AWS SAA-C03 Chapter 10 Practice Questions (100 Questions)

Practice questions for the AWS SAA-C03 (Solutions Architect Associate) exam, Chapter 10.

1. Q1. Q601. A company wants to analyze and troubleshoot Access Denied errors and Unauthorized errors that are related to IAM permissions. The company has AWS CloudTrail turned on.Which solution will meet these requirements with the LEAST effort?

   • A. Use AWS Glue and write custom scripts to query CloudTrail logs for the errors.
   • B. Use AWS Batch and write custom scripts to query CloudTrail logs for the errors.
   • C. Search CloudTrail logs with Amazon Athena queries to identify the errors.
   • D. Search CloudTrail logs with Amazon QuickSight. Create a dashboard to identify the errors.

   View question →

2. Q2. Q602. A company wants to add its existing AWS usage cost to its operation cost dashboard. A solutions architect needs to recommend a solution that will give the company access to its usage cost programmatically. The company must be able to access cost data for the current year and forecast costs for the next 12 months.Which solution will meet these requirements with the LEAST operational overhead?

   • A. Access usage cost-related data by using the AWS Cost Explorer API with pagination.
   • B. Access usage cost-related data by using downloadable AWS Cost Explorer report .csv files.
   • C. Configure AWS Budgets actions to send usage cost data to the company through FTP.
   • D. Create AWS Budgets reports for usage cost data. Send the data to the company through SMTP.

   View question →

3. Q3. Q603. A solutions architect is reviewing the resilience of an application. The solutions architect notices that a database administrator recently failed over the application's Amazon Aurora PostgreSQL database writer instance as part of a scaling exercise. The failover resulted in 3 minutes of downtime for the application.Which solution will reduce the downtime for scaling exercises with the LEAST operational overhead?

   • A. Create more Aurora PostgreSQL read replicas in the cluster to handle the load during failover.
   • B. Set up a secondary Aurora PostgreSQL cluster in the same AWS Region. During failover, update the application to use the secondary cluster's writer endpoint.
   • C. Create an Amazon ElastiCache for Memcached cluster to handle the load during failover.
   • D. Set up an Amazon RDS proxy for the database. Update the application to use the proxy endpoint.

   View question →

4. Q4. Q604. A company has a regional subscription-based streaming service that runs in a single AWS Region. The architecture consists of web servers and application servers on Amazon EC2 instances. The EC2 instances are in Auto Scaling groups behind Elastic Load Balancers. The architecture includes an Amazon Aurora global database cluster that extends across multiple Availability Zones.The company wants to expand globally and to ensure that its application has minimal downtime.Which solution will provide the MOST fault tolerance?

   • A. Extend the Auto Scaling groups for the web tier and the application tier to deploy instances in Availability Zones in a second Region. Use an Aurora global database to deploy the database in the primary Region and the second Region. Use Amazon Route 53 health checks with a failover routing policy to the second Region.
   • B. Deploy the web tier and the application tier to a second Region. Add an Aurora PostgreSQL cross- Region Aurora Replica in the second Region. Use Amazon Route 53 health checks with a failover routing policy to the second Region. Promote the secondary to primary as needed.
   • C. Deploy the web tier and the application tier to a second Region. Create an Aurora PostgreSQL database in the second Region. Use AWS Database Migration Service (AWS DMS) to replicate the primary database to the second Region. Use Amazon Route 53 health checks with a failover routing policy to the second Region.
   • D. Deploy the web tier and the application tier to a second Region. Use an Amazon Aurora global database to deploy the database in the primary Region and the second Region. Use Amazon Route 53 health checks with a failover routing policy to the second Region. Promote the secondary to primary as needed.

   View question →

5. Q5. Q605. A company is migrating its workloads to AWS. The company has transactional and sensitive data in its databases. The company wants to use AWS Cloud solutions to increase security and reduce operational overhead for the databases.Which solution will meet these requirements?

   • A. Migrate the databases to Amazon EC2. Use an AWS Key Management Service (AWS KMS) AWS managed key for encryption.
   • B. Migrate the databases to Amazon RDS Configure encryption at rest.
   • C. Migrate the data to Amazon S3 Use Amazon Macie for data security and protection
   • D. Migrate the database to Amazon RDS. Use Amazon CloudWatch Logs for data security and protection.

   View question →

6. Q6. Q606. A company has an online gaming application that has TCP and UDP multiplayer gaming capabilities. The company uses Amazon Route 53 to point the application traffic to multiple Network Load Balancers (NLBs) in different AWS Regions. The company needs to improve application performance and decrease latency for the online game in preparation for user growth.Which solution will meet these requirements?

   • A. Add an Amazon CloudFront distribution in front of the NLBs. Increase the Cache-Control max-age parameter.
   • B. Replace the NLBs with Application Load Balancers (ALBs). Configure Route 53 to use latency-based routing.
   • C. Add AWS Global Accelerator in front of the NLBs. Configure a Global Accelerator endpoint to use the correct listener ports.
   • D. Add an Amazon API Gateway endpoint behind the NLBs. Enable API caching. Override method caching for the different stages.

   View question →

7. Q7. Q607. A company stores data in Amazon S3. According to regulations, the data must not contain personally identifiable information (PII). The company recently discovered that S3 buckets have some objects that contain PII. The company needs to automatically detect PII in S3 buckets and to notify the company security team.Which solution will meet these requirements?

   • A. Use Amazon Macie. Create an Amazon EventBridge rule to filter the SensitiveData event type from Macie findings and to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
   • B. Use Amazon GuardDuty. Create an Amazon EventBridge rule to filter the CRITICAL event type from GuardDuty findings and to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
   • C. Use Amazon Macie. Create an Amazon EventBridge rule to filter the SensitiveData:S3Object/Personal event type from Macie findings and to send an Amazon Simple Queue Service (Amazon SQS) notification to the security team.
   • D. Use Amazon GuardDuty. Create an Amazon EventBridge rule to filter the CRITICAL event type from GuardDuty findings and to send an Amazon Simple Queue Service (Amazon SQS) notification to the security team.

   View question →

8. Q8. Q608. A company wants to provide data scientists with near real-time read-only access to the company's production Amazon RDS for PostgreSQL database. The database is currently configured as a Single-AZ database. The data scientists use complex queries that will not affect the production database. The company needs a solution that is highly available.Which solution will meet these requirements MOST cost-effectively?

   • A. Scale the existing production database in a maintenance window to provide enough power for the data scientists.
   • B. Change the setup from a Single-AZ to a Multi-AZ instance deployment with a larger secondary standby instance. Provide the data scientists access to the secondary instance.
   • C. Change the setup from a Single-AZ to a Multi-AZ instance deployment. Provide two additional read replicas for the data scientists.
   • D. Change the setup from a Single-AZ to a Multi-AZ cluster deployment with two readable standby instances. Provide read endpoints to the data scientists.

   View question →

9. Q9. Q609. A company runs a three-tier web application in the AWS Cloud that operates across three Availability Zones. The application architecture has an Application Load Balancer, an Amazon EC2 web server that hosts user session states, and a MySQL database that runs on an EC2 instance. The company expects sudden increases in application traffic. The company wants to be able to scale to meet future application capacity demands and to ensure high availability across all three Availability Zones.Which solution will meet these requirements?

   • A. Migrate the MySQL database to Amazon RDS for MySQL with a Multi-AZ DB cluster deployment. Use Amazon ElastiCache for Redis with high availability to store session data and to cache reads. Migrate the web server to an Auto Scaling group that is in three Availability Zones.
   • B. Migrate the MySQL database to Amazon RDS for MySQL with a Multi-AZ DB cluster deployment. Use Amazon ElastiCache for Memcached with high availability to store session data and to cache reads.Migrate the web server to an Auto Scaling group that is in three Availability Zones.
   • C. Migrate the MySQL database to Amazon DynamoDB Use DynamoDB Accelerator (DAX) to cache reads. Store the session data in DynamoDB. Migrate the web server to an Auto Scaling group that is in three Availability Zones.
   • D. Migrate the MySQL database to Amazon RDS for MySQL in a single Availability Zone. Use Amazon ElastiCache for Redis with high availability to store session data and to cache reads. Migrate the web server to an Auto Scaling group that is in three Availability Zones.

   View question →

10. Q10. Q610. A global video streaming company uses Amazon CloudFront as a content distribution network (CDN). The company wants to roll out content in a phased manner across multiple countries. The company needs to ensure that viewers who are outside the countries to which the company rolls out content are not able to view the content.Which solution will meet these requirements?

    • A. Add geographic restrictions to the content in CloudFront by using an allow list. Set up a custom error message.
    • B. Set up a new URL tor restricted content. Authorize access by using a signed URL and cookies. Set up a custom error message.
    • C. Encrypt the data for the content that the company distributes. Set up a custom error message.
    • D. Create a new URL for restricted content. Set up a time-restricted access policy for signed URLs.

    View question →

11. Q11. Q611. A company wants to use the AWS Cloud to improve its on-premises disaster recovery (DR) configuration. The company's core production business application uses Microsoft SQL Server Standard, which runs on a virtual machine (VM). The application has a recovery point objective (RPO) of 30 seconds or fewer and a recovery time objective (RTO) of 60 minutes. The DR solution needs to minimize costs wherever possible.Which solution will meet these requirements?

    • A. Configure a multi-site active/active setup between the on-premises server and AWS by using Microsoft SQL Server Enterprise with Always On availability groups.
    • B. Configure a warm standby Amazon RDS for SQL Server database on AWS. Configure AWS Database Migration Service (AWS DMS) to use change data capture (CDC).
    • C. Use AWS Elastic Disaster Recovery configured to replicate disk changes to AWS as a pilot light.
    • D. Use third-party backup software to capture backups every night. Store a secondary set of backups in Amazon S3.

    View question →

12. Q12. Q612. A company has an on-premises server that uses an Oracle database to process and store customer information. The company wants to use an AWS database service to achieve higher availability and to improve application performance. The company also wants to offload reporting from its primary database system.Which solution will meet these requirements in the MOST operationally efficient way?

    • A. Use AWS Database Migration Service (AWS DMS) to create an Amazon RDS DB instance in multiple AWS Regions. Point the reporting functions toward a separate DB instance from the primary DB instance.
    • B. Use Amazon RDS in a Single-AZ deployment to create an Oracle database. Create a read replica in the same zone as the primary DB instance. Direct the reporting functions to the read replica.
    • C. Use Amazon RDS deployed in a Multi-AZ cluster deployment to create an Oracle database. Direct the reporting functions to use the reader instance in the cluster deployment.
    • D. Use Amazon RDS deployed in a Multi-AZ instance deployment to create an Amazon Aurora database.Direct the reporting functions to the reader instances.

