Q1101. An application team uses an organization in AWS Organizations to manage multiple AWS accounts in a dedicated Organizational Unit (OU). The accounts do not host production workloads. The application team exceeds its budget every month. A solutions architect needs to implement controls to prevent the application team from exceeding the team's budget.Which solution will meet this requirement?

B. Create a fixed monthly budget in AWS Budgets. Create a budget action to apply a service control policy (SCP) to the OU to deny additional usage when the team reaches the monthly budget.

A. Create a usage report in AWS Cost Explorer.Set up automated alerts to notify the application team when usage exceeds the budget so the team can take immediate actions to reduce costs.

B. Create a fixed monthly budget in AWS Budgets. Create a budget action to apply a service control policy (SCP) to the OU to deny additional usage when the team reaches the monthly budget.

C. Create an Amazon CloudWatch metric and a ClourWatch alarm for the application team's usage.Configure an AWS Lambda to use predefined tags to identify and stop nonessential services.

D. Use AWS Cost Anomaly Detection to monitor the application team's usage and to alert the application team about unexpected spending patterns.

Q1102. A company uses Amazon Elastic Container Service (Amazon ECS) to run workloads that belong to service teams. Each service team uses an owner tag to specify the ECS containers that the team owns. The company wants to generate an AWS Cost Explorer report that shows how much each service team spends on ECS containers on a monthly basis.Which combination of steps will meet these requirements in the MOST operationally efficient way? (Select TWO.)

B. Create a custom report in Cost Explorer. Apply a filter for the owner resource tag.

E. Activate the owner tag as a cost allocation tag. Group the Cost Explorer report by the owner cost allocation tag.

A. Create a custom report in Cost Explorer. Apply a filter for Amazon ECS.

B. Create a custom report in Cost Explorer. Apply a filter for the owner resource tag.

C. Set up AWS Compute Optimizer. Review the rightsizing recommendations.

D. Activate the owner tag as a cost allocation tag. Group the Cost Explorer report by linked account.

E. Activate the owner tag as a cost allocation tag. Group the Cost Explorer report by the owner cost allocation tag.

Q1103. A company is deploying a new SFTP service. The service consists of Amazon EC2 instances in an Auto Scaling group that spans two Availability Zones and a shared Amazon Elastic File System (Amazon EFS) file system. The service is behind a Network Load Balancer (NLB) that has a security group attached. A solutions architects needs to grant a list of IP address access to the new service.Which solution will meet this requirement?

B. Add an inbound rule to the NLB security group that allows TCP Port 22 traffic from the IP addresses.Add an inbound rule to the security group referenced by the Auto Scaling group that allows TCP Port 22 traffic from the NLB security group.

A. Edit the default network ACL to add an inbound rule for Port 22 and an outbound rule for Ports 32768- 61000 for the subnet that contains the NLB and the Auto Scaling group. Add a rule to deny all other traffic.

B. Add an inbound rule to the NLB security group that allows TCP Port 22 traffic from the IP addresses.Add an inbound rule to the security group referenced by the Auto Scaling group that allows TCP Port 22 traffic from the NLB security group.

C. Add an inbound rule to the NLB security group that allows TCP Port 22 traffic from the IP addresses.Add an inbound rule to the security group referenced by the Auto Scaling group to allow all traffic from the NLB security group.

D. Add an inbound rule to the NLB security group that allows TCP Port 22 from 0.0.0.0/0. Add an inbound rule to the security group referenced by the Auto Scaling group that allows TCP Port 22 traffic from the NLB security group.

Q1104. A company runs a critical three-tier web application that consists of multiple virtual machines (VMs) and virtual databases in an on-premises environment. The company wants to set up a disaster recovery (DR) environment in AWS.The company requires a 15-minute recovery time objective (RT0). The company must be able to test the failover solution to validate the recovery. The solution must provide an automated failover mechanism.Which solution will meet these requirements?

D. Use AWS Elastic Disaster Recovery to replicate the VMs incrementally to AWS. Configure Elastic Disaster Recovery to automate the DR process.

A. Use AWS Backup to create backups of the on-premises VMs and to restore the backups in AWS.Configure recovery to Amazon EC2 instances to meet the RTO requirement.

B. Use AWS Database Migration Service (AWS DMS) to replicate the on-premises databases to Amazon RDS.Set up AWS Storage Gateway for baseline and incremental data replication to AWS to meet the RTO requirement.

C. Use AWS DataSync and AWS Storage Gateway to migrate the baseline and incremental data to AWS.Use Amazon EC2, Amazon S3, and an Application Load Balancer to set up the DR environment.

D. Use AWS Elastic Disaster Recovery to replicate the VMs incrementally to AWS. Configure Elastic Disaster Recovery to automate the DR process.

Q1105. A company wants to analyze and generate reports to track the usage of its mobile app. The app is popular and has a global user base. The company uses a custom report building program to analyze application usage.The program generates multiple reports during the last week of each month. The program takes less than l0 minutes to produce each report. The company rarely uses the program to generate reports outside of the last week of each month. The company wants to generate reports in the least amount of time when the reports are requested.Which solution will meet these requirements MOST cost-effectively?

B. Run the program in AWS Lambda. Create an Amazon EventBridge rule to run a Lambda function when reports are requested.

A. Run the program by using Amazon EC2 On-Demand Instances. Create an Amazon EventBridge rule to start the EC2 instances when reports are requested. Run the EC2 instances continuously during the last week of each month.

B. Run the program in AWS Lambda. Create an Amazon EventBridge rule to run a Lambda function when reports are requested.

C. Run the program in Amazon Elastic Container Service (Amazon ECS). Schedule Amazon ECS to run the program when reports are requested.

D. Run the program by using Amazon EC2 Spot Instances. Create an Amazon EventBridge rule to start the EC2 instances when reports are requested. Run the EC2 instances continuously during the last week of each month.

Q1106. A company is building a cloud storage and sharing application for photos. Users can upload photos from their computers and mobile phones to be stored durably in the cloud. After photos are uploaded, most are shared and downloaded frequently for the first 40-90 days. The photos are generally accessed less often after 90 days, but some photos maintain a high access rate. The application initially stores photos in Amazon S3 Standard.A solutions architect needs to reduce the application's operational costs without sacrificing user experience or data durability.Which strategy should the solutions architect use to meet these requirements MOST cost-effectively?

C. Define an S3 Lifecycle rule to transition objects from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) after 65 days.

A. Define an S3 Lifecycle rule to transition objects to S3 Intelligent-Tiering immediately.

B. Define an S3 Lifecycle rule to transition objects from S3 Standard to S3 Glacier Deep Archive after 90 days.

C. Define an S3 Lifecycle rule to transition objects from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) after 65 days.

D. Define an S3 Lifecycle rule to transition objects from S3 Standard to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 90 days.

Q1107. A company has a large workload that runs every Friday evening. The workload runs on Amazon EC2 instances that are in two Availability Zones in the us-east-l Region. Normally,the company must run no more than two instances at all times.However, the company wants to scale up to six instances each Friday to handle a regularly repeating increased workload. Which solution will meet these requirements with the LEAST operational overhead?

B. Create an Auto Scaling group that has a scheduled action.

A. Create a reminder in Amazon EventBridge to scale the instances.

B. Create an Auto Scaling group that has a scheduled action.

C. Create an Auto Scaling group that uses manual scaling.

D. Create an Auto Scaling group that uses automatic scaling.

Q1108. A company has an organization in AWS Organizations that has all features enabled. The company has multiple Amazon S3 buckets in multiple AWS Regions around the world. The S3 buckets contain sensitive data.The company needs to ensure that no personally identifiable information (PII) is stored in the S3 buckets. The company also needs a scalable solution to identify PII.Which solution will meet these requirements?

A. In the Organizations management account, configure an Amazon Macie administrator IAM user as the delegated administrator for the global organization.Use the Macie administrator user to configure Macie settings to scan for PII.

B. For each Region in the Organizations management account, designate a delegated Amazon Macie administrator account. In the Macie administrator account, add all accounts in the organization. Use the Macie administrator account to enable Macie. Configure automated sensitive data discovery for all accounts in the organization.

C. For each Region in the Organizations management account, configure a service control policy (SCP) to identify PII. Apply the SCP to the organization root.

D. In the Organizations management account, configure AWS Lambda functions to scan for PII in each Region.

Q1110. A company has a social media application that is experiencing rapid user growth.The current architecture uses t-family Amazon EC2 instances. The current architecture struggles to handle the increasing number of user posts and images. The application experiences performance slowdowns during peak usage times. A solutions architect needs to design an updated architecture that will resolve the performance issues and scale as usage increases.Which solution will meet these requirements with the LEAST operational overhead?

C. Use an Amazon API Gateway REST API and AWS Lambda functions to process requests. Store account information in Amazon DynamoDB. Use Amazon S3 to store posts and images.

A. Use the largest Amazon EC2 instance in the same family to host the application. Install a relational database on the instance to store all account information and to store posts and images.

B. Use Amazon Simple Queue Service (Amazon SQS) to buffer incoming posts. Use a larger EC2 instance in the same family to host the application. Store account information in Amazon DynamoDB.Store posts and images in the local EC2 instance file system

C. Use an Amazon API Gateway REST API and AWS Lambda functions to process requests. Store account information in Amazon DynamoDB. Use Amazon S3 to store posts and images.

D. Deploy multiple EC2 instances in the same family. Use an Application Load Balancer to distribute traffic. Use a shared file system to store account information and to store posts and images.

AWS SAA-C03 Chapter 15 Free Practice Test 2025 — Solutions Architect Associate Exam Questions

AWS SAA-C03 Chapter 15 Practice Questions (100 Questions)

Practice questions for the AWS SAA-C03 (Solutions Architect Associate) exam, Chapter 15.

