AWS SAA-C03 Chapter 1 Practice Questions (65 Questions)

Practice questions for the AWS SAA-C03 (Solutions Architect Associate) exam, Chapter 1.

1. Q1. Q1. A company has a multi-tier application that runs six front-end web servers in an Amazon EC2 Auto Scaling group in a single Availability Zone behind an Application Load Balancer (ALB). A solutions architect needs to modify the infrastructure to be highly available without modifying the application. Which architecture should the solutions architect choose that provides high availability?

   • A. Create an Auto Scaling group that uses three instances across each of two Regions
   • B. Modify the Auto Scaling group to use three instances across each of two Availability Zones
   • C. Create an Auto Scaling template that can be used to quickly create more instances in another Region
   • D. Change the ALB in front of the Amazon EC2 instances in a round-robin configuration to balance traffic to the web tier

   View question →

2. Q2. Q2. A bicycle sharing company is developing a multi-tier architecture to track the location of its bicycles during peak operating hours.The company wants to use these data points in its existing analytics platform A solutions architect must determine the most viable multi-tier option to support this architecture. The data points must be accessible from the REST API. Which action meets these requirements for storing and retrieving location data?

   • A. Use Amazon Athena with Amazon S3
   • B. Use Amazon API Gateway with AWS Lambda
   • C. Use Amazon QuickSight with Amazon Redshift
   • D. Use Amazon API Gateway with Amazon Kinesis Data Analytics

   View question →

3. Q3. Q3. A solutions architect is designing the cloud architecture for a new application being deployed on AWS. The process should run in parallel while adding and removing application nodes as needed based on the number of jobs to be processed.The processor application is stateless.The solutions architect must ensure that the application is loosely coupled and the job items are durably stored.Which design should the solutions architect use?

   • A. Create an Amazon SNS topic to send the jobs that need to be processed.Create an Amazon Machine Image (AMI) that consists of the processor application.Create a launch configuration that uses the AMI.Create an Auto Scaling group using the launch configuration.Set the scaling policy for the Auto Scaling group to add and remove nodes based on CPU usage
   • B. Create an Amazon SQS queue to hold the jobs that need to be processed.Create an Amazon Machine Image (AMI) that consists of the processor application.Create a launch configuration that uses the AMI.Create an Auto Scaling group using the launch configuration.Set the scaling policy for the Auto Scaling group to add and remove nodes based on network usage
   • C. Create an Amazon SQS queue to hold the jobs that needs to be processed.Create an Amazon Machine Image (AMI) that consists of the processor application.Create a launch template that uses the AMI.Create an Auto Scaling group using the launch template.Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of items in the SQS queue
   • D. Create an Amazon SNS topic to send the jobs that need to be processed.Create an Amazon Machine Image (AMI) that consists of the processor application.Create a launch template that uses the AMI.Create an Auto Scaling group using the launch template.Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of messages published to the SNS topic.

   View question →

4. Q4. Q4. A security team wants to limit access to specific services or actions in all of the team's AWS accounts. All accounts belong to a large organization in AWS Organizations. The solution must be scalable and there must be a single point where permissions can be maintained.What should a solutions architect do to accomplish this?

   • A. Create an ACL to provide access to the services or actions.
   • B. Create a security group to allow accounts and attach it to user groups
   • C. Create cross-account roles in each account to deny access to the services or actions.
   • D. Create a service control policy in the root organizational unit to deny access to the services or actions

   View question →

5. Q5. Q5. A company hosts an application on multiple Amazon EC2 instances. The application processes messages from an Amazon SQS queue writes to an Amazon RDS table and deletes the message from the queue Occasional duplicate records are found in the RDS table.The SQS queue does not contain any duplicate messages. What should a solutions archived do to ensure messages are being processed once only?

   • A. Use the CreateQueue API call to create a new queue
   • B. Use the AddPermission API call to add appropriate permissions
   • C. Use the ReceiveMessage API call to set an appropriate wait time.
   • D. Use the ChangeMessageVisibility API call to increase the visibility timeout

   View question →

6. Q6. Q6. An Amazon EC2 administrator created the following policy associated with an IAM group containing several users.What is the effect of this policy?

   • A. Users can terminate an EC2 instance in any AWS Region except us-east-1.
   • B. Users can terminate an EC2 instance with the IP address 10.100. 1001 in the us-east-1 Region.
   • C. Users can terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.100.100.254.
   • D. Users cannot terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.100.100.254.

   View question →

7. Q7. Q7. An application runs on Amazon EC2 instances across multiple Availability Zones. The instances run in an Amazon EC2 Auto Scaling group behind an Application Load Balancer. The application performs best when the CPU utilization of the EC2 instances is at or near 40%. What should a solutions architect do to maintain the desired performance across all instances m the group?

   • A. Use a simple scaling policy to dynamically scale the Auto Scaling group
   • B. Use a target tracking policy to dynamically scale the Auto Scaling group
   • C. Use an AWS Lambda function to update the desired Auto Scaling group capacity
   • D. Use scheduled scaling actions to scale up and scale down the Auto Scaling group

   View question →

8. Q8. Q8. A solutions architect is optimizing a website for an upcoming musical event Videos of the performances will be streamed in real time and then will be available on demand. The event is expected to attract a global online audience. Which service will improve the performance of both the real-time and on-demand streaming?

   • A. Amazon CloudFront
   • B. AWS Global Accelerator
   • C. Amazon Route 53
   • D. Amazon S3 Transfer Acceleration

   View question →

9. Q9. Q9. Organizers for a global event want to put daily reports online as static HTML pages. The pages are expected to generate millions of views from users around the world The files are stored in an Amazon S3 bucket.A solutions architect has been asked to design an efficient and effective solution. Which action should the solutions architect take to accomplish this?

