Q1201. A company has set up hybrid connectivity between an on-premises data center and AWS by using AWS Site-to-Site VPN. The company is migrating a workload to AWS.The company sets up a VPC that has two public subnets and two private subnets.The company wants to monitor the total packet loss and round-trip-time (RTT) between the data center and AWS.Which solution will meet these requirements with the LEAST operational overhead?

A. Use Amazon CloudWatch Network Monitor to set up Internet Control Message Protocol (ICMP) probe monitoring from each subnet to the on-premises destination.

B. Create an Amazon EC2 instance in each subnet. Create a scheduled job to send Internet Control Message Protocol (lCMP) packets to the on-premises destination.

C. Create an AWS Lambda function in each subnet. Write a script to perform Internet Control Message Protocol (lCMP) connectivity checks.

D. Create an AWS Batch job in each subnet. Write a script to perform Internet Control Message Protocol (ICMP) connectivity checks.

Q1202. A company's packaged application dynamically creates and returns single-use text files in response to user requests. The company is using Amazon CloudFront for distribution, but wants to further reduce data transfer costs.The company cannot modify the application's source code.What should a solutions architect do to reduce costs?

C. Enable caching on the CloudFront distribution to store generated files at the edge.

A. Use Lambda@Edge to compress the files as they are sent to users

B. Enable Amazon S3 Transfer Acceleration to reduce the response times.

C. Enable caching on the CloudFront distribution to store generated files at the edge.

D. Use Amazon S3 multipart uploads to move the files to Amazon S3 before returning them to users.

Q1203. An analytics application runs on multiple Amazon EC2 Linux instances that use Amazon Elastic File System (Amazon EFS) Standard storage.The files that the application uses vary in size and access frequency.The company accesses the files infrequently after 30 days. However, users sometimes request older files to generate reports.The company wants to reduce storage costs for files that are accessed infrequently.The company also wants throughput to adjust based on the size of the file system. The company wants to use the TransitionTolA Amazon EFS lifecycle policy to transition files to Infrequent Access (lA) storage after 30 days.Which solution will meet these requirements?

C. Configure files to transition back to Standard storage when a user accesses the files again. Specify the bursting throughput mode.

A. Configure files to transition back to Standard storage when a user accesses the files again. Specify the provisioned throughput mode.

B. Specify the provisioned throughput mode only.

C. Configure files to transition back to Standard storage when a user accesses the files again. Specify the bursting throughput mode.

D. Specify the bursting throughput mode only.

Q1204. A solutions architect needs to optimize a large data analytics job that runs on an Amazon EMR cluster. The job takes 13 hours to finish. The cluster has multiple core nodes and worker nodes that are deployed on large,compute-optimized instances.After reviewing EMR logs, the solutions architect discovers that several nodes are idle for more than 5 hours while the job is running.The solutions architect needs to optimize cluster performance.Which solution will meet this requirement MOST cost-effectively?

B. Use the EMR managed scaling feature to automatically resize the cluster based on workload.

A. Increase the number of core nodes to ensure there is enough processing power to handle the analytics job without any idle time.

B. Use the EMR managed scaling feature to automatically resize the cluster based on workload.

C. Migrate the analytics job to a set of AWS Lambda functions. Configure reserved concurrency for the functions.

D. Migrate the analytics job core nodes to a memory-optimized instance type to reduce the total job runtime.

Q1205. A company uses Amazon RDS for MySQL as a database engine for its applications. A recent security audit revealed an RDS instance that is not compliant with company policy for encrypting data at rest. A solutions architect at the company needs to ensure that all existing RDS databases are encrypted using server-side encryption and that any future deviations from the policy are detected.Which combination of steps should the solutions architect take to accomplish this?(Select TWO.)

A. Create an AWS Config rule to detect the creation of unencrypted RDS databases. Create an Amazon EventBridge rule to trigger on the AWS Config rules compliance state change and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.

D. Take a snapshot of the unencrypted RDS database. Copy the snapshot and enable snapshot encryption in the process.Restore the database instance from the newly created encrypted snapshot.Terminate the unencrypted database instance.

A. Create an AWS Config rule to detect the creation of unencrypted RDS databases. Create an Amazon EventBridge rule to trigger on the AWS Config rules compliance state change and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.

