Q1001. A company is building an application in the AWS Cloud. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 for the DNS.The company needs a managed solution with proactive engagement to detect against DDoS attacks.Which solution will meet these requirements?

D. Subscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources.

A. Enable AWS Config. Configure an AWS Config managed rule that detects DDoS attacks.

B. Enable AWS WAF on the ALCreate an AWS WAF web ACL with rules to detect and prevent DDoS attacks. Associate the web ACL with the ALB.

C. Store the ALB access logs in an Amazon S3 bucket. Configure Amazon GuardDuty to detect and take automated preventative actions for DDoS attacks.

D. Subscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources.

Q1002. A healthcare company is developing an AWS Lambda function that publishes notifications to an encrypted Amazon Simple Notification Service (Amazon SNS) topic. The notifications contain protected health information (PHI).The SNS topic uses AWS Key Management Service (AWS KMS) customer managed keys for encryption. The company must ensure that the application has the necessary permissions to publish messages securely to the SNS topic.Which combination of steps will meet these requirements? (Choose three.)

A. Create a resource policy for the SNS topic that allows the Lambda function to publish messages to the topic.

C. Create a resource policy for the encryption key that the SNS topic uses that has the necessary AWS KMS permissions.

F. Configure a Lambda execution role that has the necessary IAM permissions to use a customer managed key in AWS KMS.

A. Create a resource policy for the SNS topic that allows the Lambda function to publish messages to the topic.

B. Use server-side encryption with AWS KMS keys (SSE-KMS) for the SNS topic instead of customer managed keys.

C. Create a resource policy for the encryption key that the SNS topic uses that has the necessary AWS KMS permissions.

D. Specify the Lambda function's Amazon Resource Name (ARN) in the SNS topic's resource policy.

E. Associate an Amazon API Gateway HTTP API with the SNS topic to control access to the topic by using API Gateway resource policies.

F. Configure a Lambda execution role that has the necessary IAM permissions to use a customer managed key in AWS KMS.

Q1003. A media company has a multi-account AWS environment in the us-east-1 Region. The company has an Amazon Simple Notification Service (Amazon SNS) topic in a production account that publishes performance metrics. The company has an AWS Lambda function in an administrator account to process and analyze log data.The Lambda function that is in the administrator account must be invoked by messages from the SNS topic that is in the production account when significant metrics are reported.Which combination of steps will meet these requirements? (Choose two.)

A. Create an IAM resource policy for the Lambda function that allows Amazon SNS to invoke the function.

C. Create an IAM policy for the SNS topic that allows the Lambda function to subscribe to the topic.

A. Create an IAM resource policy for the Lambda function that allows Amazon SNS to invoke the function.

B. Implement an Amazon Simple Queue Service (Amazon SQS) queue in the administrator account to buffer messages from the SNS topic that is in the production account. Configure the SQS queue to invoke the Lambda function.

C. Create an IAM policy for the SNS topic that allows the Lambda function to subscribe to the topic.

D. Use an Amazon EventBridge rule in the production account to capture the SNS topic notifications.Configure the EventBridge rule to forward notifications to the Lambda function that is in the administrator account.

E. Store performance metrics in an Amazon S3 bucket in the production account. Use Amazon Athena to analyze the metrics from the administrator account.

Q1004. A company hosts an ecommerce application that stores all data in a single Amazon RDS for MySQL DB instance that is fully managed by AWS. The company needs to mitigate the risk of a single point of failure.Which solution will meet these requirements with the LEAST implementation effort?

A. Modify the RDS DB instance to use a Multi-AZ deployment. Apply the changes during the next maintenance window.

B. Migrate the current database to a new Amazon DynamoDB Multi-AZ deployment. Use AWS Database Migration Service (AWS DMS) with a heterogeneous migration strategy to migrate the current RDS DB instance to DynamoDB tables.

C. Create a new RDS DB instance in a Multi-AZ deployment. Manually restore the data from the existing RDS DB instance from the most recent snapshot.

D. Configure the DB instance in an Amazon EC2 Auto Scaling group with a minimum group size of three.Use Amazon Route 53 simple routing to distribute requests to all DB instances.

Q1005. A company has multiple Microsoft Windows SMB file servers and Linux NFS file servers for file sharing in an on-premises environment. As part of the company's AWS migration plan, the company wants to consolidate the file servers in the AWS Cloud.The company needs a managed AWS storage service that supports both NFS and SMB access. The solution must be able to share between protocols. The solution must have redundancy at the Availability Zone level.Which solution will meet these requirements?

A. Use Amazon FSx for NetApp ONTAP for storage. Configure multi-protocol access.

B. Create two Amazon EC2 instances. Use one EC2 instance for Windows SMB file server access and one EC2 instance for Linux NFS file server access.

C. Use Amazon FSx for NetApp ONTAP for SMB access. Use Amazon FSx for Lustre for NFS access.

D. Use Amazon S3 storage. Access Amazon S3 through an Amazon S3 File Gateway.

Q1006. A software company needs to upgrade a critical web application. The application currently runs on a single Amazon EC2 instance that the company hosts in a public subnet. The EC2 instance runs a MySQL database. The application's DNS records are published in an Amazon Route 53 zone.A solutions architect must reconfigure the application to be scalable and highly available. The solutions architect must also reduce MySQL read latency.Which combination of solutions will meet these requirements? (Choose two.)

B. Create and configure an Auto Scaling group to launch private EC2 instances in multiple Availability Zones. Add the instances to a target group behind a new Application Load Balancer.

C. Migrate the database to an Amazon Aurora MySQL cluster. Create the primary DB instance and reader DB instance in separate Availability Zones.

A. Launch a second EC2 instance in a second AWS Region. Use a Route 53 failover routing policy to redirect the traffic to the second EC2 instance.

B. Create and configure an Auto Scaling group to launch private EC2 instances in multiple Availability Zones. Add the instances to a target group behind a new Application Load Balancer.

C. Migrate the database to an Amazon Aurora MySQL cluster. Create the primary DB instance and reader DB instance in separate Availability Zones.

D. Create and configure an Auto Scaling group to launch private EC2 instances in multiple AWS Regions.Add the instances to a target group behind a new Application Load Balancer.

E. Migrate the database to an Amazon Aurora MySQL cluster with cross-Region read replicas.

Q1007. A company runs thousands of AWS Lambda functions. The company needs a solution to securely store sensitive information that all the Lambda functions use. The solution must also manage the automatic rotation of the sensitive information.Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)

C. Store sensitive information in AWS Secrets Manager

D. Store sensitive information in AWS Systems Manager Parameter Store

A. Create HTTP security headers by using Lambda@Edge to retrieve and create sensitive information

B. Create a Lambda layer that retrieves sensitive information

C. Store sensitive information in AWS Secrets Manager

D. Store sensitive information in AWS Systems Manager Parameter Store

E. Create a Lambda consumer with dedicated throughput to retrieve sensitive information and create environmental variables

Q1008. A company has an internal application that runs on Amazon EC2 instances in an Auto Scaling group. The EC2 instances are compute optimized and use Amazon Elastic Block Store (Amazon EBS) volumes.The company wants to identify cost optimizations across the EC2 instances, the Auto Scaling group, and the EBS volumes.Which solution will meet these requirements with the MOST operational efficiency?

C. Configure AWS Compute Optimizer for cost recommendations for the EC2 instances, the Auto Scaling group and the EBS volumes.

A. Create a new AWS Cost and Usage Report. Search the report for cost recommendations for the EC2 instances the Auto Scaling group, and the EBS volumes.

B. Create new Amazon CloudWatch billing alerts. Check the alert statuses for cost recommendations for the EC2 instances, the Auto Scaling group, and the EBS volumes.

C. Configure AWS Compute Optimizer for cost recommendations for the EC2 instances, the Auto Scaling group and the EBS volumes.

D. Configure AWS Compute Optimizer for cost recommendations for the EC2 instances. Create a new AWS Cost and Usage Report. Search the report for cost recommendations for the Auto Scaling group and the EBS volumes.

Q1009. A company uses an Amazon RDS for MySQL instance. To prepare for end-of-year processing, the company added a read replica to accommodate extra read-only queries from the company's reporting tool. The read replica CPU usage was 60% and the primary instance CPU usage was 60%.After end-of-year activities are complete, the read replica has a constant 25% CPU usage. The primary instance still has a constant 60% CPU usage. The company wants to rightsize the database and still provide enough performance for future growth.Which solution will meet these requirements?

B. Resize the read replica to a smaller instance size Do not make changes to the primary instance

A. Delete the read replica Do not make changes to the primary instance

B. Resize the read replica to a smaller instance size Do not make changes to the primary instance

C. Resize the read replica to a larger instance size Resize the primary instance to a smaller instance size

D. Delete the read replica Resize the primary instance to a larger instance

Q1010. A company is migrating its databases to Amazon RDS for PostgreSQL. The company is migrating its applications to Amazon EC2 instances. The company wants to optimize costs for long-running workloads.Which solution will meet this requirement MOST cost-effectively?

D. Purchase Reserved Instances for a 3 year term with the All Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 3 year EC2 Instance Savings Plan with the All Upfront option for the EC2 instances.

A. Use On-Demand Instances for the Amazon RDS for PostgreSQL workloads. Purchase a 1 year Compute Savings Plan with the No Upfront option for the EC2 instances.

B. Purchase Reserved Instances for a 1 year term with the No Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 1 year EC2 Instance Savings Plan with the No Upfront option for the EC2 instances.

C. Purchase Reserved Instances for a 1 year term with the Partial Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 1 year EC2 Instance Savings Plan with the Partial Upfront option for the EC2 instances.

D. Purchase Reserved Instances for a 3 year term with the All Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 3 year EC2 Instance Savings Plan with the All Upfront option for the EC2 instances.

AWS SAA-C03 Chapter 14 Free Practice Test 2025 — Solutions Architect Associate Exam Questions

AWS SAA-C03 Chapter 14 Practice Questions (100 Questions)

Practice questions for the AWS SAA-C03 (Solutions Architect Associate) exam, Chapter 14.

