine-grained access control across multiple data sources. It integrates with S3 and RDS via Glue JDBC connections, manages permissions at a granular level, and minimizes operational overhead by handling the complex setup of data catalogs and access policies. Lake Formation's centralized permission management is ideal for allowing various teams to access data with minimal operational burden.
Why the other options are wrong
- A. Migrating all data to RDS is inefficient for large-scale purchase data analytics and doesn't leverage S3's cost-effectiveness for data storage.
- B. Using S3 policies alone does not provide the fine-grained, centralized permission management that Lake Formation offers, and managing access across multiple data sources is more complex.
- D. Redshift requires managing a cluster and ETL processes, which adds significant operational overhead compared to the managed Lake Formation approach.
Question 212
A company uses Amazon API Gateway to run a private gateway with two REST APIs in the same VPC. The BuyStock RESTful web service calls the CheckFunds RESTful web service to ensure that enough funds are available before a stock can be purchased. The company has noticed in the VPC flow logs that the BuyStock RESTful web service calls the CheckFunds RESTful web service over the internet instead of through the VPC. A solutions architect must implement a solution so that the APIs communicate through the VPC. Which solution will meet these requirements with the FEWEST changes to the code?
Show answer and explanation
Correct answer: B. Use an interface endpoint.
An interface VPC endpoint allows the BuyStock API to call the CheckFunds API through the VPC without routing traffic over the internet. This requires minimal code changes, just updating the endpoint URL in the API client to use the VPC endpoint DNS name. Interface endpoints provide private connectivity within the VPC while maintaining the same API Gateway functionality and communication between the two REST APIs.
Why the other options are wrong
- A. Adding X-API-Key headers addresses authorization, not the routing problem; traffic would still traverse the internet without an endpoint solution.
- C. Gateway endpoints are for S3 and DynamoDB, not for API Gateway private connectivity.
- D. Using SQS as a queue between APIs introduces architectural complexity and asynchronous communication, requiring significant code changes and not addressing the core routing requirement.
Question 213
A company's application integrates with multiple software-as-a-service (SaaS) sources for data collection. The company runs Amazon EC2 instances to receive the data and to upload the data to an Amazon S3 bucket for analysis. The same EC2 instance that receives and uploads the data also sends a notification to the user when an upload is complete. The company has noticed slow application performance and wants to improve the performance as much as possible. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Create an Amazon AppFlow flow to transfer data between each SaaS source and the S3 bucket. Configure an S3 event notification to send events to an Amazon Simple Notification Service (Amazon SNS) topic when the upload to the S3 bucket is complete.
AppFlow is a fully managed service that eliminates the need to manage EC2 instances for data transfer between SaaS sources and S3, directly addressing the performance bottleneck with minimal operational overhead. Combined with S3 event notifications to SNS for user alerts, this solution removes the burden of data ingestion from EC2 while automating the notification workflow, requiring no infrastructure management.
Why the other options are wrong
- A. Auto Scaling only addresses capacity but doesn't eliminate the core performance issue of EC2 instances handling data ingestion; it still requires operational management.
- C. EventBridge can route data but is designed for event-driven workflows rather than continuous data transfer from SaaS sources, making it less suitable for this use case.
- D. Using ECS with containers still requires managing compute infrastructure and doesn't leverage purpose-built SaaS integration services like AppFlow.
Question 214
A company has implemented a self-managed DNS service on AWS. The solution consists of the following: • Amazon EC2 instances in different AWS Regions • Endpoints of a standard accelerator in AWS Global Accelerator The company wants to protect the solution against DDoS attacks. What should a solutions architect do to meet this requirement?
Show answer and explanation
Correct answer: A. Subscribe to AWS Shield Advanced. Add the accelerator as a resource to protect.
AWS Shield Advanced provides DDoS protection and can be associated with AWS Global Accelerator endpoints. Since the company uses Global Accelerator as the entry point for their DNS service across regions, protecting the accelerator itself is the most effective approach. Shield Advanced at the accelerator level protects all backend resources simultaneously, and this is the recommended architecture for protecting Global Accelerator endpoints against DDoS attacks.
Why the other options are wrong
- B. EC2 instances are backend resources; protecting them individually is less efficient than protecting the Global Accelerator entry point, and Shield Advanced is applied at the accelerator level for optimal protection.
- C. WAF rate-based rules are not the primary DDoS protection mechanism; Shield Advanced is required for comprehensive DDoS mitigation at the infrastructure level.
- D. WAF cannot be associated with EC2 instances directly, and this approach does not address the accelerator endpoint vulnerability.
Question 215
A company needs to migrate a legacy application from an on-premises data center to the AWS Cloud because of hardware capacity constraints. The application runs 24 hours a day, 7 days a week. The application’s database storage continues to grow over time. What should a solutions architect do to meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: C. Migrate the application layer to Amazon EC2 Reserved Instances. Migrate the data storage layer to Amazon Aurora Reserved Instances.
For a 24/7 application with growing storage needs, Reserved Instances provide the best cost savings for predictable, continuous workloads. EC2 Reserved Instances reduce compute costs significantly for always-on applications, and Amazon Aurora (with reserved capacity) is ideal for databases that require high availability and automatic scaling while maintaining cost efficiency. Aurora also handles growing storage better than RDS with the flexibility of auto-scaling storage capacity.
Why the other options are wrong
- A. Spot Instances are unreliable for 24/7 applications as they can be interrupted, and S3 is not appropriate for relational database storage.
- B. RDS On-Demand instances are more expensive than reserved options for predictable 24/7 workloads with continuous operation.
- D. On-Demand instances are significantly more expensive than Reserved Instances for continuous 24/7 usage patterns.
Question 216
A company recently migrated to AWS and wants to implement a solution to protect the traffic that flows in and out of the production VPC. The company had an inspection server in its on-premises data center. The inspection server performed specific operations such as traffic flow inspection and traffic filtering. The company wants to have the same functionalities in the AWS Cloud. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use AWS Network Firewall to create the required rules for traffic inspection and traffic filtering for the production VPC.
AWS Network Firewall is designed to provide network-level protection with traffic inspection and filtering capabilities similar to on-premises inspection servers. It allows creation of custom rules for inspecting and filtering traffic flowing in and out of VPCs. This directly replaces the inspection server functionality from the on-premises data center with AWS-native capabilities.
Why the other options are wrong
- A. GuardDuty is a threat detection service using machine learning; it doesn't provide manual traffic filtering rules like an inspection server.
- B. Traffic Mirroring only copies traffic for inspection; it doesn't provide the filtering and rule-based blocking capabilities needed.