Q1. Q1101. An application team uses an organization in AWS Organizations to manage multiple AWS accounts in a dedicated Organizational Unit (OU). The accounts do not host production workloads. The application team exceeds its budget every month. A solutions architect needs to implement controls to prevent the application team from exceeding the team's budget.Which solution will meet this requirement?
- A. Create a usage report in AWS Cost Explorer.Set up automated alerts to notify the application team when usage exceeds the budget so the team can take immediate actions to reduce costs.
- B. Create a fixed monthly budget in AWS Budgets. Create a budget action to apply a service control policy (SCP) to the OU to deny additional usage when the team reaches the monthly budget.
- C. Create an Amazon CloudWatch metric and a ClourWatch alarm for the application team's usage.Configure an AWS Lambda to use predefined tags to identify and stop nonessential services.
- D. Use AWS Cost Anomaly Detection to monitor the application team's usage and to alert the application team about unexpected spending patterns.
View question →
Q2. Q1102. A company uses Amazon Elastic Container Service (Amazon ECS) to run workloads that belong to service teams. Each service team uses an owner tag to specify the ECS containers that the team owns. The company wants to generate an AWS Cost Explorer report that shows how much each service team spends on ECS containers on a monthly basis.Which combination of steps will meet these requirements in the MOST operationally efficient way? (Select TWO.)
- A. Create a custom report in Cost Explorer. Apply a filter for Amazon ECS.
- B. Create a custom report in Cost Explorer. Apply a filter for the owner resource tag.
- C. Set up AWS Compute Optimizer. Review the rightsizing recommendations.
- D. Activate the owner tag as a cost allocation tag. Group the Cost Explorer report by linked account.
- E. Activate the owner tag as a cost allocation tag. Group the Cost Explorer report by the owner cost allocation tag.
View question →
Q3. Q1103. A company is deploying a new SFTP service. The service consists of Amazon EC2 instances in an Auto Scaling group that spans two Availability Zones and a shared Amazon Elastic File System (Amazon EFS) file system. The service is behind a Network Load Balancer (NLB) that has a security group attached. A solutions architects needs to grant a list of IP address access to the new service.Which solution will meet this requirement?
- A. Edit the default network ACL to add an inbound rule for Port 22 and an outbound rule for Ports 32768- 61000 for the subnet that contains the NLB and the Auto Scaling group. Add a rule to deny all other traffic.
- B. Add an inbound rule to the NLB security group that allows TCP Port 22 traffic from the IP addresses.Add an inbound rule to the security group referenced by the Auto Scaling group that allows TCP Port 22 traffic from the NLB security group.
- C. Add an inbound rule to the NLB security group that allows TCP Port 22 traffic from the IP addresses.Add an inbound rule to the security group referenced by the Auto Scaling group to allow all traffic from the NLB security group.
- D. Add an inbound rule to the NLB security group that allows TCP Port 22 from 0.0.0.0/0. Add an inbound rule to the security group referenced by the Auto Scaling group that allows TCP Port 22 traffic from the NLB security group.
View question →
Q4. Q1104. A company runs a critical three-tier web application that consists of multiple virtual machines (VMs) and virtual databases in an on-premises environment. The company wants to set up a disaster recovery (DR) environment in AWS.The company requires a 15-minute recovery time objective (RT0). The company must be able to test the failover solution to validate the recovery. The solution must provide an automated failover mechanism.Which solution will meet these requirements?
- A. Use AWS Backup to create backups of the on-premises VMs and to restore the backups in AWS.Configure recovery to Amazon EC2 instances to meet the RTO requirement.
- B. Use AWS Database Migration Service (AWS DMS) to replicate the on-premises databases to Amazon RDS.Set up AWS Storage Gateway for baseline and incremental data replication to AWS to meet the RTO requirement.
- C. Use AWS DataSync and AWS Storage Gateway to migrate the baseline and incremental data to AWS.Use Amazon EC2, Amazon S3, and an Application Load Balancer to set up the DR environment.
- D. Use AWS Elastic Disaster Recovery to replicate the VMs incrementally to AWS. Configure Elastic Disaster Recovery to automate the DR process.
View question →
Q5. Q1105. A company wants to analyze and generate reports to track the usage of its mobile app. The app is popular and has a global user base. The company uses a custom report building program to analyze application usage.The program generates multiple reports during the last week of each month. The program takes less than l0 minutes to produce each report. The company rarely uses the program to generate reports outside of the last week of each month. The company wants to generate reports in the least amount of time when the reports are requested.Which solution will meet these requirements MOST cost-effectively?
- A. Run the program by using Amazon EC2 On-Demand Instances. Create an Amazon EventBridge rule to start the EC2 instances when reports are requested. Run the EC2 instances continuously during the last week of each month.
- B. Run the program in AWS Lambda. Create an Amazon EventBridge rule to run a Lambda function when reports are requested.
- C. Run the program in Amazon Elastic Container Service (Amazon ECS). Schedule Amazon ECS to run the program when reports are requested.
- D. Run the program by using Amazon EC2 Spot Instances. Create an Amazon EventBridge rule to start the EC2 instances when reports are requested. Run the EC2 instances continuously during the last week of each month.
View question →
Q6. Q1106. A company is building a cloud storage and sharing application for photos. Users can upload photos from their computers and mobile phones to be stored durably in the cloud. After photos are uploaded, most are shared and downloaded frequently for the first 40-90 days. The photos are generally accessed less often after 90 days, but some photos maintain a high access rate. The application initially stores photos in Amazon S3 Standard.A solutions architect needs to reduce the application's operational costs without sacrificing user experience or data durability.Which strategy should the solutions architect use to meet these requirements MOST cost-effectively?
- A. Define an S3 Lifecycle rule to transition objects to S3 Intelligent-Tiering immediately.
- B. Define an S3 Lifecycle rule to transition objects from S3 Standard to S3 Glacier Deep Archive after 90 days.
- C. Define an S3 Lifecycle rule to transition objects from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) after 65 days.
- D. Define an S3 Lifecycle rule to transition objects from S3 Standard to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 90 days.
View question →
Q7. Q1107. A company has a large workload that runs every Friday evening. The workload runs on Amazon EC2 instances that are in two Availability Zones in the us-east-l Region. Normally,the company must run no more than two instances at all times.However, the company wants to scale up to six instances each Friday to handle a regularly repeating increased workload. Which solution will meet these requirements with the LEAST operational overhead?
- A. Create a reminder in Amazon EventBridge to scale the instances.
- B. Create an Auto Scaling group that has a scheduled action.
- C. Create an Auto Scaling group that uses manual scaling.
- D. Create an Auto Scaling group that uses automatic scaling.
View question →
Q8. Q1108. A company has an organization in AWS Organizations that has all features enabled. The company has multiple Amazon S3 buckets in multiple AWS Regions around the world. The S3 buckets contain sensitive data.The company needs to ensure that no personally identifiable information (PII) is stored in the S3 buckets. The company also needs a scalable solution to identify PII.Which solution will meet these requirements?
- A. In the Organizations management account, configure an Amazon Macie administrator IAM user as the delegated administrator for the global organization.Use the Macie administrator user to configure Macie settings to scan for PII.
- B. For each Region in the Organizations management account, designate a delegated Amazon Macie administrator account. In the Macie administrator account, add all accounts in the organization. Use the Macie administrator account to enable Macie. Configure automated sensitive data discovery for all accounts in the organization.
- C. For each Region in the Organizations management account, configure a service control policy (SCP) to identify PII. Apply the SCP to the organization root.
- D. In the Organizations management account, configure AWS Lambda functions to scan for PII in each Region.
View question →
Q9. Q1109. A company is hosting multiple websites for several lines of business under its registered parent domain. Users accessing these websites will be routed to appropriate backend Amazon EC2 instances based on the subdomain. The websites host static webpages, images, and server-side scripts like PHP and JavaScript.Some of the websites experience peak access during the first two hours of business with constant usage throughout the rest of the day. A solutions architect needs to design a solution that will automatically adjust capacity to these traffic patterns while keeping costs low. Which combination of AWS services or features will meet these requirements? (Select TWO.)
- A. AWS Batch
- B. Network Load Balancer
- C. Application Load Balancer
- D. Amazon EC2 Auto Scaling
- E. Amazon S3 website hosting
View question →
Q10. Q1110. A company has a social media application that is experiencing rapid user growth.The current architecture uses t-family Amazon EC2 instances. The current architecture struggles to handle the increasing number of user posts and images. The application experiences performance slowdowns during peak usage times. A solutions architect needs to design an updated architecture that will resolve the performance issues and scale as usage increases.Which solution will meet these requirements with the LEAST operational overhead?
- A. Use the largest Amazon EC2 instance in the same family to host the application. Install a relational database on the instance to store all account information and to store posts and images.
- B. Use Amazon Simple Queue Service (Amazon SQS) to buffer incoming posts. Use a larger EC2 instance in the same family to host the application. Store account information in Amazon DynamoDB.Store posts and images in the local EC2 instance file system
- C. Use an Amazon API Gateway REST API and AWS Lambda functions to process requests. Store account information in Amazon DynamoDB. Use Amazon S3 to store posts and images.
- D. Deploy multiple EC2 instances in the same family. Use an Application Load Balancer to distribute traffic. Use a shared file system to store account information and to store posts and images.
View question →
Q11. Q1111. A company launches a new web application that uses an Amazon Aurora PostgreSQL database. The company wants to add new features to the application that rely on AI. The company requires vector storage capability to use AI tools.Which solution will meet this requirement MOST cost-effectively?
- A. Use Amazon OpenSearch Service to create an OpenSearch service. Configure the application to write vector embeddings to a vector index.
- B. Create an Amazon DocumentDB cluster. Configure the application to write vector embeddings to a vector index.
- C. Create an Amazon Neptune ML cluster. Configure the application to write vector embeddings to a vector graph.
- D. Install the pgvector extension on the Aurora PostgreSQL database. Configure the application to write vector embeddings to a vector table.
View question →
Q12. Q1112. A software as a service (SaaS) company uses AWS Organizations to manage its AWS accounts. The company uses a central security account to manage security-related services such as AWS Config and AWS Security Hub.To gather data for the service that the company provides, the company runs a large number of Amazon EMR jobs in an account on an Amazon EC2 fleet that includes hundreds of instances for each job. The company launches EC2 instances by using a launch template definition. The company wants to monitor workload compliance and security findings. Which combination of solutions will meet these requirements MOST cost-effectively? (Select TWO.)
- A. Use Spot Instances to host the EMR jobs.
- B. Configure AWS Config to record items on a daily basis.
- C. Configure AWS Config to record items on an hourly basis.
- D. Use Reserved Instances to host the EMR jobs.
- E. Exclude the account that runs the EMR workloads from AWS Config.
View question →
Q13. Q1113. A company runs production workloads in its AWS account. Multiple teams create and maintain the workloads.The company needs to be able to detect changes in resource configurations. The company needs to capture changes as configuration items without changing or modifying the existing resources.Which solution will meet these requirements?
- A. Use AWS Config. Start the configuration recorder for AWS resources to detect changes in resource configurations.
- B. Use AWS CloudFormation. Initiate drift detection to capture changes in resource configurations.
- C. Use Amazon Detective to detect, analyze, and investigate changes in resource configurations.
- D. Use AWS Audit Manager to capture management events and global service events for resource configurations.
View question →
Q14. Q1114. A company is building a serverless web application with multiple interdependent workflows that millions of users worldwide will access. The application needs to handle bursts of traffic. Which solution will meet these requirements MOST cost-effectively?
- A. Deploy an Amazon API Gateway HTTP API with a usage plan and throttle settings. Use AWS Step Functions with a Standard Workflow.
- B. Deploy an Amazon API Gateway HTTP API with a usage plan and throttle settings. Use AWS Step Functions with an Express Workflow.
- C. Deploy an Amazon API Gateway HTTP API without a usage plan. Use AWS Step Functions with an Express Workflow.
- D. Deploy an Amazon API Gateway HTTP API without a usage plan. Use AWS Step Functions and multiple AWS Lambda functions with reserved concurrency.
View question →
Q15. Q1115. A solutions architect is designing the architecture for a web application that has a frontend and a backend. The backend services must receive data from the frontend services for processing. The frontend must manage access to the application by using API keys. The backend must scale without affecting the frontend.Which solution will meet these requirements?
- A. Deploy an Amazon API Gateway HTTP API as the frontend to direct traffic to an Amazon Simple Queue Service (Amazon SQS) queue. Use AWS Lambda functions as the backend to read from the queue.
- B. Deploy an Amazon API Gateway REST API as the frontend to direct traffic to an Amazon Simple Queue Service (Amazon SQS) queue. Use Amazon Elastic Container Service (Amazon ECS) on AWS Fargate as the backend to read from the queue.