Q1. Q1001. A company is building an application in the AWS Cloud. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 for the DNS.The company needs a managed solution with proactive engagement to detect against DDoS attacks.Which solution will meet these requirements?
- A. Enable AWS Config. Configure an AWS Config managed rule that detects DDoS attacks.
- B. Enable AWS WAF on the ALCreate an AWS WAF web ACL with rules to detect and prevent DDoS attacks. Associate the web ACL with the ALB.
- C. Store the ALB access logs in an Amazon S3 bucket. Configure Amazon GuardDuty to detect and take automated preventative actions for DDoS attacks.
- D. Subscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources.
View question →
Q2. Q1002. A healthcare company is developing an AWS Lambda function that publishes notifications to an encrypted Amazon Simple Notification Service (Amazon SNS) topic. The notifications contain protected health information (PHI).The SNS topic uses AWS Key Management Service (AWS KMS) customer managed keys for encryption. The company must ensure that the application has the necessary permissions to publish messages securely to the SNS topic.Which combination of steps will meet these requirements? (Choose three.)
- A. Create a resource policy for the SNS topic that allows the Lambda function to publish messages to the topic.
- B. Use server-side encryption with AWS KMS keys (SSE-KMS) for the SNS topic instead of customer managed keys.
- C. Create a resource policy for the encryption key that the SNS topic uses that has the necessary AWS KMS permissions.
- D. Specify the Lambda function's Amazon Resource Name (ARN) in the SNS topic's resource policy.
- E. Associate an Amazon API Gateway HTTP API with the SNS topic to control access to the topic by using API Gateway resource policies.
- F. Configure a Lambda execution role that has the necessary IAM permissions to use a customer managed key in AWS KMS.
View question →
Q3. Q1003. A media company has a multi-account AWS environment in the us-east-1 Region. The company has an Amazon Simple Notification Service (Amazon SNS) topic in a production account that publishes performance metrics. The company has an AWS Lambda function in an administrator account to process and analyze log data.The Lambda function that is in the administrator account must be invoked by messages from the SNS topic that is in the production account when significant metrics are reported.Which combination of steps will meet these requirements? (Choose two.)
- A. Create an IAM resource policy for the Lambda function that allows Amazon SNS to invoke the function.
- B. Implement an Amazon Simple Queue Service (Amazon SQS) queue in the administrator account to buffer messages from the SNS topic that is in the production account. Configure the SQS queue to invoke the Lambda function.
- C. Create an IAM policy for the SNS topic that allows the Lambda function to subscribe to the topic.
- D. Use an Amazon EventBridge rule in the production account to capture the SNS topic notifications.Configure the EventBridge rule to forward notifications to the Lambda function that is in the administrator account.
- E. Store performance metrics in an Amazon S3 bucket in the production account. Use Amazon Athena to analyze the metrics from the administrator account.
View question →
Q4. Q1004. A company hosts an ecommerce application that stores all data in a single Amazon RDS for MySQL DB instance that is fully managed by AWS. The company needs to mitigate the risk of a single point of failure.Which solution will meet these requirements with the LEAST implementation effort?
- A. Modify the RDS DB instance to use a Multi-AZ deployment. Apply the changes during the next maintenance window.
- B. Migrate the current database to a new Amazon DynamoDB Multi-AZ deployment. Use AWS Database Migration Service (AWS DMS) with a heterogeneous migration strategy to migrate the current RDS DB instance to DynamoDB tables.
- C. Create a new RDS DB instance in a Multi-AZ deployment. Manually restore the data from the existing RDS DB instance from the most recent snapshot.
- D. Configure the DB instance in an Amazon EC2 Auto Scaling group with a minimum group size of three.Use Amazon Route 53 simple routing to distribute requests to all DB instances.
View question →
Q5. Q1005. A company has multiple Microsoft Windows SMB file servers and Linux NFS file servers for file sharing in an on-premises environment. As part of the company's AWS migration plan, the company wants to consolidate the file servers in the AWS Cloud.The company needs a managed AWS storage service that supports both NFS and SMB access. The solution must be able to share between protocols. The solution must have redundancy at the Availability Zone level.Which solution will meet these requirements?
- A. Use Amazon FSx for NetApp ONTAP for storage. Configure multi-protocol access.
- B. Create two Amazon EC2 instances. Use one EC2 instance for Windows SMB file server access and one EC2 instance for Linux NFS file server access.
- C. Use Amazon FSx for NetApp ONTAP for SMB access. Use Amazon FSx for Lustre for NFS access.
- D. Use Amazon S3 storage. Access Amazon S3 through an Amazon S3 File Gateway.
View question →
Q6. Q1006. A software company needs to upgrade a critical web application. The application currently runs on a single Amazon EC2 instance that the company hosts in a public subnet. The EC2 instance runs a MySQL database. The application's DNS records are published in an Amazon Route 53 zone.A solutions architect must reconfigure the application to be scalable and highly available. The solutions architect must also reduce MySQL read latency.Which combination of solutions will meet these requirements? (Choose two.)
- A. Launch a second EC2 instance in a second AWS Region. Use a Route 53 failover routing policy to redirect the traffic to the second EC2 instance.
- B. Create and configure an Auto Scaling group to launch private EC2 instances in multiple Availability Zones. Add the instances to a target group behind a new Application Load Balancer.
- C. Migrate the database to an Amazon Aurora MySQL cluster. Create the primary DB instance and reader DB instance in separate Availability Zones.
- D. Create and configure an Auto Scaling group to launch private EC2 instances in multiple AWS Regions.Add the instances to a target group behind a new Application Load Balancer.
- E. Migrate the database to an Amazon Aurora MySQL cluster with cross-Region read replicas.
View question →
Q7. Q1007. A company runs thousands of AWS Lambda functions. The company needs a solution to securely store sensitive information that all the Lambda functions use. The solution must also manage the automatic rotation of the sensitive information.Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
- A. Create HTTP security headers by using Lambda@Edge to retrieve and create sensitive information
- B. Create a Lambda layer that retrieves sensitive information
- C. Store sensitive information in AWS Secrets Manager
- D. Store sensitive information in AWS Systems Manager Parameter Store
- E. Create a Lambda consumer with dedicated throughput to retrieve sensitive information and create environmental variables
View question →
Q8. Q1008. A company has an internal application that runs on Amazon EC2 instances in an Auto Scaling group. The EC2 instances are compute optimized and use Amazon Elastic Block Store (Amazon EBS) volumes.The company wants to identify cost optimizations across the EC2 instances, the Auto Scaling group, and the EBS volumes.Which solution will meet these requirements with the MOST operational efficiency?
- A. Create a new AWS Cost and Usage Report. Search the report for cost recommendations for the EC2 instances the Auto Scaling group, and the EBS volumes.
- B. Create new Amazon CloudWatch billing alerts. Check the alert statuses for cost recommendations for the EC2 instances, the Auto Scaling group, and the EBS volumes.
- C. Configure AWS Compute Optimizer for cost recommendations for the EC2 instances, the Auto Scaling group and the EBS volumes.
- D. Configure AWS Compute Optimizer for cost recommendations for the EC2 instances. Create a new AWS Cost and Usage Report. Search the report for cost recommendations for the Auto Scaling group and the EBS volumes.
View question →
Q9. Q1009. A company uses an Amazon RDS for MySQL instance. To prepare for end-of-year processing, the company added a read replica to accommodate extra read-only queries from the company's reporting tool. The read replica CPU usage was 60% and the primary instance CPU usage was 60%.After end-of-year activities are complete, the read replica has a constant 25% CPU usage. The primary instance still has a constant 60% CPU usage. The company wants to rightsize the database and still provide enough performance for future growth.Which solution will meet these requirements?
- A. Delete the read replica Do not make changes to the primary instance
- B. Resize the read replica to a smaller instance size Do not make changes to the primary instance
- C. Resize the read replica to a larger instance size Resize the primary instance to a smaller instance size
- D. Delete the read replica Resize the primary instance to a larger instance
View question →
Q10. Q1010. A company is migrating its databases to Amazon RDS for PostgreSQL. The company is migrating its applications to Amazon EC2 instances. The company wants to optimize costs for long-running workloads.Which solution will meet this requirement MOST cost-effectively?
- A. Use On-Demand Instances for the Amazon RDS for PostgreSQL workloads. Purchase a 1 year Compute Savings Plan with the No Upfront option for the EC2 instances.
- B. Purchase Reserved Instances for a 1 year term with the No Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 1 year EC2 Instance Savings Plan with the No Upfront option for the EC2 instances.
- C. Purchase Reserved Instances for a 1 year term with the Partial Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 1 year EC2 Instance Savings Plan with the Partial Upfront option for the EC2 instances.
- D. Purchase Reserved Instances for a 3 year term with the All Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 3 year EC2 Instance Savings Plan with the All Upfront option for the EC2 instances.
View question →
Q11. Q1011. A company is using an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The company must ensure that Kubernetes service accounts in the EKS cluster have secure and granular access to specific AWS resources by using IAM roles for service accounts (IRSA).Which combination of solutions will meet these requirements? (Choose two.)
- A. Create an IAM policy that defines the required permissions Attach the policy directly to the IAM role of the EKS nodes.
- B. Implement network policies within the EKS cluster to prevent Kubernetes service accounts from accessing specific AWS services.
- C. Modify the EKS cluster's IAM role to include permissions for each Kubernetes service account. Ensure a one-to-one mapping between IAM roles and Kubernetes roles.
- D. Define an IAM role that includes the necessary permissions. Annotate the Kubernetes service accounts with the Amazon ResourceName (ARN) of the IAM role.
- E. Set up a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider.
View question →
Q12. Q1012. A company regularly uploads confidential data to Amazon S3 buckets for analysis.The company's security policies mandate that the objects must be encrypted at rest. The company must automatically rotate the encryption key every year. The company must be able to track key rotation by using AWS CloudTrail. The company also must minimize costs for the encryption key.Which solution will meet these requirements?
- A. Use server-side encryption with customer-provided keys (SSE-C)
- B. Use server-side encryption with Amazon S3 managed keys (SSE-S3)
- C. Use server-side encryption with AWS KMS keys (SSE-KMS)
- D. Use server-side encryption with customer managed AWS KMS keys
View question →
Q13. Q1013. An ecommerce company is preparing to deploy a web application on AWS to ensure continuous service for customers. The architecture includes a web application that the company hosts on Amazon EC2 instances, a relational database in Amazon RDS, and static assets that the company stores in Amazon S3.The company wants to design a robust and resilient architecture for the application.Which solution will meet these requirements?
- A. Deploy Amazon EC2 instances in a single Availability Zone. Deploy an RDS DB instance in the same Availability Zone. Use Amazon S3 with versioning enabled to store static assets.
- B. Deploy Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones. Deploy a Multi-AZ RDS DB instance. Use Amazon CloudFront to distribute static assets.
- C. Deploy Amazon EC2 instances in a single Availability Zone. Deploy an RDS DB instance in a second Availability Zone for cross-AZ redundancy. Serve static assets directly from the EC2 instances.
- D. Use AWS Lambda functions to serve the web application. Use Amazon Aurora Serverless v2 for the database. Store static assets in Amazon Elastic File System (Amazon EFS) One Zone-Infrequent Access (One Zone-IA).
View question →
Q14. Q1014. A company runs its production workload on an Amazon Aurora MySQL DB cluster that includes six Aurora Replicas. The company wants near-real-time reporting queries from one of its departments to be automatically distributed across three of the Aurora Replicas. Those three replicas have a different compute and memory specification from the rest of the DB cluster.Which solution meets these requirements?
- A. Create and use a custom endpoint for the workload
- B. Create a three-node cluster clone and use the reader endpoint
- C. Use any of the instance endpoints for the selected three nodes
- D. Use the reader endpoint to automatically distribute the read-only workload
View question →
Q15. Q1015. A company runs a Node js function on a server in its on-premises data center. The data center stores data in a PostgreSQL database. The company stores the credentials in a connection string in an environment variable on the server. The company wants to migrate its application to AWS and to replace the Node.js application server with AWS Lambda. The company also wants to migrate to Amazon RDS for PostgreSQL and to ensure that the database credentials are securely managed.Which solution will meet these requirements with the LEAST operational overhead?
- A. Store the database credentials as a parameter in AWS Systems Manager Parameter Store Configure Parameter Store to automatically rotate the secrets every 30 days. Update the Lambda function to retrieve the credentials from the parameter.
- B. Store the database credentials as a secret in AWS Secrets Manager. Configure Secrets Manager to automatically rotate the credentials every 30 days. Update the Lambda function to retrieve the credentials from the secret.
- C. Store the database credentials as an encrypted Lambda environment variable. Write a custom Lambda function to rotate the credentials. Schedule the Lambda function to run every 30 days.
- D. Store the database credentials as a key in AWS Key Management Service (AWS KMS). Configure automatic rotation for the key. Update the Lambda function to retneve the credentials from the KMS key.
View question →
Q16. Q1016. A company has a custom application with embedded credentials that retrieves information from a database in an Amazon RDS for MySQL DB cluster. The company needs to make the application more secure with minimal programming effort. The company has created credentials on the RDS for MySQL database for the application user.Which solution will meet these requirements?
- A. Store the credentials in AWS Key Management Service (AWS KMS). Create keys in AWS KMS.Configure the application to load the database credentials from AWS KMS. Enable automatic key rotation