- D. AWS Firewall Manager is for centrally managing WAF and Shield policies across accounts, not for VPC-level traffic inspection and filtering.
Question 217
A company has an application that collects data from IoT sensors on automobiles. The data is streamed and stored in Amazon S3 through Amazon Kinesis Data Firehose. The data produces trillions of S3 objects each year. Each morning, the company uses the data from the previous 30 days to retrain a suite of machine learning (ML) models. Four times each year, the company uses the data from the previous 12 months to perform analysis and train other ML models. The data must be available with minimal delay for up to 1 year. After 1 year, the data must be retained for archival purposes. Which storage solution meets these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: D. Use the S3 Standard storage class. Create an S3 Lifecycle policy to transition objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days, and then to S3 Glacier Deep Archive after 1 year.
S3 Standard is optimal for the first 30 days when data is accessed frequently for daily retraining, then transitions to Standard-IA after 30 days when access becomes infrequent but still necessary for quarterly 12-month analysis. After 1 year, transition to Glacier Deep Archive for long-term archival at minimal cost. This tiered approach matches access patterns precisely and minimizes overall costs by paying full price only for the most frequently accessed period.
Why the other options are wrong
- A. Intelligent-Tiering has higher costs than Standard for the initial period and does not optimize pricing for the known access pattern of daily access then quarterly access.
- B. Intelligent-Tiering's automatic archival rules do not align with the specific 1-year requirement and add unnecessary cost compared to explicit lifecycle policies.
- C. Standard-IA has higher retrieval costs and per-request charges than Standard, making it uneconomical for daily 30-day access patterns.
Question 218
A company uses Amazon S3 to store its confidential audit documents. The S3 bucket uses bucket policies to restrict access to audit team IAM user credentials according to the principle of least privilege. Company managers are worried about accidental deletion of documents in the S3 bucket and want a more secure solution. What should a solutions architect do to secure the audit documents?
Show answer and explanation
Correct answer: A. Enable the versioning and MFA Delete features on the S3 bucket.
Enabling versioning and MFA Delete on an S3 bucket provides protection against accidental deletion by requiring multi-factor authentication to permanently delete object versions. This directly addresses the concern about accidental deletion while maintaining least privilege access through existing bucket policies. Versioning allows recovery of deleted objects, and MFA Delete adds an additional security layer requiring physical MFA confirmation for deletions.
Why the other options are wrong
- B. Enabling MFA on IAM user credentials doesn't prevent accidental S3 deletions; it only secures IAM login.
- C. S3 Lifecycle policies cannot deny actions based on dates; they only manage object transitions and expiration.
- D. KMS encryption protects data confidentiality but doesn't prevent accidental deletion, which is the stated concern.
Question 219
A company uses AWS Organizations to run workloads within multiple AWS accounts. A tagging policy adds department tags to AWS resources when the company creates tags. An accounting team needs to determine spending on Amazon EC2 consumption. The accounting team must determine which departments are responsible for the costs regardless ofAWS account. The accounting team has access to AWS Cost Explorer for all AWS accounts within the organization and needs to access all reports from Cost Explorer. Which solution meets these requirements in the MOST operationally efficient way?
Show answer and explanation
Correct answer: A. From the Organizations management account billing console, activate a user-defined cost allocation tag named department. Create one cost report in Cost Explorer grouping by tag name, and filter by EC2.
From the Organizations management account billing console, you must activate the user-defined cost allocation tag named 'department' (since the tagging policy creates custom department tags, not AWS-defined ones). This allows the accounting team to access all cost data across accounts from a single Cost Explorer report. Creating one report grouped by the 'department' tag and filtered by EC2 provides the required spending visibility by department across all accounts. User-defined tags require activation at the organization level, and the management account console has visibility across all member accounts.
Why the other options are wrong
- B. AWS-defined tags are predefined by AWS (like aws:createdBy); the company uses user-defined department tags from its tagging policy.
- C. Member account billing console cannot provide organization-wide visibility; only the management account console can see data across all accounts.
- D. Member accounts cannot access data across the entire organization, and the tags are user-defined, not AWS-defined.
Question 220
A company has a production web application in which users upload documents through a web interface or a mobile app. According to a new regulatory requirement. new documents cannot be modified or deleted after they are stored. What should a solutions architect do to meet this requirement?
Show answer and explanation
Correct answer: A. Store the uploaded documents in an Amazon S3 bucket with S3 Versioning and S3 Object Lock enabled.
S3 Object Lock implements Write-Once-Read-Many (WORM) compliance mode, preventing any modification or deletion of objects after storage, meeting the regulatory requirement for immutable documents. When combined with S3 Versioning, it ensures complete audit trails and protection against accidental or malicious alterations. This is the AWS-native solution designed specifically for compliance scenarios requiring immutability.
Why the other options are wrong
- B. Lifecycle policies archive documents but do not prevent modification or deletion; documents can still be changed or removed before archival.
- C. Read-only ACLs only prevent access changes but do not prevent the bucket owner or privileged users from modifying or deleting objects; S3 versioning alone doesn't enforce immutability.
- D. EFS mounted in read-only mode prevents all writes, but the requirement is to allow initial storage then prevent modification, not prevent writing entirely; also EFS is not designed for document compliance scenarios.
Question 221
A company is making a prototype of the infrastructure for its new website by manually provisioning the necessary infrastructure. This infrastructure includes an Auto Scaling group, an Application Load Balancer and an Amazon RDS database. After the configuration has been thoroughly validated, the company wants the capability to immediately deploy the infrastructure for development and production use in two Availability Zones in an automated fashion. What should a solutions architect recommend to meet these requirements?
Show answer and explanation
Correct answer: B. Define the infrastructure as a template by using the prototype infrastructure as a guide. Deploy the infrastructure with AWS CloudFormation.
AWS CloudFormation is the standard AWS service for defining infrastructure as code using templates. It enables repeatable, automated deployment of the validated prototype infrastructure across multiple environments and Availability Zones. The company can create a CloudFormation template based on their prototype and deploy it to development and production with consistent, automated provisioning.
Why the other options are wrong
- A. AWS Systems Manager is primarily for operational management and automation, not for defining and deploying infrastructure from scratch.
- C. AWS Config records and tracks resource inventory and compliance, but is not designed for provisioning new infrastructure.
- D. AWS Elastic Beanstalk is for application deployment and environment management, not for replicating complex multi-tier infrastructure across multiple zones.