- C. Deploy an Amazon API Gateway REST API as the frontend to direct traffic to an Amazon Simple Notification Service (Amazon SNS) topic. Use AWS Lambda functions as the backend. Subscribe the Lambda functions to the topic.
- D. Deploy an Amazon API Gateway HTTP API as the frontend to direct traffic to an Amazon Simple Notification Service (Amazon SNS) topic. Use Amazon Elastic Kubernetes Service (Amazon EKS) on AWS Fargate as the backend. Subscribe Amazon EKS to the topic.
View question →
Q16. Q1116. A company hosts a stateless web application with low data storage in a single AWS Region. The company wants to increase the resiliency of the application to include a multi-Region presence. The company wants to set the recovery time objective (RTO) and recovery point objective (RPO) to hours. The company needs a low-cost and low-complexitydisaster recovery (DR) strategy.Which DR strategy should the company use?
- A. Warm standby
- B. Pilot light
- C. Backup and restore
- D. Multi-site active-active
View question →
Q17. Q1117. A company has an ecommerce site. The site is designed as a distributed web application that is hosted in multiple AWS accounts that are in one organization in AWS Organizations The web application is comprised of multiple microservices. All microservices expose their AWS services either through Amazon CloudFront distributions or public Application Load Balancers (ALBs). The company wants to protect public endpoints from malicious attacks. The company also wants to monitor security configurations.Which solution will meet these requirements with the LEAST operational overhead?
- A. Use AWS WAF to protect the public endpoints. Use AWS Firewall Manager from a dedicated security account to manage rules in AWS WAF. Use AWS Config rules to monitor the Regional and global WAF configurations.
- B. Use AWS WAF to protect the public endpoints. Apply AWS WAF rules in each account. Use AWS Config rules and AWS Security Hub to monitor the WAF configurations of the ALBs and the CloudFront distributions.
- C. Use AWS WAF to protect the public endpoints. Use AWS Firewall Manager from a dedicated security account to manage the rules in AWS WAF. Use Amazon Inspector and AWS Security Hub to monitor the WAF configurations of the ALBs and the CloudFront distributions.
- D. Use AWS Shield Advanced to protect the public endpoints. Use AWS Config rules to monitor the Shield Advanced configuration for each account.
View question →
Q18. Q1118. A company wants to restrict access to the content of its web application. The company needs to protect the content by using authorization techniques that are available on AWS. The company also wants to implement a serverless architecture for authorization and authentication that has low login latency.The solution must integrate with the web application and serve web content globally. The application currently has a small user base, but the company expects the application's user base to increase.Which solution will meet these requirements?
- A. Configure Amazon Cognito for authentication. Implement Lambda@Edge for authorization. Configure Amazon CloudFront to serve the web application globally.
- B. Configure AWS Directory Service for Microsoft Active Directory for authentication. Implement AWS Lambda for authorization.Use an Application Load Balancer to serve the web application globally.
- C. Configure Amazon Cognito for authentication. Implement AWS Lambda for authorization. Use Amazon S3 Transfer Acceleration to serve the web application globally.
- D. Configure AWS Directory Service for Microsoft Active Directory for authentication. Implement Lambda@Edge for authorization. Use AWS Elastic Beanstalk to serve the web application globally.
View question →
Q19. Q1119. A company runs a mobile game app on AWS. The app stores data for every user session. The data updates frequently during a gaming session. The app stores up to 256 KB for each session. Sessions can last up to 48 hours.The company wants to automate the deletion of expired session data. The company must be able to restore all session data automatically if necessary.Which solution will meet these requirements?
- A. Use an Amazon DynamoDB table to store the session data.Enable point-in-time recovery (PITR) and TTL for the table. Select the corresponding attribute for TTL in the session data.
- B. Use an Amazon MemoryDB table to store the session data. Enable point-in-time recovery(PITR) and TTL for the table. Select the corresponding attribute for TTL in the session data.
- C. Store session data in an Amazon S3 bucket. Use the S3 Standard storage class. Enable S3 Versioning for the bucket. Create an S3 Lifecycle configuration to expire objects after 48 hours.
- D. Store session data in an Amazon S3 bucket. Use the S3 Intelligent-Tiering storage class. Enable S3 Versioning for the bucket. Create an S3 Lifecycle configuration to expire objects after 48 hours.
View question →
Q20. Q1120. A company has a three-tier web application. An Application Load Balancer (ALB) is in front of Amazon EC2 instances that are in the ALB target group. An Amazon S3 bucket stores documents.The company requires the application to meet a recovery time objective (RTO) of 60 seconds.Which solution will meet this requirement?
- A. Replicate S3 objects to a second AWS Region. Create a second ALB and a minimum set of EC2 instances in the second Region. Ensure that the EC2 instances are shut down until they are needed.Configure Amazon Route 53 to fail over to the second Region by using an IP-based routing policy.
- B. Use AWS Backup to take hourly backups of the EC2 instances. Back up the S3 data to a second AWS Region. Use AWS CloudFormation to deploy the entire infrastructure in the second Region when needed.
- C. Create daily snapshots of the EC2 instances in a second AWS Region. Use the snapshots to recreate the instances in the second Region. Back up the S3 data to the second Region. Perform a failover by modifying the application DNS record when needed.
- D. Replicate S3 objects to a second AWS Region. Create a second ALB and a minimum set of EC2 instances in the second Region.Ensure that the EC2 instances in the second Region are running.Configure Amazon Route 53 to fail over to the secondary Region based on health checks.
View question →
Q21. Q1121. A company is designing a non-production application that runs on an Amazon EC2 instance that runs Windows Server.The EC2 instance has an Amazon Elastic Block Store(Amazon EBS) volume attached.The EC2 instance also has an instance profile. The instance needs to download and process large files from an Amazon S3 bucket.Which solution will meet these requirements in the MOST operationally efficient way?
- A. Use the AWS CLI to transfer the files from Amazon S3 to the EBS volume.
- B. Mount the S3 bucket as a file system on the EC2 instance by using Amazon Elastic File System (Amazon EFS).
- C. Use AWS Batch jobs to transfer the files from Amazon S3 to the EBS volume.
- D. Replace the EBS volume with an instance store volume. Use AWS Batch jobs to transfer the files from Amazon S3 to the instance store volume.
View question →
Q22. Q1122. A company runs a web application that uses Amazon RDS for MySQL to store relational data. Data in the database does not change frequently.A solutions architect notices that during peak usage times, the database has performance issues when it serves the data. The company wants to improve the performance of the database.Which combination of steps will meet these requirements?(Select TWO.)
- A. Integrate AWS WAF with the application.
- B. Create a read replica for the database. Redirect read traffic to the read replica.
- C. Create an Amazon ElastiCache (Memcached) cluster. Configure the application and the database to integrate with the cluster.
- D. Use the Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) storage class to store the data that changes infrequently.
- E. Migrate the database to Amazon DynamoDB. Configure the application to use the DynamoDB database.
View question →
Q23. Q1123. A company is designing a website that displays stock market prices to users.The company wants to use Amazon ElastiCache (Redis OSS) for the data caching layer. The company needs to ensure that the website's data caching layer can automatically fail over to another node if necessary.Which solution will meet this requirement?
- A. Enable read replicas in ElastiCache (Redis OSS).Promote the read replica when necessary.
- B. Enable Multi-AZ in ElastiCache (Redis OSS).Fail over to a second node when necessary.
- C. Export a backup of the ElastiCache (Redis OSS) cache to an Amazon S3 bucket. Restore the cache to a second cluster when necessary.
- D. Export a backup of the ElastiCache (Redis OSS) cache by using AWS Backup.Restore the cache to a second cluster when necessary.
View question →
Q24. Q1124. A company deployed an application in two AWS Regions. If the application becomes unavailable in one Region, the application must fail over to the second Region.The failover process must avoid stale DNS client caches. The company wants to use one endpoint to access both copies of the application.Which solution will meet these requirements?
- A. Use an Amazon CloudFront distribution that has multiple origins. Correlate each origin with the application in each Region.
- B. Use an Amazon Route 53 weighted routing policy that uses equal weights to route client requests to the second Region if the application becomes unavailable in the original Region.
- C. Use AWS Global Accelerator, and assign a static anycast IP address to the application endpoint.
- D. Use an Amazon Route 53 IP-based routing policy to route requests to the second Region if the application becomes unavailable in the original Region.
View question →
Q25. Q1125. A company creates a new AWS account. The company wants to use multi-factor authentication (MFA) to secure root user access to the account.Which types of MFA can the company use to meet this requirement?(Select THREE.)
- A. Passkeys and security keys
- B. Virtual authenticator applications
- C. Access key pairs
- D. Hardware time-based one-time password (TOTP) token devices
- E. Windows Hello
- F. Certificate-based authentication
View question →
Q26. Q1126. A company is launching a new gaming application. The company will use Amazon EC2 Auto Scaling groups to deploy the application. The application stores user data in a relational database.The company has office locations around the world that need to run analytics on the user data in the database.The company needs a cost-effective database solution that provides cross-Region disaster recovery with low-latency read performance across AWS Regions.Which solution will meet these requirements?
- A. Create an Amazon ElastiCache (Redis OSS) cluster in the Region where the application is deployed.Create read replicas in Regions where the company offices are located.Ensure the company offices read from the read replica instances.
- B. Create Amazon DynamoDB global tables. Deploy the tables to the Regions where the company offices are located and to the Region where the application is deployed. Ensure that each company office reads from the tables that are in the same Region as the office.
- C. Create an Amazon Aurora global database. Configure the primary cluster to be in the Region where the application is deployed. Configure the secondary Aurora replicas to be in the Regions where the company offices are located. Ensure the company offices read from the Aurora replicas.
- D. Create an Amazon RDS Multi-AZ DB cluster deployment in the Region where the application is deployed. Ensure the company offices read from read replica instances.
View question →
Q27. Q1127. A company runs a monolithic application in its on-premises data center. The company used Java/Tomcat to build the application. The application uses Microsoft SQL Server as a database.The company wants to migrate the application to AWS.Which solution will meet this requirement with the LEAST operational overhead?
- A. Use AWS App2Container to containerize the application. Deploy the application on Amazon Elastic Kubernetes Service (Amazon EKS). Deploy the database to Amazon RDS for SQL Server. Configure a Multi-AZ deployment.
- B. Containerize the application and deploy the application on a self-managed Kubernetes cluster on an Amazon EC2 instance. Deploy the database on a separate EC2 instance. Set up Microsoft SQL Server Always On availability groups.
- C. Deploy the frontend of the web application as a website on Amazon S3. Use Amazon DynamoDB for the database tier.
- D. Use AWS App2Container to containerize the application. Deploy the application on Amazon Elastic Kubernetes Service (Amazon EKS). Use Amazon DynamoDB for the database tier.
View question →
Q28. Q1128. A company needs to run its external website on Amazon EC2 instances and on-premises virtualized servers. The AWS environment has a1 GB AWS Direct Connect connection to the data center. The application has IP addresses that will not change. The on-premises and AWS servers are able to restart themselves while maintaining the same IP address if a failure occurs. Some website users have to add their vendors to an allow list, so the solution must have a fixed IP address. The company needs a solution with the lowest operational overhead to handle this split traffic.What should a solutions architect do to meet these requirements?
- A. Deploy an Amazon Route 53 Resolver with rules pointing to the on-premises and AWS IP addresses.
- B. Deploy a Network Load Balancer on AWS. Create target groups for the on-premises and AWS IP addresses.
- C. Deploy an Application Load Balancer on AWS.Register the on-premises and AWS IP addresses with the target group.
- D. Deploy Amazon API Gateway to direct traffic to the on-premises and AWS IP addresses based on the header of the request.
View question →
Q29. Q1129. A company hosts a public web application on AWS. The website has a three-tier architecture. The frontend web tier is comprised of Amazon EC2 instances in an Auto Scaling group.The application tier is a second Auto Scaling group. The database tier is an Amazon RDS database.The company has configured the Auto Scaling groups to handle the application's normal level of demand. During an unexpected spike in demand, the company notices a long delay in the startup time when the frontend and application layers scale out. The company needs to improve the scaling performance of the application without negatively affecting the user experience.Which solution will meet these requirements MOST cost-effectively?
- A. Decrease the minimum number of EC2 instances for both Auto Scaling groups. Increase the desired number of instances to meet the peak demand requirement.
- B. Configure the maximum number of instances for both Auto Scaling groups to be the number required to meet the peak demand. Create a warm pool.
- C. Increase the maximum number of EC2 instances for both Auto Scaling groups to meet the normal demand requirement. Create a warm pool.
- D. Reconfigure both Auto Scaling groups to use a scheduled scaling policy. Increase the size of the EC2 instance types and the RDS instance types.
View question →