- B. Store the credentials in encrypted local storage. Configure the application to load the database credentials from the local storage. Set up a credentials rotation schedule by creating a cron job.
- C. Store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Set up a credentials rotation schedule by creating an AWS Lambda function for Secrets Manager.
- D. Store the credentials in AWS Systems Manager Parameter Store. Configure the application to load the database credentials from Parameter Store. Set up a credentials rotation schedule in the RDS for MySQL database by using Parameter Store.
View question →
Q17. Q1017. A company wants to move its application to a serverless solution. The serverless solution needs to analyze existing data and new data by using SQL. The company stores the data in an Amazon S3 bucket. The data must be encrypted at rest and replicated to a different AWS Region.Which solution will meet these requirements with the LEAST operational overhead?
- A. Create a new S3 bucket that uses server-side encryption with AWS KMS multi-Region keys (SSE- KMS). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon Athena to query the data.
- B. Create a new S3 bucket that uses server-side encryption with Amazon S3 managed keys (SSE-S3).Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon RDS to query the data.
- C. Configure Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3). Use Amazon Athena to query the data.
- D. Configure S3 Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use Amazon RDS to query the data.
View question →
Q18. Q1018. A company has a web application that has thousands of users. The application uses 8-10 user-uploaded images to generate AI images. Users can download the generated AI images once every 6 hours. The company also has a premium user option that gives users the ability to download the generated AI images anytime.The company uses the user-uploaded images to run AI model training twice a year. The company needs a storage solution to store the images.Which storage solution meets these requirements MOST cost-effectively?
- A. Move uploaded images to Amazon S3 Glacier Deep Archive. Move premium user-generated AI images to S3 Standard. Move non-premium user-generated AI images to S3 Standard-Infrequent Access (S3 Standard-IA).
- B. Move uploaded images to Amazon S3 Glacier Deep Archive Move all generated AI images to S3 Glacier Flexible Retrieval.
- C. Move uploaded images to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA). Move premium user-generated AI images to S3 Standard. Move non-premium user-generated AI images to S3 Standard-Infrequent Access (S3 Standard-IA).
- D. Move uploaded images to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA). Move all generated AI images to S3 Glacier Flexible Retrieval.
View question →
Q19. Q1019. A company is developing machine learning (ML) models on AWS. The company is developing the ML models as independent microservices. The microservices fetch approximately 1 GB of model data from Amazon S3 at startup and load the data into memory. Users access the ML models through an asynchronous API. Users can send a request or a batch of requests.The company provides the ML models to hundreds of users. The usage patterns for the models are irregular. Some models are not used for days or weeks. Other models receive batches of thousands of requests at a time.Which solution will meet these requirements?
- A. Direct the requests from the API to a Network Load Balancer (NLB). Deploy the ML models as AWS Lambda functions that the NLB will invoke. Use auto scaling to scale the Lambda functions based on the traffic that the NLB receives.
- B. Direct the requests from the API to an Application Load Balancer (ALB). Deploy the ML models as Amazon Elastic Container Service (Amazon ECS) services that the ALB will invoke. Use auto scaling to scale the ECS cluster instances based on the traffic that the ALB receives.
- C. Direct the requests from the API into an Amazon Simple Queue Service (Amazon SQS) queue. Deploy the ML models as AWS Lambda functions that SQS events will invoke. Use auto scaling to increase the number of vCPUs for the Lambda functions based on the size of the SQS queue.
- D. Direct the requests from the API into an Amazon Simple Queue Service (Amazon SQS) queue. Deploy the ML models as Amazon Elastic Container Service (Amazon ECS) services that read from the queue.Use auto scaling for Amazon ECS to scale both the cluster capacity and number of the services based on the size of the SQS queue.
View question →
Q20. Q1020. A company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application stores data in an Amazon Aurora MySQL DB cluster.The company needs to create a disaster recovery (DR) solution. The acceptable recovery time for the DR solution is up to 30 minutes. The DR solution does not need to support customer usage when the primary infrastructure is healthy.Which solution will meet these requirements?
- A. Deploy the DR infrastructure in a second AWS Region with an ALB and an Auto Scaling group. Set the desired capacity and maximum capacity of the Auto Scaling group to a minimum value. Convert the Aurora MySQL DB cluster to an Aurora global database. Configure Amazon Route 53 for an active- passive failover with ALB endpoints.
- B. Deploy the DR infrastructure in a second AWS Region with an ALUpdate the Auto Scaling group to include EC2 instances from the second Region. Use Amazon Route 53 to configure active-active failover. Convert the Aurora MySQL DB cluster to an Aurora global database.
- C. Back up the Aurora MySQL DB cluster data by using AWS Backup. Deploy the DR infrastructure in a second AWS Region with an ALB. Update the Auto Scaling group to include EC2 instances from the second Region. Use Amazon Route 53 to configure active-active failover. Create an Aurora MySQL DB cluster in the second Region Restore the data from the backup.
- D. Back up the infrastructure configuration by using AWS Backup. Use the backup to create the required infrastructure in a second AWS Region. Set the Auto Scaling group desired capacity to zero. Use Amazon Route 53 to configure active-passive failover. Convert the Aurora MySQL DB cluster to an Aurora global database.
View question →
Q21. Q1021. A company is migrating its data processing application to the AWS Cloud. The application processes several short-lived batch jobs that cannot be disrupted. Data is generated after each batch job is completed. The data is accessed for 30 days and retained for 2 years.The company wants to keep the cost of running the application in the AWS Cloud as low as possible.Which solution will meet these requirements?
- A. Migrate the data processing application to Amazon EC2 Spot Instances. Store the data in Amazon S3 Standard. Move the data to Amazon S3 Glacier Instant. Retrieval after 30 days. Set an expiration to delete the data after 2 years.
- B. Migrate the data processing application to Amazon EC2 On-Demand Instances. Store the data in Amazon S3 Glacier Instant Retrieval. Move the data to S3 Glacier Deep Archive after 30 days. Set an expiration to delete the data after 2 years.
- C. Deploy Amazon EC2 Spot Instances to run the batch jobs. Store the data in Amazon S3 Standard. Move the data to Amazon S3 Glacier Flexible Retrieval after 30 days. Set an expiration to delete the data after 2 years.
- D. Deploy Amazon EC2 On-Demand Instances to run the batch jobs. Store the data in Amazon S3 Standard. Move the data to Amazon S3 Glacier Deep Archive after 30 days. Set an expiration to delete the data after 2 years.
View question →
Q22. Q1022. A company needs to design a hybrid network architecture. The company's workloads are currently stored in the AWS Cloud and in on-premises data centers. The workloads require single-digit latencies to communicate. The company uses an AWS Transit Gateway transit gateway to connect multiple VPCs.Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
- A. Establish an AWS Site-to-Site VPN connection to each VPC.
- B. Associate an AWS Direct Connect gateway with the transit gateway that is attached to the VPCs.
- C. Establish an AWS Site-to-Site VPN connection to an AWS Direct Connect gateway.
- D. Establish an AWS Direct Connect connection. Create a transit virtual interface (VIF) to a Direct Connect gateway.
- E. Associate AWS Site-to-Site VPN connections with the transit gateway that is attached to the VPCs.
View question →
Q23. Q1023. A global ecommerce company runs its critical workloads on AWS. The workloads use an Amazon RDS for PostgreSQL DB instance that is configured for a Multi-AZ deployment. Customers have reported application timeouts when the company undergoes database failovers. The company needs a resilient solution to reduce failover time.Which solution will meet these requirements?
- A. Create an Amazon RDS Proxy. Assign the proxy to the DB instance.
- B. Create a read replica for the DB instance. Move the read traffic to the read replica.
- C. Enable Performance Insights. Monitor the CPU load to identify the timeouts.
- D. Take regular automatic snapshots. Copy the automatic snapshots to multiple AWS Regions.
View question →
Q24. Q1024. A company has multiple Amazon RDS DB instances that run in a development AWS account. All the instances have tags to identify them as development resources. The company needs the development DB instances to run on a schedule only during business hours.Which solution will meet these requirements with the LEAST operational overhead?
- A. Create an Amazon CloudWatch alarm to identify RDS instances that need to be stopped. Create an AWS Lambda function to start and stop the RDS instances.
- B. Create an AWS Trusted Advisor report to identify RDS instances to be started and stopped. Create an AWS Lambda function to start and stop the RDS instances.
- C. Create AWS Systems Manager State Manager associations to start and stop the RDS instances.
- D. Create an Amazon EventBridge rule that invokes AWS Lambda functions to start and stop the RDS instances.
View question →
Q25. Q1025. A consumer survey company has gathered data for several years from a specific geographic region. The company stores this data in an Amazon S3 bucket in an AWS Region.The company has started to share this data with a marketing firm in a new geographic region. The company has granted the firm's AWS account access to the S3 bucket. The company wants to minimize the data transfer costs when the marketing firm requests data from the S3 bucket.Which solution will meet these requirements?
- A. Configure the Requester Pays feature on the company's S3 bucket.
- B. Configure S3 Cross-Region Replication (CRR) from the company's S3 bucket to one of the marketing firm's S3 buckets.
- C. Configure AWS Resource Access Manager to share the S3 bucket with the marketing firm AWS account.
- D. Configure the company's S3 bucket to use S3 Intelligent-Tiering Sync the S3 bucket to one of the marketing firm's S3 buckets.
View question →
Q26. Q1026. A company uses AWS to host its public ecommerce website. The website uses an AWS Global Accelerator accelerator for traffic from the internet. The Global Accelerator accelerator forwards the traffic to an Application Load Balancer (ALB) that is the entry point for an Auto Scaling group.The company recently identified a DDoS attack on the website. The company needs a solution to mitigate future attacks.Which solution will meet these requirements with the LEAST implementation effort?
- A. Configure an AWS WAF web ACL for the Global Accelerator accelerator to block traffic by using rate- based rules
- B. Configure an AWS Lambda function to read the ALB metrics to block attacks by updating a VPC network ACL
- C. Configure an AWS WAF web ACL on the ALB to block traffic by using rate-based rules
- D. Configure an Amazon CloudFront distribution in front of the Global Accelerator accelerator
View question →
Q27. Q1027. A solutions architect is designing the cloud architecture for a new stateless application that will be deployed on AWS. The solutions architect created an Amazon Machine Image (AMI) and launch template for the application.Based on the number of jobs that need to be processed, the processing must run in parallel while adding and removing application Amazon EC2 instances as needed. The application must be loosely coupled. The job items must be durably stored.Which solution will meet these requirements?
- A. Create an Amazon Simple Notification Service (Amazon SNS) topic to send the jobs that need to be processed. Create an Auto Scaling group by using the launch template with the scaling policy set to add and remove EC2 instances based on CPU usage.
- B. Create an Amazon Simple Queue Service (Amazon SQS) queue to hold the jobs that need to be processed. Create an Auto Scaling group by using the launch template with the scaling policy set to add and remove EC2 instances based on network usage.
- C. Create an Amazon Simple Queue Service (Amazon SQS) queue to hold the jobs that need to be processed. Create an Auto Scaling group by using the launch template with the scaling policy set to add and remove EC2 instances based on the number of items in the SQS queue.
- D. Create an Amazon Simple Notification Service (Amazon SNS) topic to send the jobs that need to be processed. Create an Auto Scaling group by using the launch template with the scaling policy set to add and remove EC2 instances based on the number of messages published to the SNS topic.
View question →
Q28. Q1028. A global ecommerce company uses a monolithic architecture. The company needs a solution to manage the increasing volume of product data. The solution must be scalable and have a modular service architecture. The company needs to maintain its structured database schemas. The company also needs a storage solution to store product data and product images.Which solution will meet these requirements with the LEAST operational overhead?
- A. Use an Amazon EC2 instance in an Auto Scaling group to deploy a containerized application. Use an Application Load Balancer to distribute web traffic. Use an Amazon RDS DB instance to store product data and product images.
- B. Use AWS Lambda functions to manage the existing monolithic application. Use Amazon DynamoDB to store product data and product images. Use Amazon Simple Notification Service (Amazon SNS) for event-driven communication between the Lambda functions.
- C. Use Amazon Elastic Kubernetes Service (Amazon EKS) with an Amazon EC2 deployment to deploy a containerized application. Use an Amazon Aurora cluster to store the product data. Use AWS Step Functions to manage workflows. Store the product images in Amazon S3 Glacier Deep Archive.
- D. Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate to deploy a containerized application. Use Amazon RDS with a Multi-AZ deployment to store the product data. Store the product images in an Amazon S3 bucket.
View question →
Q29. Q1029. A company is migrating an application from an on-premises environment to AWS. The application will store sensitive data in Amazon S3. The company must encrypt the data before storing the data in Amazon S3.Which solution will meet these requirements?
- A. Encrypt the data by using client-side encryption with customer managed keys.
- B. Encrypt the data by using server-side encryption with AWS KMS keys (SSE-KMS).
- C. Encrypt the data by using server-side encryption with customer-provided keys (SSE-C).
- D. Encrypt the data by using client-side encryption with Amazon S3 managed keys.
View question →
Q30. Q1030. A company wants to create an Amazon EMR cluster that multiple teams will use. The company wants to ensure that each team big data workloads can access only the AWS services that each team needs to interact with. The company does not want the workloads to have access to Instance Metadata Service Version 2 (IMDSv2) on the cluster underlying EC2 instances.Which solution will meet these requirements?