Question 222
A company plans to use Amazon ElastiCache for its multi-tier web application. A solutions architect creates a Cache VPC for the ElastiCache cluster and an App VPC for the application’s Amazon EC2 instances. Both VPCs are in the us-east-1 Region. The solutions architect must implement a solution to provide the application’s EC2 instances with access to the ElastiCache cluster. Which solution will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: A. Create a peering connection between the VPCs. Add a route table entry for the peering connection in both VPCs. Configure an inbound rule for the ElastiCache cluster’s security group to allow inbound connection from the application’s security group.
VPC peering is the most cost-effective solution for direct connectivity between two VPCs in the same region. It requires minimal setup (peering connection and route table entries) and incurs only standard data transfer costs. The security group rule on the ElastiCache cluster's security group allows traffic from the application's security group CIDR. A Transit VPC adds unnecessary complexity and cost.
Why the other options are wrong
- B. A Transit VPC is unnecessarily complex and expensive for a simple two-VPC connection; it adds operational overhead and additional data transfer costs.
- C. Peering connections themselves do not have security groups; security groups are applied to resources (like ElastiCache clusters) that receive traffic, not to the peering connection.
- D. Transit VPC approach is costlier and more complex than direct peering; the peering connection's security group reference in option C is also technically incorrect.
Question 223
A company runs a shopping application that uses Amazon DynamoDB to store customer information. In case of data corruption, a solutions architect needs to design a solution that meets a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 1 hour. What should the solutions architect recommend to meet these requirements?
Show answer and explanation
Correct answer: B. Configure DynamoDB point-in-time recovery. For RPO recovery, restore to the desired point in time.
DynamoDB point-in-time recovery (PITR) meets both the 15-minute RPO and 1-hour RTO requirements by allowing restoration to any point within the last 35 days with minimal recovery time. This is a fully managed feature requiring no additional infrastructure, making it the most straightforward solution for data corruption scenarios.
Why the other options are wrong
- A. Global tables provide cross-region redundancy but do not directly address data corruption; pointing to another region does not recover from corrupted data.
- C. Daily S3 exports result in a 24-hour RPO, which far exceeds the 15-minute requirement and requires manual restoration procedures.
- D. EBS snapshots are not applicable to DynamoDB, which is a managed NoSQL service that does not use EBS storage.
Question 224
A company recently created a disaster recovery site in a different AWS Region. The company needs to transfer large amounts of data back and forth between NFS file systems in the two Regions on a periodic basis. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Use AWS DataSync.
AWS DataSync is purpose-built for transferring large amounts of data between NFS file systems across AWS Regions. It automates the transfer process, provides built-in validation, and minimizes operational overhead by handling scheduling, bandwidth optimization, and data integrity checks. It's the most suitable managed solution for periodic large-scale file system transfers between Regions.
Why the other options are wrong
- B. AWS Snowball requires physical device shipment logistics, which adds time and complexity for periodic transfers that can be done over network.
- C. Setting up and maintaining an SFTP server on EC2 creates significant operational overhead compared to managed solutions.
- D. AWS DMS is designed for database migration, not for transferring general NFS file system data between Regions.
Question 225
A company is moving its data management application to AWS. The company wants to transition to an event-driven architecture. The architecture needs to be more distributed and to use serverless concepts while performing the different aspects of the workflow. The company also wants to minimize operational overhead. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Build out the workflow in AWS Step Functions. Use Step Functions to create a state machine. Use the state machine to invoke AWS Lambda functions to process the workflow steps.
AWS Step Functions provides serverless orchestration with state machines that coordinate complex workflows across distributed components, including Lambda functions. This meets all requirements: event-driven architecture, distributed processing, serverless concepts, and minimal operational overhead. Step Functions manages the workflow logic without requiring infrastructure management.
Why the other options are wrong
- A. AWS Glue is an ETL service designed for data integration tasks, not general workflow orchestration for event-driven architectures.
- B. Deploying on EC2 instances introduces operational overhead and contradicts the serverless requirement.
- C. EventBridge with scheduled Lambda invocations is not suitable for complex workflows requiring state management and conditional logic between steps.
Question 226
An entertainment company is using Amazon DynamoDB to store media metadata. The application is read intensive and experiencing delays. The company does not have staff to handle additional operational overhead and needs to improve the performance efficiency of DynamoDB without reconfiguring the application. What should a solutions architect recommend to meet this requirement?
Show answer and explanation
Correct answer: B. Use Amazon DynamoDB Accelerator (DAX).
Amazon DynamoDB Accelerator (DAX) is a managed, in-memory cache specifically designed for DynamoDB that transparently caches frequently accessed data. It improves read performance without requiring application code changes, the application continues using the same DynamoDB API calls, but DAX intercepts requests and serves cached data when available. This is ideal for read-intensive workloads and requires no operational overhead since AWS manages the service. ElastiCache options require application integration and custom code, while global tables address replication, not caching.
Why the other options are wrong
- A. ElastiCache for Redis requires application code changes to integrate caching logic, violating the no-reconfiguration requirement.
- C. DynamoDB global tables replicate data across regions for high availability, not for improving read performance in a single region.
- D. ElastiCache for Memcached similarly requires application code changes and custom integration to function as a cache layer.
Question 227
A company sells datasets to customers who do research in artificial intelligence and machine learning (AI/ML). The datasets are large, formatted files that are stored in an Amazon S3 bucket in the us-east-1 Region. The company hosts a web application that the customers use to purchase access to a given dataset. The web application is deployed on multiple Amazon EC2 instances behind an Application Load Balancer. After a purchase is made, customers receive an S3 signed URL that allows access to the files. The customers are distributed across North America and Europe. The company wants to reduce the cost that is associated with data transfers and wants to maintain or improve performance. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: B. Deploy an Amazon CloudFront distribution with the existing S3 bucket as the origin. Direct customer requests to the CloudFront URL. Switch to CloudFront signed URLs for access control.
CloudFront is the optimal solution for reducing data transfer costs for geographically distributed users while maintaining performance. CloudFront caches content at edge locations across North America and Europe, reducing origin traffic and data transfer costs significantly. Using CloudFront signed URLs provides robust access control while maintaining the security previously provided by S3 signed URLs. This approach directly addresses both cost reduction and performance improvement for the global customer base.
Why the other options are wrong
- A. S3 Transfer Acceleration optimizes upload performance but does not cache content, so it does not reduce data transfer costs for repeated downloads across regions.
- C. Cross-Region Replication with S3 signed URLs requires customers to route requests correctly, adds replication costs, and does not provide the cost benefits of caching at edge locations.
- D. Streaming datasets through the web application defeats the purpose of using S3, increases EC2 load and costs, and does not leverage AWS's global content delivery infrastructure.