    View question →

13. Q13. Q613. A company wants to build a web application on AWS. Client access requests to the website are not predictable and can be idle for a long time. Only customers who have paid a subscription fee can have the ability to sign in and use the web application.Which combination of steps will meet these requirements MOST cost-effectively? (Choose three.)

    • A. Create an AWS Lambda function to retrieve user information from Amazon DynamoDB. Create an Amazon API Gateway endpoint to accept RESTful APIs. Send the API calls to the Lambda function.
    • B. Create an Amazon Elastic Container Service (Amazon ECS) service behind an Application Load Balancer to retrieve user information from Amazon RDS. Create an Amazon API Gateway endpoint to accept RESTful APIs. Send the API calls to the Lambda function.
    • C. Create an Amazon Cognito user pool to authenticate users.
    • D. Create an Amazon Cognito identity pool to authenticate users.
    • E. Use AWS Amplify to serve the frontend web content with HTML, CSS, and JS. Use an integrated Amazon CloudFront configuration.
    • F. Use Amazon S3 static web hosting with PHP, CSS, and JS. Use Amazon CloudFront to serve the frontend web content.

    View question →

14. Q14. Q614. A media company uses an Amazon CloudFront distribution to deliver content over the internet. The company wants only premium customers to have access to the media streams and file content. The company stores all content in an Amazon S3 bucket. The company also delivers content on demand to customers for a specific purpose, such as movie rentals or music downloads.Which solution will meet these requirements?

    • A. Generate and provide S3 signed cookies to premium customers.
    • B. Generate and provide CloudFront signed URLs to premium customers.
    • C. Use origin access control (OAC) to limit the access of non-premium customers.
    • D. Generate and activate field-level encryption to block non-premium customers.

    View question →

15. Q15. Q615. A retail company uses a regional Amazon API Gateway API for its public REST APIs. The API Gateway endpoint is a custom domain name that points to an Amazon Route 53 alias record. A solutions architect needs to create a solution that has minimal effects on customers and minimal data loss to release the new version of APIs.Which solution will meet these requirements?

    • A. Create a canary release deployment stage for API Gateway. Deploy the latest API version. Point an appropriate percentage of traffic to the canary stage. After API verification, promote the canary stage to the production stage.
    • B. Create a new API Gateway endpoint with a new version of the API in OpenAPI YAML file format. Use the import-to-update operation in merge mode into the API in API Gateway. Deploy the new version of the API to the production stage.
    • C. Create a new API Gateway endpoint with a new version of the API in OpenAPI JSON file format. Use the import-to-update operation in overwrite mode into the API in API Gateway. Deploy the new version of the API to the production stage.
    • D. Create a new API Gateway endpoint with new versions of the API definitions. Create a custom domain name for the new API Gateway API. Point the Route 53 alias record to the new API Gateway API custom domain name.

    View question →

16. Q16. Q616. A solutions architect needs to ensure that API calls to Amazon DynamoDB from Amazon EC2 instances in a VPC do not traverse the internet.What should the solutions architect do to accomplish this? (Select TWO )

    • A. Create a route table entry for the endpoint
    • B. Create a gateway endpoint for DynamoDB
    • C. Create a new DynamoDB table that uses the endpoint
    • D. Create an ENI for the endpoint in each of the subnets of the VPC
    • E. Create a security group entry in the default security group to provide access

    View question →

17. Q17. Q617. A recent analysis of a company's IT expenses highlights the need to reduce backup costs. The company's chief information officer wants to simplify the on-premises backup infrastructure and reduce costs by eliminating the use of physical backup tapes. The company must preserve the existing investment in the on-premises backup applications and workflows.What should a solutions architect recommend?

    • A. Set up AWS Storage Gateway to connect with the backup applications using the NFS interface.
    • B. Set up an Amazon EFS file system that connects with the backup applications using the NFS interface
    • C. Set up an Amazon EFS file system that connects with the backup applications using the iSCSI interface
    • D. Set up AWS Storage Gateway to connect with the backup applications using the iSCSI-virtual tape library (VTL) interface.

    View question →

18. Q18. Q618. A solutions architect is designing the storage architecture for a new web application used for storing and viewing engineering drawings.All application components will be deployed on the AWS infrastructure. The application design must support caching to minimize the amount of time that users wait for the engineering drawings to load. The application must be able to store petabytes of data. Which combination of storage and caching should the solutions architect use?

    • A. Amazon S3 with Amazon CloudFront
    • B. Amazon S3 Glacier with Amazon ElastiCache
    • C. Amazon Elastic Block Store (Amazon EBS) volumes with Amazon CloudFront
    • D. AWS Storage Gateway with Amazon ElastiCache

    View question →

19. Q19. Q619. A company has an application with a REST-based Interface that allows data to be received in near-real time from a third-party vendor.Once received, the application processes and stores the data for further analysis.The application Is running on Amazon EC2 instances.The third-party vendor has received many 503 Service Unavailable Errors when sending data to the application.When the data volume spikes, the compute capacity reaches its maximum limit and the application is unable to process all requests.Which design should a solutions architect recommend to provide a more scalable solution?

    • A. Use Amazon Kinesis Data Streams to ingest the data.Process the data using AWS Lambda functions.
    • B. Use Amazon API Gateway on top of the existing application.Create a usage plan with a quota Iimit for the third-party vendor.
    • C. Use Amazon Simple Notification Service (Amazon SNS) to ingest the data.Put the EC2 instances in an Auto Scaling group behind an Application Load Balancer.
    • D. Repackage the application as a container.Deploy the application using Amazon Elastic Container Service (Amazon ECS) using the EC2 launch type with an Auto Scaling group.

    View question →

20. Q20. Q620. A company has created a multi-tier application for its ecommerce website. The website uses an Application Load Balancer that resides in the public subnets, a web tier n the public subnets, and a MySQL cluster hosted on Amazon EC2 instances in the private subnets.The MySQL database needs to retrieve product catalog and pricing information that is hosted on the internet by a third party provider. A solutions architect must devise a strategy that maximizes security without increasing operational overhead.What should the solutions architect do to meet these requirements?

    • A. Deploy a NAT instance in the VPC.Route all the internet-based traffic through tho NAT instance.
    • B. Deploy a NAT gateway in the public subnets. Modify the private subnet route table to direct all internet- bound traffic to the NAT gateway.
    • C. Configure an internet gateway and attach it to tho VPC Modify the private subnet route table to direct internet-bound traffic to the internet gateway.
    • D. Configure a virtual private gateway and attach it to the VPC.Modify the private subnet route table to direct internet-bound traffic to the virtual private gateway.

    View question →

21. Q21. Q621. A company is building a RESTful serverless web application on AWS by using Amazon API Gateway and AWS Lambda.The users of this web application will be geographically disturbed, and the company wants to reduce the latency of API requests to these users.Which type of endpoint should a solutions architect use to meet these requirements?

    • A. Private endpoint
    • B. Regional endpoint
    • C. Interface VPC endpoint
    • D. Edge-optimized endpoint

    View question →

22. Q22. Q622. A company is deploying an application that processes large quantities of data in parallel. The company plans to use Amazon EC2 instances for the workload. The network architecture must be configurable to prevent groups of nodes from sharing the same underlying hardware.Which networking solution meets these requirements?

    • A. Run the EC2 instances in a spread placement group
    • B. Group the EC2 instances in separate accounts
    • C. Configure the EC2 instances with dedicated tenancy
    • D. Configure the EC2 instances with shared tenancy

    View question →

23. Q23. Q623. A solutions architect is designing the architecture fora software demonstration environment. The environment will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The system will experience significant increases in traffic during working hours but is not required to operate on weekends.Which combination of actions should the solutions architect take to ensure that the system can scale to meet demand? (Select TWO)

    • A. Use AWS Auto Scaling to adjust the ALB capacity based on request rate.
    • B. Use AWS Auto Scaling to scale the capacity of the VPC internet gateway.
    • C. Launch the EC2 instances in multiple AWS Regions to distribute the load across Regions.
    • D. Use a target tracking scaling policy to scale the Auto Scaling group based on instance CPU utilization.
    • E. Use scheduled scaling to change the Auto Scaling group minimum, maximum, and desired capacity to zero for weekends Revert to the default values at the start of the week.

    View question →

24. Q24. Q624. A company is building an ecommerce application and needs to store sensitive customer information. The company needs to give customers the ability to complete purchase transactions on the website. The company also needs to ensure that sensitive customer data is protected even from database administrators.Which solution meets these requirements?

    • A. Store sensitive data in an Amazon Elastic Block Store (Amazon EBS) volume Use EBS encryption to encrypt the data. Use an IAM instance role to restrict access.
    • B. Store sensitive data in Amazon RDS for MySQL Use AWS Key Management Service (AWS KMS) client-side encryption to encrypt the data.
    • C. Store sensitive data in Amazon S3. Use AWS Key Management Service (AWS KMS) server-side encryption to encrypt the data. Use S3 bucket policies to restrict access.
    • D. Store sensitive data in Amazon FSx for Windows Server. Mount the file share on application servers Use Windows file permissions to restrict access.

    View question →

25. Q25. Q625. A company is using AWS Key Management Service (AWS KMS) customer master keys (CMKs) to encrypt AWS Lambda environment variables. A solutions architect needs to ensure that the required permissions are in place to decrypt and use the environment variables. Which steps must the solutions architect take to implement the correct permissions? (Select TWO.)

    • A. Add AWS KMS permissions in the Lambda resource policy
    • B. Add AWS KMS permissions in the Lambda execution role.
    • C. Add AWS KMS permissions in the Lambda function policy
    • D. Allow the Lambda execution role in the AWS KMS key policy
    • E. Allow the Lambda resource policy in the AWS KMS key policy.

    View question →

26. Q26. Q626. A company has two VPCs that are located in the us-west-2 Region within the same AWS account. The company needs to allow network traffic between these VPCs. Approximately 500 GB of data transfer will occur between the VPCs each month.What is the Most cost-effective solution to connect these VPCs?

    • A. Implement AWS Transit Gateway to connect the VPCs Update the route tables of each VPC to use the transit gateway for inter-VPC communication.
    • B. Implement an AWS Site-to-Site VPN tunnel between the VPCs Update the route tables of each VPC to use the VPN tunnel for inter-VPC communication.
    • C. Set up a VPC peering connection between the VPCs. Update the route tables ofeach VPC to use the VPC peering connection for inter-VPC communication
    • D. Set up a 1 GB AWS Direct Connect connection between the VPCs. Update the route tables of each VPC to use the Direct Connect connection for inter-VPC communication.