B. Use AWS Systems Manager State Manager to detect RDS database encryption configuration drift.Create an Amazon EventBridge rule to track state changes and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.

C. Create a read replica for the existing unencrypted RDS database and enable replica encryption in the process. Once the replica becomes active,promote it into a standalone database instance and terminate the unencrypted database instance.

D. Take a snapshot of the unencrypted RDS database. Copy the snapshot and enable snapshot encryption in the process.Restore the database instance from the newly created encrypted snapshot.Terminate the unencrypted database instance.

E. Enable encryption for the identified unencrypted RDS instance by changing the configurations of the existing database

Q1206. A company plans to use an Amazon S3 bucket to archive backup data. Regulations require the company to retain the backup data for 7 years.During the retention period,the company must prevent users,including administrators,from deleting the data.The company can delete the data after 7 years.Which solution will meet these requirements?

C. Create an S3 Object Lock default retention policy that retains data for 7 years in compliance mode.Create an S3 Lifecycle policy to delete the data after 7 years.

A. Create an S3 bucket policy that denies delete operations for 7 years. Create an S3 Lifecycle policy to delete the data after 7 years

B. Create an S3 Object Lock default retention policy that retains data for 7 years in governance mode.Create an S3 Lifecycle policy to delete the data after 7 years.

C. Create an S3 Object Lock default retention policy that retains data for 7 years in compliance mode.Create an S3 Lifecycle policy to delete the data after 7 years.

D. Create an S3 Batch Operations job to set a legal hold on each object for 7 years.Create an S3 Lifecycle policy to delete the data after 7 years.

Q1207. A company needs to accommodate traffic for a web application that the company hosts on AWS,especially during peak usage hours.The application uses Amazon EC2 instances as web servers,an Amazon RDS DB instance for database operations, and an Amazon S3 bucket to store transaction documents.The application struggles to scale effectively and experiences performance issues.The company wants to improve the scalability of the application and prevent future performance issues. The company also wants to improve global access speeds to the transaction documents for the company's global users.Which solution will meet these requirements?

A. Place the EC2 instances in Auto Scaling groups to scale appropriately during peak usage hours. Use Amazon RDS read replicas to improve database read performance. Deploy an Amazon CloudFront distribution that uses Amazon S3 as the origin.

B. Increase the size of the EC2 instances to provide more compute capacity. Use Amazon ElastiCache to reduce database read loads. Use AWS Global Accelerator to optimize the delivery of the transaction documents that are in the S3 bucket.

C. Transition workloads from the EC2 instances to AWS Lambda functions to scale in response to the usage peaks. Migrate the database to an Amazon Aurora global database to provide cross-Region reads. Use AWS Global Accelerator to deliver the transaction documents that are in the S3 bucket.

D. Convert the application architecture to use Amazon Elastic Container Service (Amazon ECS) containers. Configure a Multi-AZ deployment of Amazon RDS to support database operations.Replicate the transaction documents that are in the S3 bucket across multiple AWS Regions.

Q1208. A company has an application that runs on five Amazon EC2 instances. The instances run behind an Application Load Balancer (ALB). The application processes messages from an Amazon Simple Queue Service (Amazon SQS) queue.During the upcoming discount season, the company is expecting an increase in the average number of users each day.The number of users will double during peak times and will result in more messages in the SQS queue.What should a solutions architect do to handle the increase in user traffic MOST cost-effectively?

D. Create an EC2 Auto Scaling group.Add the existing EC2 instances to the Auto Scaling group.Update the ALB's target to be the Auto Scaling group. Configure the Auto Scaling group to scale in or out based on the number of messages in the SQS queue.

A. Create an EC2 Auto Scaling group.Add the existing EC2 instances to the Auto Scaling group.Update the ALB's target to be the Auto Scaling group. Configure the Auto Scaling group to scale in or out based on the average CPU utilization of the EC2 instances.

B. Double the capacity of the SQS queue.Add another five EC2 instances to handle the increase in the number of messages.

C. Double the capacity of the SQS queue. Double the memory of the EC2 instances to handle the increase in the number of messages.