Question 228
A company hosts a serverless application on AWS. The application uses Amazon API Gateway, AWS Lambda, and an Amazon RDS for PostgreSQL database. The company notices an increase in application errors that result from database connection timeouts during times of peak traffic or unpredictable traffic. The company needs a solution that reduces the application failures with the least amount of change to the code. What should a solutions architect do to meet these requirements?
Show answer and explanation
Correct answer: B. Enable RDS Proxy on the RDS DB instance.
RDS Proxy manages database connection pooling, allowing many Lambda functions to share a smaller pool of database connections. This prevents connection exhaustion during traffic spikes and reduces timeout errors with minimal code changes, as applications can point to the proxy endpoint instead of the database.
Why the other options are wrong
- A. Reducing Lambda concurrency would limit application scalability and throughput rather than solving connection timeout issues.
- C. Resizing the DB instance class to accept more connections is expensive and does not address the root cause of inefficient connection management.
- D. Migrating to DynamoDB requires significant application code changes and may not be suitable for existing PostgreSQL relational queries.
Question 229
A company is running a multi-tier web application on premises. The web application is containerized and runs on a number of Linux hosts connected to a PostgreSQL database that contains user records. The operational overhead of maintaining the infrastructure and capacity planning is limiting the company's growth. A solutions architect must improve the application's infrastructure. Which combination of actions should the solutions architect take to accomplish this? (Choose two.)
Show answer and explanation
Correct answer: A, E. Migrate the PostgreSQL database to Amazon Aurora; Migrate the web application to be hosted on AWS Fargate with Amazon Elastic Container Service (Amazon ECS).
Migrating PostgreSQL to Amazon Aurora removes database management overhead while providing high availability and automated backups. Migrating the containerized web application to AWS Fargate with ECS eliminates infrastructure management entirely, no need to provision or manage EC2 instances. Together, these actions address the operational overhead limiting growth by moving to fully managed services that handle capacity planning and maintenance automatically.
Why the other options are wrong
- B. Migrating to EC2 instances still requires capacity planning and operational management of infrastructure, which does not address the company's stated growth limitations.
- C. CloudFront optimizes content delivery but does not reduce operational overhead for the application infrastructure or database management.
- D. ElastiCache can improve performance but does not address the operational overhead of infrastructure and capacity planning that is limiting growth.
Question 230
A company has a Microsoft .NET application that runs on an on-premises Windows Server. The application stores data by using an Oracle Database Standard Edition server. The company is planning a migration to AWS and wants to minimize development changes while moving the application. The AWS application environment should be highly available. Which combination of actions should the company take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, E. Rehost the application in AWS Elastic Beanstalk with the .NET platform in a Multi-AZ deployment; Use AWS Database Migration Service (AWS DMS) to migrate from the Oracle database to Oracle on Amazon RDS in a Multi-AZ deployment.
Option B (Elastic Beanstalk with Multi-AZ .NET deployment) minimizes code changes while providing high availability without major refactoring. Option E (AWS DMS to Oracle on RDS Multi-AZ) maintains the Oracle database compatibility without code changes and provides built-in multi-AZ high availability. Together, these preserve the application architecture while achieving the HA requirement. Option A requires major refactoring to serverless. Option C changes the OS which may introduce compatibility issues. Option D uses DynamoDB which is incompatible with Oracle SQL.
Why the other options are wrong
- A. Refactoring to Lambda requires significant code changes, violating the minimize development changes requirement.
- C. Moving to Amazon Linux introduces OS incompatibility with a Windows Server/.NET application.
- D. DynamoDB is incompatible with Oracle SQL queries; data migration would require application refactoring.
Question 231
A company stores several petabytes of data across multiple AWS accounts. The company uses AWS Lake Formation to manage its data lake. The company's data science team wants to securely share selective data from its accounts with the company's engineering team for analytical purposes. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: D. Use Lake Formation tag-based access control to authorize and grant cross-account permissions for the required data to the engineering team accounts.
Lake Formation tag-based access control (LF-TBAC) provides the most operationally efficient way to grant cross-account permissions. It allows the data science team to authorize and manage access to specific data assets across accounts using tags, without copying data or managing multiple IAM policies. This approach is built into Lake Formation and minimizes operational overhead while maintaining security controls.
Why the other options are wrong
- A. Copying data to a common account introduces data duplication, increased storage costs, and operational overhead for data synchronization.
- B. Using Grant commands in each account requires manual administration in every account where data resides, increasing operational overhead.
- C. AWS Data Exchange is designed for commercial data exchange, not internal cross-account sharing, and adds unnecessary complexity.
Question 232
A company wants to reduce the cost of its existing three-tier web architecture. The web, application, and database servers are running on Amazon EC2 instances for the development, test, and production environments. The EC2 instances average 30% CPU utilization during peak hours and 10% CPU utilization during non-peak hours. The production EC2 instances run 24 hours a day. The development and test EC2 instances run for at least 8 hours each day. The company plans to implement automation to stop the development and test EC2 instances when they are not in use. Which EC2 instance purchasing solution will meet the company's requirements MOST cost-effectively?
Show answer and explanation
Correct answer: B. Use Reserved Instances for the production EC2 instances. Use On-Demand Instances for the development and test EC2 instances.
Reserved Instances provide the lowest hourly rate for production instances running 24/7 with predictable usage. On-Demand Instances are ideal for development and test environments that run only 8+ hours daily because they can be stopped during off-hours without penalty, avoiding the commitment cost of Reserved Instances. This combination minimizes costs across both persistent and variable workloads.
Why the other options are wrong
- A. Spot Instances are unsuitable for production workloads requiring 24/7 availability due to potential interruptions; Reserved Instances for dev/test would waste money since those instances are stopped daily.
- C. Spot Blocks require a specific block duration commitment and are more expensive than On-Demand for short, interrupted usage; production should use Reserved Instances for continuous operation.
- D. On-Demand Instances are expensive for 24/7 production use, and Spot Blocks cannot be reliably stopped/started for dev/test schedules.
Question 233
A company is running an online transaction processing (OLTP) workload on AWS. This workload uses an unencrypted Amazon RDS DB instance in a Multi-AZ deployment. Daily database snapshots are taken from this instance. What should a solutions architect do to ensure the database and snapshots are always encrypted moving forward?
Show answer and explanation
Correct answer: A. Encrypt a copy of the latest DB snapshot. Replace existing DB instance by restoring the encrypted snapshot.