- A. Configure interface VPC endpoints for each AWS service that the teams need. Use the required interface VPC endpoints to submit the big data workloads.
- B. Create EMR runtime roles. Configure the cluster to use the runtime roles. Use the runtime roles to submit the big data workloads.
- C. Create an EC2 IAM instance profile that has the required permissions for each team. Use the instance profile to submit the big data workloads.
- D. Create an EMR security configuration that has the EnableApplicationScopedIAMRole option set to false.Use the security configuration to submit the big data workloads.
View question →
Q31. Q1031. A solutions architect is designing an application that helps users fill out and submit registration forms. The solutions architect plans to use a two-tier architecture that includes a web application server tier and a worker tier.The application needs to process submitted forms quickly. The application needs to process each form exactly once. The solution must ensure that no data is lost.Which solution will meet these requirements?
- A. Use an Amazon Simple Queue Service (Amazon SQS) FIFO queue between the web application server tier and the worker tier to store and forward form data.
- B. Use an Amazon API Gateway HTTP API between the web application server tier and the worker tier to store and forward form data.
- C. Use an Amazon Simple Queue Service (Amazon SQS) standard queue between the web application server tier and the worker tier to store and forward form data.
- D. Use an AWS Step Functions workflow. Create a synchronous workflow between the web application server tier and the worker tier that stores and forwards form data.
View question →
Q32. Q1032. A finance company uses an on-premises search application to collect streaming data from various producers. The application provides real-time updates to search and visualization features. The company is planning to migrate to AWS and wants to use an AWS native solution.Which solution will meet these requirements?
- A. Use Amazon EC2 instances to ingest and process the data streams to Amazon S3 buckets tor storage.Use Amazon Athena to search the data. Use Amazon Managed Grafana to create visualizations.
- B. Use Amazon EMR to ingest and process the data streams to Amazon Redshift for storage. Use Amazon Redshift Spectrum to search the data. Use Amazon QuickSight to create visualizations.
- C. Use Amazon Elastic Kubernetes Service (Amazon EKS) to ingest and process the data streams to Amazon DynamoDB for storage. Use Amazon CloudWatch to create graphical dashboards to search and visualize the data.
- D. Use Amazon Kinesis Data Streams to ingest and process the data streams to Amazon OpenSearch Service. Use OpenSearch Service to search the data. Use Amazon QuickSight to create visualizations.
View question →
Q33. Q1033. A company currently runs an on-premises application that usesASP.NET on Linux machines. The application is resource-intensive and serves customers directly.The company wants to modernize the application to .NET. The company wants to run the application on containers and to scale based on Amazon CloudWatch metrics. The company also wants to reduce the time spent on operational maintenance activities.Which solution will meet these requirements with the LEAST operational overhead?
- A. Use AWS App2Container to containerize the application. Use an AWS CloudFormation template to deploy the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.
- B. Use AWS App2Container to containerize the application. Use an AWS CloudFormation template to deploy the application to Amazon Elastic Container Service (Amazon ECS) on Amazon EC2 instances.
- C. Use AWS App Runner to containerize the application. Use App Runner to deploy the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.
- D. Use AWS App Runner to containerize the application. Use App Runner to deploy the application to Amazon Elastic Kubernetes Service (Amazon EKS) on Amazon EC2 instances.
View question →
Q34. Q1034. A company is designing a new internal web application in the AWS Cloud. The new application must securely retrieve and store multiple employee usernames and passwords from an AWS managed service.Which solution will meet these requirements with the LEAST operational overhead?
- A. Store the employee credentials in AWS Systems Manager Parameter Store. Use AWS CloudFormation and the BatchGetSecretValue API to retrieve usernames and passwords from Parameter Store.
- B. Store the employee credentials in AWS Secrets Manager. Use AWS CloudFormation and AWS Batch with the BatchGetSecretValue API to retrieve the usernames and passwords from Secrets Manager.
- C. Store the employee credentials in AWS Systems Manager Parameter Store. Use AWS CloudFormation and AWS Batch with the BatchGetSecretValue API to retrieve the usernames and passwords from Parameter Store.
- D. Store the employee credentials in AWS Secrets Manager. Use AWS CloudFormation and the BatchGetSecretValue API to retrieve the usernames and passwords from Secrets Manager.
View question →
Q35. Q1035. A company currently runs an on-premises stock trading application by using Microsoft Windows Server. The company wants to migrate the application to the AWS Cloud. The company needs to design a highly available solution that provides low-latency access to block storage across multiple Availability Zones.Which solution will meet these requirements with the LEAST implementation effort?
- A. Configure a Windows Server cluster that spans two Availability Zones on Amazon EC2 instances. Install the application on both cluster nodes. Use Amazon FSx for Windows File Server as shared storage between the two cluster nodes.
- B. Configure a Windows Server cluster that spans two Availability Zones on Amazon EC2 instances. Install the application on both cluster nodes. Use Amazon Elastic Block Store (Amazon EBS) General Purpose SSD (gp3) volumes as storage attached to the EC2 instances. Set up application-level replication to sync data from one EBS volume in one Availability Zone to another EBS volume in the second Availability Zone.
- C. Deploy the application on Amazon EC2 instances in two Availability Zones. Configure one EC2 instance as active and the second EC2 instance in standby mode. Use an Amazon FSx for NetApp ONTAP Multi-AZ file system to access the data by using Internet Small Computer Systems Interface (iSCSI) protocol.
- D. Deploy the application on Amazon EC2 instances in two Availability Zones. Configure one EC2 instance as active and the second EC2 instance in standby mode. Use Amazon Elastic Block Store (Amazon EBS) Provisioned IOPS SSD (io2) volumes as storage attached to the EC2 instances. Set up Amazon EBS level replication to sync data from one io2 volume in one Availability Zone to another io2 volume in the second Availability Zone.
View question →
Q36. Q1036. A company is designing a web application with an internet-facing Application Load Balancer (ALB).The company needs the ALB to receive HTTPS web traffic from the public internet. The ALB must send only HTTPS traffic to the web application servers hosted on the Amazon EC2 instances on port 443. The ALB must perform a health check of the web application servers over HTTPS on port 8443.Which combination of configurations of the security group that is associated with the ALB will meet these requirements? (Choose three.)
- A. Allow HTTPS inbound traffic from 0.0.0.0/0 for port 443.
- B. Allow all outbound traffic to 0.0.0.0/0 for port 443.
- C. Allow HTTPS outbound traffic to the web application instances for port 443.
- D. Allow HTTPS inbound traffic from the web application instances for port 443.
- E. Allow HTTPS outbound traffic to the web application instances for the health check on port 8443.
- F. Allow HTTPS inbound traffic from the web application instances for the health check on port 8443.
View question →
Q37. Q1037. A company hosts an application on AWS. The application gives users the ability to upload photos and store the photos in an Amazon S3 bucket. The company wants to use Amazon CloudFront and a custom domain name to upload the photo files to the S3 bucket in the eu-west-1 Region.Which solution will meet these requirements? (Choose two.)
- A. Use AWS Certificate Manager (ACM) to create a public certificate in the us-east-1 Region. Use the certificate in CloudFront.
- B. Use AWS Certificate Manager (ACM) to create a public certificate in eu-west-1. Use the certificate in CloudFront.
- C. Configure Amazon S3 to allow uploads from CloudFront. Configure S3 Transfer Acceleration.
- D. Configure Amazon S3 to allow uploads from CloudFront origin access control (OAC).
- E. Configure Amazon S3 to allow uploads from CloudFront. Configure an Amazon S3 website endpoint.
View question →
Q38. Q1038. A weather forecasting company collects temperature readings from various sensors on a continuous basis. An existing data ingestion process collects the readings and aggregates the readings into larger Apache Parquet files. Then the process encrypts the files by using client-side encryption with KMS managed keys (CSE-KMS). Finally, the process writes the files to an Amazon S3 bucket with separate prefixes for each calendar day.The company wants to run occasional SQL queries on the data to take sample moving averages for a specific calendar day.Which solution will meet these requirements MOST cost-effectively?
- A. Configure Amazon Athena to read the encrypted files. Run SQL queries on the data directly in Amazon S3.
- B. Use Amazon S3 Select to run SQL queries on the data directly in Amazon S3.
- C. Configure Amazon Redshift to read the encrypted files. Use Redshift Spectrum and Redshift query editor v2 to run SQL queries on the data directly in Amazon S3.
- D. Configure Amazon EMR Serverless to read the encrypted files. Use Apache SparkSQL to run SQL queries on the data directly in Amazon S3.
View question →
Q39. Q1039. A company is developing a new application that uses a relational database to store user data and application configurations. The company expects the application to have steady user growth. The company expects the database usage to be variable and read-heavy, with occasional writes.The company wants to cost-optimize the database solution. The company wants to use an AWS managed database solution that will provide the necessary performance.Which solution will meet these requirements MOST cost-effectively?
- A. Deploy the database on Amazon RDS. Use Provisioned IOPS SSD storage to ensure consistent performance for read and write operations.
- B. Deploy the database on Amazon Aurora Serverless to automatically scale the database capacity based on actual usage to accommodate the workload.
- C. Deploy the database on Amazon DynamoDB. Use on-demand capacity mode to automatically scale throughput to accommodate the workload.
- D. Deploy the database on Amazon RDS. Use magnetic storage and use read replicas to accommodate the workload.
View question →
Q40. Q1040. A company is building a cloud-based application on AWS that will handle sensitive customer data. The application uses Amazon RDS for the database, Amazon S3 for object storage, and S3 Event Notifications that invoke AWS Lambda for serverless processing.The company uses AWS IAM Identity Center to manage user credentials. The development, testing, and operations teams need secure access to Amazon RDS and Amazon S3 while ensuring the confidentiality of sensitive customer data. The solution must comply with the principle of least privilege.Which solution meets these requirements with the LEAST operational overhead?
- A. Use IAM roles with least privilege to grant all the teams access. Assign IAM roles to each team with customized IAM policies defining specific permission for Amazon RDS and S3 object access based on team responsibilities.
- B. Enable IAM Identity Center with an Identity Center directory. Create and configure permission sets with granular access to Amazon RDS and Amazon S3. Assign all the teams to groups that have specific access with the permission sets.
- C. Create individual IAM users for each member in all the teams with role-based permissions. Assign the IAM roles with predefined policies for RDS and S3 access to each user based on user needs.Implement IAM Access Analyzer for periodic credential evaluation.
- D. Use AWS Organizations to create separate accounts for each team. Implement cross-account IAM roles with least privilege. Grant specific permission for RDS and S3 access based on team roles and responsibilities.
View question →
Q41. Q1041. A company has an Amazon S3 bucket that contains sensitive data files. The company has an application that runs on virtual machines in an on-premises data center. The company currently uses AWS IAM Identity Center.The application requires temporary access to files in the S3 bucket. The company wants to grant the application secure access to the files in the S3 bucket.Which solution will meet these requirements?
- A. Create an S3 bucket policy that permits access to the bucket from the public IP address range of the company on-premises data center.
- B. Use IAM Roles Anywhere to obtain security credentials in IAM Identity Center that grant access to the S3 bucket. Configure the virtual machines to assume the role by using the AWS CLI.
- C. Install the AWS CLI on the virtual machine. Configure the AWS CLI with access keys from an IAM user that has access to the bucket.
- D. Create an IAM user and policy that grants access to the bucket. Store the access key and secret key for the IAM user in AWS Secrets Manager. Configure the application to retrieve the access key and secret key at startup.
View question →
Q42. Q1042. A company hosts its main public web application in one AWS Region across multiple Availability Zones. The application uses an Amazon EC2 Auto Scaling group and an Application Load Balancer (ALB).A web development team needs a cost-optimized compute solution to improve the company ability to serve dynamic content globally to millions of customers.Which solution will meet these requirements?
- A. Create an Amazon CloudFront distribution. Configure the existing ALB as the origin.
- B. Use Amazon Route 53 to serve traffic to the ALB and EC2 instances based on the geographic location of each customer.
- C. Create an Amazon S3 bucket with public read access enabled. Migrate the web application to the S3 bucket. Configure the S3 bucket for website hosting.
- D. Use AWS Direct Connect to directly serve content from the web application to the location of each customer.
View question →
Q43. Q1043. A company is testing an application that runs on an Amazon EC2 Linux instance. A single 500 GB Amazon Elastic Block Store (Amazon EBS) General Purpose SSO (gp2) volume is attached to the EC2 instance. The company will deploy the application on multiple EC2 instances in an Auto Scaling group. All instances require access to the data that is stored in the EBS volume. The company needs a highly available and resilient solution that does not introduce significant changes to the application's code.Which solution will meet these requirements?
- A. Provision an EC2 instance that uses NFS server software. Attach a single 500 GB gp2 EBS volume to the instance.
- B. Provision an Amazon FSx for Windows File Server file system. Configure the file system as an SMB file store within a single Availability Zone.
- C. Provision an EC2 instance with two 250 GB Provisioned IOPS SSD EBS volumes.
- D. Provision an Amazon Elastic File System (Amazon EFS) file system. Configure the file system to use General Purpose performance mode.
View question →