D. Create an EC2 Auto Scaling group.Add the existing EC2 instances to the Auto Scaling group.Update the ALB's target to be the Auto Scaling group. Configure the Auto Scaling group to scale in or out based on the number of messages in the SQS queue.

Q1209. A company is using AWS Identity and Access Management Access Analyzer to refine IAM permissions for employee users. The company uses an organization in AWS Organizations and AWS Control Tower to manage its AWS accounts. The company has designated a specific member account as an audit account.A solutions architect needs to set up IAM Access Analyzer to aggregate findings from all member accounts in the audit account.What is the first step the solutions architect should take?

B. Configure a delegated administrator account for IAM Access Analyzer in the AWS Control Tower management account.In the delegated administrator account for IAM Access Analyzer, specify the AWS account ID of the audit account.

A. Use AWS CloudTrail to configure one trail for all accounts. Create an Amazon S3 bucket in the audit account. Configure the trail to send events related to access activity to the new S3 bucket in the audit account.

B. Configure a delegated administrator account for IAM Access Analyzer in the AWS Control Tower management account.In the delegated administrator account for IAM Access Analyzer, specify the AWS account ID of the audit account.

C. Create an Amazon S3 bucket in the audit account. Generate a new permissions policy,and add a service role to the policy to give IAM Access Analyzer access to AWS CloudTrail and the S3 bucket in the audit account.

D. Add a new trust policy that includes permissions to allow IAM Access Analyzer to perform sts:AssumeRole actions.Modify the permissions policy to allow IAM Access Analyzer to generate policies.

Q1210. A company wants to use AWS services to build an event-driven application. The company wants to use an Amazon API Gateway REST API to control traffic between blue and green environments during deployments.Which solution will meet these requirements?

D. Create a single AWS Lambda function. Use AWS Serverless Application Model (AWS SAM) to perform blue/green deployments by creating two Lambda aliases and updating the APl Gateway stage variable to switch between aliases.

A. Create two AWS Lambda functions. Configure API Gateway with two stage variables that point to each of the Lambda functions. Use AWS Serverless Application Model (AWS SAM) to perform blue/green deployments by updating the stage variables in API Gateway.

B. Create a single AWS Lambda function. Use AWS Systems Manager Run Command to perform blue/ green deployments by swapping the Lambda function alias between two different versions.

C. Create two AWS Lambda functions. Use AWS Serverless Application Model(AWS SAM) to update the Lambda functions. Use Amazon EventBridge to route events to each of the Lambda functions based on environment tags during deployments.

D. Create a single AWS Lambda function. Use AWS Serverless Application Model (AWS SAM) to perform blue/green deployments by creating two Lambda aliases and updating the APl Gateway stage variable to switch between aliases.

AWS SAA-C03 Chapter 16 Free Practice Test 2025 — Solutions Architect Associate Exam Questions

AWS SAA-C03 Chapter 16 Practice Questions (100 Questions)

Practice questions for the AWS SAA-C03 (Solutions Architect Associate) exam, Chapter 16.