    View question →

27. Q27. Q627. A company has a financial application that produces reports. The reports average 50 KB in size and are stored in Amazon S3. The reports are frequently accessed during the first week after production and must be stored for several years. The reports must be retrievable within 6 hours. Which solution meets these requirements MOST cost-effectively?

    • A. Use S3 Standard Use an S3 Lifecycle rule to transition the reports to S3 Glacier after 7 days
    • B. Use S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days.
    • C. Use S3 Intelligent-Tiering. Configure S3 Intelligent-Tiering to transition the reports to S3 Standard- Infrequent Access (S3 Standard-IA)and S3 Glacier.
    • D. Use S3 Standard Use an S3 Lifecycle rule to transition the reports to S3 Glacier Deep Archive after 7 days

    View question →

28. Q28. Q628. A company wants to direct its users to a backup static error page if he company's primary website is unavailable. The primary website's DNS records are hosted in Amazon Route 53 The domain is pointing to an Application Load Balancer (ALB).The company needs a solution that minimizes changes and infrastructure overhead.Which solution will meet these requirements?

    • A. Update the Route 53 records to use a latency routing policy Add a static error page that is hosted in an Amazon S3 bucket to the records so that the traffic is sent to the most responsive endpoints.
    • B. Set up a Route 53 active-passive failover configuration Direct traffic to a static error page that is hosted in an Amazon S3 bucket when Route 53 health checks determine that the ALB endpoint is unhealthy
    • C. Set up a Route 53 actve-active configuration with the ALB and an Amazon EC2 instance that hosts a static error page as endpoints. Configure Route 53to send requests to the instance only if the health checks fail for the ALB
    • D. Update the Route 53 records to use a multivalue answer routing policy. Create a health check Direct traffic to the website if the health check passes Direct traffic to a static error page that is hosted in Amazon S3 if the health check does not pass

    View question →

29. Q29. Q629. A company runs multiple Amazon EC2 Linux instances in a VPC across two Availability Zones. The instances host applications that use a hierarchical directory structure. The applications need to read and write rapidly and concurrently to shared storage.What should a solutions architect do to meet these requirements?

    • A. Create an Amazon S3 bucket. Allow access from all the EC2 instances in the VPC
    • B. Create an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system from each EC2 instance.
    • C. Create a file system on a Provisioned IOPS SSD (io2) Amazon Elastic Block Store (Amazon EBS) volume. Attach the EBS volume to all the EC2 instances
    • D. Create file systems on Amazon Elastic Block Store (Amazon EBS) volumes that are attached to each EC2 instance. Synchronize the EBS volumes across the different EC2 instances.

    View question →

30. Q30. Q630. A solutions architect is designing a workload that will store hourly energy consumption by business tenants in a building. The sensors will feed a database through HTTP requests that will add up usage for each tenant. The solutions architect must use managed services when possible. The workload will receive more features in the future as the solutions architect adds independent components. Which solution will meet these requirements with the LEAST operational overhead?

    • A. Use Amazon API Gateway with AWS Lambda functions to receive the data from the sensors, process the data, and store the data in an Amazon DynamoDB table.
    • B. Use an Elastic Load Balancer that is supported by an Auto Scaling group of Amazon EC2 instances to receive and process the data from the sensors. Use an Amazon S3 bucket to store the processed data.
    • C. Use Amazon API Gateway with AWS Lambda functions to receive the data from the sensors, process the data, and store the data in a Microsoft SQL Server Express database on an Amazon EC2 instance.
    • D. Use an Elastic Load Balancer that is supported by an Auto Scaling group of Amazon EC2 instances to receive and process the data from the sensors. Use an Amazon Elastic File System (Amazon EFS) shared file system to store the processed data.

    View question →

31. Q31. Q631. A company has five organizational units (OUs) as part of its organization in AWS Organizations. Each OU correlates to the five businesses that the company owns. The company's research and development (R&D) business is separating from the company and will need its own organization.A solutions architect creates a separate new management account for this purpose.What should the solutions architect do next in the new management account?

    • A. Have the R&D AWS account be part of both organizations during the transition
    • B. Invite the R&D AWS account to be part of the new organization after the R&D AWS account has left the prior organization
    • C. Create a new R&D AWS account in the new organization. Migrate resources from the prior R&D AWS account to the new R&D AWS account
    • D. Have the R&D AWS account join the new organization. Make the new management account a member of the prior organization.

    View question →

32. Q32. Q632. A solutions architect is using an AWS CloudFormation template to deploy a three-tier web application. The web application consists of a web tier and an application tier that stores and retrieves user data in Amazon DynamoDB tables. The web and application tiers are hosted on Amazon EC2 instances, and the database tier is not publicly accessible. The application EC2 instances need to access the DynamoDB tables without exposing API credentials in the template.What should the solutions architect do to meet these requirements?

    • A. Create an IAM role to read the DynamoDB tables. Associate the role with the application instances by referencing an instance profile.
    • B. Create an IAM role that has the required permissions to read and write from the DynamoDB tables. Add the role to the EC2 instance profile, and associate the instance profile with the application instances
    • C. Use the parameter section in the AWS CloudFormation template to have the user input access and secret keys from an already-created IAM user that has the required permissions to read and write from the DynamoDB tables
    • D. Create an IAM user in the AWS CloudFomation template that has the required permissions to read and write from the DynamoDB tables Use the GetAtt function to retrieve the access and secret keys, and pass them to the application instances through the user data

    View question →

33. Q33. Q633. A company's website handles millions of requests each day, and the number of requests continues to increase.A solutions architect needs to improve the response time of the web application. The solutions architect determines that the application needs to decrease latency when retrieving product details from the Amazon DynamoDB table.Which solution will meet these requirements with the LEAST amount of operational overhead?

    • A. Set up a DynamoDB Accelerator (DAX) cluster. Route all read requests through DAX.
    • B. Set up Amazon ElastiCache for Redis between the DynamoDB table and the web application. Route all read requests through Redis.
    • C. Set up Amazon ElastiCache for Memcached between the DynamoDB table and the web application.Route all read requests through Memcached.
    • D. Set up Amazon DynamoDB Streams on the table, and have AWS Lambda read from the table and populate Amazon ElastiCache. Route all read requests through ElastiCache.

    View question →

34. Q34. Q634. A company uses multiple vendors to distribute digital assets that are stored in Amazon S3 buckets. The company wants to ensure that its vendor AWS accounts have the minimum access that is needed to download objects in these S3 Buckets.Which solution will meet these requirements with the LEAST operational overhead?

    • A. Design a bucket policy that has anonymous read permissions and permissions to list all buckets
    • B. Design a bucket policy that gives read-only access to users. Specify IAM entities as principals
    • C. Create a cross-account IAM role that has a read-only access policy specified for the IAM role
    • D. Create a user policy and vendor user groups that give read-only access to vendor users

    View question →

35. Q35. Q635. A solutions architect is designing a disaster recovery (DR) strategy to provide Amazon EC2 capacity in a failover AWS Region. Business requirements state that the DR strategy must meet capacity in the failover Region.Which solution will meet these requirements?

    • A. Purchase On-Demand Instances in the failover Region
    • B. Purchase an EC2 Savings Plan in the failover Region
    • C. Purchase regional Reserved Instances in the failover Region
    • D. Purchase a Capacity Reservation in the failover Region

    View question →

36. Q36. Q636. A company collects and shares research data with the company's employees all over the world. The company wants to collect and store the data in an Amazon S3 bucket and process the data in the AWS Cloud. The company will share the data with the company's employees. The company needs a secure solution in the AWS Cloud that minimizes operational overhead.Which solution will meet these requirements?

    • A. Use an AWS Lambda function to create an S3 presigned URL.Instruct employees to use the URL
    • B. Create an IAM user for each employee. Create an IAM policy for each employee to allow S3 access.Instruct employees to use the AWS Management Console
    • C. Create an S3 File Gateway. Create a share for uploading and a share for downloading. Allow employees to mount shares on their local computers to use S3 File Gateway
    • D. Configure AWS Transfer Family SFTP endpoints. Select the custom identity provider options. Use AWS Secrets Manager to manage the user credentials Instruct employees to use Transfer Family

    View question →

37. Q37. Q637. A company runs an application that stores and shares photos. Users upload the photos to an Amazon S3 bucket. Every day, users upload approximately 150 photos. The company wants to design a solution that creates a thumbnail of each new photo and stores the thumbnail in a second S3 bucket. Which solution will meet these requirements MOST cost-effectively?

    • A. Configure an Amazon EventBridge scheduled rule to invoke a script every minute on along-running Amazon EMR cluster. Configure the script to generate thumbnails for the photos that do not have thumbnails. Configure the script to upload the thumbnails to the second S3 bucket.
    • B. Configure an Amazon EventBridge scheduled rule to invoke a script every minute on a memory- optimized Amazon EC2 instance that is always on. Configure the script to generate thumbnails for the photos that do not have thumbnails. Configure the script to upload the thumbnails to the second S3 bucket
    • C. Configure an S3 event notification to invoke an AWS Lambda function each time a user uploads a new photo to the application. Configure the Lambda function to generate a thumbnail and to upload the thumbnail to the second S3 bucket
    • D. Configure S3 Storage Lens to invoke an AWS Lambda function each time a user uploads a new photo to the application. Configure the Lambda function to generate a thumbnail and to upload the thumbnail to a second S3 bucket

    View question →

38. Q38. Q638. A company runs an application that uses Amazon RDS for PostgreSQL. The application receives traffic only on weekdays during business hours. The company wants to optimize costs and reduce operational overhead based on this usage.Which solution will meet these requirements?

    • A. Use the Instance Scheduler on AWS to configure start and stop schedules
    • B. Turn off automatic backups. Create weekly manual snapshots of the database
    • C. Create a custom AWS Lambda function to start and stop the database based on minimum CPU utilization
    • D. Purchase All Upfront reserved DB instances

    View question →

39. Q39. Q639. An ecommerce company runs a PostgreSQL database on premises. The database stores data by using high IOPS Amazon Elastic Block Store (Amazon EBS) block storage.The daily peak I/O transactions per second do not exceed 15,000 IOPS. The company wants to migrate the database to Amazon RDS for PostgreSQL and provision disk IOPS performance independent of disk storage capacity. Which solution will meet these requirements MOST cost_effectively?