   • A. Generate presigned URLs for the files
   • B. Use cross-Region replication to all Regions
   • C. Use the geoproximity feature of Amazon Route 53
   • D. Use Amazon CloudFront with the S3 bucket as its origin

   View question →

10. Q10. Q10. A solutions architect is designing a two-tier web application. The application consists of a public-facing web tier hosted on Amazon EC2 in public subnets. The database tier consists of Microsoft SQL Server running on Amazon EC2 in a private subnet Security is a high priority for the company. How should security groups be configured in this situation? (Select TWO)

    • A. Configure the security group for the web tier to allow inbound traffic on port 443 from 0.0.0.0.0/0
    • B. Configure the security group for the web tier to allow outbound traffic on port 443 from 0.0.0.0/0
    • C. Configure the security group for the database tier to allow inbound traffic on port 1433 from the security group for the web tier
    • D. Configure the security group for the database tier to allow outbound traffic on ports 443 and 1433 to the security group for the web tier
    • E. Configure the security group for the database tier to allow inbound traffic on ports 443 and 1433 from the security group for the web tier

    View question →

11. Q11. Q11. A company is hosting a web application on AWS using a single Amazon EC2 instance that stores user- uploaded documents in an Amazon EBS volume.For better scalability and availability the company duplicated the architecture and created a second EC2 instance and EBS volume in another Availability Zone: placing both behind an Application Load Balancer. After completing this change users reported that each time they refreshed the website they could see one subset of their documents or the other but never all of the documents at the same time. What should a solutions architect propose to ensure users see all of their documents at once''

    • A. Copy the data so both EBS volumes contain all the documents.
    • B. Configure the Application Load Balancer to direct a user to the server with the documents.
    • C. Copy the data from both EBS volumes to Amazon EFS.Modify the application to save new documents to Amazon EFS.
    • D. Configure the Application Load Balancer to send the request to both servers.Return each document from the correct server.

    View question →

12. Q12. Q12. An application runs on Amazon EC2 instances in private subnets. The application needs to access an Amazon DynamoDB table. What is the MOST secure way to access the table while ensuring that the traffic does not leave the AWS network?

    • A. Use a VPC endpoint for DynamoDB.
    • B. Use a NAT gateway in a public subnet.
    • C. Use a NAT instance in a private subnet.
    • D. Use the internet gateway attached to the VPC.

    View question →

13. Q13. Q13. A media company is evaluating the possibility of moving its systems to the AWS Cloud. The company needs at least 10 TB of storage with the maximum possible I/O performance for video processing. 300 TB of very durable storage for storing media content, and 900 TB of storage to meet requirements for archival media that is not in use anymore. Which set of services should a solutions architect recommend to meet these requirements?

    • A. Amazon EBS for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage
    • B. Amazon EBS for maximum performance. Amazon EFS for durable data storage, and Amazon S3 Glacier for archival storage
    • C. Amazon EC2 instance store for maximum performance, Amazon EFS for durable data storage, and Amazon S3 for archival storage
    • D. Amazon EC2 instance store for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage

    View question →

14. Q14. Q14. A company has a large Microsoft SharePoint deployment running on-premises that requires Microsoft Windows shared file storage. The company wants to migrate this workload to the AWS Cloud and is considering various storage options. The storage solution must be highly available and integrated with Active Directory for access control.Which solution will satisfy these requirements?

    • A. Configure Amazon EFS storage and set the Active Directory domain for authentication.
    • B. Create an SMB file share on an AWS Storage Gateway file gateway in two Availability Zones.
    • C. Create an Amazon S3 bucket and configure Microsoft Windows Server to mount it as a volume.
    • D. Create an Amazon FSx for Windows File Server file system on AWS and set the Active Directory domain for authentication.

    View question →

15. Q15. Q15. A company runs an application using Amazon ECS. The application creates resized versions of an original image and then makes Amazon S3 API calls to store the resized images in Amazon S3. How can a solutions architect ensure that the application has permission to access Amazon S3?

    • A. Update the S3 role in AWS IAM to allow read/write access from Amazon ECS, and then relaunch the container.
    • B. Create an IAM role with S3 permissions, and then specify that role as the taskRoleArn in the task definition.
    • C. Create a security group that allows access from Amazon ECS to Amazon S3, and update the launch configuration used by the ECS cluster.
    • D. Create an IAM user with S3 permissions, and then relaunch the Amazon EC2 instances for the ECS cluster while logged in as this account.

    View question →

16. Q16. Q16. A company's web application is running on Amazon EC2 instances behind an Application Load Balancer. The company recently changed its policy, which now requires the application to be accessed from one specific country only.Which configuration will meet this requirement?

    • A. Configure the security group for the EC2 instances.
    • B. Configure the security group on the Application Load Balancer.
    • C. Configure AWS WAF on the Application Load Balancer in a VPC.
    • D. Configure the network ACL for the subnet that contains the EC2 instances.

    View question →

17. Q17. Q17. A company's website provides users with downloadable historical performance reports. The website needs a solution that will scale to meet the company's website demands globally. The solution should be cost effective, limit the? provisioning of Into and provide the fastest possible response time. Which combination should a solutions architect recommend to meet these requirements?

    • A. Amazon CloudFront and Amazon S3
    • B. AWS Lambda and Amazon Dynamo
    • C. Application Load Balancer with Amazon EC2 Auto Scaling
    • D. Amazon Route 53 with internal Application Load Balances

    View question →

18. Q18. Q18. A company has an Amazon EC2 instance running on a private subnet that needs to access a public websites to download patches and updates. The company does not want external websites to see the EC2 instance IP address or initiate connection to it.How can a solution architect achieve this objective?

    • A. Create a site-to-site VPN connection between the private subnet and the network in which the public site is deployed
    • B. Create a NAT gateway in a public subnet Route outbound traffic from the private subnet through the NAI gateway
    • C. Create a network ACL for the private subnet where the EC2 instance deployed only allows access from the IP address range of the public website
    • D. Create a security group that only allows connections from the IP address range of the public website.Attach the security group to the EC2 instance.

    View question →

19. Q19. Q19. A development team needs to host a website that will be accessed by other teams. The website contents.consist of HTML. CSS, client side JavaScript, and images. Which method is the MOST cost- effective for hosting the website?

    • A. Containerize the website and host it in AWS Fargate
    • B. Create an Amazon S3 bucket and host the website there.
    • C. Deploy a web server on an Amazon EC2 instance to host the website.
    • D. Configure an Application Load Balancer with an AWS Lambda target that uses the Express is framework

    View question →

20. Q20. Q20. Company is designing a website that uses an Amazon S3 bucket to store static images. The company wants ail future requests have taster response times while reducing both latency and cost. Which service configuration should a solutions architect recommend?