The correct approach is to encrypt a copy of the latest database snapshot and then restore from that encrypted snapshot to replace the existing unencrypted DB instance. This is the standard AWS method for enabling encryption on an existing unencrypted RDS instance. Once the new encrypted instance is running, all future snapshots will automatically be encrypted, meeting the requirement for both the database and snapshots to be encrypted going forward.
Why the other options are wrong
- B. Creating EBS volumes and copying snapshots to them does not enable encryption on the RDS instance itself; EBS encryption is separate from RDS encryption.
- C. While copying snapshots with KMS encryption is part of the process, this option does not clearly state restoring to a new instance, making it incomplete and not the standard procedure.
- D. Copying snapshots to S3 is a backup approach but does not address encrypting the live RDS instance, which is the primary requirement.
Question 234
A solutions architect is designing a new API using Amazon API Gateway that will receive requests from users. The volume of requests is highly variable; several hours can pass without receiving a single request. The data processing will take place asynchronously, but should be completed within a few seconds after a request is made. Which compute service should the solutions architect have the API invoke to deliver the requirements at the lowest cost?
Show answer and explanation
Correct answer: B. An AWS Lambda function
AWS Lambda is the lowest-cost option for highly variable request volumes with long idle periods because you pay only for execution time. The asynchronous processing requirement and few-second completion fit Lambda's model perfectly. Lambda integrates seamlessly with API Gateway, scales automatically, and incurs zero cost during the hours without requests, far more cost-effective than provisioned services like ECS, EKS, or Glue jobs.
Why the other options are wrong
- A. AWS Glue is designed for ETL batch jobs, not real-time API request processing, and requires provisioned resources.
- C. EKS requires provisioned cluster nodes running continuously, incurring costs even during idle periods with no requests.
- D. ECS with EC2 requires running instances 24/7, resulting in continuous costs regardless of request volume.
Question 235
A company is planning to store data on Amazon RDS DB instances. The company must encrypt the data at rest. What should a solutions architect do to meet this requirement?
Show answer and explanation
Correct answer: A. Create a key in AWS Key Management Service (AWS KMS). Enable encryption for the DB instances.
AWS KMS is the standard service for managing encryption keys in AWS. RDS supports native encryption at rest using KMS keys, when you enable encryption on an RDS instance, you specify a KMS key to encrypt the database. This is the proper, secure way to meet data encryption requirements. Secrets Manager (B) stores secrets, not encryption keys for RDS. ACM and IAM certificates (C, D) are for SSL/TLS in-transit encryption, not at-rest encryption.
Why the other options are wrong
- B. AWS Secrets Manager is designed for storing application secrets and credentials, not for managing encryption keys for RDS at-rest encryption.
- C. AWS Certificate Manager provides SSL/TLS certificates for in-transit encryption, not at-rest encryption of database data.
- D. IAM cannot generate certificates; ACM is the correct service, but certificates are for SSL/TLS in-transit encryption, not at-rest encryption.
Question 236
A solutions architect is designing the architecture of a new application being deployed to the AWS Cloud. The application will run on Amazon EC2 On-Demand Instances and will automatically scale across multiple Availability Zones. The EC2 instances will scale up and down frequently throughout the day. An Application Load Balancer (ALB) will handle the load distribution. The architecture needs to support distributed session data management. The company is willing to make changes to code if needed. What should the solutions architect do to ensure that the architecture supports distributed session data management?
Show answer and explanation
Correct answer: A. Use Amazon ElastiCache to manage and store session data.
Amazon ElastiCache provides a distributed, in-memory session store that works seamlessly with horizontally scaled EC2 instances across multiple Availability Zones. As instances scale up and down, all instances can access the same session data from ElastiCache, avoiding session loss. This is the standard pattern for distributed session management in cloud architectures.
Why the other options are wrong
- B. Sticky sessions on the ALB tie users to specific instances, defeating the benefits of auto-scaling and causing session loss when instances are terminated.
- C. AWS Systems Manager Session Manager is for managing SSH/RDP sessions to EC2 instances, not for application session data management.
- D. STS GetSessionToken is for AWS credential management, not for managing application user session data.
Question 237
A company has applications that run on Amazon EC2 instances in a VPC. One of the applications needs to call the Amazon S3 API to store and read objects. According to the company's security regulations, no traffic from the applications is allowed to travel across the internet. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Configure an S3 gateway endpoint.
An S3 gateway endpoint enables EC2 instances in a VPC to access S3 without traversing the internet. Traffic stays within the AWS network, satisfying the security requirement that no traffic travels across the internet. Gateway endpoints are free and integrate seamlessly with S3 bucket policies.
Why the other options are wrong
- B. S3 bucket location (private subnet) doesn't control network traffic routing; S3 is a regional service not subnet-dependent.
- C. Creating S3 in the same region doesn't prevent internet traffic; access still routes through the public internet without a gateway endpoint.
- D. A NAT gateway routes traffic to the internet, which violates the requirement that no traffic travel across the internet.
Question 238
A company offers a food delivery service that is growing rapidly. Because of the growth, the company’s order processing system is experiencing scaling problems during peak traffic hours. The current architecture includes the following: • A group of Amazon EC2 instances that run in an Amazon EC2 Auto Scaling group to collect orders from the application • Another group of EC2 instances that run in an Amazon EC2 Auto Scaling group to fulfill orders The order collection process occurs quickly, but the order fulfillment process can take longer. Data must not be lost because of a scaling event. A solutions architect must ensure that the order collection process and the order fulfillment process can both scale properly during peak traffic hours. The solution must optimize utilization of the company’s AWS resources. Which solution meets these requirements?
Show answer and explanation
Correct answer: D. Provision two Amazon Simple Queue Service (Amazon SQS) queues: one for order collection and another for order fulfillment. Configure the EC2 instances to poll their respective queue. Create a metric based on a backlog per instance calculation. Scale the Auto Scaling groups based on this metric.
Option D is correct because it combines SQS queues (which decouple the order collection and fulfillment processes and prevent data loss) with Auto Scaling based on a backlog-per-instance metric. This metric directly reflects the actual workload in the queues rather than just CPU utilization, enabling more accurate scaling decisions that respond to the actual queue depth. This ensures both processes scale appropriately during peak hours while optimizing resource utilization. Option C lacks the backlog-per-instance metric and relies on queue notifications, which is less precise for scaling decisions.
Why the other options are wrong
- A. Configuring minimum capacity according to peak values wastes resources during off-peak hours and doesn't address the decoupling needed between order collection and fulfillment.
- B. SNS topic-based scaling is reactive and cumbersome; it doesn't provide the continuous, metric-based scaling that SQS queue depth offers.