    • A. Configure the General Purpose SSD(gp2)EBS volume storage type and provision 15.000 IOPS
    • B. Configure the Provisioned IOPS SSD(io1)EBS volume storage type and provision 15,000 IOPS
    • C. Configure the General Purpose SSD (gp3) EBS volume storage type and provision 15,000 IOPS
    • D. Configure the EBS magnetic volume type to achieve maximum lOPS

    View question →

40. Q40. Q640. A company has an on-premises MySQL database that handles transactional data. The company is migrating the database to the AWS Cloud. The migrated database must maintain compatibility with the company's applications that use the database. The migrated database also must scale automatically during periods of increased demand.Which migration solution will meet these requirements?

    • A. Use native MySQL tools to migrate the database to Amazon RDSfor MySQL. Configure elastic storage scaling
    • B. Migrate the database to Amazon Redshift by using the mysqldump utility. Turn on Auto Scaling for the Amazon Redshift cluster
    • C. Use AWS Database Migration Service (AWS DMS) to migrate the database to Amazon Aurora. Turn on Aurora Auto Scaling
    • D. Use AWS Database Migration Service (AWS DMS) to migrate the database to Amazon DynamoDB.Configure an Auto Scaling policy

    View question →

41. Q41. Q641. A company wants to use an event-driven programming model with AWS Lambda. The company wants to reduce startup latency for Lambda functions that run on Java 11, The company does not have strict latency requirements for the applications. The company wants to reduce cold starts and outlier latencies when a function scales up. Which solution will meet these requirements MOST cost-effectively?

    • A. Configure Lambda provisioned concurrency
    • B. Increase the timeout of the Lambda functions
    • C. Increase the memory of the Lambda functions
    • D. Configure Lambda SnapStart.

    View question →

42. Q42. Q642. An ecommerce company uses Amazon Route 53 as its DNS provider. The company hosts its website on premises and in the AWS Cloud. The company's on-premises data center is near the us-west-1 Region.The company uses the eu-central-1 Region to host the website.The company wants to minimize load time for the website as much as possible.Which solution will meet these requirements?

    • A. Set up a geolocation routing policy. Send the traffic that is near us-west-1 to the on-premises data center. Send the traffic that is near eu-central-1 to eu- central-1
    • B. Set up a simple routing policy that routes all traffic that is near eu-central-1 to eu-central-1 and routes all traffic that is near the on-premises data center to the on-premises data center
    • C. Set up a latency routing policy Associate the policy with us-west-1
    • D. Set up a weighted routing policy. Split the traffic evenly between eu-central-1 and the on-premises data center

    View question →

43. Q43. Q643. A company will migrate 10 PB of data to Amazon S3 in 6 weeks.The current data center has a 500 Mbps uplink to the internet. Other on-premises applications share the uplink. The company can use 80% of the internet bandwidth for this one-time migration task.Which solution will meet these requirements?

    • A. Configure AWS DataSync to migrate the data to Amazon S3 and to automatically verify the data
    • B. Use rsync to transfer the data directly to Amazon S3
    • C. Use the AWS CLI and multiple copy processes to send the data directly to Amazon S3
    • D. Order multiple AWS Snowball devices. Copy the data to the devices. Send the devices to AWS to copy the data to Amazon S3

    View question →

44. Q44. Q644. A company wants to use Amazon FSx for Windows File Server for its Amazon EC2 instances that have an SMB file share mounted as a volume in the us-east-1 Region. The company has a recovery point objective (RPO) of 5 minutes for planned system maintenance or unplanned service disruptions. The company needs to replicate the file system to the us-west-2 Region. The replicated data must not be deleted by any user for 5 years.Which solution will meet these requirements?

    • A. Create an FSx for Windows File Server file system in us-east-1 that has a Single-AZ 2 deployment type.Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in compliance mode for a target vault in us-west-2.Configure a minimum duration of 5 years
    • B. Create an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type.Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in governance mode for a target vault in us-west-2.Configure a minimum duration of 5 years
    • C. Create an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type.Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in compliance mode for a target vault in us-west-2.Configure a minimum duration of 5 years
    • D. Create an FSx for Windows File Server file system in us-east-1 that has a Single-AZ 2 deployment type.Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in governance mode for a target vault in us-west-2.Configure a minimum duration of 5 years

    View question →

45. Q45. Q645. A company hosts multiple applications on AWS for different product lines. The applications use different compute resources,including Amazon EC2 instances and Application Load Balancers.The applications run in different AWS accounts under the same organization in AWS Organizations across multiple AWS Regions. Teams for each product line have tagged each compute resource in the individual accounts. The company wants more details about the cost for each product line from the consolidated billing feature in Organizations.Which combination of steps will meet these requirements?(Select TWO.)

    • A. Select a specific AWS generated tag in the AWS Billing console
    • B. Select a specific user-defined tag in the AWS Billing console
    • C. Select a specific user-defined tag in the AWS Resource Groups console
    • D. Activate the selected tag from each AWS account
    • E. Activate the selected tag from the Organizations management account

    View question →

46. Q46. Q646. A company runs a website that stores images of historical events Website users need the ability to search and view images based on the year that the event in the image occurred. On average,users request each image only once or twice a year. The company wants a highly available solution to store and deliver the images to users.Which solution will meet these requirements MOST cost-effectively?

    • A. Store images in Amazon Elastic Block Store (Amazon EBS). Use a web server that runs on Amazon EC2
    • B. Store images in Amazon Elastic File System (Amazon EFS). Use a web server that runs on Amazon EC2
    • C. Store images in Amazon S3 Standard. Use S3 Standard to directly deliver images by using a static website
    • D. Store images in Amazon S3 Standard-Infrequent Access (S3 Standard- IA). Use S3 Standard-IA to directly deliver images by using a static website

    View question →

47. Q47. Q647. A company has a large data workload that runs for 6 hours each day. The company cannot lose any data while the process is running. A solutions architect is designing an Amazon EMR cluster configuration to support this critical data workload.Which solution will meet these requirements MOST cost_effectively?

    • A. Configure a long-running cluster that runs the primary node and core nodes on On-Demand Instances and the task nodes on Spot Instances
    • B. Configure a transient cluster that runs the primary node and core nodes on On-Demand Instances and the task nodes on Spot Instances
    • C. Configure a transient cluster that runs the primary node on an On-Demand Instance and the core nodes and task nodes on Spot Instances
    • D. Configure a long-running cluster that runs the primary node on an On-Demand Instance, the core nodes on Spot Instances, and the task nodes on Spot Instances

    View question →

48. Q48. Q648. A company has multiple AWS accounts with applications deployed in the us-west-2 Region Application togs are stored within Amazon S3 buckets in each account. The company wants to build a centralized log analysts solution that uses a single S3 bucket Logs must not leave us-west-2T and the company wants to incur minimal operational overhead. Which solution meets these requirements and is MOST cost-effective?

    • A. Create an S3 Lifecycle policy that copies the objects from one of the application S3 buckets to the centralized S3 bucket
    • B. Use S3 Same-Region Replication to replicate togs from the S3 buckets to another S3 bucket in us- west-2 Use this S3 bucket for log analysis
    • C. Write a script that uses the PutObject API operation every day to copy the entire contents of the buckets to another S3 bucket in us-west-2 Use this S3 bucket for log analysis
    • D. Write AWS Lambda functions in these accounts that are triggered every time logs ate delivered to the S3 buckets (s3 ObjectCreated. * event)Copy the logs to another S3 bucket in us-west-2 Use this S3 bucket for log analysis

    View question →

49. Q49. Q649. A company has a business-critical application that runs on Amazon EC2 instances The application stores data in an Amazon DynamoDB table. The company must be able to revert the table to any point within the last24 hours.Which solution meets these requirements with the LEAST operational overhead?

    • A. Configure point-in-time recovery for the table
    • B. Use AWS Backup for the table
    • C. Use an AWS Lambda function to make an on-demand backup of the table every hour.
    • D. Turn on streams on the table to capture a log of all changes to the table in the last24hours. Store a copy of the stream in an Amazon S3 bucket

    View question →

50. Q50. Q650. A company hosts an application used to upload files to an Amazon S3 bucket. Once uploaded, the files are processed to extract metadata, which takes less than 5 seconds. The volume and frequency of the uploads varies from a few files each hour to hundreds of concurrent uploads. The company has asked a solutions architect to design a cost-effective architecture that will meet these requirements.What should the solutions architect recommend?

    • A. Configure AWS Cloud Trail trails to log S3 API calls.Use AWS AppSync to process the files.
    • B. Configure an object-created event notification within the S3 bucket to invoke an AWS Lambda function to process the files.
    • C. Configure Amazon Kinesis Data Streams to process and send data to Amazon S3.Invoke an AWS Lambda function to process the files.
    • D. Configure an Amazon Simple Notification Service (Amazon SNS) topic to process the files uploaded to Amazon S3.Invoke an AWS Lambda function to process the files.

    View question →

51. Q51. Q651. A company is developing a mobile game that streams score updates to a backend processor and then posts results on a leaderboard. A solutions architect needs to design a solution that can handle large traffic spikes, process the mobile game updates in order of receipt, and store the processed updates in a highly available database. The company also wants to minimize the management overhead required to maintain the solution. What should the solutions architect do to meet these requirements?

    • A. Push score updates to Amazon Kinesis Data Streams.Process the updates in Kinesis Data Streams with AWS Lambda.Store the processed updates in Amazon DynamoDB.
    • B. Push score updates to Amazon Kinesis Data Streams.Process the updates with a fleet of Amazon EC2 instances set up for Auto Scaling.Store the processed updates in Amazon Redshift.
    • C. Push score updates to an Amazon Simple Notification Service (Amazon SNS) topic.Subscribe an AWS Lambda function to the SNS topic to process the updates.Store the processed updates in a SQL database running on Amazon EC2.
    • D. Push score updates to an Amazon Simple Queue Service (Amazon SQS) queue.Use a fleet of Amazon EC2 instances with Auto Scaling to process the updates in the SOS queue.Store the processed updates in an Amazon RDS Multi-AZ DB instance.

    View question →

52. Q52. Q652. A company maintains about 300 TB m Amazon S3 Standard storage month after month. The S3 objects are each typically around 50 GB m size and are frequently replaced with multipart uploads by their global application. The number and size of S3 objects remain constant but the company's S3 storage costs are increasing each month.How should a solutions architect reduce costs in this situation?

    • A. Switch from multipart uploads to Amazon S3 Transfer Acceleration
    • B. Enable an S3 Lifecycle policy that deletes incomplete multipart uploads
    • C. Configure S3 inventory to prevent objects from being archived too quickly
    • D. Configure Amazon CloudFront to reduce the number of objects stored in Amazon S3

    View question →

53. Q53. Q653. A company is deploying an application that processes streaming data in near-real time. The company plans to use Amazon EC2 instances for the workload. The network architecture must be configurable to provide the lowest possible latency between nodes.Which combination of network solutions will meet these requirements? (Select TWO.)