Q1. Q1201. A company has set up hybrid connectivity between an on-premises data center and AWS by using AWS Site-to-Site VPN. The company is migrating a workload to AWS.The company sets up a VPC that has two public subnets and two private subnets.The company wants to monitor the total packet loss and round-trip-time (RTT) between the data center and AWS.Which solution will meet these requirements with the LEAST operational overhead?
- A. Use Amazon CloudWatch Network Monitor to set up Internet Control Message Protocol (ICMP) probe monitoring from each subnet to the on-premises destination.
- B. Create an Amazon EC2 instance in each subnet. Create a scheduled job to send Internet Control Message Protocol (lCMP) packets to the on-premises destination.
- C. Create an AWS Lambda function in each subnet. Write a script to perform Internet Control Message Protocol (lCMP) connectivity checks.
- D. Create an AWS Batch job in each subnet. Write a script to perform Internet Control Message Protocol (ICMP) connectivity checks.
View question →
Q2. Q1202. A company's packaged application dynamically creates and returns single-use text files in response to user requests. The company is using Amazon CloudFront for distribution, but wants to further reduce data transfer costs.The company cannot modify the application's source code.What should a solutions architect do to reduce costs?
- A. Use Lambda@Edge to compress the files as they are sent to users
- B. Enable Amazon S3 Transfer Acceleration to reduce the response times.
- C. Enable caching on the CloudFront distribution to store generated files at the edge.
- D. Use Amazon S3 multipart uploads to move the files to Amazon S3 before returning them to users.
View question →
Q3. Q1203. An analytics application runs on multiple Amazon EC2 Linux instances that use Amazon Elastic File System (Amazon EFS) Standard storage.The files that the application uses vary in size and access frequency.The company accesses the files infrequently after 30 days. However, users sometimes request older files to generate reports.The company wants to reduce storage costs for files that are accessed infrequently.The company also wants throughput to adjust based on the size of the file system. The company wants to use the TransitionTolA Amazon EFS lifecycle policy to transition files to Infrequent Access (lA) storage after 30 days.Which solution will meet these requirements?
- A. Configure files to transition back to Standard storage when a user accesses the files again. Specify the provisioned throughput mode.
- B. Specify the provisioned throughput mode only.
- C. Configure files to transition back to Standard storage when a user accesses the files again. Specify the bursting throughput mode.
- D. Specify the bursting throughput mode only.
View question →
Q4. Q1204. A solutions architect needs to optimize a large data analytics job that runs on an Amazon EMR cluster. The job takes 13 hours to finish. The cluster has multiple core nodes and worker nodes that are deployed on large,compute-optimized instances.After reviewing EMR logs, the solutions architect discovers that several nodes are idle for more than 5 hours while the job is running.The solutions architect needs to optimize cluster performance.Which solution will meet this requirement MOST cost-effectively?
- A. Increase the number of core nodes to ensure there is enough processing power to handle the analytics job without any idle time.
- B. Use the EMR managed scaling feature to automatically resize the cluster based on workload.
- C. Migrate the analytics job to a set of AWS Lambda functions. Configure reserved concurrency for the functions.
- D. Migrate the analytics job core nodes to a memory-optimized instance type to reduce the total job runtime.
View question →
Q5. Q1205. A company uses Amazon RDS for MySQL as a database engine for its applications. A recent security audit revealed an RDS instance that is not compliant with company policy for encrypting data at rest. A solutions architect at the company needs to ensure that all existing RDS databases are encrypted using server-side encryption and that any future deviations from the policy are detected.Which combination of steps should the solutions architect take to accomplish this?(Select TWO.)
- A. Create an AWS Config rule to detect the creation of unencrypted RDS databases. Create an Amazon EventBridge rule to trigger on the AWS Config rules compliance state change and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.
- B. Use AWS Systems Manager State Manager to detect RDS database encryption configuration drift.Create an Amazon EventBridge rule to track state changes and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.
- C. Create a read replica for the existing unencrypted RDS database and enable replica encryption in the process. Once the replica becomes active,promote it into a standalone database instance and terminate the unencrypted database instance.
- D. Take a snapshot of the unencrypted RDS database. Copy the snapshot and enable snapshot encryption in the process.Restore the database instance from the newly created encrypted snapshot.Terminate the unencrypted database instance.