- C. While SQS provides decoupling, scaling based only on queue notifications without a backlog-per-instance metric is less precise and doesn't optimize resource utilization as effectively.
Question 239
A company wants to use artificial intelligence (AI) to determine the quality of its customer service calls. The company currently manages calls in four different languages, including English. The company will offer new languages in the future. The company does not have the resources to regularly maintain machine learning (ML) models. The company needs to create written sentiment analysis reports from the customer service call recordings. The customer service call recording text must be translated into English. Which combination of steps will meet these requirements? (Choose three.)
Show answer and explanation
Correct answer: D, E, F. Use Amazon Transcribe to convert the audio recordings in any language into text; Use Amazon Translate to translate text in any language to English; Use Amazon Comprehend to create the sentiment analysis reports.
Amazon Transcribe converts audio recordings to text in any language, Amazon Translate converts the text to English, and Amazon Comprehend performs sentiment analysis. This combination of services requires no ML model maintenance and handles the multi-language requirement natively. All three services are fully managed AI services requiring no custom development.
Why the other options are wrong
- A. Amazon Comprehend is not designed to translate audio; it analyzes text sentiment and content.
- B. Amazon Lex is a conversational chatbot service and is not designed to create written sentiment analysis reports.
- C. Amazon Polly converts text to speech, the opposite of what is needed; Transcribe converts speech to text.
Question 240
A solutions architect must migrate a Windows Internet Information Services (IIS) web application to AWS. The application currently relies on a file share hosted in the user's on-premises network-attached storage (NAS). The solutions architect has proposed migrating the IIS web servers to Amazon EC2 instances in multiple Availability Zones that are connected to the storage solution, and configuring an Elastic Load Balancer attached to the instances. Which replacement to the on-premises file share is MOST resilient and durable?
Show answer and explanation
Correct answer: C. Migrate the file share to Amazon FSx for Windows File Server.
Amazon FSx for Windows File Server is purpose-built as a managed Windows file share solution that replaces on-premises NAS for Windows environments. It provides native Windows SMB protocol support, integrates seamlessly with Windows EC2 instances, offers automatic backups, multi-AZ deployment for high availability, and handles all administrative overhead. It is the most resilient and durable replacement for a NAS file share in a Windows IIS environment.
Why the other options are wrong
- A. RDS is a relational database service, not a file share; it is unsuitable for NAS replacement and does not support file share protocols.
- B. Storage Gateway is a hybrid solution designed for on-premises environments; while it can support file shares, it is not the most resilient managed solution for cloud-native architecture.
- D. EFS uses NFS protocol designed for Linux; it does not provide native Windows SMB support needed for Windows IIS file share access.
Question 241
A company operates a two-tier application for image processing. The application uses two Availability Zones, each with one public subnet and one private subnet. An Application Load Balancer (ALB) for the web tier uses the public subnets. Amazon EC2 instances for the application tier use the private subnets. Users report that the application is running more slowly than expected. A security audit of the web server log files shows that the application is receiving millions of illegitimate requests from a small number of IP addresses. A solutions architect needs to resolve the immediate performance problem while the company investigates a more permanent solution. What should the solutions architect recommend to meet this requirement?
Show answer and explanation
Correct answer: B. Modify the network ACL for the web tier subnets. Add an inbound deny rule for the IP addresses that are consuming resources.
Network ACLs at the web tier subnets are the appropriate place to block malicious IP addresses before traffic reaches the ALB and application servers. This provides immediate relief by filtering illegitimate requests at the subnet boundary, preventing them from consuming ALB and application resources. Network ACLs are stateless and efficient for IP-based blocking.
Why the other options are wrong
- A. Security groups are stateful and designed for instance-level protection; blocking at the security group won't prevent traffic from reaching the ALB itself.
- C. The application tier instances are not the entry point; blocking at this layer misses the opportunity to protect the ALB and web tier.
- D. The application tier is downstream and not the immediate bottleneck; the problem originates at the ALB/web tier layer.
Question 242
A company hosts a website on Amazon EC2 instances behind an Application Load Balancer (ALB). The website serves static content. Website traffic is increasing, and the company is concerned about a potential increase in cost.
Show answer and explanation
Correct answer: A. Create an Amazon CloudFront distribution to cache state files at edge locations
CloudFront is a CDN service that caches static content at edge locations worldwide, significantly reducing origin server load and associated EC2 costs. It's the standard AWS solution for caching and serving static content efficiently. This reduces the number of requests reaching the ALB and EC2 instances, directly lowering infrastructure costs.
Why the other options are wrong
- B. ElastiCache is designed for application-level caching (database query results, sessions) not for serving static files to end users.
- C. AWS WAF is a Web Application Firewall for protection, not a caching mechanism; it does not cache static files.
- D. Adding a second ALB in another region would increase costs significantly and is unnecessary for static content; it's also more complex than CDN-based solutions.
Question 243
Organizers for a global event want to put daily reports online as static HTML pages. The pages are expected to generate millions of views from users around the world. The files are stored in an Amazon S3 bucket. A solutions architect has been asked to design an efficient and effective solution. Which action should the solutions architect take to accomplish this?
Show answer and explanation
Correct answer: D. Use Amazon CloudFront with the S3 bucket as its origin.
Amazon CloudFront is a content delivery network that caches static content at edge locations globally, providing low latency and high performance for millions of users worldwide. Using CloudFront with an S3 origin is the standard, most efficient solution for distributing static HTML files globally with minimal origin load.
Why the other options are wrong
- A. Presigned URLs are for temporary access control, not for efficient global content delivery.
- B. Cross-Region replication replicates data across regions but doesn't provide the caching and edge distribution that CloudFront offers.
- C. Route 53 geoproximity routing directs users to specific origins but doesn't provide caching or edge distribution like CloudFront does.
Question 244
A company hosts a containerized web application on a fleet of on-premises servers that process incoming requests. The number of requests is growing quickly. The on-premises servers cannot handle the increased number of requests. The company wants to move the application to AWS with minimum code changes and minimum development effort. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Use AWS Fargate on Amazon Elastic Container Service (Amazon ECS) to run the containerized web application with Service Auto Scaling. Use an Application Load Balancer to distribute the incoming requests.
AWS Fargate on ECS with Service Auto Scaling provides the least operational overhead for containerized applications. Fargate eliminates EC2 instance management, Application Load Balancer handles request distribution, and Service Auto Scaling automatically adjusts capacity based on demand. This requires minimal code changes since the application runs in its existing container format. EC2 requires instance management; Lambda requires code rewrite; HPC is unnecessary for web request processing.