Q44. Q1044. A company recently launched a new application for its customers. The application runs on multiple Amazon EC2 instances across two Availability Zones. End users use TCP to communicate with the application.The application must be highly available and must automatically scale as the number of users increases.Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
- A. Add a Network Load Balancer in front of the EC2 instances.
- B. Configure an Auto Scaling group for the EC2 instances.
- C. Add an Application Load Balancer in front of the EC2 instances.
- D. Manually add more EC2 instances for the application.
- E. Add a Gateway Load Balancer in front of the EC2 instances.
View question →
Q45. Q1045. A company runs an on-premises application on a Kubernetes cluster. The company recently added millions of new customers. The company's existing on-premises infrastructure is unable to handle the large number of new customers. The company needs to migrate the on-premises application to the AWS Cloud.The company will migrate to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The company does not want to manage the underlying compute infrastructure for the new architecture on AWS.Which solution will meet these requirements with the LEAST operational overhead?
- A. Use a self-managed node to supply compute capacity. Deploy the application to the new EKS cluster.
- B. Use managed node groups to supply compute capacity. Deploy the application to the new EKS cluster.
- C. Use AWS Fargate to supply compute capacity. Create a Fargate profile. Use the Fargate profile to deploy the application.
- D. Use managed node groups with Karpenter to supply compute capacity. Deploy the application to the new EKS cluster.
View question →
Q46. Q1046. A company is launching a new application that requires a structured database to store user profiles, application settings, and transactional data. The database must be scalable with application traffic and must offer backups.Which solution will meet these requirements MOST cost-effectively?
- A. Deploy a self-managed database on Amazon EC2 instances by using open source software. Use Spot Instances for cost optimization. Configure automated backups to Amazon S3.
- B. Use Amazon RDS. Use on-demand capacity mode for the database with General Purpose SSD storage. Configure automatic backups with a retention period of 7 days.
- C. Use Amazon Aurora Serverless for the database. Use serverless capacity scaling. Configure automated backups to Amazon S3.
- D. Deploy a self-managed NoSQL database on Amazon EC2 instances. Use Reserved Instances for cost optimization. Configure automated backups directly to Amazon S3 Glacier Flexible Retrieval.
View question →
Q47. Q1047. A company runs its legacy web application on AWS. The web application server runs on an Amazon EC2 instance in the public subnet of a VPC. The web application server collects images from customers and stores the image files in a locally attached Amazon Elastic Block Store (Amazon EBS) volume. The image files are uploaded every night to an Amazon S3 bucket for backup.A solutions architect discovers that the image files are being uploaded to Amazon S3 through the public endpoint. The solutions architect needs to ensure that traffic to Amazon S3 does not use the public endpoint.Which solution will meet these requirements?
- A. Create a gateway VPC endpoint for the S3 bucket that has the necessary permissions for the VPC.Configure the subnet route table to use the gateway VPC endpoint.
- B. Move the S3 bucket inside the VPC. Configure the subnet route table to access the S3 bucket through private IP addresses.
- C. Create an Amazon S3 access point for the Amazon EC2 instance inside the VPConfigure the web application to upload by using the Amazon S3 access point.
- D. Configure an AWS Direct Connect connection between the VPC that has the Amazon EC2 instance and Amazon S3 to provide a dedicated network path.
View question →
Q48. Q1048. A company operates a food delivery service. Because of recent growth, the company's order processing system is experiencing scaling problems during peak traffic hours. The current architecture includes Amazon EC2 instances in an Auto Scaling group that collect orders from an application. A second group of EC2 instances in an Auto Scaling group fulfills the orders.The order collection process occurs quickly, but the order fulfillment process can take longer. Data must not be lost because of a scaling event.A solutions architect must ensure that the order collection process and the order fulfillment process can both scale adequately during peak traffic hours.Which solution will meet these requirements?
- A. Use Amazon CloudWatch to monitor the CPUUtilization metric for each instance in both Auto Scaling groups. Configure each Auto Scaling group's minimum capacity to meet its peak workload value.
- B. Use Amazon CloudWatch to monitor the CPUUtilization metric for each instance in both Auto Scaling groups. Configure a CloudWatch alarm to invoke an Amazon Simple Notification Service (Amazon SNS) topic to create additional Auto Scaling groups on demand.
- C. Provision two Amazon Simple Queue Service (Amazon SQS) queues. Use one SQS queue for order collection. Use the second SQS queue for order fulfillment. Configure the EC2 instances to poll their respective queues. Scale the Auto Scaling groups based on notifications that the queues send.
- D. Provision two Amazon Simple Queue Service (Amazon SQS) queues. Use one SQS queue for order collection. Use the second SQS queue for order fulfillment. Configure the EC2 instances to poll their respective queues. Scale the Auto Scaling groups based on the number of messages in each queue.
View question →
Q49. Q1049. A company runs its media rendering application on premises. The company wants to reduce storage costs and has moved all data to Amazon S3. The on-premises rendering application needs low-latency access to storage.The company needs to design a storage solution for the application. The storage solution must maintain the desired application performance.Which storage solution will meet these requirements in the MOST cost-effective way?
- A. Use Mountpoint for Amazon S3 to access the data in Amazon S3 for the on-premises application.
- B. Configure an Amazon S3 File Gateway to provide storage for the on-premises application.
- C. Copy the data from Amazon S3 to Amazon FSx for Windows File Server. Configure an Amazon FSx File Gateway to provide storage for the on-premises application.
- D. Configure an on-premises file server. Use the Amazon S3 API to connect to S3 storage. Configure the application to access the storage from the on-premises file server.
View question →
Q50. Q1050. A company hosts its enterprise resource planning (ERP) system in the us-east-1 Region. The system runs on Amazon EC2 instances. Customers use a public API that is hosted on the EC2 instances to exchange information with the ERP system. International customers report slow API response times from their data centers.Which solution will improve response times for the international customers MOST cost-effectively?
- A. Create an AWS Direct Connect connection that has a public virtual interface (VIF) to provide connectivity from each customer's data center to us-east-1. Route customer API requests by using a Direct Connect gateway to the ERP system API.
- B. Set up an Amazon CloudFront distribution in front of the API. Configure the CachingOptimized managed cache policy to provide improved cache efficiency.
- C. Set up AWS Global Accelerator. Configure listeners for the necessary ports. Configure endpoint groups for the appropriate Regions to distribute traffic. Create an endpoint in the group for the API.
- D. Use AWS Site-to-Site VPN to establish dedicated VPN tunnels between Regions and customer networks. Route traffic to the API over the VPN connections.
View question →
Q51. Q1051. A company tracks customer satisfaction by using surveys that the company hosts on its website. The surveys sometimes reach thousands of customers every hour. Survey results are currently sent in email messages to the company so company employees can manually review results and assess customer sentiment.The company wants to automate the customer survey process. Survey results must be available for the previous 12 months.Which solution will meet these requirements in the MOST scalable way?
- A. Send the survey results data to an Amazon API Gateway endpoint that is connected to an Amazon Simple Queue Service (Amazon SQS) queue. Create an AWS Lambda function to poll the SQS queue, call Amazon Comprehend for sentiment analysis, and save the results to an Amazon DynamoDB table.Set the TTL for all records to 365 days in the future.
- B. Send the survey results data to an API that is running on an Amazon EC2 instance. Configure the API to store the survey results as a new record in an Amazon DynamoDB table, call Amazon Comprehend for sentiment analysis, and save the results in a second DynamoDB table. Set the TTL for all records to 365 days in the future.
- C. Write the survey results data to an Amazon S3 bucket. Use S3 Event Notifications to invoke an AWS Lambda function to read the data and call Amazon Rekognition for sentiment analysis. Store the sentiment analysis results in a second S3 bucket. Use S3 lifecycle policies on each bucket to expire objects after 365 days.
- D. Send the survey results data to an Amazon API Gateway endpoint that is connected to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the SQS queue to invoke an AWS Lambda function that calls Amazon Lex for sentiment analysis and saves the results to an Amazon DynamoDB table. Set the TTL for all records to 365 days in the future.
View question →
Q52. Q1052. A company uses AWS Systems Manager for routine management and patching of Amazon EC2 instances. The EC2 instances are in an IP address type target group behind an Application Load Balancer (ALB).New security protocols require the company to remove EC2 instances from service during a patch. When the company attempts to follow the security protocol during the next patch, the company receives errors during the patching window.Which combination of solutions will resolve the errors? (Choose two.)
- A. Change the target type of the target group from IP address type to instance type.
- B. Continue to use the existing Systems Manager document without changes because it is already optimized to handle instances that are in an IP address type target group behind an ALB.
- C. Implement the AWSEC2-PatchLoadBalanacerInstance Systems Manager Automation document to manage the patching process.
- D. Use Systems Manager Maintenance Windows to automatically remove the instances from service to patch the instances.
- E. Configure Systems Manager State Manager to remove the instances from service and manage the patching schedule. Use ALB health checks to re-route traffic.
View question →
Q53. Q1053. A medical company wants to perform transformations on a large amount of clinical trial data that comes from several customers. The company must extract the data from a relational database that contains the customer data. Then the company will transform the data by using a series of complex rules. The company will load the data to Amazon S3 when the transformations are complete.All data must be encrypted where it is processed before the company stores the data in Amazon S3. All data must be encrypted by using customer-specific keys.Which solution will meet these requirements with the LEAST amount of operational effort?
- A. Create one AWS Glue job for each customer. Attach a security configuration to each job that uses server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data.
- B. Create one Amazon EMR cluster for each customer. Attach a security configuration to each cluster that uses client-side encryption with a custom client-side root key (CSE-Custom) to encrypt the data.
- C. Create one AWS Glue job for each customer. Attach a security configuration to each job that uses client-side encryption with AWS KMS managed keys (CSE-KMS) to encrypt the data.
- D. Create one Amazon EMR cluster for each customer. Attach a security configuration to each cluster that uses server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the data.
View question →
Q54. Q1054. A company hosts a website analytics application on a single Amazon EC2 On-Demand Instance. The analytics application is highly resilient and is designed to run in stateless mode.The company notices that the application is showing signs of performance degradation during busy times and is presenting 5xx errors. The company needs to make the application scale seamlessly.Which solution will meet these requirements MOST cost-effectively?
- A. Create an Amazon Machine Image (AMI) of the web application. Use the AMI to launch a second EC2 On-Demand Instance. Use an Application Load Balancer to distribute the load across the two EC2 instances.
- B. Create an Amazon Machine Image (AMI) of the web application. Use the AMI to launch a second EC2 On-Demand Instance. Use Amazon Route 53 weighted routing to distribute the load across the two EC2 instances.
- C. Create an AWS Lambda function to stop the EC2 instance and change the instance type. Create an Amazon CloudWatch alarm to invoke the Lambda function when CPU utilization is more than 75%.
- D. Create an Amazon Machine Image (AMI) of the web application. Apply the AMI to a launch template.Create an Auto Scaling group that includes the launch template. Configure the launch template to use a Spot Fleet. Attach an Application Load Balancer to the Auto Scaling group.
View question →
Q55. Q1055. A company runs an environment where data is stored in an Amazon S3 bucket. The objects are accessed frequently throughout the day. The company has strict da ta encryption requirements for data that is stored in the S3 bucket. The company currently uses AWS Key Management Service (AWS KMS) for encryption.The company wants to optimize costs associated with encrypting S3 objects without making additional calls to AWS KMS.Which solution will meet these requirements?
- A. Use server-side encryption with Amazon S3 managed keys (SSE-S3).
- B. Use an S3 Bucket Key for server-side encryption with AWS KMS keys (SSE-KMS) on the new objects.
- C. Use client-side encryption with AWS KMS customer managed keys.
- D. Use server-side encryption with customer-provided keys (SSE-C) stored in AWS KMS.
View question →
Q56. Q1056. A company runs multiple workloads on virtual machines (VMs) in an on-premises data center. The company is expanding rapidly. The on-premises data center is not able to scale fast enough to meet business needs. The company wants to migrate the workloads to AWS.The migration is time sensitive. The company wants to use a lift-and-shift strategy for non-critical workloads.Which combination of steps will meet these requirements? (Choose three.)
- A. Use the AWS Schema Conversion Tool (AWS SCT) to collect data about the VMs.
- B. Use AWS Application Migration Service. Install the AWS Replication Agent on the VMs.
- C. Complete the initial replication of the VMs. Launch test instances to perform acceptance tests on the VMs.
- D. Stop all operations on the VMs. Launch a cutover instance.
- E. Use AWS App2Container (A2C) to collect data about the VMs.
- F. Use AWS Database Migration Service (AWS DMS) to migrate the VMs.
View question →
Q57. Q1057. A company hosts an application in a private subnet. The company has already integrated the application with Amazon Cognito. The company uses an Amazon Cognito user pool to authenticate users.The company needs to modify the application so the application can securely store user documents in an Amazon S3 bucket.Which combination of steps will securely integrate Amazon S3 with the application? (Choose two.)
- A. Create an Amazon Cognito identity pool to generate secure Amazon S3 access tokens for users when they successfully log in.
- B. Use the existing Amazon Cognito user pool to generate Amazon S3 access tokens for users when they successfully log in.