- E. Enable encryption for the identified unencrypted RDS instance by changing the configurations of the existing database
View question →
Q6. Q1206. A company plans to use an Amazon S3 bucket to archive backup data. Regulations require the company to retain the backup data for 7 years.During the retention period,the company must prevent users,including administrators,from deleting the data.The company can delete the data after 7 years.Which solution will meet these requirements?
- A. Create an S3 bucket policy that denies delete operations for 7 years. Create an S3 Lifecycle policy to delete the data after 7 years
- B. Create an S3 Object Lock default retention policy that retains data for 7 years in governance mode.Create an S3 Lifecycle policy to delete the data after 7 years.
- C. Create an S3 Object Lock default retention policy that retains data for 7 years in compliance mode.Create an S3 Lifecycle policy to delete the data after 7 years.
- D. Create an S3 Batch Operations job to set a legal hold on each object for 7 years.Create an S3 Lifecycle policy to delete the data after 7 years.
View question →
Q7. Q1207. A company needs to accommodate traffic for a web application that the company hosts on AWS,especially during peak usage hours.The application uses Amazon EC2 instances as web servers,an Amazon RDS DB instance for database operations, and an Amazon S3 bucket to store transaction documents.The application struggles to scale effectively and experiences performance issues.The company wants to improve the scalability of the application and prevent future performance issues. The company also wants to improve global access speeds to the transaction documents for the company's global users.Which solution will meet these requirements?
- A. Place the EC2 instances in Auto Scaling groups to scale appropriately during peak usage hours. Use Amazon RDS read replicas to improve database read performance. Deploy an Amazon CloudFront distribution that uses Amazon S3 as the origin.
- B. Increase the size of the EC2 instances to provide more compute capacity. Use Amazon ElastiCache to reduce database read loads. Use AWS Global Accelerator to optimize the delivery of the transaction documents that are in the S3 bucket.
- C. Transition workloads from the EC2 instances to AWS Lambda functions to scale in response to the usage peaks. Migrate the database to an Amazon Aurora global database to provide cross-Region reads. Use AWS Global Accelerator to deliver the transaction documents that are in the S3 bucket.
- D. Convert the application architecture to use Amazon Elastic Container Service (Amazon ECS) containers. Configure a Multi-AZ deployment of Amazon RDS to support database operations.Replicate the transaction documents that are in the S3 bucket across multiple AWS Regions.
View question →
Q8. Q1208. A company has an application that runs on five Amazon EC2 instances. The instances run behind an Application Load Balancer (ALB). The application processes messages from an Amazon Simple Queue Service (Amazon SQS) queue.During the upcoming discount season, the company is expecting an increase in the average number of users each day.The number of users will double during peak times and will result in more messages in the SQS queue.What should a solutions architect do to handle the increase in user traffic MOST cost-effectively?
- A. Create an EC2 Auto Scaling group.Add the existing EC2 instances to the Auto Scaling group.Update the ALB's target to be the Auto Scaling group. Configure the Auto Scaling group to scale in or out based on the average CPU utilization of the EC2 instances.
- B. Double the capacity of the SQS queue.Add another five EC2 instances to handle the increase in the number of messages.
- C. Double the capacity of the SQS queue. Double the memory of the EC2 instances to handle the increase in the number of messages.
- D. Create an EC2 Auto Scaling group.Add the existing EC2 instances to the Auto Scaling group.Update the ALB's target to be the Auto Scaling group. Configure the Auto Scaling group to scale in or out based on the number of messages in the SQS queue.
View question →
Q9. Q1209. A company is using AWS Identity and Access Management Access Analyzer to refine IAM permissions for employee users. The company uses an organization in AWS Organizations and AWS Control Tower to manage its AWS accounts. The company has designated a specific member account as an audit account.A solutions architect needs to set up IAM Access Analyzer to aggregate findings from all member accounts in the audit account.What is the first step the solutions architect should take?
- A. Use AWS CloudTrail to configure one trail for all accounts. Create an Amazon S3 bucket in the audit account. Configure the trail to send events related to access activity to the new S3 bucket in the audit account.
- B. Configure a delegated administrator account for IAM Access Analyzer in the AWS Control Tower management account.In the delegated administrator account for IAM Access Analyzer, specify the AWS account ID of the audit account.
- C. Create an Amazon S3 bucket in the audit account. Generate a new permissions policy,and add a service role to the policy to give IAM Access Analyzer access to AWS CloudTrail and the S3 bucket in the audit account.