Why the other options are wrong
- B. Fixed EC2 instances require manual capacity planning and instance management, and cannot scale to meet growing request volume automatically.
- C. Lambda requires rewriting the application in a supported language, violating the 'minimum code changes' requirement.
- D. HPC solutions like ParallelCluster are designed for scientific computing workloads, not for scaling web application request processing.
Question 245
A solutions architect needs to design a highly available application consisting of web, application, and database tiers. HTTPS content delivery should be as close to the edge as possible, with the least delivery time. Which solution meets these requirements and is MOST secure?
Show answer and explanation
Correct answer: C. Configure a public Application Load Balancer (ALB) with multiple redundant Amazon EC2 instances in private subnets. Configure Amazon CloudFront to deliver HTTPS content using the public ALB as the origin.
Option C provides the optimal security and availability design: EC2 instances are placed in private subnets (reducing exposure), the public ALB sits in front and is the only internet-facing component, and CloudFront connects to the public ALB as origin. This provides defense-in-depth with edge content delivery via CloudFront while keeping application servers private and protected from direct internet exposure.
Why the other options are wrong
- A. EC2 instances in public subnets are directly exposed to the internet, increasing security risk unnecessarily.
- B. CloudFront connecting directly to EC2 instances in private subnets is less secure and requires complex routing; the ALB should be the front-facing component.
- D. EC2 instances in public subnets are exposed to direct internet attacks and are less secure than private subnets behind a load balancer.
Question 246
A meteorological startup company has a custom web application to sell weather data to its users online. The company uses Amazon DynamoDB to store its data and wants to build a new service that sends an alert to the managers of four internal teams every time a new weather event is recorded. The company does not want this new service to affect the performance of the current application. What should a solutions architect do to meet these requirements with the LEAST amount of operational overhead?
Show answer and explanation
Correct answer: C. Enable Amazon DynamoDB Streams on the table. Use triggers to write to a single Amazon Simple Notification Service (Amazon SNS) topic to which the teams can subscribe.
DynamoDB Streams with SNS provides the least operational overhead for this requirement. Streams automatically capture all new items written to the table without impacting application performance, and triggers can seamlessly forward events to a single SNS topic for team subscriptions. This decouples the notification logic from the application code and requires no polling or cron jobs.
Why the other options are wrong
- A. DynamoDB transactions are not the appropriate mechanism for sending notifications; they are designed for ACID compliance.
- B. Modifying the current application to publish to SNS increases application complexity and couples business logic to notification infrastructure.
- D. A cron job scanning the table every minute introduces operational overhead, requires custom code maintenance, and creates unnecessary database load.
Question 247
A company has a multi-tier application that runs six front-end web servers in an Amazon EC2 Auto Scaling group in a single Availability Zone behind an Application Load Balancer (ALB). A solutions architect needs to modify the infrastructure to be highly available without modifying the application. Which architecture should the solutions architect choose that provides high availability?
Show answer and explanation
Correct answer: B. Modify the Auto Scaling group to use three instances across each of two Availability Zones.
To achieve high availability without modifying the application, the Auto Scaling group should be reconfigured to span multiple Availability Zones within the same region. This ensures that if one AZ becomes unavailable, instances in other AZs continue running and the ALB automatically routes traffic to healthy instances. This approach maintains the existing application design while eliminating single points of failure. Multi-region solutions add complexity and cost, while round-robin configuration does not address availability.
Why the other options are wrong
- A. Multi-region deployment adds significant complexity and cost, and is not necessary for high availability within a single region.
- C. Creating a template for another region does not provide automatic high availability; it only enables manual failover capability.
- D. Round-robin configuration in the ALB is already the default behavior and does not address the lack of high availability across availability zones.
Question 248
A company has a three-tier application on AWS that ingests sensor data from its users’ devices. The traffic flows through a Network Load Balancer (NLB), then to Amazon EC2 instances for the web tier, and finally to EC2 instances for the application tier. The application tier makes calls to a database. What should a solutions architect do to improve the security of the data in transit?
Show answer and explanation
Correct answer: A. Configure a TLS listener. Deploy the server certificate on the NLB.
Configuring a TLS listener and deploying the server certificate on the NLB directly encrypts data in transit between clients and the load balancer. This is the most direct and appropriate solution for securing data flowing through the network load balancer, addressing the specific security concern mentioned in the question.
Why the other options are wrong
- B. AWS Shield and WAF address DDoS and application-layer attacks, not encryption of data in transit.
- C. While WAF is useful for application security, switching to ALB is unnecessary and doesn't directly address data in transit encryption; NLB can support TLS.
- D. EBS encryption protects data at rest on EC2 volumes, not data in transit through the network.
Question 249
A company is migrating applications to AWS. The applications are deployed in different accounts. The company manages the accounts centrally by using AWS Organizations. The company's security team needs a single sign-on (SSO) solution across all the company's accounts. The company must continue managing the users and groups in its on-premises self-managed Microsoft Active Directory. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console. Create a two-way forest trust to connect the company's self-managed Microsoft Active Directory with AWS SSO by using AWS Directory Service for Microsoft Active Directory.
AWS SSO (now IAM Identity Center) can use an on-premises self-managed Active Directory through AWS Directory Service for Microsoft Active Directory. That integration requires a two-way forest trust between AWS Managed Microsoft AD and the on-premises domain, so users and groups stay managed on premises.
Why the other options are wrong
- A. A one-way trust is not supported for connecting AWS SSO to on-premises users and groups; a two-way forest trust is required.
- C. A trust with AWS Directory Service alone does not provide single sign-on across all the accounts in the organization.
- D. Deploying a new on-premises IdP adds infrastructure and still needs configuration to sync users and groups, while the AD trust uses what already exists.
Question 250
A company has migrated an application to Amazon EC2 Linux instances. One of these EC2 instances runs several 1-hour tasks on a schedule. These tasks were written by different teams and have no common programming language. The company is concerned about performance and scalability while these tasks run on a single instance. A solutions architect needs to implement a solution to resolve these concerns. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Use AWS Batch to run the tasks as jobs. Schedule the jobs by using Amazon EventBridge (Amazon CloudWatch Events).
AWS Batch is purpose-built for running batch jobs with scheduling through EventBridge, providing automatic scaling, fault tolerance, and the ability to run heterogeneous tasks (different languages) without operational overhead. Batch manages compute resources, job queuing, and execution automatically, eliminating the need to manage EC2 instances or scale infrastructure manually.
Why the other options are wrong
- B. App Runner is designed for continuous web applications, not scheduled batch jobs, and requires containerization which may not be practical for multiple legacy task implementations.