    • A. Deploy a NAT server in front of Amazon S3.
    • B. Deploy Amazon CloudFront in front of Amazon S3.
    • C. Deploy a Network Load Balancer in front of Amazon S3.
    • D. Configure Auto Scaling to automatically adjust the capacity of the website.

    View question →

21. Q21. Q21. A company's dynamic website is hosted using on-premises servers in the United States. The company is launching its product in Europe and it wants to optimize site loading times for new European users. The site's backend must remain in the United States. The product is being launched in a few days, and an immediate solution is neededWhat should the solutions architect recommend?

    • A. Launch an Amazon EC2 instance in us-east-1 and migrate the site to it
    • B. Move the website to Amazon S3 Use cross-Region replication between Regions.
    • C. Use Amazon CloudFront with a custom origin pointing to the on-premises servers
    • D. Use an Amazon Route 53 geoproximity routing policy pointing to on-premises servers

    View question →

22. Q22. Q22. A company has recently updated its internal security standards. The company must now ensure all Amazon S3 buckets and Amazon Elastic Block Store (Amazon EBS) volumes are encrypted with keys created and periodically rotated by internal security specialists.The company is looking for a native, software-based AWS service to accomplish this goal. What should a solutions architect recommend as a solution?

    • A. Use AWS Secrets Manager with customer master keys (CMKs) to store master key material and apply a routine to create a new CMK periodically and replace it in AWS Secrets Manager.
    • B. Use AWS Key Management Service (AWS KMS) with customer master keys (CMKs) to store master key material and apply a routing to re-create a new key periodically and replace it in AWS KMS.
    • C. Use an AWS CloudHSM cluster with customer master keys (CMKs) to store master key material and apply a routine a re-create a new key periodically and replace it in the CloudHSM cluster nodes.
    • D. Use AWS Systems Manager Parameter Store with customer master keys (CMKs) keys to store master key material and apply a routine to re-create a new periodically and replace it in the Parameter Store.

    View question →

23. Q23. Q23. A solution architect must design a solution that uses Amazon CloudFront with an Amazon S3 to store a static website.The company security policy requires that all websites traffic be inspected by AWS WAF.How should the solution architect company with these requirements?

    • A. Configure an S3 bucket policy to accept requests coming from the AWS WAF Amazon Resource Name (ARN) only
    • B. Configure Amazon CloudFront to forward all incoming requests to AWS WAF before requesting content from the S3 origin,
    • C. Configure a security group that allows Amazon CloudFront IP addresses to access Amazon S3 only Associate AWS WAF to CloudFront.
    • D. Configure Amazon CloudFront and Amazon S3 to use an origin access identity (OAI) to restrict access to the S3 bucket. Enable AWS WAF on the distribution.

    View question →

24. Q24. Q24. A solutions architect is using Amazon S3 to design the storage architecture of a new digital media application.The media files must be resilient to the loss of an Availability Zone Some files are accessed frequently while other files are rarely accessed in an unpredictable pattern. The solutions architect must minimize the costs of storing and retrieving the media files.Which storage option meets these requirements?

    • A. S3 Standard
    • B. S3 Intelligent-Tiering
    • C. S3 Standard-Infrequent Access (S3 Standard-IA)
    • D. S3 One Zone-Infrequent Access (S3 One Zone-IA)

    View question →

25. Q25. Q25. An application allows users at a company's headquarters to access product data. The product data is stored in an Amazon RDS MySQL DB instance. The operations team has isolated an application performance slowdown and wants to separate read traffic from write traffic. A solutions architect needs to optimize the application's performance quickly.What should the solutions architect recommend?

    • A. Change the existing database to a Multi-AZ deployment.Serve the read requests from the primary Availability Zone.
    • B. Change the existing database to a Multi-AZ deployment.Serve the read requests from the secondary Availability Zone.
    • C. Create read replicas for the database.Configure the read replicas with half of the compute and storage resources as the source database.
    • D. Create read replicas for the database.Configure the read replicas with the same compute and storage resources as the source database.

    View question →

26. Q26. Q26. A company that hosts its web application on AWS wants to ensure all Amazon EC2 instances. Amazon RDS DB instances and Amazon Redshift clusters are configured with tags. The company wants to minimize the effort of configuring and operating this check. What should a solutions architect do to accomplish this''

    • A. Use AWS Config rules to define and detect resources that are not property tagged
    • B. Use Cost Explorer to display resources that are not properly tagged Tag those resources manually.
    • C. Write API calls to check all resources for proper tag allocation.Periodically run the code on an EC2 instance.
    • D. Write API calls to check all resources for proper tag allocation.Schedule an AWS Lambda function through Amazon CloudWatch to periodically run the code

    View question →

27. Q27. Q27. A company stores call recordings on a monthly basis Statistically, the recorded data may be referenced randomly within a year but accessed rarely after 1 year. Files that are newer than 1 year old must be queried and retrieved as quickly as possible. A delay in retrieving older files is acceptable A solutions architect needs to store the recorded data at a minimal cost.Which solution is MOST cost-effective?

    • A. Store individual files in Amazon S3 Glacier and store search metadata in object tags created in S3 Glacier.Query S3 Glacier tags and retrieve the files from S3 Glacier
    • B. Store individual files in Amazon S3 Use lifecycle policies to move the files to Amazon S3 Glacier after 1 year.Query and retrieve the files from Amazon S3 or S3 Glacier.
    • C. Archive individual files and store search metadata for each archive in Amazon S3.Use lifecycle policies to move the files to Amazon S3 Glacier after 1 year.Query and retrieve the files by searching for metadata from Amazon S3
    • D. Archive individual files in Amazon S3.Use lifecycle policies to move the files to Amazon S3 Glacier after 1 year.Store search metadata in Amazon DynamoDB Query the files from DynamoDB and retrieve them from Amazon S3 or S3 Glacier

    View question →

28. Q28. Q28. A company has a highly dynamic batch processing job that uses many Amazon EC2 instances to complete it.The job is stateless in nature, can be started and stopped at any given time with no negative impact, and typically takes upwards of 60 minutes total to complete. The company has asked a solutions architect to design a scalable and cost-effective solution that meets the requirements of the job.What should the solutions architect recommend?