- C. Create an Amazon S3 VPC endpoint in the same VPC where the company hosts the application.
- D. Create a NAT gateway in the VPC where the company hosts the application. Assign a policy to the S3 bucket to deny any request that is not initiated from Amazon Cognito.
- E. Attach a policy to the S3 bucket that allows access only from the users' IP addresses.
View question →
Q58. Q1058. A company has a three-tier web application that processes orders from customers. The web tier consists of Amazon EC2 instances behind an Application Load Balancer. The processing tier consists of EC2 instances. The company decoupled the web tier and processing tier by using Amazon Simple Queue Service (Amazon SQS). The storage layer uses Amazon DynamoDB.At peak times, some users report order processing delays and halls. The company has noticed that during these delays, the EC2 instances are running at 100% CPU usage, and the SQS queue fills up. The peak times are variable and unpredictable.The company needs to improve the performance of the application.Which solution will meet these requirements?
- A. Use scheduled scaling for Amazon EC2 Auto Scaling to scale out the processing tier instances for the duration of peak usage times. Use the CPU Utilization metric to determine when to scale.
- B. Use Amazon ElastiCache for Redis in front of the DynamoDB backend tier. Use target utilization as a metric to determine when to scale.
- C. Add an Amazon CloudFront distribution to cache the responses for the web tier. Use HTTP latency as a metric to determine when to scale.
- D. Use an Amazon EC2 Auto Scaling target tracking policy to scale out the processing tier instances. Use the ApproximateNumberOfMessages attribute to determine when to scale.
View question →
Q59. Q1059. A company's production environment consists of Amazon EC2 On-Demand Instances that run constantly between Monday and Saturday. The instances must run for only 12 hours on Sunday and cannot tolerate interruptions. The company wants to cost-optimize the production environment.Which solution will meet these requirements MOST cost-effectively?
- A. Purchase Scheduled Reserved Instances for the EC2 instances that run for only 12 hours on Sunday.Purchase Standard Reserved Instances for the EC2 instances that run constantly between Monday and Saturday.
- B. Purchase Convertible Reserved Instances for the EC2 instances that run for only 12 hours on Sunday.Purchase Standard Reserved Instances for the EC2 instances that run constantly between Monday and Saturday.
- C. Use Spot Instances for the EC2 instances that run for only 12 hours on Sunday. Purchase Standard Reserved Instances for the EC2 instances that run constantly between Monday and Saturday.
- D. Use Spot Instances for the EC2 instances that run for only 12 hours on Sunday. Purchase Convertible Reserved Instances for the EC2 instances that run constantly between Monday and Saturday.
View question →
Q60. Q1060. A digital image processing company wants to migrate its on-premises monolithic application to the AWS Cloud. The company processes thousands of images and generates large files as part of the processing workflow.The company needs a solution to manage the growing number of image processing jobs. The solution must also reduce the manual tasks in the image processing workflow. The company does not want to manage the underlying infrastructure of the solution.Which solution will meet these requirements with the LEAST operational overhead?
- A. Use Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 Spot Instances to process the images. Configure Amazon Simple Queue Service (Amazon SQS) to orchestrate the workflow. Store the processed files in Amazon Elastic File System (Amazon EFS).
- B. Use AWS Batch jobs to process the images. Use AWS Step Functions to orchestrate the workflow.Store the processed files in an Amazon S3 bucket.
- C. Use AWS Lambda functions and Amazon EC2 Spot Instances to process the images. Store the processed files in Amazon FSx.
- D. Deploy a group of Amazon EC2 instances to process the images. Use AWS Step Functions to orchestrate the workflow. Store the processed files in an Amazon Elastic Block Store (Amazon EBS) volume.
View question →
Q61. Q1061. A company runs an application in a private subnet behind an Application Load Balancer (ALB) in a VPC. The VPC has a NAT gateway and an internet gateway. The application calls the Amazon S3 API to store objects.According to the company's security policy, traffic from the application must not travel across the internet.Which solution will meet these requirements MOST cost-effectively?
- A. Configure an S3 interface endpoint. Create a security group that allows outbound traffic to Amazon S3.
- B. Configure an S3 gateway endpoint. Update the VPC route table to use the endpoint.
- C. Configure an S3 bucket policy to allow traffic from the Elastic IP address that is assigned to the NAT gateway.
- D. Create a second NAT gateway in the same subnet where the legacy application is deployed. Update the VPC route table to use the second NAT gateway.
View question →
Q62. Q1062. A company has an application that runs on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on Amazon EC2 instances. The application has a UI that uses Amazon DynamoDB and data services that use Amazon S3 as part of the application deployment.The company must ensure that the EKS Pods for the UI can access only Amazon DynamoDB and that the EKS Pods for the data services can access only Amazon S3. The company uses AWS Identity and Access Management (IAM).Which solution meals these requirements?
- A. Create separate IAM policies for Amazon S3 and DynamoDB access with the required permissions.Attach both IAM policies to the EC2 instance profile. Use role-based access control (RBAC) to control access to Amazon S3 or DynamoDB for the respective EKS Pods.
- B. Create separate IAM policies for Amazon S3 and DynamoDB access with the required permissions.Attach the Amazon S3 IAM policy directly to the EKS Pods for the data services and the DynamoDB policy to the EKS Pods for the UI.
- C. Create separate Kubernetes service accounts for the UI and data services to assume an IAM role.Attach the AmazonS3FullAccess policy to the data services account and the AmazonDynamoDBFullAccess policy to the UI service account.
- D. Create separate Kubernetes service accounts for the UI and data services to assume an IAM role. Use IAM Role for Service Accounts (IRSA) to provide access to the EKS Pods for the UI to Amazon S3 and the EKS Pods for the data services to DynamoDB.
View question →
Q63. Q1063. A law firm needs to make hundreds of files readable for the general public. The law firm must prevent members of the public from modifying or deleting the files before a specified future date.Which solution will meet these requirements MOST securely?
- A. Upload the files to an Amazon S3 bucket that is configured for static website hosting. Grant read-only IAM permissions to any AWS principals that access the S3 bucket until the specified date.
- B. Create a new Amazon S3 bucket.Enable S3 Versioning. Use S3 Object Lock and set a retention period based on the specified date. Create an Amazon CloudFront distribution to serve content from the bucket. Use an S3 bucket policy to restrict access to the CloudFront origin access control (OAC).
- C. Create a new Amazon S3 bucket.Enable S3 Versioning. Configure an event trigger to run an AWS Lambda function if a user modifies or deletes an object. Configure the Lambda function to replace the modified or deleted objects with the original versions of the objects from a private S3 bucket.
- D. Upload the files to an Amazon S3 bucket that is configured for static website hosting. Select the folder that contains the files. Use S3 Object Lock with a retention period based on the specified date. Grant read-only IAM permissions to any AWS principals that access the S3 bucket.
View question →
Q64. Q1064. A company is planning to run an AI/ML workload on AWS.The company needs to train a model on a dataset that is in Amazon S3 Standard. A model training application requires multiple compute nodes and single-digit millisecond access to the data.Which solution will meet these requirements in the MOST cost-effective way?
- A. Move the data to S3 Intelligent-Tiering. Point the model training application to S3 intelligent-Tiering as the data source.
- B. Add partitions to the S3 bucket by adding random prefixes. Reconfigure the model training application to point to the new prefixes as the data source.
- C. Move the data to S3 Express One Zone. Point the model training application to S3Express One Zone as the data source.
- D. Move the data to a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume attached to an Amazon EC2 instance. Point the model training application to the gp3 volume as the data source.
View question →
Q65. Q1065. A company is creating a web application that will store a large number of images in Amazon S3. The images will be accessed by users over variable periods of time. The company wants to:Retain all the images.Incur no cost for retrieval.Have minimal management overhead.Have the images available with no impact on retrieval time.Which solution meets these requirements?
- A. Implement S3 Intelligent-Tiering.
- B. Implement S3 storage class analysis.
- C. Implement an S3 Lifecycle policy to move data to S3 Standard-Infrequent Access (S3 Standard-IA).
- D. Implement an S3 Lifecycle policy to move data to S3 One Zone-Infrequent Access (S3 One Zone-IA).
View question →
Q66. Q1066. A company is planning to migrate a TCP-based application into the company's VPC. The application is publicly accessible on a nonstandard TCP port through a hardware appliance in the company's data center.This public endpoint can process up to 3 million requests per second with low latency. The company requires the same level of performance for the new public endpoint in AWS.What should a solutions architect recommend to meet this requirement?
- A. Deploy a Network Load Balancer (NLB). Configure the NLB to be publicly accessible over the TCP port that the application requires.
- B. Deploy an Application Load Balancer (ALB). Configure the ALB to be publicly accessible over the TCP port that the application requires.
- C. Deploy an Amazon CloudFront distribution that listens on the TCP port that the application requires.Use an Application Load Balancer as the origin.
- D. Deploy an Amazon API Gateway API that is configured with the TCP port that the application requires.Configure AWS Lambda functions with provisioned concurrency to process the requests.
View question →
Q67. Q1067. A global ecommerce company is planning to enhance its AWS data storage architecture to improve system availability and resilience.The company handles millions of daily transactions in the form of relational data.The company needs a database configuration that minimizes downtime and data loss.The company stores unstructured data in the form of images that are over 4 MB in size.The solution must provide continuous operation in multiple geographic locations. The company must have the ability to manage both transaction data and unstructured data.The solution must be highly availability and fault tolerant.Which solution will meet these requirements?
- A. Use Amazon RDS Multi-AZ deployments for transaction data. Use Amazon DynamoDB global tables for unstructured data.
- B. Use an Amazon Aurora global database for transaction data. Use Amazon S3 with Cross-Region Replication for unstructured data.
- C. Use Amazon DynamoDB global tables for both transaction data and unstructured data.
- D. Use an Amazon Aurora global database for transaction data. Use Amazon Elastic File System (Amazon EFS) with Cross-Region Replication for unstructured data.
View question →
Q68. Q1068. A social media application is experiencing high volumes of new user requests after a recent marketing campaign. The application is served by an Amazon RDS for MySQL instance.A solutions architect examines the database performance and notices high CPU usage and many "too many connections" errors that lead to failed requests on the database. The solutions architect needs to address the failed requests.Which solution will meet this requirement?
- A. Deploy an Amazon DynamoDB Accelerator (DAX) cluster. Configure the application to use the DAX cluster.
- B. Deploy an RDS Proxy. Configure the application to use the RDS Proxy.
- C. Migrate the database to an Amazon RDS for PostgreSQL instance.
- D. Deploy an Amazon ElastiCache (Redis OSS) cluster. Configure the application to use the ElastiCache cluster.
View question →
Q69. Q1069. A company is planning to deploy a data processing platform on AWS.The data processing platform is based on PostgreSQL. The company stores the data that the platform must process on premises.To comply with regulations,the company must not migrate the data to the cloud.However,the company wants to use AWS managed data analytics solutions.Which solution will meet these requirements?
- A. Create an Amazon RDS for PostgreSQL database in a VPC. Create an interface VPC endpoint to connect the on-premises PostgreSQL database to the RDS for PostgreSQL database.
- B. Create Amazon EC2 instances in an Auto Scaling group on AWS Outposts. Install PostgreSQL data analytics software on the instances.
- C. Create an Amazon EMR cluster on AWS Outposts. Connect the EMR cluster to the on-premises PostgreSQL database to perform data processing locally.
- D. Create an Amazon EMR cluster in a VPC. Connect the EMR cluster to Amazon RDS for SQL Server with a linked server to connect to the company's data processing platform.
View question →
Q70. Q1070. A company is migrating an online marketplace application from a mainframe system to an Auto Scaling group of Amazon EC2 instances. The EC2 instances access an Amazon Aurora cluster. The application requires a scalable, persistent caching solution to store the results of in-progress transactions and SQL queries.Which solution will meet these requirements?
- A. Use an Amazon ElastiCache (Redis OSS) cluster to serve transaction and query results.
- B. Use an Amazon CloudFront distribution with an Amazon S3 bucket as the origin to cache the transactions. Add an Amazon EC2 instance store volume to the EC2 instances for query result caching.
- C. Use an Amazon ElastiCache (Memcached) cluster to serve transaction and query results.
- D. Use an Amazon ElastiCache (Redis OSS) cluster to cache the transactions. Add an Amazon EC2 instance store volume to the EC2 instances for query result caching.
View question →
Q71. Q1071. A company is developing a containerized web application that needs to be highly available and scalable.The application requires access to GPU resources.How should the company run the containerized application?
- A. Package the application as an AWS Lambda function in a container image. Use Lambda to run the containerized application on a runtime with GPU access.
- B. Deploy the application container to Amazon Elastic Kubernetes Service (Amazon EKS). Use AWS Fargate to manage compute resources and access to GPU resources.
- C. Deploy the application container to Amazon Elastic Container Registry(Amazon ECR).Use Amazon ECR to run the containerized application with an attached GPU.
- D. Run the application on Amazon EC2 instances from a GPU instance family by using Amazon Elastic Container Service (Amazon ECS) for orchestration.
View question →
Q72. Q1072. A company is moving data from an on-premises data center to the AWS Cloud.The company must store all its data in an Amazon S3 bucket.To comply with regulations, the company must also ensure that the data will be protected against overwriting indefinitely.Which solution will ensure that the data in the S3 bucket cannot be overwritten?