Q30. Q1130. A company runs complex workloads in Amazon RDS. The company frequently needs to create new Amazon RDS instances to perform tests.Some data is required to perform the tests.As the company has grown, the process to deploy testing instances has become time consuming. The company wants to automate the RDS deployment process.Which solution will meet this requirement with the LEAST operational overhead?
- A. Create a new RDS instance, import the required data,and take a snapshot of the new instance. Create an AWS CloudFormation template that builds a new RDS instance from the snapshot. Use the CloudFormation template to deploy new RDS instances.
- B. Use the AWS Management Console to take a snapshot of an existing RDS instance. Restore the snapshot to a new RDS instance. Create a script to delete the data and schema from new instances.Run the script from an Amazon EC2 instance to reset new RDS tables.
- C. Create an AWS CloudFormation template that builds a new RDS instance. Create a Python script to load the required data into a new instance. Run the script from an Amazon EC2 instance each time a new RDS instance is created.
- D. Create an AWS Lambda function that loads the required data on a target RDS instance. When a new RDS instance is created, update the Lambda function to target the new instance, and invoke the function.
View question →
Q31. Q1131. An ecommerce company is launching a new marketing campaign. The company anticipates the campaign to generate ten times the normal number of daily orders through the company's ecommerce application.The campaign will last 3 days.The ecommerce application architecture is based on Amazon EC2 instances in an Auto Scaling group and an Amazon RDS for MySQL database. The application writes order transactions to an Amazon Elastic File System (Amazon EFS) file system before the application writes orders to the database.During normal operations, the application write operations peak at 5,000 IOPS.A solutions architect needs to ensure that the application can handle the anticipated workload during the marketing campaign.Which solution will meet this requirement?
- A. For the duration of the campaign, increase the provisioned IOPS for the RDS for MySQL database. Set the Amazon EFS throughput mode to Bursting throughput.
- B. For the duration of the campaign, increase the provisioned IOPS for the RDS for MySQL database. Set the Amazon EFS throughput mode to Elastic throughput.
- C. Convert the database to a Multi-AZ deployment. Set the Amazon EFS throughput mode to Elastic throughput for the duration of the campaign.
- D. Use AWS Database Migration Service (AWS DMS) to convert the database to RDS for PostgreSQL.Set the Amazon EFS throughput mode to Bursting throughput.
View question →
Q32. Q1132. A company runs a website that serves static and dynamic content by using several Amazon EC2 instances that are in an Auto Scaling group.The company uses PHP to develop dynamic content. The current architecture includes an Application Load Balancer (ALB) that directs traffic to instances in the Auto Scaling group.Users report that website performance is degrading as the number of website users increases. The company needs to improve the performance of the website. The company creates an Amazon CloudFront distribution to serve content and sets an Amazon S3 bucket as an origin.Which additional steps will meet these requirements?
- A. Copy the static content to the S3 bucket. Migrate the dynamic content to a CloudFront function.
- B. Copy the static content to the S3 bucket. Configure the existing ALB as a second origin to serve the dynamic content.
- C. Copy the static content to the S3 bucket. Migrate the dynamic content to a Lambda@Edge function.
- D. Copy both the static and dynamic content to the S3 bucket.
View question →
Q33. Q1133. A genomics research company is designing a scalable architecture for a loosely coupled workload. Tasks in the workload are independent and can be processed in parallel. The architecture needs to minimize management overhead and provide automatic scaling based on demand.Which solution will meet these requirements MOST cost-effectively?
- A. Use a cluster of Amazon EC2 instances. Use AWS Systems Manager to manage the workload.
- B. Implement a serverless architecture that uses AWS Lambda functions.
- C. Use AWS ParallelCluster to deploy a dedicated high-performance cluster.
- D. Implement vertical scaling for each workload task.
View question →
Q34. Q1134. A company uses a single Amazon S3 bucket to store data that multiple business applications must access. The company hosts the applications on Amazon EC2 Windows instances that are in a VPC. The company configured a bucket policy for the S3 bucket to grant the applications access to the bucket.The company continually adds more business applications to the environment. As the number of business applications increases, the policy document becomes more difficult to manage. The S3 bucket policy document will soon reach its policy size quota. The company needs a solution to scale its architecture to handle more business applications.Which solution will meet these requirements in the MOST operationally efficient way?
- A. Migrate the data from the S3 bucket to an Amazon Elastic File System (Amazon EFS) volume. Ensure that all application owners configure their applications to use the EFS volume.
- B. Deploy an AWS Storage Gateway appliance for each application. Reconfigure the applications to use a dedicated Storage Gateway appliance to access the S3 objects instead of accessing the objects directly.
- C. Create a new S3 bucket for each application. Configure S3 replication to keep the new buckets synchronized with the original S3 bucket. Instruct application owners to use their respective S3 buckets.
- D. Create an S3 access point for each application. Instruct application owners to use their respective S3 access points.
View question →
Q35. Q1135. A company runs multiple applications in multiple AWS accounts within the same organization in AWS Organizations. A content management system(CMS) runs on Amazon EC2 instances in a VPC. The CMS needs to access shared files from an Amazon Elastic File System (Amazon EFS) file system that is deployed in a separate AWS account.The EFS account is in a separate VPC.Which solution will meet this requirement?
- A. Mount the EFS file system on the EC2 instances by using the EFS Elastic IP address.
- B. Enable VPC sharing between the two accounts. Use the EFS mount helper to mount the file system on the EC2 instances. Redeploy the EFS file system in a shared subnet.
- C. Configure AWS Systems Manager Run Command to mount the EFS file system on the EC2 instances.
- D. Install the amazon-efs-utils package on the EC2 instances. Add the mount target in the efs-config file.Mount the EFS file system by using the EFS access point.
View question →
Q36. Q1136. A company wants to store 100 TB of data in an Amazon S3 bucket for an indefinite period of time.The user access patterns for the data are unpredictable. Users require instant access to the data when required.Which solution will meet these requirements MOST cost-effectively?
- A. Store the data in the S3 Standard storage class. Create an S3 Lifecycle policy to move objects to S3 Glacier Deep Archive after 1 week.
- B. Store the data in the S3 Intelligent-Tiering storage class. Enable the S3 Glacier Deep Archive Access access tier.
- C. Store the data in the S3 Standard storage class. Create an S3 Lifecycle policy to move objects to S3 Express One Zone after 1 week.
- D. Store the data in the S3 Intelligent-Tiering storage class. Disable the Archive Access access tier and the Deep Archive Access access tier.
View question →
Q37. Q1137. A company is developing a new online gaming application. The application will run on Amazon EC2 instances in multiple AWS Regions and will have a high number of globally distributed users. A solutions architect must design the application to optimize network latency for the users.Which actions should the solutions architect take to meet these requirements?(Select TWO.)
- A. Configure AWS Global Accelerator. Create Regional endpoint groups in each Region where an EC2 fleet is hosted.
- B. Create a content delivery network (CDN) by using Amazon CloudFront. Enable caching for static and dynamic content, and specify a high expiration period.
- C. Integrate AWS Client VPN into the application. Instruct users to select which Region is closest to them after they launch the application. Establish a VPN connection to that Region.
- D. Create an Amazon Route 53 weighted routing policy. Configure the routing policy to give the highest weight to the EC2 instances in the Region that has the largest number of users.
- E. Configure an Amazon API Gateway endpoint in each Region where an EC2 fleet is hosted. Instruct users to select which Region is closest to them after they launch the application. Use the API Gateway endpoint that is closest to them.
View question →
Q38. Q1138. A media company is migrating a Microsoft Windows-based application to the AWS Cloud. The company uses the application to analyze media files.The company requires a resilient shared storage solution that the company can access by using the SMB protocol.Which storage solution will meet these requirements?
- A. Use an Amazon S3 bucket to store the media files. Connect the application servers to the bucket.
- B. Use Amazon FSx for Windows File Server in a Multi-AZ deployment as shared storage for the application servers.
- C. Use an Amazon Elastic Block Store (Amazon EBS) volume as shared storage for the application servers.
- D. Use an Amazon FSx File Gateway as shared storage for the application servers.
View question →
Q39. Q1139. An application uses an Amazon SQS queue and two AWS Lambda functions. One of the Lambda functions pushes messages to the queue, and the other function polls the queue and receives queued messages.A solutions architect needs to ensure that only the two Lambda functions can write to or read from the queue.Which solution will meet these requirements?
- A. Attach an IAM policy to the SQS queue that grants the Lambda function principals read and write access. Attach an IAM policy to the execution role of each Lambda function that denies all access to the SQS queue except for the principal of each function.
- B. Attach a resource-based policy to the SQS queue to deny read and write access to the queue for any entity except the principal of each Lambda function. Attach an IAM policy to the execution role of each Lambda function that allows read and write access to the queue.
- C. Attach a resource-based policy to the SQS queue that grants the Lambda function principals read and write access to the queue. Attach an IAM policy to the execution role of each Lambda function that allows read and write access to the queue.
- D. Attach a resource-based policy to the SQS queue to deny all access to the queue. Attach an IAM policy to the execution role of each Lambda function that grants read and write access to the queue.
View question →
Q40. Q1140. An international company needs to share data from an Amazon S3 bucket to employees who are located around the world. The company needs a secure solution to provide employees with access to the S3 bucket. The employees are already enrolled in AWS IAM Identity Center.Which solution will meet these requirements with the LEAST operational overhead?
- A. Create a help desk application to generate an Amazon S3 presigned URL for each employee.Configure the presigned URLs to have short expirations. Instruct employees to contact the company help desk to receive a presigned URL to access the S3 bucket.
- B. Create a group for Amazon S3 access in IAM Identity Center. Add the employees who require access to the S3 bucket to the group. Create an IAM policy to allow Amazon S3 access from them group.Instruct employees to use the AWS access portal to access the AWS Management Console and navigate to the S3 bucket.
- C. Create an Amazon S3 File Gateway. Create one share for data uploads and a second share for data downloads. Set up an SFTP service on an Amazon EC2 instance.Mount the shares to the EC2 instance. Instruct employees to use the SFTP server.
- D. Configure AWS Transfer Family SFTP endpoints. Select the custom identity provider option. Use AWS Secrets Manager to manage the user credentials. Instruct employees to use Transfer Family SFTP.
View question →
Q41. Q1141. A company stores critical data in a single Amazon S3 bucket in the us-east-1 Region. Versioning is enabled on the bucket. The company needs to make the data accessible in a second AWS Region.Which solution will meet this requirement?
- A. Create a second S3 bucket in a second Region. Enable versioning on the new bucket. Enable cross- Region replication between the buckets. Use a Network Load Balancer with health checks to fail over to the secondary Region if necessary.
- B. Create an Amazon CloudFront distribution that uses the S3 bucket as an origin. Create a second S3 bucket in a second Region. Enable versioning on the new bucket. Enable cross-Region replication between the buckets. Set a high TTL on the objects.
- C. Create a second S3 bucket in a second Region.Enable versioning on the new bucket. Associate an S3 Multi-Region Access Point with both buckets.Set both buckets to active.Create a two-way replication rule between the buckets.
- D. Create a second S3 bucket in a second Region. Enable versioning on the new bucket.Enable cross- Region replication between the buckets.Create an Amazon Route 53 health check based on an Amazon CloudWatch alarm for Amazon S3 latency. Fail over to the secondary Region if necessary.
View question →
Q42. Q1142. A solutions architect is creating a data reporting application that will send traffic through third-party network firewalls in an AWS security account. The firewalls and application servers must be load balanced.The application uses TCP connections to generate reports.The reports can run for several hours and can be idle for up to 1 hour. The reports must not time out during an idle period.Which solution will meet these requirements?
- A. Use a Gateway Load Balancer (GWLB) for the firewalls. Use an Application Load Balancer (ALB) for the application servers. Set the ALB idle timeout period to 1 hour.
- B. Use a single firewall in the security account. Use an Application Load Balancer (ALB) for the application servers. Set the ALB idle timeout and firewall idle timeout periods to 1 hour.
- C. Use a Gateway Load Balancer (GWLB) for the firewalls. Use an Application Load Balancer(ALB) for the application servers.Set the idle timeout periods for the ALB, the GWLB, and the firewalls to 1 hour.
- D. Use a Gateway Load Balancer(GWLB) for the firewalls. Use an Application Load Balancer(ALB) for the application servers. Configure the ALB idle timeout period to 1 hour. Increase the application server capacity to finish the report generation faster.
View question →
Q43. Q1143. A company has an industrial application that controls a process in real time. The company plans to rearchitect the application to distribute jobs across several Amazon EC2 instances in a VPC. The solution needs to maximize the network throughput and minimize the network latency between the instances.Which solution will meet these requirements?
- A. Place the instances in a host-level partition placement group. Choose instance types that support enhanced networking.
- B. Place the instances in several dedicated hosts in the same partition of a partition placement group.Choose dedicated hosts that support enhanced networking.