    • A. Enable and configure enhanced networking on each EC2 instance.
    • B. Group the EC2 instances in separate accounts.
    • C. Run the EC2 instances in a cluster placement group.
    • D. Attach multiple elastic network interfaces to each EC2 instance.
    • E. Use Amazon Elastic Block Store (Amazon EBS) optimized instance types.

    View question →

54. Q54. Q654. A company built an application with Docker containers and needs to run the application in the AWS Cloud. The company wants to use a managed service to host the application. The solution must scale in and out appropriately according to demand on the individual container services The solution also must not result in additional operational overhead or infrastructure to manage. Which solutions will meet these requirements? (Select TWO)

    • A. Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate
    • B. Use Amazon Elastic Kubermetes Service Amazon EKS) with AWS Fargate
    • C. Provision an Amazon API Gateway API. Connect the API to AWS Lambda to run the containers
    • D. Use Amazon Elastic Container Service Amazon ECS) with Amazon EC2 worker nodes
    • E. Use Amazon Elastic Kubernetes Service (Amazon EKS) with Amazon EC2 worker nodes.

    View question →

55. Q55. Q655. A company has an AWS Direct Connect connection from its on-premises location to an AWS account. The AWS account has 3O different VPCs in the same AWS Region. The VPCs use private virtual interfaces (VIFs).Each VPC has a CIDR block that does not overlap with other networks under the company's control. The company wants to centrally manage the networking architecture while sill allowing each VPC to communicate with all other VPCs and on-premises networks.Which solution will meet these requirements with the LEAST amount of operational overhead?

    • A. Create a transit gateway, and associate the Direct Connect connection with a new transit VIF.Turn on the transit gateway's route propagation feature.
    • B. Create a Direct Connect gateway. Recreate the private VlFs to use the new gateway.Associate each VPC by creating new virtual private gateways.
    • C. Create a transit VPC. Connect the Direct Connect connection to the transit VPC. Create a peering connection between all other VPCs in the Region. Update the route tables.
    • D. Create AWS Site-to-Site VPN connections from on premises to each VPC. Ensure that both VPN tunnels are UP for each connection. Turn on the route propagation feature.

    View question →

56. Q56. Q656. A solutions architect is designing a shared storage solution for a web application that is deployed across multiple Availability Zones. The web application runs on Amazon EC2 instances that are in an Auto Scaling group. The company plans to make frequent changes to the content. The solution must have strong consistency in returning the new content as soon as the changes occur.Which solutions meet these requirements? (Select TWO.)

    • A. Use AWS Storage Gateway Volume Gateway Internet Small Computer Systems Interface (iSCSl) block storage that is mounted to the individual EC2 instances.
    • B. Create an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system on the individual EC2 instances.
    • C. Create a shared Amazon Elastic Block Store (Amazon EBS) volume. Mount the EBS volume on the individual EC2 instances
    • D. Use AWS DataSync to perform continuous synchronization of data between EC2 hosts in the Auto Scaling group
    • E. Create an Amazon S3 bucket to store the web content. Set the metadata for the Cache-Control header to no-cache. Use Amazon CloudFront to deliver the content.

    View question →

57. Q57. Q657. A company has an organization in AWS Organizations that has all features enabled. The company requires that all API calls and logins in any existing or new AWS account must be audited. The company needs a managed solution to prevent additional work and to minimize costs. The company also needs to know when any AWS account is not compliant with the AWS Foundational Security Best Practices (FSBP) standard.Which solution will meet these requirements with the LEAST operational overhead?

    • A. Deploy an AWS Control Tower environment in the Organizations management account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment
    • B. Deploy an AWS Control Tower environment in a dedicated Organizations member account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment
    • C. Use AWS Managed Services (AMS) Accelerate to build a multi-account landing zone(MALZ). Submit an RFC to self-service provision Amazon GuardDuty in the MALZ
    • D. Use AWS Managed Services (AMS) Accelerate to build a multi-account landing zone (MALZ). Submit an RFC to self-service provision AWS Security Hub in the MALZ

    View question →

58. Q58. Q658. A company that uses AWS needs a solution to predict the resources needed for manufacturing processes each month.The solution must use historical values that are currently stored in an Amazon S3 bucket. The company has no machine learning (ML) experience and wants to use a managed service for the training and predictions.Which combination of steps will meet these requirements?(Select TWO.)

    • A. Deploy an Amazon SageMaker model.Create a SageMaker endpoint for inference
    • B. Use Amazon SageMaker to train a model by using the historical data in the S3 bucket
    • C. Configure an AWS Lambda function with a function URL that uses Amazon SageMaker endpoints to create predictions based on the inputs
    • D. Configure an AWS Lambda function with a function URL that uses an Amazon Forecast predictor to create a prediction based on the inputs
    • E. Train an Amazon Forecast predictor by using the historical data in the S3 bucket

    View question →

59. Q59. Q659. A company collects and processes data from a vendor. The vendor stores its data in an Amazon RDS for MySQL database in the vendor's own AWS account. The company's VPC does not have an internet gateway, an AWS Direct Connect connection, or an AWS Site-to-Site VPN connection. The company needs to access the data that is in the vendor database.Which solution will meet this requirement?

    • A. Instruct the vendor to sign up for the AWS Hosted Connection Direct Connect Program. Use VPC peering to connect the company's VPC and the vendor's VPC
    • B. Configure a client VPN connection between the company's VPC and the vendor's VPC. Use VPC peering to connect the company's VPC and the vendor's VPC
    • C. Instruct the vendor to create a Network Load Balancer (NLB). Place the NLB in front of the Amazon RDS for MySQL database.Use AWS PrivateLink to integrate the company's VPC and the vendor's VPC
    • D. Use AWS Transit Gateway to integrate the company's VPC and the vendor's VPC. Use VPC peering to connect the company's VPC and the vendor's VPC

    View question →

60. Q60. Q660. A company has an organization in AWS Organizations. The company runs Amazon EC2 instances across four AWS accounts in the root organizational unit(OU). There are three nonproduction accounts and one production account. The company wants to prohibit users from launching EC2 instances of a certain size in the nonproduction accounts.The company has created a service control policy(SCP) to deny access to launch instances that use the prohibited types.Which solutions to deploy the SCP will meet these requirements?(Select TWO.)

    • A. Attach the SCP to the root OU for the organization
    • B. Attach the SCP to the three nonproduction Organizations member accounts
    • C. Attach the SCP to the Organizations management account
    • D. Create an OU for the production account. Attach the SCP to the OU. Move the production member account into the new OU
    • E. Create an OU for the required accounts.Attach the SCP to the OU. Move the nonproduction member accounts into the new OU

    View question →

61. Q61. Q661. A company's website hosted on Amazon EC2 instances processes classified data stored in Amazon S3. Due to security concerns,the company requires a private and secure connection between its EC2 resources and Amazon S3,Which solution meets these requirements?

    • A. Set up S3 bucket policies to allow access from a VPC endpoint
    • B. Set up an IAM policy to grant read-write access to the S3 bucket.
    • C. Set up a NAT gateway to access resources outside the private subnet
    • D. Set up an access key ID and a secret access key to access the S3 bucket

    View question →

62. Q62. Q662. A company's data platform uses an Amazon Aurora MySQL database. The database has multiple read replicas and multiple DB instances across different Availability Zones. Users have recently reported errors from the database that indicate that there are too many connections. The company wants to reduce the failover time by 20% when a read replica is promoted to primary writer.Which solution will meet this requirement?

    • A. Switch from Aurora to Amazon RDS with Multi-AZ cluster deployment
    • B. Use Amazon RDS Proxy in front of the Aurora database
    • C. Switch to Amazon DynamoDB with DynamoDB Accelerator (DAX) for read connections
    • D. Switch to Amazon Redshift with relocation capability

    View question →

63. Q63. Q663. A company uses an AWS Batch job to run its end-of-day sales process.The company needs a serverless solution that will invoke a third-party reporting application when the AWS Batch job is successful. The reporting application has an HTTP API interface that uses username and password authentication.Which solution will meet these requirements?

    • A. Configure an Amazon EventBridge rule to match incoming AWS Batch job SUCCEEDED events.Configure the third-party API as an EventBridge API destination with a username and password. Set the API destination as the EventBridge rule target
    • B. Configure Amazon EventBridge Scheduler to match incoming AWS Batch iob SUCCEEDED events.Configure an AWS Lambda function to invoke the third-party API by using a username and password.Set the Lambda function as the EventBridge rule target
    • C. Configure an AWS Batch job to publish job SUCCEEDED events to an Amazon API Gateway REST API. Configure an HTTP proxy integration on the API Gateway REST API to invoke the third-party API by using a username and password
    • D. Configure an AWS Batch job to publish job SUCCEEDED events to an Amazon API Gateway REST API. Configure a proxy integration on the API Gateway REST API to an AWS Lambda function.Configure the Lambda function to invoke the third party API by using a username and password

    View question →

64. Q64. Q664. A pharmaceutical company is developing a new drug. The volume of data that the company generates has grown exponentially over the past few months. The company's researchers regularly require a subset of the entire dataset to be immediately available with minimal lag. However. the entire dataset does not need to be accessed on a daily basis. All the data currently resides in on-premises storage arrays. and the company wants to reduce ongoing capital expenses.Which storaae solution should a solutions architect recommend to meet these requirements?

    • A. Run AWS DataSync as a scheduled cron job to migrate the data to an Amazon S3 bucket on an ongoing basis
    • B. Deploy an AWS Storage Gateway file gateway with an Amazon S3 bucket as the target storage.Migrate the data to the Storage Gateway appliance
    • C. Deploy an AWS Storage Gateway volume gateway with cached volumes with an Amazon S3 bucket as the target storage. Migrate the data to the Storage Gateway appliance
    • D. Configure an AWS Site-to-Site VPN connection from the on-premises environment to AWS. Migrate data to an Amazon Elastic File System (Amazon EFS) file system

    View question →

65. Q65. Q665. An ecommerce company runs its application on AWS. The application uses an Amazon Aurora PostgreSQL cluster in Multi-AZ mode for the underlying database. During a recent promotional campaign, the application experienced heavy read load and write load Users experienced timeout issues when they attempted to access the application.A solutions architect needs to make the application architecture more scalable and highly available. Which solution will meet these requirements with the LEAST downtime?