- A. Enable versioning for the S3 bucket.Use server-side encryption with Amazon S3 managed keys(SSE- S3) to protect the data.
- B. Disable versioning for the S3 bucket. Configure S3 Object Lock for the S3 bucket with a retention period of 1 year.
- C. Enable versioning for the S3 bucket. Configure S3 Object Lock for the S3 bucket with a legal hold.
- D. Configure S3 Storage Lens for the S3 bucket.Use server-side encryption with customer-provided keys (SSE-C) to protect the data.
View question →
Q73. Q1073. A company has a legacy .NET Framework application that runs on Windows Server 2012.The company wants to migrate the application to AWS. The company cannot rewrite code or update to the latest version of the .NET Framework. The company must migrate the application to AWS managed services. Which solution will meet these requirements with the LEAST administrative overhead?
- A. Use AWS Migration Hub Orchestrator to containerize the .NET application.Use Amazon Elastic Container Service (Amazon ECS) to deploy the application.
- B. Use AWS Lambda functions to run the application by using .NET libraries.
- C. Use an Amazon Machine Image (AMI) to deploy Amazon EC2 instances that run the latest version of Windows Server. Run the application on the EC2 instances.
- D. Use AWS Application Migration Service to convert the application to the latest version of the .NET Framework. Use Amazon Elastic Container Service (Amazon ECS) to deploy the application.
View question →
Q74. Q1074. A company has a web application that retrieves customer financial information. The application runs on Amazon EC2 instances. The application uses an Amazon RDS for PostgreSQL database to store confidential information.The company needs to encrypt network traffic between the application and the database.Which combinations of solutions will meet this requirement?(Select TWO).
- A. Configure the RDS for PostgreSQL instances to encrypt traffic by using an option group.
- B. Configure the RDS for PostgreSQL instances to encrypt traffic by using a parameter group.
- C. Terminate the existing RDS for PostgreSQL instances. Recreate the instances with the necessary security configuration.
- D. Restart the RDS for PostgreSQL instances after the configuration update.
- E. Do not restart the RDS for PostgreSQL instances after the configuration update.
View question →
Q75. Q1075. A company hosts its ecommerce application in the AWS Cloud.The application uses a multi-Region active- active approach and many microservices. The company needs a solution to redirect traffic if resources in an AWS Region become unavailable. The company wants to ensure that the failover Region is ready to handle traffic in case of afailover.Which solution provides application resiliency with the LEAST operational overhead?
- A. Use the Amazon Route 53 Application Recovery Controller multi-Region recovery capability.
- B. Use Amazon Route 53 health checks to monitor the multi-Region endpoints to redirect traffic. Ensure that the failover Region is ready to handle traffic by scheduling occasional resource shutdowns in the primary Region by using Amazon EventBridge Scheduler.
- C. Use AWS Fault Injection Service to reroute the traffic to another Region if resources in a Region become unavailable.
- D. Deploy Amazon API Gateway HTTP APIs in each Region. Use an Amazon CloudFront distribution. Use Lambda@Edge to query Amazon Route 53 for the Region to forward requests to based on the lowest latency.
View question →
Q76. Q1076. A media company is developing a text-to-speech application. The application must be able to convert input text into speech audio files. The application must deliver the audio files with low latency to users worldwide.Which solution meets these requirements?
- A. Use AWS Lambda for the text-to-speech conversion logic. Use Amazon Polly to generate the speech audio files. Use an Amazon API Gateway REST API to expose the application. Use an Amazon CloudFront distribution to cache and deliver the audio files.
- B. Use AWS Lambda for the text-to-speech conversion logic.Use Amazon Rekognition to generate the speech audio files. Use an Amazon API Gateway REST API to expose the application with a Regional endpoint.
- C. Use AWS Batch for the text-to-speech conversion logic. Use Amazon Transcribe to generate the speech audio files. Use an Amazon API Gateway HTTP API to expose the application. Use an Amazon CloudFront distribution to cache and deliver the audio files.
- D. Use AWS Lambda for the text-to-speech conversion logic. Use Amazon Lex to generate the speech audio files. Use an Amazon API Gateway HTTP API to expose the application. Use an Amazon CloudFront distribution to cache and deliver the audio files.
View question →
Q77. Q1077. A company wants to provide a third-party system that runs in a private data center with access to its AWS account. The company wants to call AWS APIs directly from the third-party system. The company has an existing process for managing digital certificates. The company does not want to use SAML or OpenID Connect (OIDC) capabilitiesand does not want to store long-term AWS credentials.Which solution will meet these requirements?
- A. Configure mutual TLS to allow authentication of the client and server sides of the communication channel.
- B. Configure AWS Signature Version 4 to authenticate incoming HTTPS requests to AWS APIs.
- C. Configure Kerberos to exchange tickets for assertions that can be validated by AWS APIs.
- D. Configure AWS Identity and Access Management (IAM) Roles Anywhere to exchange X.509 certificates for AWS credentials to interact with AWS APIs.
View question →
Q78. Q1078. A company discovers that an Amazon DynamoDB Accelerator (DAX) cluster for the company's web application workload is not encrypting data at rest. The company needs to resolve the security issue.Which solution will meet this requirement?
- A. Stop the existing DAX cluster. Enable encryption at rest for the existing DAX cluster, and start the cluster again.
- B. Delete the existing DAX cluster. Recreate the DAX cluster, and configure the new cluster to encrypt the data at rest.
- C. Update the configuration of the existing DAX cluster to encrypt the data at rest.
- D. Integrate the existing DAX cluster with AWS Security Hub to automatically enable encryption at rest.
View question →
Q79. Q1079. A company is migrating an on-premises application to the AWS Cloud.The application compute nodes in AWS will consist of multiple Amazon EC2 instances across multiple Availability Zones within the us-east-1 Region.The company expects the amount of application data to increase for the next 12 months. Every EC2 instance must be able to access the same data.Which solution will meet these requirements?
- A. Store the application data in Amazon Elastic Block Store (Amazon EBS) General Purpose volumes.Mount the EBS volumes on all the EC2 instances.
- B. Store the application data in Amazon Elastic Block Store(Amazon EBS) Provisioned IOPS volumes.Mount the EBS volumes on all the EC2 instances.
- C. Store the application data in an Amazon Elastic File System (Amazon EFS) file system. Create a mount target in each Availability Zone. Mount the file system on all the EC2 instances.
- D. Store the application data in Amazon S3 Express One Zone buckets. Mount the S3 buckets on all the EC2 instances.
View question →
Q80. Q1080. A company has a large fleet of vehicles that are equipped with internet connectivity to send telemetry to the company.The company receives over 1 million data points every 5 minutes from the vehicles. The company uses the data in machine learning (ML) applications to predict vehicle maintenance needs and to preorder parts. The company produces visual reports based on the captured data.The company wants to migrate the telemetry ingestion, processing, and visualization workloads to AWS.Which solution will meet these requirements?
- A. Use Amazon Timestream for LiveAnalytics to store the data points. Grant Amazon SageMaker permission to access the data for processing. Use Amazon QuickSight to visualize the data.
- B. Use Amazon DynamoDB to store the data points. Use DynamoDB Connector to ingest data from DynamoDB into Amazon EMR for processing. Use Amazon QuickSight to visualize the data.
- C. Use Amazon Neptune to store the data points. Use Amazon Kinesis Data Streams to ingest data from Neptune into an AWS Lambda function for processing. Use Amazon QuickSight to visualize the data.
- D. Use Amazon Timestream to for LiveAnalytics to store the data points. Grant Amazon SageMaker permission to access the data for processing. Use Amazon Athena to visualize the data.
View question →
Q81. QuickSight offers powerful visualization capabilities.Suitability:DynamoDB is generally used for transactional workloads rather than time series data. Ingesting data from DynamoDB into EMR may introduce latency and complexity. While feasible, this solution may not be as optimized for real-time telemetry and ML processing as Option A.C. Use Amazon Neptune to store the data points. Use Amazon Kinesis Data Streams to ingest data from Neptune into an AWS Lambda function for processing. Use Amazon QuickSight to visualize the data.Advantages:Amazon Neptune is a fully managed graph database service.Kinesis Data Streams allows real-time data streaming.AWS Lambda can process data streams in real-time.QuickSight provides visualization capabilities.Suitability:Neptune is designed for graph data, which is not suitable for telemetry data from vehicles. While Kinesis and Lambda can handle real-time data, the mismatch with Neptune makes this solution less optimal.D. Use Amazon Timestream for LiveAnalytics to store the data points. Grant Amazon SageMaker permission to access the data for processing. Use Amazon Athena to visualize the data.Advantages:Timestream and SageMaker are well-suited for time series data and ML processing, respectively. Amazon Athena allows querying data in Amazon S3 using standard SQL.Suitability:Athena is typically used for querying data stored in S3 rather than directly visualizing it. For visualization, QuickSight would be a more suitable choice than Athena.Conclusion:Based on the analysis, the most suitable solution is:
- A. Use Amazon Timestream for LiveAnalytics to store the data points. Grant Amazon SageMaker permission to access the data for processing. Use Amazon QuickSight to visualize the data.This solution effectively addresses the company's needs for storing, processing, and visualizing large volumes of telemetry data from its fleet of vehicles. Amazon Timestream is optimized for time series data, Amazon SageMaker provides powerful ML capabilities, and Amazon QuickSight offers robust visualization tools.Q1081. A company is developing software that uses a PostgreSQL database schema. The company needs to configure development environments and test environments for its developers.Each developer at the company uses their own development environment, which includes a PostgreSQL database. On average, each development environment is used for an 8-hour workday. The test environments will be used for load testing that can take up to 2 hours each day.Which solution will meet these requirements MOST cost-effectively?
- B. Configure development environments and test environments with their own Amazon Aurora Serverless v2 PostgreSQL database.
- C. For each development environment,configure an Amazon RDS for PostgreSQL Single-AZ DB instance.For the test environment, configure a single Amazon RDS for PostgreSQL Multi-AZ DB instance.
- D. Configure development environments and test environments with their own Amazon Aurora PostgreSQL DB cluster.
- E. Configure an Amazon Aurora global database. Allow developers to connect to the database with their own credentials.
View question →
Q82. Q1082. An ecommerce company has an application that collects order-related information from customers. The company uses one Amazon DynamoDB table to store customer home addresses,phone numbers, and email addresses. Customers can check out without creating an account. The application copies the customer information to a secondDynamoDB table if a customer does create an account.The company requires a solution to delete personally identifiable information (PII) for customers who did not create an account within 28 days.Which solution will meet these requirements with the LEAST operational overhead?
- A. Create an AWS Lambda function to delete items from the first DynamoDB table that have a delivery date more than 28 days in the past.Use a scheduled Amazon EventBridge rule to run the Lambda function every day.
- B. Update the application to store PII in an Amazon S3 bucket. Create an S3 Lifecycle rule to expire the objects after 28 days. Move the data to DynamoDB when a user creates an account.
- C. Launch an Amazon EC2 instance.Configure a daily cron job to run on the instance. Configure the cron job to use AWS CLI commands to delete items from DynamoDB.
- D. Use a createdAt timestamp to set TTL for data in the first DynamoDB table to 28 days.
View question →
Q83. Q1083. A company is launching a new application that will be hosted on Amazon EC2 instances. A solutions architect needs to design a solution that does not allow public IPv4 access that originates from the internet. However,the solution must allow the EC2 instances to make outbound IPv4 internet requests. The initial design proposal shows that the EC2 instances would be located in two private subnets across two Availability Zones. The entire architecture must be highly available.How should the solutions architect change the architecture to meet these requirements?
- A. Deploy a NAT gateway in public subnets in both Availability Zones. Create and configure one route table for each private subnet.
- B. Deploy an internet gateway in public subnets in both Availability Zones. Create and configure a shared route table for the private subnets.
- C. Deploy a NAT gateway in public subnets in both Availability Zones. Create and configure a shared route table for the private subnets.
- D. Deploy an egress-only internet gateway in public subnets in both Availability Zones. Create and configure one route table for each private subnet.
View question →
Q84. Q1084. A company uses an Amazon EC2 instance to run a script to poll for and process messages in an Amazon Simple Queue Service (Amazon SQS) queue. The company wants to reduce operational overhead while maintaining its ability to process an increasing number of messages that are added to the queue.Which solution will meet these requirements?
- A. Increase the size of the EC2 instance to process messages in the SQS queue faster.
- B. Configure an Amazon EventBridge rule to turn off the EC2 instance when the SQS queue is empty.
- C. Migrate the script on the EC2 instance to an AWS Lambda function with an event source of the SQS queue.
- D. Configure an AWS Systems Manager Run Command to run the script on demand.
View question →
Q85. Q1085. A company is developing a serverless web application that gives users the ability to interact with real-time analytics from online games. The data from the games must be streamed in real time. The company needs a durable, low-latency database option for user data. The company does not know how many users will use the application. Any design considerations must provide response times of single-digit milliseconds as the application scales.Which combination of AWS services will meet these requirements? (Select TWO.)
- A. Amazon CloudFront
- B. Amazon DynamoDB
- C. Amazon Kinesis
- D. Amazon RDS
- E. AWS Global Accelerator
View question →
Q86. Q1086. A media company is launching a new product platform that artists from around the world can use to upload videos and images directly to an Amazon S3 bucket. The company owns and maintains the S3 bucket. The artists must be able to upload files from personal devices without the need for AWS credentials or an AWS account.Which solution wil1 meet these requirements MOST securely?