- C. Place the instances in several dedicated hosts in the same rack of a rack-level placement group.Choose dedicated hosts that support enhanced networking.
- D. Place the instances in a cluster placement group. Choose instance types that support enhanced networking.
View question →
Q44. Q1144. A company recently migrated a large amount of research data to an Amazon S3 bucket.The company needs an automated solution to identify sensitive data in the bucket. A security team also needs to monitor access patterns for the data 24 hours a day,7 days a week to identify suspicious activities or evidence of tampering with security controls.Which solution will meet these requirements?
- A. Set up AWS CloudTrail reporting, and grant the security team read only access to the CloudTrail reports. Set up an Amazon S3 Inventory report to identify sensitive data. Review the findings with the security team.
- B. Enable Amazon Macie and Amazon GuardDuty on the account. Grant the security team access to Macie and GuardDuty. Review the findings with the security team.
- C. Set up an Amazon S3 Inventory report. Use Amazon Athena and Amazon QuickSight to identify sensitive data. Create a dashboard for the security team to review findings.
- D. Use AWS Identity and Access Management(IAM) Access Advisor to monitor for suspicious activity and tampering. Create a dashboard for the security team. Set up an Amazon S3 Inventory report to identify sensitive data. Review the findings with the security team.
View question →
Q45. Q1145. A company operates an online photo-sharing service and stores data in AWS Account A in a centralized Amazon S3 bucket.The company wants to grant a second AWS account named Account B access to the centralized S3 bucket. The company owns Account B.Which solution will meet this requirement?
- A. Enable S3 Transfer Acceleration to provide Account B access to the centralized S3 bucket in Account A,
- B. Enable cross-Region replication between Account A and Account B to share the S3 bucket data.
- C. Use Amazon CloudFront to distribute the S3 bucket contents. Grant Account B access the bucket contents through a signed URL.
- D. Create a bucket policy that grants Account B permission to access the centralized S3 bucket in Account A,
View question →
Q46. Q1146. A company runs a web application in a single AWS Region. A solutions architect wants to ensure that the web application can continue to operate if the application becomes unavailable in the Region.Which solution will meet this requirement?
- A. Deploy the application in multiple Regions. Use Amazon Route 53 DNS health checks to route traffic to a healthy Region.
- B. Deploy the application in multiple Availability Zones within a single Region. Use Amazon Route 53 DNS health checks to route traffic to healthy application resources.
- C. Deploy the application in multiple Regions. Use an Amazon Route 53 simple routing record to route traffic to a healthy Region.
- D. Deploy the application in multiple Availability Zones within a single Region. Use an Amazon Route 53 latency record in each Availability Zone to route traffic to a healthy Availability Zone.
View question →
Q47. Q1147. A company is migrating a content management system (CMS) website to AWS. The company wants to host the application on multiple Amazon EC2 instances. The CMS relies on a relational database. All components must be highly available.Which solution will meet these requirements?
- A. Create an Application Load Balancer(ALB). Deploy two EC2 instances in one Availability Zone. Add the instances as ALB targets. Use an Amazon Elastic Block Store (Amazon EBS) volume on each instance to host the CMS files. Deploy an Amazon Aurora MySQL RDS instance to host the database.
- B. Create an Application Load Balancer(ALB). Deploy two EC2 instances in two Availability Zones. Add the instances as ALB targets. Use EC2 instance store volumes to host the CMS files. Deploy an Amazon Aurora MySQL RDS instance to host the database.
- C. Create an Application Load Balancer (ALB). Deploy two EC2 instances in two Availability Zones. Add the instances as ALB targets. Use an Amazon Elastic Block Store (Amazon EBS) volume on each instance to host the CMS files. Create an Amazon DynamoDB table to host the database.
- D. Create an Application Load Balancer (ALB). Deploy two EC2 instances in two Availability Zones. Add the instances as ALB targets. Create an Amazon Elastic File Store (Amazon EFS) volume. Attach the volume to both instances to host the CMS files. Deploy an Amazon Aurora MySQL RDS instance to host the database.
View question →
Q48. Q1148. A company is using an Amazon Redshift cluster to run analytics queries for multiple sales teams. In addition to the typical workload, on the last Monday morning of each month, thousands of users run reports. Users have reported slow response times during the monthly surge.The company must improve query performance without impacting the availability of the Redshift cluster.Which solution will meet these requirements?
- A. Resize the Redshift cluster by using the classic resize capability of Amazon Redshift before every monthly surge. Reduce the cluster to its original size after each surge.
- B. Resize the Redshift cluster by using the elastic resize capability of Amazon Redshift before every monthly surge. Reduce the cluster to its original size after each surge.
- C. Enable the concurrency scaling feature for the Redshift cluster for specific workload management (WLM) queues.
- D. Enable Amazon Redshift Spectrum for the Redshift cluster before every monthly surge.
View question →
Q49. Q1149. A company is designing the network for an online multi-player game. The game uses the UDP networking protocol and will be deployed in eight AWS Regions. The network architecture needs to minimize latency and packet loss to give end users a high-quality gaming experience.Which solution will meet these requirements?
- A. Set up a transit gateway in each Region. Create inter-Region peering attachments between each transit gateway.
- B. Set up AWS Global Accelerator with UDP listeners and endpoint groups in each Region.
- C. Set up Amazon CloudFront with UDP turned on. Configure an origin in each Region.
- D. Set up a VPC peering mesh between each Region.Turn on UDP for each VPC.
View question →
Q50. Q1150. A company is planning to migrate customer records to an Amazon S3 bucket. The company needs to ensure that customer records are protected against unauthorized access and are encrypted in transit and at rest. The company must monitor all access to the S3 bucket.What solution will meet these requirements with the LEAST operational overhead?
- A. Use AWS Key Management Service (AWS KMS) to encrypt customer records at rest. Create an S3 bucket policy that includes the aws:SecureTransport condition. Use an IAM policy to control access to the records. Use AWS CloudTrail to monitor access to the records.
- B. Use AWS Nitro Enclaves to encrypt customer records at rest. Use AWS Key Management Service (AWS KMS) to encrypt the records in transit. Use an IAM policy to control access to the records. Use AWS CloudTrail and AWS Security Hub to monitor access to the records.
- C. Use AWS Key Management Service (AWS KMS) to encrypt customer records at rest. Create an Amazon Cognito user pool to control access to the records.Use AWS CloudTrail to monitor access to the records. Use Amazon GuardDuty to detect threats.
- D. Use server-side encryption with Amazon S3 managed keys (SSE-S3) with default settings to encrypt the records at rest. Access the records by using an Amazon CloudFront distribution that uses the S3 bucket as the origin. Use IAM roles to control access to the records. Use Amazon CloudWatch to monitor access to the records.
View question →
Q51. Q1151. A solutions architect is designing a three-tier web application. The architecture consists of an internet- facing Application Load Balancer (ALB) and a web tier that is hosted on Amazon EC2 instances in private subnets. The application tier with the business logic runs on EC2 instances in private subnets. The database tier consists of Microsoft SQL Server that runs on EC2 instances in private subnets. Security is a high priority for the company.Which combination of security group configurations should the solutions architect use?(Select THREE)
- A. Configure the security group for the web tier to allow inbound HTTPS traffic from the security group for the ALB.
- B. Configure the security group for the web tier to allow outbound HTTPS traffic to 0.0.0.0/0.
- C. Configure the security group for the database tier to allow inbound Microsoft SQL Server traffic from the security group for the application tier.
- D. Configure the security group for the database tier to allow outbound HTTPS traffic and Microsoft SQL Server traffic to the security group for the web tier.
- E. Configure the security group for the application tier to allow inbound HTTPS traffic from the security group for the web tier.
- F. Configure the security group for the application tier to allow outbound HTTPS traffic and Microsoft SQL Server traffic to the security group for the web tier.
View question →
Q52. Q1152. An antivirus company wants to provide a virus scanning application for AWS account owners in the us- east-1 Region. The application runs on a group of Amazon EC2 instances in a VPC. The application receives data files on a custom TCP port, scans for viruses, and returns results to the caller.The company needs to design a scalable solution that can handle thousands of users.Which solution will meet these requirements?
- A. Register the EC2 instances that run the antivirus application in a target group that is associated with a public Application Load Balancer (ALB). Ensure that users connect to the application by using the DNS name of the ALB.
- B. Register the EC2 instances that run the antivirus application in a target group that is associated with a Network Load Balancer (NLB). Create an AWS PrivateLink endpoint service. Associate the PrivateLink endpoint with the NLB. Ensure that users connect to the application by using a PrivateLink endpoint in each user's account.
- C. Attach the VPC that hosts the antivirus application to a transit gateway. Create a new VPC attachment for each user that wants to use the antivirus application. Update route tables accordingly.
- D. Use VPC peering to connect the VPC that hosts the antivirus application to the VPC of each application user. Update route tables on each side to route relevant traffic through the peering connection.
View question →
Q53. Q1153. An insurance company wants to migrate an application that calculates insurance premiums to AWS. The company needs to run calculations immediately when a customer submits information through the application. The application usually takes 10 seconds to process a calculation.A solutions architect needs to develop an architecture on AWS to handle the application.Which solution will meet this requirement?
- A. Set up an Amazon API Gateway HTTP API to receive the data. Use an AWS Lambda function to process the data immediately.
- B. Upload the customer data to an Amazon S3 bucket. Start an Amazon EC2 Spot Instance to process every data upload.
- C. Set up AWS Transfer Family to receive the customer data. Configure an Amazon Elastic Kubernetes Service(Amazon EKS) job to process the customer data on a schedule.
- D. Upload the data to an Amazon S3 bucket. Invoke an AWS Batch job to process every customer data upload.
View question →
Q54. Q1154. A company uses an Amazon EC2 Auto Scaling group to host an API. The EC2 instances are in a target group that is associated with an Application Load Balancer (ALB). The company stores data in an Amazon Aurora PostgreSQL database.The API has a weekly maintenance window. The company must ensure that the API returns a static maintenance response during the weekly maintenance window.Which solution will meet this requirement with the LEAST operational overhead?
- A. Create a table in Aurora PostgreSQL that has fields to contain keys and values. Create a key for a maintenance flag.Set the flag when the maintenance window starts. Configure the API to query the table for the maintenance flag and to return a maintenance response if the flag is set. Reset the flag when the maintenance window is finished.
- B. Create an Amazon Simple Queue Service (Amazon SQS) queue. Subscribe the EC2 instances to the queue. Publish a message to the queue when the maintenance window starts. Configure the API to return a maintenance message if the instances receive a maintenance start message from the queue.Publish another message to the queue when the maintenance window is finished to restore normal operation.
- C. Create a listener rule on the ALB to return a maintenance response when the path on a request matches a wildcard. Set the rule priority to one. Perform the maintenance. When the maintenance window is finished,delete the listener rule.
- D. Create an Amazon Simple Notification Service (Amazon SNS) topic.Subscribe the EC2 instances to the topic.Publish a message to the topic when the maintenance window starts. Configure the API to return a maintenance response if the instances receive the maintenance start message from the topic. Publish another message to the topic when the maintenance window finshes to restore normal operation.
View question →
Q55. Q1155. A company is redesigning a static website. The company needs a solution to host the new website in the company's AWS account. The solution must be secure and scalable.Which combination of solutions will meet these requirements? (Select THREE.)
- A. Configure an Amazon CloudFront distribution. Set the Amazon S3 bucket as the origin.
- B. Associate an AWS Certificate Manager (ACM) TLS certificate to the Amazon CloudFront distribution.
- C. Enable static website hosting for the Amazon S3 bucket.
- D. Create an Amazon S3 bucket to store the static website content.
- E. Export the website's SSL/TLS certificate from AWS Certificate Manager (ACM) to the root of the Amazon S3 bucket.
- F. Turn off Block Public Access for the Amazon S3 bucket.
View question →
Q56. Q1156. A finance company is migrating its trading platform to AWS. The trading platform processes a high volume of market data and processes stock trades. The company needs to establish a consistent, low-latency network connection from its on-premises data center to AWS.The company will host resources in a VPC. The solution must not use the public internet.Which solution will meet these requirements?
- A. Use AWS Client VPN to connect the on-premises data center to AWS.
- B. Use AWS Direct Connect to set up a connection from the on-premises data center to AWS.
- C. Use AWS PrivateLink to set up a connection from the on-premises data center to AWS.
- D. Use AWS Site-to-Site VPN to connect the on-premises data center to AWS.
View question →
Q57. Q1157. A company uses AWS Organizations to manage multiple AWS accounts. Each department in the company has its own AWS account.A security team needs to implement centralized governance and control to enforce security best practices across all accounts. The team wants to have control over which AWS services each account can use. The team needs to restrict access to sensitive resources based on IP addresses or geographic regions. The root user must be protected with multi-factor authentication (MFA) across all accounts.Which solution will meet these requirements?