    • A. Implement EC2 Spot Instances
    • B. Purchase EC2 Reserved Instances
    • C. Implement EC2 On-Demand Instances
    • D. Implement the processing on AWS Lambda

    View question →

29. Q29. Q29. A company runs a production application on a fleet of Amazon EC2 instances. The application reads the data from an Amazon SQS queue and processes the messages in parallel. The message volume is unpredictable and often has intermittent traffic. This application should continually process messages without any downtime Which solution meets these requirements MOST cost-effectively?

    • A. Use Spot Instances exclusively to handle the maximum capacity required
    • B. Use Reserved Instances exclusively to handle the maximum capacity required
    • C. Use Reserved Instances for the baseline capacity and use Spot InstaKes to handle additional capacity
    • D. Use Reserved instances for the baseline capacity and use On-Demand Instances to handle additional capacity

    View question →

30. Q30. Q30. A company provides an API to its users that automates inquiries for tax complutations based on item prices. The company experiences a larger number of inquires during the holiday season only that cause slower response times. A solution architect needs to design a solution that is scalable and elastic. What should the solutions architect do to accomplish this?

    • A. Provide an API hosted on an Amazon EC2 instance.The EC2 instance performs the required computations when the API request is made.
    • B. Design a REST API using Amazon API Gateway that accepts the item names, API Gateway passes item names to AWS Lambada for tax computations.
    • C. Create ans Application Load Balancer that has two Amazon EC2 instances behind it.The EC2 instances will compute the tax on the recieved item names.
    • D. Design a REST API using Amazon API Gateway that connects with an API hosted on an Amazon EC2 instance, API Gateway accepts and passes the item names to the EC2 instance for tax computations.

    View question →

31. Q31. Q31. A solutions architect is designing a VPC with public and private subnets. The VPC and subnets use IP 4 CIDR blocks. There is one public subnet and one private subnet in each of three Availability Zone (AZs) for high availability. An internet gateway is used to provide internet access for the public subnets. The private subnets require access to the internet to allow Amazon EC2 instances to download software updates. What should the solutions architect do to enable Intrnet access for the private subnets?

    • A. Create three NAT gateways, one for each public subnet in each AZ.Create a private route table for each AZ that forwards non-VPC traffic to the NAT gateway in its AZ.
    • B. Create three NAT gateways, one for each private subnet in each AZ.Create a private route table for each AZ that forwards non-VPC traffic to the NAT gateway in its AZ.
    • C. Create second internet gateway on one of the private subnets.Update the rout table for the private subnets that forward non-VPC traffic to the private internt gateway.
    • D. Create an egress-only internet gateway on one of the public subnets.Update the route table for the private subnets that forward non-VPC traffic to the egress-only internet gateway.

    View question →

32. Q32. Q32. A company is preparing to launch a public-facing web application in the AWS Cloud. The architecture consists of Amazon EC2 instances within a VPC behind an Elastic Load Balancer (ELB). A third-party service is used for the DNS. The company's solutions architect must recommend a solution to detect and protect against large-scale DDoS attacks.Which solution meets these requirements?

    • A. Enable Amazon Guard Duty on th account
    • B. Enable Amazon Inspector on the EC2 instances
    • C. Enable AWS Shield and assign Amazon Route 53 to it.
    • D. Enable AWS Shield Advancd and assign the ELB to it.

    View question →

33. Q33. Q33. A company has a dynamic web application hostes on two Amazon EC2 instances. The company has its own SSL certificate, which is on each instance to perform SSL termination. There has been an increase in traffic recently, and the operations team determined that SSL encryption and decryption is causing the compute capacity of the web servers to reach their maximum limit. What should a solutions architect do to increase the application's performance?

    • A. Create a new SSL certificate using AWS Certificate Manager (ACM).Install the ACM certificate on each instance.
    • B. Create an Amazon S3 bucket Migrate the SSL certificate to the S3 bucket.Configure the EC2 instances to reference the bucket for SSL termination.
    • C. Create another EC2 instance as a proxy server.Migrate the SSL certificate to the new instance and configure it to direct connctions to the existing EC2 instances.
    • D. Import the SSL certificate into AWS Crtificate Manager (ACM).Create an Application Load Balancer with an HTTPS listener that uses the SSL certificate from ACM.

    View question →

34. Q34. Q34. A company maintains a searchable repository of items on its website. The data is stored in an Amazon RDS for MySQL database table that contains over 10 million rows. The database has 2 TB of General Purpose SSD (gp2) storage. There are millions of updates against this data every day through the company's website. The company has noticed some operations are taking 10 seconds or longer, and has determined that the database storage performance is bottleneck.Which solution addresses the performance issues?

    • A. Change the storage type to Provissioned IOPS SSD (io1).
    • B. Change the instance to a memory-optimized instance class.
    • C. Change the instance to a burstable performance DB instance class.
    • D. Enable Multi-AZ RDS read replicas with MySQL natice asynchronous replication.

    View question →

35. Q35. Q35. A company has na application that generates a large number of files, each approximately 5 MB in size. The files are stored in Amazon S3. Company policy requires teh files to be stored for 4 years before they can be deleted. Immediate accessibility is always required as teh files contain critical business data that is not easy to reproduce. The files are frequently accessed in the first 30 days of the object creation but are rarely accessed after the first 30 days.Which storage solution is MOST cost effective?

    • A. Create an S3 bucket lifecycle policy to move files from S3 Standard to S3 Glacier 30 days from object creation.Delete the files 4 years after the object creation.
    • B. Create an S3 bucket lifecycle policy to move files from S3 Standard to S3 One Zone-Infrequent Access (S3 One Zone-IA) 30 days from object creation.Delete the files 4 years after the object creation.
    • C. Create an S3 bucket lifecycle policy to move files from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) 30 days from object creation.Delete the files 4 years after the object creation.
    • D. Create an S3 bucket lifecycle policy to move files from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) 30 days from object creation.Move the file to S3 Glacier 4 years after object creation.