    • A. Create an Amazon EventBridge rule that has the Aurora cluster as a source. Create an AWS Lambda function to log the state change events of the Aurora cluster. Add the Lambda function as a target for the EventBridge rule. Add additional reader nodes to fail over to
    • B. Modify the Aurora cluster and activate the zero-downtime restart (ZDR) feature. Use Database Activity Streams on the cluster to track the cluster status
    • C. Add additional reader instances to the Aurora cluster. Create an Amazon RDS Proxy target group for the Aurora cluster
    • D. Create an Amazon ElastiCache for Redis cache. Replicate data from the Aurora cluster to Redis by using AWS Database Migration Service(AWS DMS) with a write-around approach

    View question →

66. Q66. Q666. A company has a mobile game that reads most of its metadata from an Amazon RDS DB instance. As the game increased in popularity, developers noticed slowdowns related to the game's metadata load times. Performance metrics indicate that simply scaling the database will not help. A solutions architect must explore all options that include capabilities for snapshots, replication, and sub-millisecond response times. What should the solutions architect recommend to solve these issues?

    • A. Migrate the database to Amazon Aurora with Aurora Replicas
    • B. Migrate the database to Amazon DynamoDB with global tables
    • C. Add an Amazon ElastiCache for Redis laver in front of the database
    • D. Add an Amazon ElastiCache for Memcached layer in front of the database

    View question →

67. Q67. Q667. A company maintains its accounting records in a custom application that runs on Amazon EC2 instances. The company needs to migrate the data to an AWS managed service for development and maintenance of the application data.The solution must require minimal operational support and provide immutable,cryptographically verifiable logs of data changes. Which solution will meet these requirements MOST cost-effectively?

    • A. Copy the records from the application into an Amazon Redshift cluster
    • B. Copy the records from the application into an Amazon Neptune cluster
    • C. Copy the records from the application into an Amazon Timestream database
    • D. Copy the records from the application into an Amazon Quantum Ledger Database(Amazon QLDB) ledger

    View question →

68. Q68. Q668. A company is building an application on AWS that connects to an Amazon RDS database.The company wants to manage the application configuration and to securely store and retrieve credentials for the database and other services.Which solution will meet these requirements with the LEAST administrative overhead?

    • A. Use AWS AppConfig to store and manage the application configuration. Use AWS Secrets Manager to store and retrieve the credentials
    • B. Use AWS Lambda to store and manage the application configuration. Use AWS Systems Manager Parameter Store to store and retrieve the credentials
    • C. Use an encrypted application configuration file. Store the file in Amazon S3 for the application configuration. Create another S3 file to store and retrieve the credentials
    • D. Use AWS AppConfig to store and manage the application configuration. Use Amazon RDS to store and retrieve the credentials

    View question →

69. Q69. Q669. A company wants to standardize its Amazon Elastic Block Store(Amazon EBS) volume encryption strategy.The company also wants to minimize the cost and configuration effort required to operate the volume encryption check.Which solution will meet these requirements?

    • A. Write API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Use Amazon EventBridge to schedule an AWS Lambda function to run the API calls
    • B. Write API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Run the API calls on an AWS Fargate task
    • C. Create an AWS Identity and Access Management (IAM) policy that requires the use of tags on EBS volumes.Use AWS Cost Explorer to display resources that are not properly tagged.Encrypt the untagged resources manually
    • D. Create an AWS Config rule for Amazon EBS to evaluate if a volume is encrypted and to flag the volume if it is not encrypted

    View question →

70. Q70. Q670. A company's marketing data is uploaded from multiple sources to an Amazon S3 bucket. A series of data preparation jobs aggregate the data for reporting. The data preparation jobs need to run at regular intervals in parallel. Afew jobs need to run in a specific order later. The company wants to remove the operational overhead of job error handling, retry logic, and state management.Which solution will meet these requirements?

    • A. Use an Aws Lambda function to process the data as soon as the data is uploaded to the S3 bucket.Invoke other Lambda functions at regularly scheduled intervals
    • B. Use Amazon Athena to process the data.Use Amazon EventBridge Scheduler to invoke Athena on a regular internal
    • C. Use AWS Glue DataBrew to process the data.Use an AWS Step Functions state machine to run the DataBrew data preparation jobs
    • D. Use AWS Data Pipeline to process the data. Schedule Data Pipeline to process the data once at midnight

    View question →

71. Q71. Q671. A company is designing a web application on AWS. The application will use a VPN connection between the company's existing data centers and the company's VPCs The company uses Amazon Route 53 as its DNS service.The application must use private DNS records to communicate with the on-premises services from a VPC.Which solution will meet these requirements in the MOST secure manner?

    • A. Create a Route 53 Resolver outbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC
    • B. Create a Route 53 Resolver inbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC
    • C. Create a Route 53 private hosted zone. Associate the private hosted zone with the VPC
    • D. Create a Route 53 public hosted zone. Create a record for each service to allow service communication

    View question →

72. Q72. Q672. An ecommerce company runs applications in AWS accounts that are part of an organization in AWS Organizations. The applications run on Amazon Aurora PostgreSQL databases across all the accounts.The company needs to prevent malicious activity and must identify abnormal failed and incomplete login attempts to the databases.Which solution will meet these requirements in the MOST operationally efficient way?

    • A. Attach service control policies (SCPs) to the root of the organization to identify the failed login attempts
    • B. Enable the Amazon RDS Protection feature in Amazon GuardDuty for the member accounts of the organization
    • C. Publish the Aurora general logs to alog group in Amazon CloudWatch Logs.Export the log data to a central Amazon S3 bucket
    • D. Publish all the Aurora PostgreSQL database events in AWS CloudTrail to a central Amazon S3 bucket

    View question →

73. Q73. Q673. A company needs to extract the names of ingredients from recipe records that are stored as text files in an Amazon S3 bucket. A web application will use the ingredient names to query an Amazon DynamoDB table and determine a nutrition score The application can handle non-food records and errors. The company does not have any employees who have machine learning knowledge to develop this solution. Which solution will meet these requirements MOST cost-effectively?

    • A. Use S3 Event Notifications to invoke an AWS Lambda function when PutObject requests occur.Program the Lambda function to analyze the object and extract the ingredient names by using Amazon Comprehend. Store the Amazon Comprehend output in the DynamoDB table
    • B. Use an Amazon EventBridge rule to invoke an AWS Lambda function when PutObject requests occur.Program the Lambda function to analyze the object by using Amazon Forecast to extract the ingredient names. Store the Forecast output in the DynamoDB table
    • C. Use S3 Event Notifications to invoke an AWS Lambda function when PutObject requests occur. Use Amazon Polly to create audio recordings of the recipe records. Save the audio files in the S3 bucket.Use Amazon Simple Notification Service (Amazon SNS) to send a URL as a message to employees.Instruct the employees to listen to the audio files and calculate the nutrition score. Store the ingredient names in the DynamoDB table
    • D. Use an Amazon EventBridge rule to invoke an AWS Lambda function when a PutObject request occurs. Program the Lambda function to analyze the object and extract the ingredient names by using Amazon SageMaker. Store the inference output from the SageMaker endpoint in the DynamoDB table.

    View question →

74. Q74. Q674. A company needs a solution to prevent AWS CloudFormation stacks from deploying AWS Identity and Access Management (IAM) resources that include an inline policy or "" in the statement. The solution must also prohibit deployment of Amazon EC2 instances with public IP addresses. The company has AWS Control Tower enabled in its organization in AWS Organizations.Which solution will meet these requirements?

    • A. Use AWS Control Tower proactive controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or "'
    • B. Use AWS Control Tower detective controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or ""
    • C. Use AWS Config to create rules for EC2 and IAM compliance. Configure the rules to run an AWS Systems Manager Session Manager automation to delete a resource when it is not compliant
    • D. Use a service control policy(SCP) to block actions for the EC2 instances and IAM resources if the actions lead to noncompliance

    View question →

75. Q75. Q675. An online gaming company hosts its platform on Amazon EC2 instances behind Network Load Balancers (NLBs) across multiple AWS Regions.The NLBs can route requests to targets over the internet.The company wants to improve the customer playing experience by reducing end-to-end load time for its global customer base.Which solution will meet these requirements?

    • A. Create Application Load Balancers (ALBs) in each Region to replace the existing NLBs. Register the existing EC2 instances as targets for the ALBs in each Region
    • B. Configure Amazon Route 53 to route egually weighted traffic to the NLBs in each Region
    • C. Create additional NLBs and EC2 instances in other Regions where the company has large customer bases
    • D. Create a standard accelerator in AWS Global Accelerator. Configure the existing NLBs as target endpoints

    View question →

76. Q76. Q676. A solutions architect needs to design the architecture for an application that a vendor provides as a Docker container image.The container needs 50 GB of storage available for temporary files.The infrastructure must be serverless.Which solution meets these requirements with the LEAST operational overhead?

    • A. Create an AWS Lambda function that uses the Docker container image with an Amazon S3 mounted volume that has more than 50 GB of space
    • B. Create an AWS Lambda function that uses the Docker container image with an Amazon Elastic Block Store(Amazon EBS) volume that has more than 50 GB of space
    • C. Create an Amazon Elastic Container Service(Amazon ECS) cluster that uses the AWS Fargate launch type. Create a task definition for the container image with an Amazon Elastic File System (Amazon EFS) volume. Create a service with that task definition
    • D. Create an Amazon Elastic Container Service (Amazon ECS) cluster that uses the Amazon EC2 launch type with an Amazon Elastic Block Store (Amazon EBS) volume that has more than 50 GB of space.Create a task definition for the container image. Create a service with that task definition

    View question →

77. Q77. Q677. A company's applications use Apache Hadoop and Apache Spark to process data on premises. The existing infrastructure is not scalable and is complex to manage. A solutions architect must design a scalable solution that reduces operational complexity. The solution must keep the data processing on premises.Which solution will meet these requirements?

    • A. Use AWS Site-to-Site VPN to access the on-premises Hadoop Distributed File System (HDFS) data and application. Use an Amazon EMR cluster to process the data
    • B. Use AWS DataSync to connect to the on-premises Hadoop Distributed File System (HDFS) cluster.Create an Amazon EMR cluster to process the data
    • C. Migrate the Apache Hadoop application and the Apache Spark application to Amazon EMR clusters on AWS Outposts. Use the EMR clusters to process the data
    • D. Use an AWS Snowball device to migrate the data to an Amazon S3 bucket. Create an Amazon EMR cluster to process the data

    View question →

78. Q78. Q678. A social media company is creating a rewards program website for its users. The company gives users points when users create and upload videos to the website. Users redeem their points for gifts or discounts from the company's affiliated partners. A unique ID identifies users. The partners refer to this ID to verify user eligibility for rewards.The partners want to receive notification of user IDs through an HTTP endpoint when the company gives users points. Hundreds of vendors are interested in becoming affiliated partners every day. The company wants to design an architecture that gives the website the ability to add partners rapidly in a scalable way. Which solution will meet these requirements with the LEAST implementation effort?