- D. Add a new trust policy that includes permissions to allow IAM Access Analyzer to perform sts:AssumeRole actions.Modify the permissions policy to allow IAM Access Analyzer to generate policies.
View question →
Q10. Q1210. A company wants to use AWS services to build an event-driven application. The company wants to use an Amazon API Gateway REST API to control traffic between blue and green environments during deployments.Which solution will meet these requirements?
- A. Create two AWS Lambda functions. Configure API Gateway with two stage variables that point to each of the Lambda functions. Use AWS Serverless Application Model (AWS SAM) to perform blue/green deployments by updating the stage variables in API Gateway.
- B. Create a single AWS Lambda function. Use AWS Systems Manager Run Command to perform blue/ green deployments by swapping the Lambda function alias between two different versions.
- C. Create two AWS Lambda functions. Use AWS Serverless Application Model(AWS SAM) to update the Lambda functions. Use Amazon EventBridge to route events to each of the Lambda functions based on environment tags during deployments.
- D. Create a single AWS Lambda function. Use AWS Serverless Application Model (AWS SAM) to perform blue/green deployments by creating two Lambda aliases and updating the APl Gateway stage variable to switch between aliases.
View question →
Q11. Q1211. A company uses Amazon Redshift to store structured data and Amazon S3 to store unstructured data. The company wants to analyze the stored data and create business intelligence reports. The company needs a data visualization solution that is compatible with Amazon Redshift and Amazon S3.Which solution will meet these requirements?
- A. Use Amazon Redshift query editor v2 to analyze data stored in Amazon Redshift. Use Amazon Athena to analyze data stored in Amazon S3. Use Amazon QuickSight to access Amazon Redshift and Athena,visualize the data analyses,and create business intelligence reports.
- B. Use Amazon Redshift Serverless to analyze data stored in Amazon Redshift. Use Amazon S3 Object Lambda to analyze data stored in Amazon S3. Use Amazon Managed Grafana to access Amazon Redshift and Object Lambda, visualize the data analyses, and create business intelligence reports
- C. Use Amazon Redshift Spectrum to analyze data stored in Amazon Redshift. Use Amazon Athena to analyze data stored in Amazon S3. Use Amazon QuickSight to access Amazon Redshift and Athena,visualize the data analyses,and create business intelligence reports.
- D. Use Amazon OpenSearch Service to analyze data stored in Amazon Redshift and Amazon S3. Use Amazon Managed Grafana to access OpenSearch Service, visualize the data analyses,and create business intelligence reports.
View question →
Q12. Q1212. A company is designing a solution to capture customer activity on the company's web applications. The company wants to analyze the activity data to make predictions.Customer activity on the web applications is unpredictable and can increase suddenly.The company requires a solution that integrates with other web applications. The solution must include an authorization step.Which solution will meet these requirements?
- A. Deploy a Gateway Load Balancer(GWLB) in front of an Amazon Elastic Container Service (Amazon ECS) container instance. Store the data in an Amazon Elastic File System (Amazon EFS) file system.Configure the applications to pass an authorization header to the GWLB.
- B. Deploy an Amazon APl Gateway endpoint in front of an Amazon Kinesis data stream.Store the data in an Amazon S3 bucket. Use an AWS Lambda function to handle authorization.
- C. Deploy an Amazon APl Gateway endpoint in front of an Amazon Data Firehose delivery stream.Store the data in an Amazon S3 bucket. Use an APl Gateway Lambda authorizer to handle authorization.
- D. Deploy a Gateway Load Balancer (GWLB) in front of an Amazon Elastic Container Service (Amazon ECS) container instance.Store the data in an Amazon Elastic File System (Amazon EFS) file system.Use an AWS Lambda function to handle authorization.
View question →
Q13. Q1213. A company is building a serverless application that processes large volumes of data from a mobile app.The application uses an AWS Lambda function to process the data and store the data in an Amazon DynamoDB table.The company needs to ensure that the application can recover from failures and continue processing data without losing any records.Which solution will meet these requirements?
- A. Configure the Lambda function to use a dead-letter queue with an Amazon Simple Queue Service (Amazon SQS) queue. Configure Lambda to retry failed records from the dead-letter queue. Use a retry mechanism by implementing an exponential backoff algorithm.
- B. Configure the Lambda function to read records from Amazon Data Firehose. Replay the Firehose records in case of any failures.
- C. Use Amazon OpenSearch Service to store failed records. Configure AWS Lambda to retry failed records from OpenSearch Service. Use Amazon EventBridge to orchestrate the retry logic.
- D. Use Amazon Simple Notification Service(Amazon SNS) to store the failed records.Configure Lambda to retry failed records from the SNS topic.Use Amazon API Gateway to orchestrate the retry calls.