- C. Lambda has a 15-minute timeout limit, making it unsuitable for 1-hour tasks; refactoring tasks into Lambda would require significant effort.
- D. Auto Scaling based on an AMI does not solve the scalability problem inherent to running multiple copies of the same instance; it requires managing EC2 instances and does not efficiently handle diverse task workloads.
Question 251
A company uses AWS Organizations. The company wants to operate some of its AWS accounts with different budgets. The company wants to receive alerts and automatically prevent provisioning of additional resources on AWS accounts when the allocated budget threshold is met during a specific period. Which combination of solutions will meet these requirements? (Choose three.)
Show answer and explanation
Correct answer: B, D, F. Use AWS Budgets to create a budget. Set the budget amount under the Billing dashboards of the required AWS accounts; Create an IAM role for AWS Budgets to run budget actions with the required permissions; Add an alert to notify the company when each account meets its budget threshold. Add a budget action that selects the IAM identity created with the appropriate service control policy (SCP) to prevent provisioning of additional resources.
To meet the requirements, you must: (B) create budgets in AWS Budgets from the billing dashboard of each account, (D) create an IAM role (not user) for AWS Budgets to assume with appropriate permissions to run budget actions, and (F) configure both alerts and budget actions using SCPs to automatically prevent resource provisioning when thresholds are met. SCPs enforce organization-wide policy restrictions at the account level, making them ideal for preventing provisioning. Cost and Usage Reports (A) is for analysis, not budget configuration, IAM users (C) cannot be used for service role assumption, and config rules (E) are not the mechanism for AWS Budgets to prevent provisioning.
Why the other options are wrong
- A. Cost and Usage Reports section is for analyzing costs, not for setting up budgets or budget thresholds.
- C. IAM users cannot be assumed by AWS Budgets; only IAM roles support service assumption.
- E. Config rules are for compliance checking, not for preventing AWS API provisioning actions through AWS Budgets.
Question 252
A company has an aging network-attached storage (NAS) array in its data center. The NAS array presents SMB shares and NFS shares to client workstations. The company does not want to purchase a new NAS array. The company also does not want to incur the cost of renewing the NAS array’s support contract. Some of the data is accessed frequently, but much of the data is inactive. A solutions architect needs to implement a solution that migrates the data to Amazon S3, uses S3 Lifecycle policies, and maintains the same look and feel for the client workstations. The solutions architect has identified AWS Storage Gateway as part of the solution. Which type of storage gateway should the solutions architect provision to meet these requirements?
Show answer and explanation
Correct answer: D. Amazon S3 File Gateway
Amazon S3 File Gateway (also called File Gateway) presents S3 objects through SMB and NFS protocols, maintaining the same file-sharing interface that client workstations expect. It automatically tiering data to S3 where S3 Lifecycle policies can be applied for cost optimization. This preserves the existing NAS experience while migrating data to scalable cloud storage without requiring client workstation changes.
Why the other options are wrong
- A. Volume Gateway presents block storage (volumes), not file shares via SMB/NFS protocols.
- B. Tape Gateway is designed for backup and archival to simulate physical tape libraries, not for migrating live NAS file shares.
- C. Amazon FSx File Gateway is for Windows File Server or Lustre, not the general SMB/NFS file share migration scenario described.
Question 253
A company hosts a three-tier web application in the AWS Cloud. A Multi-AZAmazon RDS for MySQL server forms the database layer Amazon ElastiCache forms the cache layer. The company wants a caching strategy that adds or updates data in the cache when a customer adds an item to the database. The data in the cache must always match the data in the database. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Implement the write-through caching strategy
Write-through caching updates the cache whenever data is written to the database, ensuring the cache always contains current data that matches the database. This strategy guarantees consistency between cache and database, which is the explicit requirement. Data is added or updated in the cache synchronously when the database is updated.
Why the other options are wrong
- A. Lazy loading only populates the cache when data is requested, not when it is written, so cache and database could be out of sync.
- C. TTL (Time To Live) caching relies on expiration timers but does not guarantee that cache and database data always match, as updates could occur between TTL expirations.
- D. AWS AppConfig is a configuration management service and is not a caching strategy for ElastiCache.
Question 254
A company's containerized application runs on an Amazon EC2 instance. The application needs to download security certificates before it can communicate with other business applications. The company wants a highly secure solution to encrypt and decrypt the certificates in near real time. The solution also needs to store data in highly available storage after the data is encrypted. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: C. Create an AWS Key Management Service (AWS KMS) customer managed key. Allow the EC2 role to use the KMS key for encryption operations. Store the encrypted data on Amazon S3.
AWS KMS provides highly secure, near real-time encryption and decryption of certificates with minimal operational overhead. Pairing KMS with Amazon S3 provides highly available, durable storage for encrypted certificates. The EC2 IAM role can be granted permission to use the KMS key, implementing least privilege. This solution requires no code for cryptographic operations and leverages managed AWS services. S3 is the appropriate choice for certificate storage as it provides high availability across multiple AZs, whereas EBS is instance-specific and less suitable for highly available data storage.
Why the other options are wrong
- A. Secrets Manager requires manual certificate updates, which contradicts the requirement for automation and near real-time processing.
- B. Using Lambda with the Python cryptography library adds operational overhead compared to using native AWS KMS encryption services.
- D. EBS volumes are attached to a single EC2 instance and do not provide high availability across zones; S3 is the better choice for highly available storage.
Question 255
A company wants to implement a backup strategy for Amazon EC2 data and multiple Amazon S3 buckets. Because of regulatory requirements, the company must retain backup files for a specific time period. The company must not alter the files for the duration of the retention period. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Use AWS Backup to create a backup vault that has a vault lock in compliance mode. Create the required backup plan.
AWS Backup with vault lock in compliance mode is the correct solution for regulatory requirements to retain and protect backup files. Compliance mode ensures that backup files cannot be deleted or altered during the retention period, even by authorized users or AWS administrators. This meets the immutability requirement mandated by regulatory compliance. The backup plan can then be configured to handle both EC2 data and S3 buckets.
Why the other options are wrong
- A. Governance mode allows authorized users to modify or delete retention settings, which does not provide the required immutability for regulatory compliance.
- B. Data Lifecycle Manager creates snapshots but does not provide vault locking or immutability guarantees required by regulations.
- C. S3 File Gateway with lifecycle management does not provide the same level of backup protection and compliance assurance as AWS Backup with vault lock.
That was 255 of 1,019.
The full AWS SAA-C03 pack has all 1,019 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 509 free as one PDF by email. Get the Half Pack →