    View question →

36. Q36. Q36. A company is preparing to store confidential data in Amazon S3. For compliance reasons, the data must be encrypted at rest. Encryption key usage must be logged for auditing purposes. Key must be rotated every year.Which solution meets these requirements and is the MOST operationally effecient?

    • A. Server-side encryption with customer-provided keys (SSE-C)
    • B. Server-side encryption with Amazon S3 managed keys (SSE-S3)
    • C. Server-side encryption with AWS KMS (SSE-KMS) customer master keys (CMKs) with manual rotation.
    • D. Server-side encryption with AWS KMS (SSE-KMS) customer master keys (CMKs) with automatic rotation.

    View question →

37. Q37. Q37. A company wants to migrate its MySQL database from on-premises to AWS. The company recently experienced a database outage that significantly impacted the business. To ensure this does not happen again, the company wants a reliable database solution on AWS that minimizes data loss and stores every transaction on at least two nodes.Which solution meets these requirements?

    • A. Create an Amazon RDS DB instance with synchronous replication to three nodes in three Availability Zones.
    • B. Create an Amazon RDS MySQL DB instance with Multi-AZ functionality enabled to synchronously replicate the data.
    • C. Create an Amazon RDS MySQL DB instance with Multi-AZ and the create a read replica in a separate AWS Region that synchronously replicates the data.
    • D. Create and Amazon EC2 instance with a MySQL engine installed that triggers an AWS Lambda fucntion to synchronously replicate the data to an Amazon RDS MySQL DB instance.

    View question →

38. Q38. Q38. A company has an automobile sales website that stores its listings in an database on Amazon RDS When an automobile is sold, the listing needs to be removed from the website and the data must be sent to multiple target systems.Which design should a solutions architect recommend?

    • A. Create an AWS Lambda function triggered when the database on Amazon RDS is updated to send the information to an Amazon Simple Queue Service (Amazon SQS) queue for the targets to consume.
    • B. Create an AWS Lambda function triggered when the database on Amazon RDS is updated to send the information to an Amazon Simple Queue Service (Amazon SQS) FIFO queue for the targets to consume.
    • C. Subscribe to an RDS event notification and send an Amazon Simple Queue Service (Amazon SQS) queue fanned out to multiple Amazon Simple Notification Service (Amazon SNS) topics. Use AWS Lambda functions to update the targets.
    • D. Subscribe to an RDS event notification and send an Amazon Simple Notification Service (Amazon SNS) topic fanned out to multiple Amazon Simple Queue Service (Amazon SQS) queues Use AWS Lambda functions to update the targets.

    View question →

39. Q39. Q39. A company wants to build a scalable key management infrastructure to support developers who need to encrypt data in their applications.What should a solutions architect do to reduce the operational burden?

    • A. Use multi-factor authentication (MFA) to protect the encryption keys
    • B. Use AWS Key Management Service (AWS KMS) to protect the encryption keys
    • C. Use AWS Certificate Manager (ACM) to create, store and assign the encryption keys
    • D. Use an IAM policy to limit the scope of users who have access permissions to protect the encryption keys

    View question →

40. Q40. Q40. A company is running a multi-tier web application on premises. The web application is containerized and runs on a number of Linux hosts connected to a PostgreSQL database that contains user records. The operational overhead of maintaining the infrastructure and capacity planning is limiting the company's growth. A solutions architect must improve the application's infrastructure. Which combination of actions should the solutions architect take to accomplish this? (Select TWO.)

    • A. Migrate the PostgreSQL database to Amazon Aurora
    • B. Migrate the web application to be hosted on Amazon EC2 instances.
    • C. Set up an Amazon CloudFront distribution for the web application content.
    • D. Set up Amazon ElastiCache between the web application and the PostgreSQL database
    • E. Migrate the web application to be hosted on AWS Fargate with Amazon Elastic Container Service (Amazon ECS)

    View question →

41. Q41. Q41. A company runs an online marketplace web application on AWS. The application serves hundreds of thousands of users during peak hours. The company needs a scalable, near-real- time solution to share the details of millions of financial transactions with several other internal applications. Transactions also need to be processed to remove sensitive data before being stored in a document database for low-latency retrieval.What should a solutions architect recommend to meet these requirements?

    • A. Store the transactions data into Amazon DynamoDB.Set up a rule in DynamoDB to remove sensitive data from every transaction upon write.Use DynamoDB Streams to share the transactions data with other applications.
    • B. Stream the transactions data into Amazon Kinesis Data Firehose to store data in Amazon DynamoDB and Amazon S3.Use AWS Lambda integration with Kinesis Data Firehose to remove sensitive data.Other applications can consume the data stored in Amazon S3.
    • C. Stream the transactions data into Amazon Kinesis Data Streams.Use AWS Lambda integration to remove sensitive data from every transaction and then store the transactions data in Amazon DynamoDB.Other applications can consume the transactions data off the Kinesis data stream.
    • D. Store the batched transactions data in Amazon S3 as files.Use AWS Lambda to process every file and remove sensitive data before updating the files in Amazon S3.The Lambda function then stores the data in Amazon DynamoDB.Other applications can consume transaction files stored in Amazon S3.

    View question →

42. Q42. Q42. A company uses an Amazon S3 bucket to store static images for its website. The company configured permissions to allow access to Amazon S3 objects by privileged users only. What should a solutions architect do to protect against data loss? (Select TWO.)

    • A. Enable versioning on the 53 bucket.
    • B. Enable access logging on the S3 bucket.
    • C. Enable server-side encryption on the 53 bucket.
    • D. Configure an 53 lifecycle rule to transition objects to Amazon 53 Glacier
    • E. Use MEA Delete to require multi-factor authentication to delete an object.

    View question →

43. Q43. Q43. A solutions architect is developing a multiple-subnet VPC architecture. The solution will consist of six subnets in two Availability Zones.The subnets are defined as public, private, and dedicated for databases. Only the Amazon EC2 instances running in the private subnets should be able to access a database.Which solution meets these requirements?

    • A. Create a new route table that excludes the route to the public subnets' CIDR blocks. Associate the route table to the database subnets.
    • B. Create a security group that denies ingress from the security group used by instances in the public subnets. Attach the security group to an Amazon RDS DB instance.
    • C. Create a security group that allows ingress from the security group used by instances in the private subnets. Attach the security group to an Amazon RDS DB instance.
    • D. Create a new peering connection between the public subnets and the private subnets. Create a different peering connection between the private subnets and the database subnets.