View question →
Q14. Q1214. A company wants to move its on-premises Oracle database to an Amazon Aurora PostgreSQL DB cluster. The source database includes 500 GB of data,900 stored procedures and functions,and application source code with embedded SQL statements.The company understands there are some database code objects and custom features that may not be automatically converted and may need some manual intervention. Management would like to complete this migration as fast as possible with minimal downtime.Which tools and approach should be used to meet these requirements?
- A. Use AWS DMS to perform data migration and to automatically create all schemas with Aurora PostgreSQL.
- B. Use AWS DMS to perform data migration and use the AWS Schema Conversion Tool(AWS SCT) to automatically generate the converted code.
- C. Use the AWS Schema Conversion Tool (AWS SCT) to automatically convert all types of Oracle schemas to PostgreSQL and migrate the data to Aurora
- D. Use the dump and pg_dump utilities for both data migration and schema conversion.
View question →
Q15. Q1215. A company has a VPC with multiple private subnets that host multiple applications. The applications must not be accessible to the internet. However, the applications need to access multiple AWS services.The applications must not use public IP addresses to access the AWS services.Which solution will meet these requirements MOST cost-effectively?
- A. Configure interface VPC endpoints for the required AWS services. Route traffic from the private subnets through the interface VPC endpoints.
- B. Deploy a NAT gateway in each private subnet. Route traffic from the private subnets through the NAT gateways.
- C. Deploy internet gateways in each private subnet. Route traffic from the private subnets through the internet gateways.
- D. Set up an AWS Direct Connect connection between the private subnets. Route traffic from the private subnets through the Direct Connect connection.
View question →
Q16. Q1216. A company is running a critical workload on an Amazon RDS DB instance. The company needs the DB instance to be highly available. The company requires a recovery time of less than 5 minutes.Which solution will meet these requirements?
- A. Create a read replica of the DB instance.
- B. Use AWS CloudFormation to create a template of the DB instance.
- C. Take periodic snapshots of the DB instance.Store the snapshots in Amazon S3.
- D. Modify the DB instance to use a Multi-AZ deployment.
View question →
Q17. Q1217. A company runs an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to create a public APl for the application that uses JSON Web Tokens (JWT) for authentication. The company wants the API to integrate directly with the ALB.Which solution will meet these requirements?
- A. Use Amazon API Gateway to create a REST API.
- B. Use Amazon API Gateway to create an HTTP API.
- C. Use Amazon API Gateway to create a WebSocket API.
- D. Use Amazon API Gateway to create a gRPC API.
View question →
Q18. Q1218. A company uses AWS Lambda functions in a private subnet in a VPC to run application logic. The Lambda functions must not have access to the public internet. Additionally, all data communication must remain within the private network. As part of a new requirement, the application logic needs access to an Amazon DynamoDB table.What is the MOST secure way to meet this new requirement?
- A. Provision the DynamoDB table inside the same VPC that contains the Lambda functions.
- B. Create a gateway VPC endpoint for DynamoDB to provide access to the table.
- C. Use a network ACL to only allow access to the DynamoDB table from the VPC
- D. Use a security group to only allow access to the DynamoDB table from the VPC
View question →
Q19. Q1219. A company uses AWS Organizations to group multiple AWS accounts into organizational units (OUs).Each OU has service control policies (SCPs) applied.The company uses AWS ldentity and Access Management (IAM) to manage all users in the company. The company has assigned all users to IAM groups that have the required permissions to perform the tasks assigned to each group.The company does not want IAM users to be able to perform specific actions on AWS Key Management Service (AWS KMS) keys in the AWS accounts that are in a specific OU.Which solutions will meet these requirements? (Select THREE.)
- A. Attach an SCP that denies the specified AWS KMS actions to the specified OU.
- B. Attach an SCP that denies the specified AWS KMS actions to the AWS KMS keys.
- C. Attach an IAM policy that denies the specified AWS KMS actions to the IAM groups.
- D. Attach a resource-based policy that denies the specified AWS KMS actions to the AWS KMS keys.
- E. Establish a trust relationship between the AWS accounts and an identity provider (ldP) to deny the specified AWS KMS actions.
- F. Use AWS ldentity and Access Management Access Analyzer to validate the permissions of the IAM policies that are attached to the IAM groups.
View question →
Q20. Q1220. A solutions architect needs to design a serverless architecture to run an application that is packaged as a Docker container image. The container requires 50 GB of available storage for temporary files.Which solution will meet these requirements?