- A. Enable cross-origin resource sharing (CORS) on the S3 bucket.
- B. Turn off block public access for the S3 bucket. Share the bucket URL to the artists to enable uploads without credentials.
- C. Use an IAM role that has upload permissions for the S3 bucket to generate presigned URLs for S3 prefixes that are specific to each artist. Share the URLs to the artists.
- D. Create a web interface that uses an IAM role that has permission to upload and view objects in the S3 bucket. Share the web interface URL to the artists.
View question →
Q87. Q1087. A company needs to securely use AWS services and tools to share a dataset and a data schema with a partner. The partner needs to use Amazon Athena to query the data.Which solution will meet these requirements?
- A. Use an AWS Transfer Family SFTP-enabled server to export the dataset and to share the dataset with the partner.
- B. Create a custom API to expose the dataset. Create an Application Load Balancer (ALB). Add the custom API as a target of the ALB.
- C. Create AWS Lambda functions to expose the dataset. Create an Amazon API Gateway HTTP API. Add the Lambda functions as targets of the HTTP API.
- D. Create an Amazon DataZone domain and portal. Publish the dataset. Ensure the partner subscribes to the dataset.
View question →
Q88. Q1088. A media company stores movies in an Amazon S3 bucket. The movie files range in size from 1 GB to 10 GB.The company wants to make the movies available for purchase to customers. The company must be able to stream movies to customers within 5 minutes of a customer purchase. There is higher demand for movies that are less than 20 years old than for movies that are more than 20 years old. The company wants to optimize hosting costs based on demand.Which solution will meet these requirements?
- A. Store the movies in Amazon S3. Use S3 Lifecycle policies to move files to the Infrequent Access tier when the demand for a movie decreases.
- B. Store movies that are less than 20 years old in Amazon S3 Standard. Store movies that are older than 20 years in S3 Standard- Infrequent Access (S3 Standard-IA). When a user orders an older movie, retrieve the file by using standard retrieval.
- C. Store movies that are less than 20 years old in Amazon S3 Intelligent-Tiering. Store movies that are older than 20 years in S3 Glacier Flexible Retrieval. When a user orders an older movie, retrieve the file by using expedited retrieval.
- D. Store movies that are 1ess than 20 years old in Amazon S3 Standard. Store movies that are older than 20 years in S3 G1acier Flexible Retrieval. When a user orders an older movie, retrieve the video file by using bulk retrieval.
View question →
Q89. Q1089. A company is developing a social media application. The company anticipates rapid and unpredictable growth in users and data volume. The application needs to handle a continuous high volume of user requests. User requests include long-running processes that store large amounts of user-generated content and user profiles in a relational format. The processes must run in a specific order.The company requires an architecture that can scale resources to meet demand spikes without downtime or performance degradation. The company must ensure that the components of the application can evolve independently without affecting other parts of the system.Which combination of AWS services will meet these requirements?
- A. Deploy the application on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. Use Amazon RDS as the database. Use Amazon Simple Queue Service (Amazon SQS) to decouple message processing between components.
- B. Deploy the application on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. Use Amazon RDS as the database. Use Amazon Simple Notification Service (Amazon SNS) to decouple message processing between components.
- C. Use Amazon DynamoDB as the database. Use AWS Lambda functions to implement the application.Configure Amazon DynamoDB Streams to invoke the Lambda functions. Use AWS Step Functions to manage workflows between services.
- D. Use an AWS Elastic Beanstalk environment with auto scaling to deploy the application. Use Amazon RDS as the database. Use Amazon Simple Notification Service (Amazon SNS) to decouple message processing between components.
View question →
Q90. Q1090. A company is building a serverless application to process orders from an ecommerce site. The application needs to handle bursts of traffic during peak usage hours and to maintain high availability. The orders must be processed asynchronously in the order the applicationreceives them.Which solution will meet these requirements?
- A. Use an Amazon Simple Notification Service (Amazon SNS) topic to receive orders. Use an AWS Lambda function to process the orders.
- B. Use an Amazon Simple Queue Service (Amazon SQS) FIFO queue to receive orders. Use an AWS Lambda function to process the orders.
- C. Use an Amazon Simple Queue Service (Amazon SQS) standard queue to receive orders. Use AWS Batch jobs to process the orders.
- D. Use an Amazon Simple Notification Service (Amazon SNS) topic to receive orders. Use AWS Batch jobs to process the orders.
View question →
Q91. Q1091. A company wants to migrate an application that processes logs to AWS. Currently, the application runs on an on-premises storage area network (SAN).The application reads and processes large log files sequentially. The application requires throughput of up to 500 MBps.A solutions architect needs to migrate the application with minimal change to the application architecture.Which solution will meet these requirements in the MOST cost-effective way?
- A. Use a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume with 500 MBps provisioned throughput.
- B. Use a Throughput Optimized HDD (st1) Amazon Elastic Block Store (Amazon EBS) volume with provisioned storage based on the throughput requirement.
- C. Use a Cold HDD (sc1) Amazon Elastic Block Store (Amazon EBS) volume with provisioned storage based on the throughput requirement.
- D. Use a Provisioned IOPS (io1) Amazon Elastic Block Store (Amazon EBS) volume with 500 MBps Provisioned throughput.
View question →
Q92. Q1092. A company runs workloads in 20 private VPCs. Each VPC has interface VPC endpoints for many AWS services. The company wants to optimize costs for its network architecture. The company must not use public IP addresses.Which solution will meet these requirements?
- A. Create a NAT gateway in each workload VPC. Remove the interface VPC endpoints. Update the VPC route tables to add a default route to the NAT gateway.
- B. Replace the interface VPC endpoints from each workload VPC with gateway endpoints. Update the VPC route tables to route traffic bound for the AWS services to the gateway endpoints.
- C. Create interface VPC endpoints and a transit gateway in a new central VPC. Use the transit gateway to connect the workload VPCs to the central VPC. Remove the interface VPC endpoints from the workload VPCs. Set up private hosted zones in the workload VPCs to direct traffic to the central VPC.
- D. Create gateway endpoints in a new central VPC. Use VPC peering to connect the workload VPCs to the central VPC. Remove the interface VPC endpoints from workload VPCs. Set up private hosted zones in the workload VPCs to direct traffic to the central VPC.
View question →
Q93. Q1093. A company runs a critical three-tier web application that consists of multiple virtual machines (VMs) and virtual databases in an on- premises environment. The company wants to set up a disaster recovery (DR) environment in AWS.The company requires a 15-minute recovery time objective (RT0). The company must be able to test the failover solution to validate the recovery. The solution must provide an automated failover mechanism.Which solution will meet these requirements?
- A. Use AWS Backup to create backups of the on-premises VMs and to restore the backups in AWS.Configure recovery to Amazon EC2 instances to meet the RTO requirement.
- B. Use AWS Database Migration Service (AWS DMS) to replicate the on-premises databases to Amazon RDS. Set up AWS Storage Gateway for baseline and incremental data replication to AWS to meet the RTO requirement.
- C. Use AWS DataSync and AWS Storage Gateway to migrate the baseline and incremental data to AWS.Use Amazon EC2, Amazon S3, and an Application Load Balancer to set up the DR environment.
- D. Use AWS Elastic Disaster Recovery to replicate the VMs incrementally to AWS. Configure Elastic Disaster Recovery to automate the DR process.
View question →
Q94. Q1094. A solutions architect is designing the architecture for a company website that is composed of static content. The company's target customers are located in the United States and Europe.Which architecture should the solutions architect recommend to MINIMIZE cost?
- A. Store the website files on Amazon S3 in the us-east-2 Region. Use an Amazon CloudFront distribution with the price class configured to limit the edge locations in use.
- B. Store the website files on Amazon S3 in the us-east-2 Region. Use an Amazon CloudFront distribution with the price class configured to maximize the use of edge locations.
- C. Store the website files on Amazon S3 in the us-east-2 Region and the eu-west-1 Region. Use an Amazon CloudFront geolocation routing policy to route requests to the closest Region to the user.
- D. Store the website files on Amazon S3 in the us-east-2 Region and the eu-west-1 Region. Use an Amazon CloudFront distribution with an Amazon Route 53 latency routing policy to route requests to the closest Region to the user.
View question →
Q95. Q1095. A media company hosts a web application on AWS. The application gives users the ability to upload and viewvideos. The application stores the videos in an Amazon S3 bucket.The company wants to ensure that only authenticated users can upload videos. Authenticated users must have theability to upload videos only within a specified time frame after authentication.Which solution will meet these requirements with the LEAST operational overhead?
- A. Configure the application to generate IAM temporary security credentials for authenticated users.
- B. Create an AWS Lambda function that generates pre-signed URLs when a user authenticates.
- C. Develop a custom authentication service that integrates with Amazon Cognito to control and log direct S3bucket access through the application.
- D. Use AWS Security Token Service (AWS STS) to assume a pre-defined IAM role that grants authenticated userstemporary permissions to upload videos directly to the S3 bucket.
View question →
Q96. Q1096. A company has an extract, transform, and load (ETL) job that receives and processes high volumes of messages. The load occasionally spikes during the day. The ETL job uses a customer data service that is hosted on premises.The company wants to enrich the incoming messages by using customer data. However, the customer data service canbecome unstable when managing large numbers of requests. The solution must protect the customer data service frombeing overloaded.Which solution meets these requirements with the LEAST operational overhead?
- A. Create an Amazon API Gateway HTTP API as a proxy to the customer data service. Enable API Gateway throttling todecrease the number of requests. Use the API in the message processor to enrich the messages by using customerdata.
- B. Create an Amazon API Gateway REST API as a proxy to the customer data service. Enable API Gateway caching on thecustomer identification key. Use the API in the message processor to enrich the messages by using customer data.
- C. Copy al1 customer data to an Amazon DynamoDB table. Enable Amazon API Gateway caching on the customer key. Create an API Gateway REST API as a proxy to perform the lookup in DynamoDB.
- D. Create an Amazon API Gateway REST API as a proxy to an AWS Lambda function. Configure the Lambda function to call the customer data service. Set a reserved concurrency for the Lambda function.
View question →
Q97. Q1097. A company wants to run a serverless application in a VPC for a short-term project. The application uses AWS Lambda functions. The application needs to interact with an on-premises database. The company wants to establish secure and cost-effective network connectivity between the Lambda functions and the on-premises database.Which solution will meet these requirements?
- A. Create an AWS Site-to-Site VPN connection between the on-premises network and the VPC.
- B. Use AWS Direct Connect to establish a dedicated network connection between the on-premises network and the VPC.
- C. Use a Gateway Load Balancer to establish a private connection between the Lambda functions and the on-premises network.
- D. Use AWS Transit Gateway to establish a hub-and-spoke network architecture that connects the on- premises network and the VPC.
View question →
Q98. Q1098. A company is designing a new Amazon Elastic Kubernetes Service (Amazon EKS) deployment to host multi-tenant applications that use a single cluster. The company wants to ensure that each pod has its own hosted environment. The environments must not share CPU, memory,storage,or elastic network interfaces.Which solution will meet these requirements?
- A. Use Amazon EC2 instances to host self-managed Kubernetes clusters. Use taints and tolerations to enforce isolation boundaries.
- B. Use Amazon EKS with AWS Fargate.Use Fargate to manage resources and to enforce isolation boundaries.
- C. Use Amazon EKS and self-managed node groups. Use taints and tolerations to enforce isolation boundaries.
- D. Use Amazon EKS and managed node groups. Use taints and tolerations to enforce isolation boundaries.
View question →
Q99. Q1099. A solutions architect is designing a web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The company strictly requires that the application be resilient against malicious internet activity and attacks, and protect against new common vulnerabilities and exposures.What should the solutions architect recommend?
- A. Leverage Amazon CloudFront with the ALB endpoint as the origin.
- B. Deploy an appropriate managed rule for AWS WAF and associate it with the ALB.
- C. Subscribe to AWS Shield Advanced and ensure common vulnerabilities and exposures are blocked.
- D. Configure network ACLs and security groups to allow only ports 80 and 443 to access the EC2 instances.
View question →
Q100. Q1100. A company is deploying a critical application by using Amazon RDS for MySQL. The application must be highly available and must recover automatically. The company needs to support interactive users (transactional queries) and batch reporting (analytical queries) with no more than a 4-hour lag. The analytical queries must not affect the performance of the transactional queries.Which solution will meet these requirements?
- A. Configure Amazon RDS for MySQL in a Multi-AZ DB instance deployment with one standby instance.Point the transactional queries to the primary DB instance. Point the analytical queries to a secondary DB instance that runs in a different Availability Zone.
- B. Configure Amazon RDS for MySQL in a Multi-AZ DB cluster deployment with two standby instances.Point the transactional queries to the primary DB instance. Point the analytical queries to the reader endpoint.
- C. Configure Amazon RDS for MySQL to use multiple read replicas across multiple Availability Zones.Point the transactional queries to the primary DB instance. Point the analytical queries to one of the replicas in a different Availability Zone.
- D. Configure Amazon RDS for MySQL as the primary database for the transactional queries with automated backups enabled. Configure automated backups. Each night, create a read-only database from the most recent snapshot to support the analytical queries. Terminate the previously created database.
View question →