    View question →

44. Q44. Q44. A solutions architect iS designing the architecture of a new application being deployed to the AWS Cloud. The application will run on Amazon EC2 On-Demand Instances and will automatically scale across multiple Availability Zones. The EC2 instances will scale up and down frequently throughout the day. An Application Load Balancer (AL .B) will handle the load distribution. The architecture needs to support distributed session data management. The company is willing to make changes to code if needed. What should the solutions architect do to ensure that the architecture supports distributed session data management?

    • A. Use Amazon ElastiCache to manage and store session data.
    • B. Use session affinity (sticky sessions) of the AL .B to manage session data.
    • C. Use Session Manager from AWS Systems Manager to manage the session.
    • D. Use the GetSessionToken API operation in AWS Security Token Service (AWS STS) to manage the session.

    View question →

45. Q45. Q45. A solutions architect is designing a solution that requires frequent updates to a website that is hosted on Amazon S3 with versioning enabled For compliance reasons, the older versions of the objects will not be accessed frequently and will need to be deleted after 2 years. What should the solutions architect recommend to meet these requirements at the LOWEST cost?

    • A. Use S3 batch operations to replace object tags Expire the objects based on the modified tags.
    • B. Configure an S3 Lifecycle policy to transition older versions of objects to S3 Glacier. Expire the objects after 2 years.
    • C. Enable S3 Event Notifications on the bucket that sends older objects to the Amazon Simple Queue Service (Amazon SQS) queue for further processing
    • D. Replicate older object versions to a new bucket. Use an S3 Lifecycle policy to expire the objects in the new bucket after 2 years.

    View question →

46. Q46. Q46. A company is storing sensitive user information in an Amazon S3 bucket. The company wants to provide secure access to this bucketfrom the application tier running on Amazon EC2 instances inside a VPC. Which combination of steps should a solutions architect take to accomplish this? (Select TWO.)

    • A. Configure a VPC gateway endpoint for Amazon S3 within the VPC.
    • B. Create a bucket policy to make the objects in the S3 bucket public.
    • C. Create a bucket policy that limits access to only the application tier running in the VPC.
    • D. Create an IAM user with an S3 access policy and copy the IAM credentials to the EC2 instance.
    • E. Create a NAT instance and have the EC2 instances use the NAT instance to access the S3 bucket.

    View question →

47. Q47. Q47. A company is preparing to deploy a new serverless workload. A solutions architect needs to configure permissions for invoking an AWS Lambda function. The function will be triggered by an Amazon EventBridge (Amazon CloudWatch Events) rule. Permissions should be configured using the principle of least privilege.Which solution will meet these requirements?

    • A. Add an execution role to the function with lambda InvokeFunction as the action and * as the principal.
    • B. Add an execution role to the function with lambda.lnvokeFunction as the action and Service. events amazonaws.com as the principal.
    • C. Add a resource-based policy to the function with lambda:* as the action and Service: events amazonaws.com as the principal.
    • D. Add a resource-based policy to the function with lambda:lnvokeFunction as the action and Service:events amazonaws .com as the principal.

    View question →

48. Q48. Q48. A company has a service that produces event data The company wants to use AWS to process the event data as it iS received. The data iS written in a specific order that must be maintained throughout processing. The company wants to implement a solution that minimizes operational overhead.How should a solutions architect accomplish this?

    • A. Create an Amazon Simple Queue Service (Amazon SQS) FIFO queue to hold messages Set up an AWS Lambda function to process messages from the queue.
    • B. Create an Amazon Simple Notification Service (Amazon SNS) topic to deliver notifications containing payloads to process.Configure an AWS Lambda function as a subscriber.
    • C. Create an Amazon Simple Queue Service (Amazon SQS) standard queue to hold messages. Set up an AWS Lambda function to process messages from the queue independently.
    • D. Create an Amazon Simple Notification Service (Amazon SNS) topic to deliver notifications containing payloads to process Configure an Amazon Simple Queue Service (Amazon SQS) queue as a subscriber.

    View question →

49. Q49. Q49. A company uses Amazon S3 to store its confidential audit documents. The S3 bucket uses bucket policies to restrict access to audit team IAM user credentials according to the principle of least privilege. Company managers are worried about accidental deletion of documents in the S3 bucket and want a more secure solution.What should a solutions architect do to secure the audit documents?

    • A. Enable the versioning and MFA Delete features on the S3 bucket
    • B. Enable multi-factor authentication (MFA) on the IAM user credentials for each audit team IAM user account.
    • C. Add an S3 Lifecycle policy to the audit team's IAM user accounts to deny the s3:DeleteOb|ect action during audit dates.
    • D. Use AWS Key Management Service (AWS KMS> to encrypt the S3 bucket and restrict audit team IAM user accounts from accessing the KMS key.

    View question →

50. Q50. Q50. A company receives 10 TB of instrumentation data each day from several machines located at a single factory.The data consists of JSON files stored on a storage area network (SAN) in an on- premises data center located within the factory.The company wants to send this data to Amazon S3 where it can be accessed by several additional systems that provide critical near-real-lime analytics. A secure transfer is important because the data is considered sensitive. Which solution offers the MOST reliable data transfer?

    • A. AWS DataSync over public internet
    • B. AWS DataSync over AWS Direct Connect
    • C. AWS Database Migration Service (AWS DMS) over public internet
    • D. AWS Database Migration Service (AWS DMS) over AWS Direct Connect

    View question →

51. Q51. Q51. A company owns an asynchronous API that is used to ingest use requests and, based on the request type, dispatch requests to the appropriate microservice for processing. The company is using Amazon API Gateway to deploy the API front end, and an AWS Lambda function that invokes Amazon DynamoDB to store user requests before dispatching them to the processing microservices. The company provisioned as much DynamoDB throughput as its budget allows, but the company is still experiencing availability issues and is losing user requests. What should a solutions architect do to address this Issue without impacting existing users?