- A. Use AWS Identity and Access Management(IAM) to manage IAM users and IAM roles in each account.Implement MFA for the root user in each account. Enforce service restrictions by using AWS managed prefix lists.
- B. Use AWS Control Tower to establish a multi-account environment. Use service control policies (SCPs) to enforce service restrictions in AWS Organizations. Configure MFA for the root user across all accounts.
- C. Use AWS Systems Manager to enforce service restrictions across multiple accounts. Use IAM policies to enforce MFA for the root user across all accounts.
- D. Use AWS IAM Identity Center to manage user access and to enforce service restrictions by using permissions boundaries in each account.i
View question →
Q58. Q1158. A machine learning (ML) team is building an application that uses data that is in an Amazon S3 bucket. The ML team needs a storage solution for its model training workflow on AWS.The ML team requires high-performance storage that supports frequent access to training datasets. The storage solution must integrate natively with Amazon S3.Which solution will meet these requirements with the LEAST operational overhead?
- A. Use Amazon Elastic Block Store (Amazon EBS) volumes to provide high-performance storage. Use AWS DataSync to migrate data from the S3 bucket to EBS volumes.
- B. Use Amazon EC2 ML instances to provide high-performance storage.Store training data on Amazon EBS volumes. Use the S3 Copy API to copy data from the S3 bucket to EBS volumes.
- C. Use Amazon FSx for Lustre to provide high-performance storage.Store training datasets in Amazon S3 Standard storage.
- D. Use Amazon EMR to provide high-performance storage. Store training datasets in Amazon S3 Glacier Instant Retrieval storage.
View question →
Q59. Q1159. A company is building an ecommerce application that uses a relational database to store customer data and order history.The company also needs a solution to store 100 GB of product images. The company expects the traffic flow for the application to be predictable.Which solution will meet these requirements MOST cost-effectively?
- A. Use Amazon RDS for MySQL for the database. Store the product images in an Amazon S3 bucket.
- B. Use Amazon DynamoDB for the database.Store the product images in an Amazon S3 bucket.
- C. Use Amazon RDS for MySQL for the database. Store the product images in an Amazon Aurora MySQL database.
- D. Create three Amazon EC2 instances. Install MongoDB software on the instances to use as the database.Store the product images in an Amazon RDS for MySQL database with a Multi-AZ deployment.
View question →
Q60. Q1160. A company has a serverless application that uses an AWS Lambda function behind an Amazon API Gateway REST API to store data in an Amazon DynamoDB table. Queries to the database can be time- consuming. The API clients do not need to receive the results of the queries.A solutions architect wants to decrease the response time of the API and avoid timeout issues.Which solution will meet these requirements?
- A. Create an Amazon Kinesis data stream. Configure the REST API endpoint to use the Kinesis data stream as a destination. Configure the Lambda function to read records from the data stream.
- B. Create an Amazon Simple Notification Service(Amazon SNS) topic. Configure the REST API endpoint to use the SNS topic as a destination. Configure the Lambda function to subscribe to the SNS topic.
- C. Create an Application Load Balancer (ALB). Configure the ALB as the destination of the REST API. Set the Lambda function as the target of the ALB. Configure Application Auto Scaling to scale Lambda provisioned concurrency based on to the application latency.
- D. Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure the REST API endpoint to use the SQS queue as a direct destination. Configure the Lambda function to read from the SQS queue.
View question →
Q61. Q1161. A company plans to deploy containerized microservices in the AWS Cloud. The containers must mount a persistent file store that the company can manage by using OS-level permissions. The company requires fully managed services to host the containers and file store.Which solution will meet these requirements?
- A. Use AWS Lambda functions and an Amazon API Gateway REST API to handle the microservices. Use Amazon S3 buckets for storage.
- B. Use Amazon EC2 instances to host the microservices. Use Amazon Elastic Block Store (Amazon EBS) volumes for storage.
- C. Use Amazon Elastic Container Service (Amazon ECS) containers on AWS Fargate to handle the microservices. Use an Amazon Elastic File System (Amazon EFS) file system for storage.
- D. Use Amazon Elastic Container Service(Amazon ECS) containers on AWS Fargate to handle the microservices. Use an Amazon EC2 instance that runs a dedicated file store for storage.
View question →
Q62. Q1162. A company wants to migrate an application to AWS. The application runs on Docker containers behind an Application Load Balancer(ALB). The application stores data in a PostgreSQL database.The cloud-based solution must use AWS WAF to inspect all application traffic. The application experiences most traffic on weekdays. There is significantly less traffic on weekends.Which solution will meet these requirements in the MOST cost-effective way?
- A. Use a Network Load Balancer (NLB). Create a web access control list (web ACL) in AWS WAF that includes the necessary rules. Attach the web ACL to the NLB. Run the application on Amazon Elastic Container Service (Amazon ECS). Use Amazon RDS for PostgreSQL as the database.
- B. Create a web access control list(web ACL) in AWS WAF that includes the necessary rules. Attach the web ACL to the ALB. Run the application on Amazon Elastic Kubernetes Service (Amazon EKS). Use Amazon RDS for PostgreSQL as the database.
- C. Create a web access control list(web ACL) in AWS WAF that includes the necessary rules. Attach the web ACL to the ALB. Run the application on Amazon Elastic Container Service (Amazon ECS). Use Amazon Aurora Serverless as the database.
- D. Use a Network Load Balancer(NLB). Create a web access control list(web ACL) in AWS WAF that has the necessary rules.Attach the web ACL to the NLB. Run the application on Amazon Elastic Container Service (Amazon ECS). Use Amazon Aurora Serverless as the database.
View question →
Q63. Q1163. A security team uses AWS Organizations to manage multiple AWS accounts.The security team creates one organizational unit(OU) named AI/ML Development for data science accounts. The security team wants to prevent the data science teams from using GPU-based Amazon EC2 instances for development work.Which solution will meet this requirement?
- A. Create a service control policy (SCP) that denies the use of GPU-based EC2 instances. Apply the SCP to the AI/ML Development OU.
- B. Create an IAM permissions boundary policy that denies the use of GPU-based EC2 instances. Apply the permissions boundary to the AI/ML Development OU.
- C. Create an AI services opt-out policy that denies the use of GPU-based EC2 instances.
- D. Create an IAM policy that denies the use of GPU-based EC2 instances. Apply the policy to the organization root.
View question →
Q64. Q1164. A company is migrating a document management application to AWS. The application runs on Linux servers. The company will migrate the application to Amazon EC2 instances in an Auto Scaling group.The company stores 7 TiB of documents in a shared storage file system. An external relational database tracks the documents.Documents are stored once and can be retrieved multiple times for reference at any time. The company cannot modify the application during the migration.The storage solution must be highly available and must support scaling over time.Which solution will meet these requirements MOST cost-effectively?
- A. Deploy an EC2 instance with enhanced networking as a shared NFS storage system.Export the NFS share. Mount the NFS share on the EC2 instances in the Auto Scaling group.
- B. Create an Amazon S3 bucket that uses the S3 Standard-Infrequent Access (S3 Standard-IA) storage class. Mount the S3 bucket on the EC2 instances in the Auto Scaling group.
- C. Deploy an SFTP server endpoint by using AWS Transfer for SFTP and an Amazon S3 bucket.Configure the EC2 instances in the Auto Scaling group to connect to the SFTP server.
- D. Create an Amazon Elastic File System (Amazon EFS)file system with mount points in multiple Availability Zones.Use the EFS Standard-Infrequent Access (Standard-IA) storage class.Mount the NFS share on the EC2 instances in the Auto Scaling group.
View question →
Q65. Q1165. A company uses AWS to host a public website. The load on the webservers recently increased.The company wants to learn more about the traffic flow and traffic sources. The company also wants to increase the overall security of the website.Which solution will meet these requirements?
- A. Deploy AWS WAF and set up logging. Use Amazon Data Firehose to deliver the log files to an Amazon S3 bucket for analysis.
- B. Deploy Amazon APl Gateway and set up logging. Use Amazon Kinesis Data Streams to deliver the log files to an Amazon S3 bucket for analysis.
- C. Deploy a Network Load Balancer and set up logging. Use Amazon Data Firehose to deliver the log files to an Amazon S3 bucket for analysis.
- D. Deploy an Application Load Balancer and set up logging. Use Amazon Kinesis Data Streams to deliver the log files to an Amazon S3 bucket for analysis.
View question →
Q66. Q1166. A company needs to provide a team of contractors with temporary access to the company's AWS resources for a short-term project. The contractors need different levels of access to AWS services.The company needs to revoke permissions for all the contractors when the project is finished.Which solution will meet these requirements with the LEAST operational overhead?
- A. Use AWS IAM to create a user account for each contractor. Attach policies that define access levels for the contractors to the user accounts. Manually deactivate the accounts when the project is finished.
- B. Use AWS Security Token Service (AWS STS) to generate temporary credentials for the contractors.Provide the contractors access based on predefined roles. Set the access to automatically expire when the project is finished.
- C. Configure AWS Config rules to monitor the contractors' access patterns. Use AWS Config rules to automatically revoke permissions that are not in use or that are too permissive.
- D. Use AWS CloudTrail and custom Amazon EventBridge triggers to audit the contractors' actions. Adjust the permissions for each contractor based on activity logs.
View question →
Q67. Q1167. A company's solutions architect wants to receive an email alert whenever Amazon GuardDuty,AWS Identity and Access Management Access Analyzer, or Amazon Macie generate a high-severity security finding. The company uses AWS Control Tower to govern all of its accounts. The company also uses AWS Security Hub with all of the AWS service integrations turned on.Which solution will meet these requirements with the LEAST operational overhead?
- A. Set up separate AWS Lambda functions for GuardDuty, IAM Access Analyzer,and Macie to call each service's public APl to retrieve high-severity findings. Use Amazon Simple Notification Service (Amazon SNS) to send the email alerts. Create an Amazon EventBridge rule to invoke the functions on a schedule.
- B. Create an Amazon EventBridge rule with a pattern that matches Security Hub findings events with high severity. Configure the rule to send the findings to a target Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the desired email addresses to the SNS topic.
- C. Create an Amazon EventBridge rule with a pattern that matches AWS Control Tower events with high severity. Configure the rule to send the findings to a target Amazon Simple Notification Service (Amazon SNS) topic.Subscribe the desired email addresses to the SNS topic.
- D. Host an application on Amazon EC2 to call the GuardDuty,IAM Access Analyzer, and Macie APls.Within the application, use the Amazon Simple Notification Service (Amazon SNS) API to retrieve high- severity findings and to send the findings to an SNS topic. Subscribe the desired email addresses to the SNS topic.
View question →
Q68. Q1168. A company wants to use automatic machine learning (ML) to create and visualize forecasts of complex scenarios and trends.Which solution will meet these requirements with the LEAST management overhead?
- A. Use an AWS Glue ML job to transform the data and create forecasts. Use Amazon QuickSight to visualize the data.
- B. Use Amazon QuickSight to visualize the data. Use ML-powered forecasting in QuickSight to create forecasts.
- C. Use a prebuilt ML AMI from the AWS Marketplace to create forecasts. Use Amazon QuickSight to visualize the data.
- D. Use Amazon SageMaker Al inference pipelines to create and update forecasts. Use Amazon QuickSight to visualize the combined data.
View question →
Q69. Q1169. A company stores data for multiple business units in a single Amazon S3 bucket that is in the company's payer AWS account. To maintain data isolation, the business units store data in separate prefixes in the S3 bucket by using an S3 bucket policy.The company plans to add a large number of dynamic prefixes.The company does not want to rely on a single S3 bucket policy to manage data access at scale.The company wants to develop a secure access management solution in addition to the bucket policy to enforce prefix-level data isolation.Which solution will meet these requirements?
- A. Configure the S3 bucket policy to deny s3:GetObject permissions for all users. Configure the bucket policy to allow s3:* access to individual business units.
- B. Enable default encryption on the S3 bucket by using server-side encryption with Amazon S3 managed keys (SSE-S3).
- C. Configure resource-based permissions on the S3 bucket by creating an S3 access point for each business unit.
- D. Use pre-signed URLs to provide access to the S3 bucket.
View question →
Q70. Q1170. A company runs an application on Amazon EC2 instances that are behind an Application Load Balancer (ALB). The company uses Amazon Route 53 to route traffic to the ALB. The ALB is a resource in an AWS Shield Advanced protection group.The company is preparing for a blue/green deployment in which traffic will shift to a new ALB. The company wants to protect against DDoS attacks during the deployment.Which solution will meet this requirement?
- A. Add the new ALB to the Shield Advanced protection group. Select Sum as the aggregation type for the volume of traffic for the whole group.
- B. Add the new ALB to the Shield Advanced protection group. Select Mean as the aggregation type for the volume of traffic for the whole group.
- C. Create a new Shield Advanced protection group.Add the new ALB to the new protection group. Select Sum as the aggregation type for the volume of traffic.
- D. Set up an Amazon CloudFront distribution. Add the CloudFront distribution and the new ALB to the Shield Advanced protection group. Select Max as the aggregation type for the volume of traffic for the whole group.
View question →