    • A. Create an Amazon Timestream database to keep a list of affiliated partners. Implement an AWS Lambda function to read the list. Configure the Lambda function to send user IDs to each partner when the company gives users points
    • B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Choose an endpoint protocol.Subscribe the partners to the topic. Publish user IDs to the topic when the company gives users points
    • C. Create an AWS Step Functions state machine. Create a task for every affiliated partner. Invoke the state machine with user IDs as input when the company gives users points
    • D. Create a data stream in Amazon Kinesis Data Streams. Implement producer and consumer applications. Store a list of affiliated partners in the data stream. Send user IDs when the company gives users points

    View question →

79. Q79. Q679. A company is designing a tightly coupled high performance computing (HPC) environment in the AWS Cloud. The company needs to include features that will optimize the HPC environment for networking and storage.Which combination of solutions will meet these requirements? (Select TWO.)

    • A. Create an accelerator in AWS Global Accelerator. Configure custom routing for the accelerator
    • B. Create an Amazon FSx for Lustre file system. Configure the file system with scratch storage
    • C. Create an Amazon CloudFront distribution. Configure the viewer protocol policy to be HTTP and HTTPS
    • D. Launch Amazon EC2 instances. Attach an Elastic Fabric Adapter (EFA) to the instances
    • E. Create an Aws Elastic Beanstalk deployment to manage the environment

    View question →

80. Q80. Q680. A company uses high concurrency AWS Lambda functions to process a constantly increasing number of messages in a message queue during marketing events. The Lambda functions use CPU intensive code to process the messages. The company wants to reduce the compute costs and to maintain service latency for its customers.Which solution will meet these reauirements?

    • A. Configure reserved concurrency for the Lambda functions. Decrease the memory allocated to the Lambda functions
    • B. Configure reserved concurrency for the Lambda functions. Increase the memory according to AWS Compute Optimizer recommendations
    • C. Configure provisioned concurrency for the Lambda functions. Decrease the memory allocated to the Lambda functions
    • D. Configure provisioned concurrency for the Lambda functions. Increase the memory according to AWS Compute Optimizer recommendations

    View question →

81. Q81. Q681. A media company stores movies in Amazon S3. Each movie is stored in a single video file that ranges from 1 GB to 10 GB in size.The company must be able to provide the streaming content of a movie within 5 minutes of a user purchase. There is higher demand for movies that are less than 20 years old than for movies that are more than 20 years old. The company wants to minimize hosting service costs based on demand.Which solution will meet these requirements?

    • A. Store all media content in Amazon S3. Use S3 Lifecycle policies to move media data into the Infrequent Access tier when the demand for a movie decreases
    • B. Store newer movie video files in S3 Standard. Store older movie video files in S3 Standard-Infrequent Access (S3 Standard-IA). When a user orders an older movie, retrieve the video file by using standard retrieval
    • C. Store newer movie video files in S3 Intelligent-Tiering. Store older movie video files in S3 Glacier Flexible Retrieval. When a user orders an older movie, retrieve the video file by using expedited retrieval
    • D. Store newer movie video files in S3 Standard. Store older movie video files in S3 Glacier Flexible Retrieval. When a user orders an older movie. retrieve the video file by using bulk retrieval

    View question →

82. Q82. Q682. A company wants to analyze and generate reports to track the usage of its mobile app. The app is popular and has a global user base. The company uses a custom report building program to analyze application usage.The program generates multiple reports during the last week of each month. The program takes less than 10 minutes to produce each report. The company rarely uses the program to generate reports outside of the last week of each month. The company wants to generate reports in the least amount of time when the reports are requested.Which solution will meet these requirements MOST cost-effectively?

    • A. Run the program by using Amazon EC2 On-Demand Instances. Create an Amazon EventBridge rule to start the EC2 instances when reports are requested. Run the EC2 instances continuously during the last week of each month
    • B. Run the program in AWS Lambda. Create an Amazon EventBridge rule to run a Lambda function when reports are requested
    • C. Run the program in Amazon Elastic Container Service (Amazon ECS). Schedule Amazon ECS to run the program when reports are requested
    • D. Run the program by using Amazon EC2 Spot Instances. Create an Amazon EventBridge rule to start the EC2 instances when reports are requested. Run the EC2 instances continuously during the last week of each month

    View question →

83. Q83. Q683. A company's software development team needs an Amazon RDS Multi-AZ cluster. The RDS cluster will serve as a backend for a desktop client that is deployed on premises. The desktop client requires direct connectivity to the RDS cluster.The company must give the development team the ability to connect to the cluster by using the client when the team is in the office.Which solution provides the required connectivity MOST securely?

    • A. Create a VPC and two public subnets. Create the RDS cluster in the public subnets. Use AWS Site-to- Site VPN with a customer gateway in the company's office
    • B. Create a VPC and two private subnets. Create the RDS cluster in the private subnets. Use AWS Site- to-Site VPN with a customer gateway in the company's office
    • C. Create a VPC and two private subnets. Create the RDS cluster in the private subnets. Use RDS security groups to allow the company's office IP ranges to access the cluster.
    • D. Create a VPC and two public subnets. Create the RDS cluster in the public subnets. Create a cluster user for each developer. Use RDS security groups to allow the users to access the cluster

    View question →

84. Q84. Q684. A company wants to migrate an on-premises legacy application to AWS.The application ingests customer order files from an on-premises enterprise resource planning (ERP) system.The application then uploads the files to an SFTP server. The application uses a scheduled job that checks for order files every hour. The company already has an AWS account that has connectivity to the on-premises network. The new application on AWS must support integration with the existing ERP system. The new application must be secure and resilient and must use the SFTP protocol to process orders from the ERP system immediately.Which solution will meet these requirements?

    • A. Create an AWS Transfer Family SFTP internet-facing server in two Availability Zones. Use Amazon S3 storage. Create an AWS Lambda function to process order files. Use S3 Event Notifications to send s3:ObjectCreated:* events to the Lambda function
    • B. Create an AWS Transfer Family SFTP internet-facing server in one Availability Zone. Use Amazon Elastic File System (Amazon EFS) storage. Create an AWS Lambda function to process order files.Use a Transfer Family managed workflow to invoke the Lambda function
    • C. Create an AWS Transfer Family SFTP internal server in two Availability Zones. Use Amazon Elastic File System (Amazon EFS) storage. Create an AWS Step Functions state machine to process order files. Use Amazon EventBridge Scheduler to invoke the state machine to periodically check Amazon EFS for order files
    • D. Create an AWS Transfer Family SFTP internal server in two Availability Zones. Use Amazon S3 storage. Create an AWS Lambda function to process order files. Use a Transfer Family managed workflow to invoke the Lambda function

    View question →

85. Q85. Q685. A company is building a microservices-based application that will be deployed on Amazon Elastic Kubernetes Service (Amazon EKS). The microservices will interact with each other. The company wants to ensure that the application is observable to identify performance issues in the future.Which solution will meet these requirements?

    • A. Configure the application to use Amazon ElastiCache to reduce the number of requests that are sent to the microservices
    • B. Configure Amazon CloudWatch Container Insights to collect metrics from the EKS clusters. Configure AWS X-Ray to trace the requests between the microservices
    • C. Configure AWS CloudTrail to review the API calls. Build an Amazon QuickSight dashboard to observe the microservice interactions
    • D. Use AWS Trusted Advisor to understand the performance of the application

    View question →

86. Q86. Q686. A company has deployed its application on Amazon EC2 instances with an Amazon RDS database. The company used the principle of least privilege to configure the database access credentials. The company's security team wants to protect the application and the database from SQL injection and other web-based attacks.Which solution will meet these requirements with the LEAST operational overhead?

    • A. Use security groups and network ACLs to secure the database and application servers
    • B. Use AWS WAF to protect the application. Use RDS parameter groups to configure the security settings
    • C. Use AWS Network Firewall to protect the application and the database
    • D. Use different database accounts in the application code for different functions. Avoid granting excessive privileges to the database users

    View question →

87. Q87. Q687. A company has deployed an application in an AWS account. The application consists of microservices that run on AWS Lambda and Amazon Elastic Kubernetes Service (Amazon EKS). A separate team supports each microservice. The company has multiple AWS accounts and wants to give each team its own account for its microservices.A solutions architect needs to design a solution that will provide service-to-service communication over HTTPS (port 443). The solution also must provide a service registry for service discovery. Which solution will meet these requirements with the LEAST administrative overhead?

    • A. Create an inspection VPC. Deploy an AWS Network Firewall firewall to the inspection VPC. Attach the inspection VPC to a new transit gateway. Route VPC-to-VPC traffic to the inspection VPC. Apply firewall rules to allow only HTTPS communication
    • B. Create a VPC Lattice service network. Associate the microservices with the service network. Define HTTPS listeners for each service. Register microservice compute resources as targets. Identify VPCs that need to communicate with the services. Associate those VPCs with the service network
    • C. Create a Network Load Balancer (NLB) with an HTTPS listener and target groups for each microservice. Create an AWS PrivateLink endpoint service for each microservice. Create an interface VPC endpoint in each VPC that needs to consume that microservice
    • D. Create peering connections between VPCs that contain microservices. Create a prefix list for each service that requires a connection to a client. Create route tables to route traffic to the appropriate VPC Create security groups to allow only HTTPS communication

    View question →

88. Q88. Q688. A company needs to use its on-premises LDAP directory service to authenticate its users to the AWS Management Console. The directory service is not compatible with Security Assertion Markup Language (SAML).Which solution meets these requirements?

    • A. Enable AWS IAM Identity Center (AWS Single Sign-On) between AWS and the on-premises LDAP
    • B. Create an IAM policy that uses AWS credentials. and integrate the policy into LDAP
    • C. Set up a process that rotates the IAM credentials whenever LDAP credentials are updated
    • D. Develop an on-premises custom identity broker application or process that uses AWS Security Token Service (AWS STS) to get short-lived credentials

    View question →

89. Q89. Q689. A company's ecommerce website has unpredictable traffic and uses AWS Lambda functions to directly access a private Amazon RDS for PostgreSQL DB instance. The company wants to maintain predictable database performance and ensure that the Lambda invocations do not overload the database with too many connections.What should a solutions architect do to meet these requirements?