    • A. Add throttling on the API Gateway with server-side throttling limits
    • B. Use DynamoDB Accelerator (DAX) and LamDda to buffer writes to DynamoDB
    • C. Create a secondary index in DynamoDB for the label with the user requests.
    • D. Use the Amazon Simple Queue Service (Amazon SQS) queue and Lambda to buffer writes to DynamoDB.

    View question →

52. Q52. Q52. A company has an application that ingests incoming messages. These messages are then quickly consumed by dozens of other applications and microservices. The number of messages varies drastically and sometimes spikes as high as 100 000 each second The company wants to decouple the solution and increase scalability.Which solution meets these requirements?

    • A. Persist the messages to Amazon Kinesis Data Analytics. All the applications will read and process the messages.
    • B. Deploy the application on Amazon EC2 instances in an Auto Scaling group, which scales the number of EC2 instances based on CPU metrics.
    • C. Write the messages to Amazon Kinesis Data Streams with a single shard. All applications will read from the stream and process the messages.
    • D. Publish the messages to an Amazon Simple Notification Service (Amazon SNS) topic with one or more Amazon Simple Queue Service (Amazon SQS) subscriptions All applications then process the messages from the queues.

    View question →

53. Q53. Q53. A company wants to move a multi-tiered application from on premises to the AWS Cloud to improve the application's performance. The application consists of application tiers that communicate with each other by way of RESTful services. Transactions are dropped when one tier becomes overloaded. A solutions architect must design a solution that resolves these issues and modernizes the application. Which solution meets these requirements and is the MOST operationally efficient?

    • A. Use Amazon API Gateway and direct transactions to the AWS Lambda functions as the application layer. Use Amazon Simple Queue Service (Amazon SQS) as the communication layer between application services.
    • B. Use Amazon CloudWatch metrics to analyze the application performance history to determine the servers' peak utilization during the performance failures. Increase the size of the application server's Amazon EC2 instances to meet the peakrequirements.
    • C. Use Amazon Simple Notification Service (Amazon SNS) to handle the messaging between application servers running on Amazon EC2 in an Auto Scaling group. Use Amazon CloudWatch to monitor the SNS queue length and scale up and down as required.
    • D. Use Amazon Simple Queue Service (Amazon SQS) to handle the messaging between application servers running on Amazon E02 in an Auto Scaling group. Use Amazon CloudWatch to monitor the SQS queue length and scale up whencommunication failures are detected.

    View question →

54. Q54. Q54. A company recently started using Amazon Aurora as the data store for its global ecommerce application. When large reports are run,developers report that the ecommerce application is performing poorly. After reviewing metrics in Amazon CloudWatch, a solutions architect finds that the ReadlOPS and CPUUtilization metrics are spiking when monthly reports run.What is the MOST cost-effective solution?

    • A. Migrate the monthly reporting to Amazon Redshift
    • B. Migrate the monthly reporting to an Aurora Replica.
    • C. Migrate the Aurora database to a larger instance class.
    • D. Increase tho Provisioned lOPS on the Aurora instance.

    View question →

55. Q55. Q55. A company has two applications: a sender application that sends messages with payloads to be processed and a processing application intended to receive the messages with payloads. The company wants to implement an AWS service to handle messages between the two applications. The sender application can send about 1,000 messages each hour. The messages may take up to 2 days to be processed. If the messages fail to process, they must be retained SO that they do not impact the processing 0f any remaining messages.Which solution meets these requirements and is the MOST operationally efficient?

    • A. Set up an Amazon EC2 instance running a Redis database. Configure both applications to use the instance.Store,process,and delete the messages,respectively.
    • B. Use an Amazon Kinesis data stream to receive the messages from the sender application. integrate the processingapplication with the Kinesis Client Library (KCL).
    • C. Integrate the sender and processor applications with an Amazon Simple Queue Service (Amazon SQS); queue. Configure a dead-letter queue to collect the messages that failed to process.
    • D. Subscribe the processing application to an Amazon Simple Notification Service (Amazon SNS) topic to receive notifications to process. Integrate the sender application to write to the SNS topic.

    View question →

56. Q56. Q56. A company wants to use high performance computing (HPC) infrastructure on AWS for financial risk modeling. The company's HPC workloads run on Linux. Each HPC workflow runs on hundreds of Amazon EC2 Spot Instances, is short-lived and generates thousands of output files that are ultimately stored in persistent storage for analytics and long term future use. The company seeks a cloud storage solution that permits the copying of on-premises data to long-term persistent storage to make data available for processing by all EC2 instances. The solution should also be a high performance file system that is integrated with persistent storage to read and write datasets and output files. Which combination of AWS services meets these requirements?

    • A. Amazon FSx for Lustre integrated with Amazon S3
    • B. Amazon FSx for Windows File Server integrated with Amazon S3
    • C. Amazon S3 Glacier integrated with Amazon Elastic Block Store (Amazon EBS)
    • D. Amazon S3 bucket with a VPC endpoint integrated with an Amazon Elastic Block Store (Amazon EBS) General Purpose SSD (gp2) volume.

    View question →

57. Q57. Q57. A company recently migrated a message processing system to AWS. The system receives messages into an ActiveMQ queue running on an Amazon EC2 instance. Messages are processed by a consumer application running on Amazon EC2. The consumer application processes the messages and writes results to a MySQL database running on Amazon EC2. The company wants this application to be highly available with low operational complexity.Which architecture offers the HIGHEST availability?

    • A. Add a second ActiveMQ server to another Availability Zone. Add an additional consumer EC2 instance in another Availability Zone. Replicate the MySQL database to another Availability Zone.
    • B. Use Amazon MQ with active/standby brokers configured across two Availability Zones. Add an additional consumer EC2 instance in another Availability Zone. Replicate the MySQL database to another Availability Zone.
    • C. Use Amazon MQ with active/standby brokers configured across two Availability Zones. Add an additional consumer EC2 instance in another Availability Zone. Use Amazon RDS for MySQL with Multi- AZ enabled.
    • D. Use Amazon MQ with active/standby brokers configured across two Availability Zones. Add an Auto Scaling group for the consumer EC2 instances across two Availability Zones Use Amazon RDS for MySQL with Multi-AZ enabled.