Q71. Q1171. A company runs a workload in an AWS Region. Users connect to the workload by using an Amazon API Gateway REST API.The company uses Amazon Route 53 as its DNS provider and has created a Route 53 Hosted Zone. The company wants to provide unique and secure URLs for all workload users.Which combination of steps will meet these requirements with the MOST operational efficiency?(Select THREE.)
- A. Create a wildcard custom domain name in the Route 53 hosted zone as an alias for the API Gateway endpoint.
- B. Use AWS Certificate Manager (ACM) to request a wildcard certificate that matches the custom domain in a second Region.
- C. Create a hosted zone for each user in Route 53. Create zone records that point to the APl Gateway endpoint.
- D. Use AWS Certificate Manager (ACM) to request a wildcard certificate that matches the custom domain name in the same Region.
- E. Use API Gateway to create multiple API endpoints for each user.
- F. Create a custom domain name in API Gateway for the REST API. Import the certificate from AWS Certificate Manager (ACM).
View question →
Q72. Q1172. A company runs an application on Amazon EC2 instances. The application is deployed in private subnets in three Availability Zones of the us-east-1 Region. The instances must be able to connect to the internet to download files. The company wants a design that is highly available across the Region.Which solution should be implemented to ensure that there are no disruptions to internet connectivity?
- A. Deploy a NAT instance in a private subnet of each Availability Zone.
- B. Deploy a NAT gateway in a public subnet of each Availability Zone.
- C. Deploy a transit gateway in a private subnet of each Availability Zone.
- D. Deploy an internet gateway in a public subnet of each Availability Zone.
View question →
Q73. Q1173. A company manages an application that stores data on an Amazon RDS for PostgreSQL Multi-AZ DB instance. High traffic on the application is causing increased latency for many read queries.A solutions architect must improve the performance of the application.Which solution will meet this requirement?
- A. Enable Amazon RDS Performance Insights. Configure storage capacity to scale automatically.
- B. Configure the DB instance to use DynamoDB Accelerator (DAX).
- C. Create a read replica of the DB instance. Serve read traffic from the read replica.
- D. Use Amazon Data Firehose between the application and Amazon RDS to increase the concurrency of database requests.
View question →
Q74. Q1174. A company has developed an online portal that displays the most recent information about its products. The company has deployed the code as AWS Lambda functions and has exposed the code by using Amazon API Gateway. Amazon DynamoDB stores the data for the system.After reviewing its Amazon CloudWatch metrics, the company noticed that some products are more popular and are viewed more often than other products. The company wants the fastest possible read response time for the most popular products without adding operational overhead.Which solution will reduce the number of database calls with the LEAST number of code changes?
- A. Configure DynamoDB Accelerator(DAX). Update the Getltem API calls of the Lambda functions to point to the DAX cluster endpoint.
- B. Create an Amazon OpenSearch Service cluster that uses a cache-aside caching strategy. Update the Getltem APl calls of the Lambda functions to point to the OpenSearch Service endpoint.
- C. Create an Amazon ElastiCache (Redis OSS) cluster. Update the Lambda function code to use a lazy loading caching strategy for the Getltem APl calls to the Redis cluster.
- D. Create an Amazon ElastiCache (Memcached) cluster. Update the Lambda function code to use a write- through caching strategy for the Getltem APl calls to the Memcached cluster.
View question →
Q75. Q1175. A company runs multiple applications on Amazon EC2 instances in a VPC. Application A runs in a private subnet that has a custom route table and network ACL. Application B runs in a second private subnet in the same VPC.The company needs to prevent Application A from sending traffic to Application B.Which solution will meet this requirement?
- A. Add a deny outbound rule to a security group that is associated with Application B. Configure the rule to prevent Application B from sending traffic to Application A.
- B. Add a deny outbound rule to a security group that is associated with Application A. Configure the rule to prevent Application A from sending traffic to Application B.
- C. Add a deny outbound rule to the custom network ACL for the Application B subnet. Configure the rule to prevent Application B from sending traffic to IP addresses that are associated with the Application A subnet.
- D. Add a deny outbound rule to the custom network ACL for the Application A subnet. Configure the rule to prevent Application A from sending traffic to lP addresses that are associated with the Application B subnet.
View question →
Q76. Q1176. A company runs an application on Amazon EC2 instances across multiple Availability Zones in the same AWS Region. The EC2 instances share an Amazon Elastic File System (Amazon EFS) volume that is mounted on all the instances. The EFS volume stores a variety of files such as installation media,third-party files,interface files, and other one-time files.The company accesses some EFS files frequently and needs to retrieve the files quickly. The company accesses other files rarely.The EFS volume is multiple terabytes in size. The company needs to optimize storage costs for Amazon EFS.Which solution will meet these requirements with the LEAST effort?
- A. Move the files to Amazon S3. Set up a lifecycle policy to move the files to S3 Glacier Flexible Retrieval.
- B. Apply a lifecycle policy to the EFS files to move the files to EFS Infrequent Access.
- C. Move the files to Amazon Elastic Block Store (Amazon EBS) Cold HDD Volumes(sc1).
- D. Move the files to Amazon S3. Set up a lifecycle policy to move the rarely-used files to S3 Glacier Deep Archive.
View question →
Q77. Q1177. A company uses an Amazon CloudFront distribution to serve thousands of media files to users. The CloudFront distribution uses a private Amazon S3 bucket as an origin.A solutions architect must prevent users in specific countries from accessing the company's files.Which solution will meet these requirements in the MOST operationally-efficient way?
- A. Require users to access the files by using CloudFront signed URLs
- B. Configure geographic restrictions in CloudFront.
- C. Require users to access the files by using CloudFront signed cookies.
- D. Configure an origin access control (OAC) between CloudFront and the S3 bucket.
View question →
Q78. Q1178. A company hosts an application on AWS that uses an Amazon S3 bucket and an Amazon Aurora database. The company wants to implement a multi-Region disaster recovery (DR) strategy that minimizes potential data loss.Which solution will meet these requirements?
- A. Create an Aurora read replica in a second Availability Zone within the same AWS Region. Enable S3 Versioning for the bucket.
- B. Create an Aurora read replica in a second AWS Region. Configure AWS Backup to create continuous backups of the S3 bucket to a second bucket in a second Availability Zone.
- C. Enable Aurora native database backups across multiple AWS Regions. Use S3 cross-account backups within the company's local Region.
- D. Migrate the database to an Aurora global database. Create a second S3 bucket in a second Region.Configure Cross-Region Replication.
View question →
Q79. Q1179. A company plans to store sensitive user data on Amazon S3. Internal security compliance requirement mandate encryption of data before sending it to Amazon S3.What should a solutions architect recommend to satisfy these requirements?
- A. Server-side encryption with customer-provided encryption keys
- B. Client-side encryption with Amazon S3 managed encryption keys
- C. Server-side encryption with keys stored in AWS Key Management Service (AWS KMS)
- D. Client-side encryption with a key stored in AWS Key Management Service (AWS KMS)
View question →
Q80. Q1180. A company is using an AWS Lambda function in a VPC. The Lambda function needs to access dependencies that exceed the size of the Lambda layer quota. The data that the Lambda function retrieves must be encrypted in transit.Which solution will meet these requirements with the LEAST operational overhead?
- A. Store the dependencies in an Amazon Elastic File System (Amazon EFS) file system. Mount the file system to the Lambde function. Retrieve the dependencies from the file system.
- B. Store the dependencies on an Amazon EC2 instance that has an instance store volume and web server software. Use HTTPS API calls to retrieve the dependencies each time the Lambda function runs.
- C. Store the dependencies on an Amazon EC2 instance that hosts an NFS file server. Read the files from the EC2 instance each time the Lambda function runs.
- D. Store the dependencies in two separate Lambda layers. Redesign the application to have two Lambda functions that use different Lambda layers.
View question →
Q81. Q1181. A company uses Amazon API Gateway to manage REST APIs that third-party service providers access. The company must protect the REST APIs from SQL injection attacks and cross-site scripting attacks. The company wants to minimize changes to the architecture.Which solution will meet these requirements?
- A. Activate AWS Shield Advanced. Configure Shield Advanced to operate in front of the REST APIs to inspect the inbound traffic.
- B. Enable AWS WAF and configure web ACLs. Add the REST APIs as protected resources.
- C. Create an Amazon CloudFront distribution. Set each REST API as an origin. Configure AWS Shield to protect the CloudFront distribution.
- D. Create an Amazon CloudFront distribution. Set each REST API as an origin. Create an AWS Lambda@Edge function to inspect inbound API traffic.
View question →
Q82. Q1182. A multinational company operates in multiple AWS Regions. The company must ensure that its developers and administrators have secure,role-based access to AWS resources. The roles must be specific to each user's geographic location and job responsibilities.The company wants to implement a solution to ensure that each team can access only resources within the team's Region.The company wants to use its existing directory service to manage user access.The existing directory service organizes users into roles based on location. The system must be capable of integrating seamlessly with multi-factor authentication (MFA).Which solution will meet these requirements?
- A. Use AWS Security Token Service (AWS STS) to generate temporary access tokens to grant users access to the company's AWS account. Integrate AWS STS with the company's existing directory service to authenticate users. Assign Region specific roles based on predefined policies.
- B. Configure AWS IAM Identity Center with federated access. Integrate IAM Identity Center with the company's existing directory service to set up Region specific IAM roles for each user's account.
- C. Create IAM managed policies that restrict access based on each user's geographic location. Apply IAM policies based on group memberships in the company's existing directory service.
- D. Use custom AWS Lambda functions to implement a dynamic IAM policy approach that adjusts permissions based on each user's current login location and job function. Integrate this approach with the existing directory service to verify user identities and to assign roles.
View question →
Q83. Q1183. A company wants to create a payment processing application. The application must run when a payment record arrives in an existing Amazon S3 bucket.The application must process each payment record exactly once. The company wants to use an AWS Lambda function to process the payments.Which solution will meet these requirements?
- A. Configure the existing S3 bucket to send object creation events to Amazon EventBridge. Configure EventBridge to route events to an Amazon Simple Queue Service (Amazon SQS) FIFO queue.Configure the Lambda function to run when a new event arrives in the SQS queue.
- B. Configure the existing S3 bucket to send object creation events to an Amazon Simple Notification Service (Amazon SNS) topic. Configure the Lambda function to run when a new event arrives in the SNS topic.
- C. Configure the existing S3 bucket to send object creation events to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the Lambda function to run when a new event arrives in the SQS queue.
- D. Configure the existing S3 bucket to send object creation events directly to the Lambda function.Configure the Lambda function to handle object creation events and to process the payments.
View question →
Q84. Q1184. A company uses a set of Amazon EC2 instances to host a website. The website uses an Amazon S3 bucket to store images and media files.The company wants to automate website infrastructure creation to deploy the website to multiple AWS Regions.The company also wants to provide the EC2 instances access to the S3 bucket so the instances can store and access data by using AWS Identity and Access Management (IAM).Which solution will meet these requirements MOST securely?
- A. Create an AWS CloudFormation template for the web server EC2 instances. Save an IAM access key in the UserData section of the AWS::EC2::Instance entity in the CloudFormation template.
- B. Create a file that contains an IAM secret access key and access key ID.Store the file in a new S3 bucket. Create an AWS CloudFormation template. In the template, create a parameter to specify the location of the S3 object that contains the access key and access key ID.
- C. Create an IAM role and an IAM access policy that allows the web server EC2 instances to access the S3 bucket. Create an AWS CloudFormation template for the web server EC2 instances that contains an IAM instance profile entity that references the IAM role and the IAM access policy.
- D. Create a script that retrieves an IAM secret access key and access key ID from IAM and stores them on the web server EC2 instances. Include the script in the UserData section of the AWS::EC2::Instance entity in an AWS CloudFormation template.
View question →
Q85. Q1185. A solutions architect manages an Amazon DynamoDB table for a company's ecommerce application.The company's security team identifies that Amazon EC2 instances in a VPC are accessing DynamoDB through the internet. The security team expresses concern about sending and receiving data across the internet.The solutions architect must modify the DynamoDB access pattern so that data stays entirely within the Amazon network.Which solution will meet these requirements MOST cost-effectively?
- A. Create an interface VPC endpoint for DynamoDB so that the EC2 instances in the VPC use their private IP addresses to access DynamoDB.
- B. Use a VPN to route all DynamoDB network traffic to the EC2 instances through the company's corporate network infrastructure.
- C. Create a gateway VPC endpoint for DynamoDB so that the EC2 instances in the VPC use their private IP addresses to access DynamoDB.
- D. Use a virtual private gateway to route all DynamoDB network traffic to the EC2 instances through the company's corporate network infrastructure.
View question →
Q86. Q1186. A company is using an Amazon RDS for MySQL DB instance for a production application. During the company's upcoming scheduled maintenance window, a solutions architect will perform a major version upgrade to the DB instance.The application is critical, so the company wants to minimize the maintenance time and allow for a rollback if a problem occurs.Which solution will meet these requirements?