    • A. Point the client driver at an RDS custom endpoint. Deploy the Lambda functions inside a VPC
    • B. Point the client driver at an RDS proxy endpoint. Deploy the Lambda functions inside a VPC
    • C. Point the client driver at an RDS custom endpoint. Deploy the Lambda functions outside a VPC
    • D. Point the client driver at an RDS proxy endpoint. Deploy the Lambda functions outside a VPC

    View question →

90. Q90. Q690. A company has a nightly batch processing routine that analyzes report files that an on-premises file system receives daily through SFTP. The company wants to move the solution to the AWS Cloud. The solution must be highly available and resilient. The solution also must minimize operational effort.Which solution meets these requirements?Note: AWS certification is more difficult for non-technical personnel, each question needs to spend several minutes to read, reading consumes a lot of time and energy, thus affecting their work, if non-technical personnel have a need for exam shortcuts contact wechat: ANYPASS, we will help you to easily pass (and of course if the technical staff need to contact.

    • A. Deploy AWS Transfer for SFTP and an Amazon Elastic File System (Amazon EFS) file system for storage. Use an Amazon EC2 instance in an Auto Scaling group with a scheduled scaling policy to run the batch operation
    • B. Deploy an Amazon EC2 instance that runs Linux and an SFTP service. Use an Amazon Elastic Block Store (Amazon EBS) volume for storage. Use an Auto Scaling group with the minimum number of instances and desired number of instances set to 1
    • C. Deploy an Amazon EC2 instance that runs Linux and an SFTP service. Use an Amazon Elastic File System (Amazon EFS) file system for storage. Use an Auto Scaling group with the minimum number of instances and desired number of instances set to
    • D. Deploy AWS Transfer for SFTP and an Amazon S3 bucket for storage. Modify the application to pull the batch files from Amazon S3 to an Amazon EC2 instance for processing. Use an EC2 instance in an Auto Scaling group with a scheduled scaling policy to run the batch operation

    View question →

91. Q91. Q691. To meet security requirements,a company needs to encrypt all of its application data in transit while communicating with an Amazon RDS MySQL DB instance.A recent security audit revealed that encryption at rest is enabled using AWS Key Management Service (AWS KMS), but data in transit is not enabled. What should a solutions architect do to satisfy the security requirements?

    • A. Enable IAM database authentication on the database
    • B. Provide self-signed certificates. Use the certificates in all connections to the RDS instance
    • C. Take a snapshot of the RDS instance. Restore the snapshot to a new instance with encryption enabled
    • D. Download AWS-provided root certificates. Provide the certificates in all connections to the RDS instance.

    View question →

92. Q92. Q692. A solutions architect must provide an automated solution for a company's compliance policy that states security groups cannot include a rule that allows SSH from 0.0.0.0/0. The company needs to be notified if there is any breach in the policy. A solution is needed as soon as possible.What should the solutions architect do to meet these requirements with the LEAST operational overhead?

    • A. Write an AWS Lambda script that monitors security groups for SSH being open to 0.0.0.0/0 addresses and creates a notification every time it finds one
    • B. Enable the restricted-ssh AWS Config managed rule and generate an Amazon Simple Notification Service (Amazon SNS) notification when a noncompliant rule is created
    • C. Create an IAM role with permissions to globally open security groups and network ACLs. Create an Amazon Simple Notification Service (Amazon SNS) topic to generate a notification every time the role is assumed by a use
    • D. Configure a service control policy (SCP) that prevents non-administrative users from creating or editing security groups. Create a notification in the ticketing system when a user requests a rule that needs administrator permissions

    View question →

93. Q93. Q693. A company has users all around the world accessing its HTTP-based application deployed on Amazon EC2 instances in multiple AWS Regions.The company wants to improve the availability and performance of the application. The company also wants to protect the application against common web exploits that may affect availability, compromise security, or consume excessive resources. Static IP addresses are required. What should a solutions architect recommend to accomplish this?

    • A. Put the EC2 instances behind Network Load Balancers (NLBs) in each Region. Deploy AWS WAF on the NLBs. Create an accelerator using AWS Global Accelerator and register the NLBs as endpoints
    • B. Put the EC2 instances behind Application Load Balancers (ALBs) in each Region. Deploy AWS WAF on the ALBs. Create an accelerator using AWS Global Accelerator and register the ALBs as endpoints
    • C. Put the EC2 instances behind Network Load Balancers (NLBs) in each Region. Deploy AWS WAF on the NLBs. Create an Amazon CloudFront distribution with an origin that uses Amazon Route latency-based routing to route requests to the NLBs
    • D. Put the EC2 instances behind Application Load Balancers (ALBs) in each Region. Create an Amazon CloudFront distribution with an origin that uses Amazon Route 53 latency-based routing to route requests to the ALBs. Deploy AWS WAF on the CloudFront distribution

    View question →

94. Q94. Q694. A company is designing the architecture for a new mobile app that uses the AWS Cloud. The company uses organizational units (OUs) in AWS Organizations to manage its accounts. The company wants to tag Amazon EC2 instances with data sensitivity by using values of sensitive and nonsensitive. IAM identities must not be able to delete a tag or create instances without a tag.Which combination of steps will meet these requirements? (Select TWO.)

    • A. In Organizations, create a new tag policy that specifies the data sensitivity tag key and the required values. Enforce the tag values for the EC2 instances. Attach the tag policy to the appropriate OU
    • B. In Organizations, create a new service control policy(SCP) that specifies the data sensitivity tag key and the required tag values. Enforce the tag values for the EC2 instances. Attach the SCP to the appropriate OU
    • C. Create a tag policy to deny running instances when a tag key is not specified. Create another tag policy that prevents identities from deleting tags. Attach the tag policies to the appropriate OU
    • D. Create a service control policy(SCP) to deny creating instances when a tag key is not specified. Create another SCP that prevents identities from deleting tags. Attach the SCPs to the appropriate OU
    • E. Create an AWS Config rule to check if EC2 instances use the data sensitivity tag and the specified values. Configure an AWS Lambda function to delete the resource if a noncompliant resource is found

    View question →

95. Q95. Q695. A company sets up an organization in AWS Organizations that contains 10 AWS accounts. A solutions architect must design a solution to provide access to the accounts for several thousand employees. The company has an existing identity provider (IdP). The company wants to use the existing IdP for authentication to AWS.Which solution will meet these requirements?Note: AWS certification is more difficult for non-technical personnel, each question needs to spend several minutes to read, reading consumes a lot of time and energy, thus affecting their work, if non-technical personnel have a need for exam shortcuts contact wechat: ANYPASS, we will help you to easily pass (and of course if the technical staff need to contact.

    • A. Create IAM users for the employees in the required AWS accounts. Connect IAM users to the existing IdP. Configure federated authentication for the IAM users
    • B. Set up AWS account root users with user email addresses and passwords that are synchronized from the existing IdP
    • C. Configure AWS IAM Identity Center (AWS Single Sign-On). Connect IAM Identity Center to the existing IdP. Provision users and groups from the existing IdP
    • D. Use AWS Resource Access Manager (AWS RAM) to share access to the AWS accounts with the users in the existing IdP

    View question →

96. Q96. Q696. A company plans to migrate to AWS and use Amazon EC2 On-Demand Instances for its application. During the migration testing phase, a technical team observes that the application takes a long time to launch and load memory to become fully productive.Which solution will reduce the launch time of the application during the next testing phase?

    • A. Launch two or more EC2 On-Demand Instances. Turn on auto scaling features and make the EC2 On- Demand Instances available during the next testing phase
    • B. Launch EC2 Spot Instances to support the application and to scale the application so it is available during the next testing phase
    • C. Launch the EC2 On-Demand Instances with hibernation turned on. Configure EC2 Auto Scaling warm pools during the next testing phase
    • D. Launch EC2 On-Demand Instances with Capacity Reservations. Start additional EC2 instances during the next testing phase

    View question →

97. Q97. Q697. A city has deployed a web application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The application's users have reported sporadic performance which appears to be related to DDoS attacks originating from random IP addresses. The city needs a solution that requires minimal configuration changes and provides an audit trail for the DDoS sources.Which solution meets these requirements?

    • A. Enable an AWS WAF web ACL on the ALB, and configure rules to block traffic from unknown sources
    • B. Subscribe to Amazon Inspector. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service
    • C. Subscribe to AWS Shield Advanced. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service
    • D. Create an Amazon CloudFront distribution for the application, and set the ALB as the origin. Enable an AWS WAF web ACL on the distribution, and configure rules to block traffic from unknown sources

    View question →

98. Q98. Q698. A marketing team wants to build a campaign for an upcoming multi-sport event. The team has news reports from the past five years in PDF format. The team needs a solution to extract insights about the content and the sentiment of the news reports. The solution must use Amazon Textract to process the news reports.Which solution will meet these requirements with the LEAST operational overhead?

    • A. Provide the extracted insights to Amazon Athena for analysis. Store the extracted insights and analysis in an Amazon S3 bucket
    • B. Store the extracted insights in an Amazon DynamoDB table. Use Amazon SageMaker to build a sentiment model
    • C. Provide the extracted insights to Amazon Comprehend for analysis. Save the analysis to an Amazon S3 bucket
    • D. Store the extracted insights in an Amazon S3 bucket. Use Amazon QuickSight to visualize and analyze the data

    View question →

99. Q99. Q699. A company has an application that uses an Amazon DynamoDB table for storage. A solutions architect discovers that many requests to the table are not returning the latest data The company's users have not reported any other issues with database performance. Latency is in an acceptable range.Which design change should the solutions architect recommend?

    • A. Add read replicas to the table
    • B. Use a global secondary index(GSl)
    • C. Request strongly consistent reads for the table
    • D. Request eventually consistent reads for the table

    View question →

100. Q100. Q700. A company's website is used to sell products to the public. The site runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). There is also an Amazon CloudFront distribution and AWS WAF is being used to protect against SQL injection attacks. The ALB is the origin for the CloudFront distribution. A recent review of security logs revealed an external malicious IP that needs to be blocked from accessing the website. What should a solutions architect do to protect the application?Note: AWS certification is more difficult for non-technical personnel, each question needs to spend several minutes to read, reading consumes a lot of time and energy, thus affecting their work, if non-technical personnel have a need for exam shortcuts contact wechat: ANYPASS, we will help you to easily pass (and of course if the technical staff need to contact.

     • A. Modify the network ACL on the CloudFront distribution to add a deny rule for the malicious IP address
     • B. Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address
     • C. Modify the network ACL for the EC2 instances in the target groups behind the ALB to deny the malicious IP address
     • D. Modify the security groups for the EC2 instances in the target groups behind the ALB to deny the malicious IP address

     View question →