    View question →

58. Q58. Q58. A company runs an application in the AWS Cloud and uses Amazon DynamoDB as the database. The company deploys Amazon EC2 instances to a private network to process data from the database. The company uses two NAT instances to provide connectivity to DynamoDB.The company wants to retire the NAT instances.A solutions architect must implement a solution that provides connectivity to DynamoDB and that does not require ongoing management.What is the MOST cost-effective solution that meets these requirements?

    • A. Create a gateway VPC endpoint to provide connectivity to DynamoDB
    • B. Configure a managed NAT gateway to provide connectivity to DynamoDB
    • C. Establish an AWS Direct Connect connection between the private network and DynamoDB
    • D. Deploy an AWS PrivateLink endpoint service between the private network and DynamoDB

    View question →

59. Q59. Q59. A company runs a web-based portal that provides users with global breaking news, local alerts, and weather updates.The portal delivers each user a personalized view by using a mixture of static and dynamic content. Content is served over HTTPS through an API server running on an Amazon EC2 instance behind an Application Load Balancer (ALB).The company wants the portal to provide this content to its users across the world as quickly s possible. How should a solutions architect design the application to ensure the LEAST amount of latency for all users?

    • A. Deploy the application stack in a ingle AWS RegionUse Amazon CloudFront to serve all static and dynamic content by specifying the ALB as an origin
    • B. Deploy the application stack in two AWS RegionsUse an Amazon Route 53 latency routing policy to serve all content from the ALB in the closest Region.
    • C. Deploy the application stack in a single AWS RegionUse Amazon CloudFront to serve the static contentServe the dynamic content directly from the ALB.
    • D. Deploy t e application stack in two AWS RegionsUse an Amazon Route 53 geolocation routing policy to serve all content from the ALB in the closest Region.

    View question →

60. Q60. Q60. A company is running a batch application on Amazon EC2 instances. The application consists of a backend with multiple Amazon RDS databases. The application is causing a high number of reads on the databases. A solutions architect must reduce the number of database reads while ensuring high availability. What should the solutions architect do to meet this requirement?If you have any questions, please contact wechat :ANYPASS. If you don't want to memorize the questions, please register for the through train.

    • A. Add Amazon RDS read replicas.
    • B. Use Amazon ElastiCache for Redis
    • C. Use Amazon Route 53 DNS caching
    • D. Use Amazon ElastiCache for Memcached

    View question →

61. Q61. Q61. A company has a Microsoft NET application that runs on an on-premises Windows Server. The application stores data by using an Oracle Database Standard Edition server. The company is planning a migration to AWS and wants to minimize development changes while moving the application. The AWS application environment should be highly available. Which combination of actions should the company take to meet these requirements? (Select TWO )

    • A. Refactor the application as serverless with AWS Lambda functions running NET Core
    • B. Rehost the application in AWS Elastic Beanstalk with the NET platform in a Multi-AZ deployment
    • C. Replatform the application to run on Amazon EC2 with the Amazon Linux Amazon Machine Image (AMI).
    • D. Use AWS Database Migration Service (AWS DMS) to migrate from the Oracle database to Amazon DynamoDB in a Multi-AZ deployment
    • E. Use AWS Database Migration Service (AWS DMS) to migrate from the Oracle database to Oracle on Amazon RDS in a Multi-AZ deployment

    View question →

62. Q62. Q62. A company hosts its multi-tier applications on AWS.For compliance, governance, auditing, and security, the company must track configuration changes on its AWS resources and record a history of API calls made o these resources. What should a solutions architect do to meet these requirements?

    • A. Use AWS CloudTrail to track configuration changes and AWS Config to record API calls
    • B. Use AWS Config to track configuration changes and AWS CloudTrail to record API calls
    • C. Use AWS Config to track configuration changes and Amazon CloudWatch to record API calls
    • D. Use AWS CloudTrail to track configuration changes and Amazon CloudWatch to record API calls

    View question →

63. Q63. Q63. A company recently launched Linux-based application instances on Amazon EC2 in a private subnet and launched a Linux-based bastion host on an Amazon EC2 instance in a public subnet of an VPC. A solution architect needs to connect from the on-premises network, through the company's internet connection, to the bastion host, and to the application servers. The solution architect must make sure that the security groups of all the EC2 instances will allow that access. Which combination of steps should the solutions architect take to meet these requirements? (select TWO)

    • A. Replace the current security group of the bastion host with one that only allows inbound access from the application instances.
    • B. Replace the current security group of the bastion host with one that only allows inbound access from the internal IP range for the company.
    • C. Replace the current security group of the bastion host with one that only allows inbound access from the external IP range for the company
    • D. Replace the current security group of the application instances with one that allows inbound SSH access from only the private IP address of the bastion host.
    • E.

    View question →

64. Q64. Q64. A company observes an increase in Amazon EC2 costs in its most recent bill. The billing team notices unwanted vertical scaling of instance types for a couple of EC2 instances. A solutions architect needs to create a graph comparing the last 2 months of EC2 costs and perform an in- depth analysis to identity the root cause of the vertical scaling. How should the solutions architect generate the information with the LEAST operational overhead?

    • A. Use AWS Budgets to create a budget report and compare costs based on instance types.
    • B. Use Cost Explorer's granular filtering feature to perform an in-depth analysis of EC2 costs based on instance types.
    • C. Use graphs from he AWS Billing and Cost Management dashboard to compare EC2 costs based on instance typ s for the least 2 months.
    • D. Use AWS Cost and Usage Report to create a report and send it to an Amazon S3 bucket.Use Amazon QuickSight Amazon S3 as a source to generate an interactive graph based on instance types.

    View question →

65. Q65. Q65. A company is running a publicly accessible serverless application that uses Amazon API Gateway and AWS Lambda.The application's traffic recently spiked due to fraudulent requests from botnets. Which steps should a solutions architect take to block requests from unauthorized users? (Select TWO.)

    • A. Create a usage plan with an API key that is shared with genuine users only.
    • B. Integrate logic within the Lambda function to ignore the requests from fraudulent addresses.
    • C. Implement an AWS WAF rule to target malicious requests and trigger actions to filter them out.
    • D. Convert the existing public API to a private API.Update the DNS records to redirect users to the new API endpoint.
    • E. Create an IAM role for each user attempting to access the API.A user will assume the role when making the API call.

    View question →