- A. Enable the automatic upgrade option by using the AWS Management Console. Amazon RDS will apply the upgrade, which will occur during the scheduled maintenance window with no downtime.
- B. Create a new DB instance that has the desired version. Configure AWS Database Migration Service (AWS DMS) to migrate the existing data to the new DB instance. Change the DNS records to point to the new DB instance.
- C. Create a read replica of the DB instance. Upgrade the version on the read replica. Promote the read replica to be the primary DB instance. Direct the application to use the read replica endpoint.
- D. Create a read replica of the DB instance. Configure a policy to fail over to the read replica if failure occurs during the upgrade. Upgrade the version on the primary DB instance.
View question →
Q87. Q1187. A company is running a blogging platform.A security audit determines that the Amazon RDS DB instance that is used by the platform is not configured to encrypt the data at rest. The company must encrypt the DB instance within 30 days.What should a solutions architect do to meet this requirement with the LEAST amount of downtime?
- A. Create a read replica of the DB instance,and enable encryption. When the read replica is available, promote the read replica and update the endpoint that is used by the application. Delete the unencrypted DB instance.
- B. Take a snapshot of the DB instance. Make an encrypted copy of the snapshot. Restore the encrypted snapshot. When the new DB instance is available, update the endpoint that is used by the application.Delete the unencrypted DB instance.
- C. Create a new encrypted DB instance.Perform an initial data load,and set up logical replication between the two DB instances. When the new DB instance is in sync with the source DB instance, update the endpoint that is used by the application.Delete the unencrypted DB instance.
- D. Convert the DB instance to an Amazon Aurora DB cluster, and enable encryption. When the DB cluster is available, update the endpoint that is used by the application to the cluster endpoint. Delete the unencrypted DB instance.
View question →
Q88. Q1188. A company wants to optimize costs for its AWS infrastructure.The company wants to receive notifications when actual costs or forecasted costs exceed a specified budget.The company does not want to develop a custom solution.Which solution will meet these requirements?
- A. Use AWS Trusted Advisor to set up budget notifications. Configure Amazon CloudWatch to monitor costs. Export CloudWatch data to Amazon S3. Use machine learning(ML) to estimate future trends based on the CloudWatch data.
- B. Create a budget in AWS Budgets that has a specified cost threshold. Create an AWS Lambda function that sends a notification to the company when costs reach the specified threshold. Use AWS Billing and Cost Management reports to monitor costs.
- C. Use AWS Cost Explorer to set a specified budget threshold. Create an AWS Lambda function to calculate cost estimates. Configure the Lambda function to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic if estimated costs exceed the specified threshold.
- D. Create a budget in AWS Budgets that has a specified cost threshold. Configure AWS Budgets to send budget alerts to an Amazon Simple Notification Service(Amazon SNS) topic. Use AWS Cost Explorer to monitor costs.
View question →
Q89. Q1189. A company runs a multi-tier web application that hosts news content. The application runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an EC2 Auto Scaling group across multiple Availability Zones and use an Amazon Aurora database. A solutions architect needs to make the application more resilient to periodic increases in request rates.Which architecture should the solutions architect implement? (Select TWO.)
- A. Add AWS Shield.
- B. Add Aurora Replicas.
- C. Add AWS Direct Connect.
- D. Add AWS Global Accelerator.
- E. Add an Amazon CloudFront distribution in front of the Application Load Balancer.
View question →
Q90. Q1190. A company has multiple consumers that consume data from Amazon Kinesis Data Streams. The company wants to share throughput across all consumers. The company must prevent any one consumer from monopolizing the stream's throughput. Each consumer must have its own read throughput and must not compete with other consumers.Which solution will meet these requirements?
- A. Configure enhanced fan-out to allow each consumer to receive its own dedicated throughput.
- B. Increase the number of shards in the stream.
- C. Configure lease management within the consumers.
- D. Send the data to an Amazon Simple Queue Service (Amazon SQS) queue before distributing data to the consumers.
View question →
Q91. Q1191. A company has a website that handles dynamic traffic loads. The website architecture is based on Amazon EC2 instances in an Auto Scaling group that is configured to use scheduled scaling. Each EC2 instance runs code from an Amazon Elastic File System (Amazon EFS) volume and stores shared data back to the same volume.The company wants to optimize costs for the website.Which solution will meet this requirement?
- A. Reconfigure the Auto Scaling group to set a desired number of instances.Turn off scheduled scaling.
- B. Create a new launch template version for the Auto Scaling group that uses larger EC2 instances.
- C. Reconfigure the Auto Scaling group to use a target tracking scaling policy.
- D. Replace the EFS volume with instance store volumes.
View question →
Q92. Q1192. A company has a non-production application that runs on an Amazon EC2 instance. The EC2 instance has an instance profile and an associated IAM role.The company wants to automate patching for the EC2 instance.Which solution will meet this requirement?
- A. Create a new IAM role.Attach the AmazonSSMManagedInstanceCore policy to the new IAM role.Attach the new IAM role to EC2 instance profile. Use AWS Systems Manager to patch the instance.
- B. Create an IAM user. Attach the AmazonSSMManagedInstanceCore policy to the IAM user. Configure AWS Systems Manager to use the IAM user to patch the instance.
- C. Attach the AmazonSSMManagedlnstanceCore policy to the existing IAM role. Use AWS Systems Manager to patch the EC2 instance.
- D. Attach the AmazonSSMManagedInstanceCore policy to an existing IAM user. Use EC2 Image Builder to patch the EC2 instance.
View question →
Q93. Q1193. A company runs an application on Amazon EC2 instances that have instance store volumes attached. The application uses Amazon Elastic File System (Amazon EFS) to store files that are shared across a cluster of Linux servers. The shared files are at least 1 GB in size.The company accesses the files often for the first 7 days after creation. The files must remain readily available after the first 7 days.The company wants to optimize costs for the application.Which solution will meet these requirements?
- A. Configure an AWS Storage Gateway Amazon S3 File Gateway to cache frequently accessed files locally. Store older files in Amazon S3.
- B. Move the files from Amazon EFS, and store the the files locally on each EC2 instance.
- C. Configure a lifecycle policy to move the files to the EFS Infrequent Access (lA) storage class after 7 days.
- D. Deploy AWS DataSync to automatically move files older than 7 days to Amazon S3 Glacier Deep Archive.
View question →
Q94. Q1194. An ecommerce company is redesigning a web application to run on the AWS Cloud. The application needs to store static website content and must use a Microsoft SQL Server database to store customer data.The company needs to deploy the application in a resilient way across multiple Availability Zones.Which solution will meet these requirements?
- A. Use an Amazon S3 bucket to store static content. Deploy an Amazon RDS Custom for SQL Server DB instance for the database.
- B. Use an Amazon S3 bucket to store static content. Create an Amazon RDS for SQL Server Multi-AZ deployment for the database.
- C. Create an Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume to store static content.Deploy an Amazon RDS for SQL Server DB instance for the database.
- D. Create an Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume to store static content.Deploy SQL Server on two Amazon EC2 instances in separate Availability Zones.
View question →
Q95. Q1195. A company operates a fleet of servers on premises and operates a fleet of Amazon EC2 instances in its organization in AWS Organizations. The company's AWS accounts contain hundreds of VPCs. The company wants to connect its AWS accounts to its on-premises network. AWS Site-to-Site VPN connections are already established to a single AWS account. The company wants to control which VPCs can communicate with other VPCs.Which combination of steps will achieve this level of control with the LEAST operational effort? (Select THREE.)
- A. Create a transit gateway in an AWS account. Share the transit gateway across accounts by using AWS Resource Access Manager (AWS RAM).
- B. Configure attachments to all VPCs and VPNs.
- C. Set up transit gateway route tables.Associate the VPCs and VPNs with the route tables.
- D. Configure VPC peering between the VPCs.
- E. Configure attachments between the VPCs and VPNs
- F. Set up route tables on the VPCs and VPNs
View question →
Q96. Q1196. A company deploys a new payroll application on a set of two Amazon EC2 instances that run Amazon Linux. The instances have one root volume that stores the operating system and the application.The application needs to store temporary files and provide long-term file storage for all payroll data. Both storage options must have high performance and be compatible with Linux. Both EC2 instances must be able to access long-term payroll data from a single location.The long-term payroll data must be highly available.Which combination of actions will meet these requirements? (Select TWO.)
- A. Change the instances to an instance family that supports instance store volumes for the temporary data.
- B. Deploy an Amazon ElastiCache (Redis OSS) instance. Configure the EC2 instances to save the temporary data to the ElastiCache (Redis OSS) instance.
- C. Create an Amazon S3 bucket. Configure the EC2 instances to save temporary data to the S3 bucket.
- D. Create and attach a new Amazon Elastic Block Store (Amazon EBS) volume to each of the two EC2 instances to store the long-term data.
- E. Deploy an Amazon Elastic File System (Amazon EFS) Regional file system to store the long-term data.
View question →
Q97. Q1197. Amedia company is using video conversion tools that run on Amazon EC2 instances. The video conversion tools run on a combination of Windows EC2 instances and Linux EC2 instances.Each video file is tens of gigabytes in size.The video conversion tools must process the video files in the shortest possible amount of time. The company needs a single, centralized file storage solution that can be mounted on all the EC2 instances that host the video conversion tools.Which solution will meet these requirements?
- A. Deploy Amazon FSx for Windows File Server with hard disk drive(HDD) storage
- B. Deploy Amazon FSx for Windows File Server with solid state drive (SSD) storage.
- C. Deploy Amazon Elastic File System (Amazon EFS) with Max I/O performance mode.
- D. Deploy Amazon Elastic File System (Amazon EFS) with General Purpose performance mode.
View question →
Q98. Q1198. A company hosts a website analytics application on a single Amazon EC2 On-Demand Instance.The analytics application is highly resilient and is designed to run in stateless mode.The company notices that the application is showing signs of performance degradation during busy times and is presenting 5xx errors.The company needs to make the application scale seamlessly.Which solution will meet these requirements MOST cost-effectively?
- A. Create an Amazon Machine Image (AMl) of the web application. Use the AMl to launch a second EC2 On-Demand Instance. Use an Application Load Balancer to distribute the load across the two EC2 instances.
- B. Create an Amazon Machine Image (AMl) of the web application. Use the AMl to launch a second EC2 On-Demand Instance. Use Amazon Route 53 weighted routing to distribute the load across the two EC2 instances.
- C. Create an AWS Lambda function to stop the EC2 instance and change the instance type. Create an Amazon CloudWatch alarm to invoke the Lambda function when CPU utilization is more than 75%.
- D. Create an Amazon Machine Image (AMl) of the web application. Apply the AMl to a launch template.Create an Auto Scaling group that includes the launch template. Configure the launch template to use a Spot Fleet. Attach an Application Load Balancer to the Auto Scaling group.
View question →
Q99. Q1199. A company is developing a SaaS solution for customers.The solution runs on Amazon EC2 instances that have Amazon Elastic Block Store (Amazon EBS) volumes attached. Within the SaaS application,customers can request how much storage they need.The application needs to allocate the amount of block storage each customer requests.A solutions architect must design an operationally efficient solution that meets the storage scaling requirement.Which solution will meet these requirements MOST cost-effectively?
- A. Migrate the data from the EBS volumes to an Amazon S3 bucket. Use the Amazon S3 Standard storage class.
- B. Migrate the data from the EBS volumes to an Amazon Elastic File System (Amazon EFS) file system.Use the EFS Standard storage class.Invoke an AWS Lambda function to increase the EFS volume capacity based on user input.
- C. Migrate the data from the EBS volumes to an Amazon FSx for Windows File Server file system. Invoke an AWS Lambda function to increase the capacity of the file system based on user input.
- D. Invoke an AWS Lambda function to increase the size of EBS volumes based on user input by using EBS Elastic Volumes.
View question →
Q100. Q1200. A company uses AWS Organizations.The company has more than 100 AWS accounts and will increase the number of accounts. The company also uses an external corporate identity provider (ldP).The company needs to provide users with role-based access to the accounts.The solution must maximize scalability and operational efficiency.Which solution will meet these requirements?
- A. In each account,create a set of dedicated IAM users.Ensure that all users assume these IAM users through federation with the existing ldP.
- B. Deploy an IAM role in a central identity account. Allow users to assume the role through federation with the existing ldP. ln each account, deploy a set of IAM roles that match the desired access patterns.Include a trust policy that allows access from the central identity account. Edit the permissions policy for the role in each account to match user access requirements.
- C. Enable AWS IAM Identity Center.Integrate IAM Identity Center with the company's existing IdP. Create permission sets that match the desired access patterns. Assign permissions to match user access requirements.
- D. In each account, deploy a set of IAM roles that match the desired access patterns. Create a trust policy with the existing IdP. Update each role's permissions policy to use SAML-based IAM condition keys that are based on user access requirements.
View question →