- A. Use AWS App Runner to deploy the Docker container image. Configure 50 GB of ephemeral storage.
- B. Create an AWS Lambda function that uses the Docker container image. Attach an Amazon Elastic Block Store (Amazon EBS) volume that has more than 50 GB of storage to the Docker container.
- C. Create an Amazon Elastic Container Service (Amazon ECS) cluster that uses the AWS Fargate launch type. Create a task definition for the container image that has an Amazon Elastic File System (Amazon EFS) volume. Use the task definition to create an ECS service.
- D. Create an Amazon Elastic Container Service (Amazon ECS) cluster that uses the Amazon EC2 launch type.Attach an Amazon Elastic Block Store (Amazon EBS) volume that has more than 50 GB of storage to the ECS cluster. Create a task definition for the container image. Use the task definition to create an ECS service.
View question →
Q21. Q1221. A solutions architect needs to design a disaster recovery (DR) plan for an application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer(ALB). The instances are in an Auto Scaling group. The application uses an Amazon Aurora PostgreSQL database. The recovery time objective (RTO) and recovery point objective (RPO) are 15 minutes each.Which combination of steps should the solutions architect take to meet these requirements MOST cost- effectively?(Select TWO.)
- A. Configure Aurora backups to be exported to the DR Region.
- B. Configure the Aurora cluster to replicate data to the DR Region by using the Aurora global database option.
- C. Configure the DR Region with an ALB and an Auto Scaling group. Use the same configuration as in the primary Region.
- D. Configure the DR Region with an ALB and an Auto Scaling group.Set the Auto Scaling group's minimum capacity,maximum capacity,and desired capacity to 1,
- E. Manually launch a new ALB and a new Auto Scaling group by using AWS CloudFormation during a failover activity.
View question →
Q22. Q1222. Acompany hosts an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants the application be accessible only from inside the VPC that hosts the ALB. The company creates an alias record of example.com in Amazon Route 53. The DNS record for the application must be resolvable only in the VPC where the application runs.Which solution will meet these requirements?
- A. Use an internet-facing ALB. Create a Route 53 public hosted zone for the application DNS name
- B. Use an internal ALB. Create a Route 53 public hosted zone for the application DNS name.
- C. Use an internet-facing ALB. Create a Route 53 private hosted zone for the application DNS name.
- D. Use an internal ALB. Create a Route 53 private hosted zone for the application DNS name.
View question →
Q23. Q1223. A company has a hybrid environment. The company has set up an AWS Direct Connect connection between the company's on-premises data center and a workload that runs in a VPC. The company uses Amazon Route 53 for DNS on AWS.The company uses a private hosted zone to manage DNS names for a set of services that are hosted on AWS.The company wants the on-premises servers to use Route 53 for DNS resolution of the private hosted zone.Which solution will meet these requirements?
- A. Create a Route 53 inbound endpoint. Ensure that security groups and routing allow the traffic from the on-premises data center. Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone's domain name to the IP addresses of the inbound endpoint.
- B. Create a Route 53 outbound endpoint. Ensure that security groups and routing allow the traffic from the VPC.Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone's domain name to the IP addresses of the outbound endpoint.
- C. Edit the private hosted zone in Route 53 with a TXT record that references the on-premises DNS servers. Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone's domain name to the base of the VPC CIDR IPv4 network range, plus two.
- D. Edit the private hosted zone in Route 53 with a PTR record that references the on-premises DNS servers. Configure the DNS server on the on-premises network to conditionally forward DNS queries for the private hosted zone's domain name to the base of the VPC CIDR IPv4 network range, plus two
View question →
Q24. Q1224. A company has an application that collects survey data and feedback from customers. The company logs customer responses to the surveys. The company frequently uses Amazon CloudWatch to access the logs. The company must ensure that personally identifiable information (PII) that customers enter into the application is not visible when the company accesses the logs.The company wants to ensure that any PII present in the logs is masked,regardless of the way the company accesses the log data.Which solution will meet these requirements?
- A. Create an AWS Lambda function that runs when a new log stream is created. Configure the Lambda function to mask sensitive data in the logs.
- B. Set up a subscription to export log data to an Amazon S3 bucket. Configure Amazon Macie to identify PII in the data.
- C. Set up a subscription to export log data to an Amazon Kinesis data stream. Use Kinesis to mask PII in the data.
- D. Create a CloudWatch data protection policy to mask PIl data when the company accesses the logs.
View question →
Q25. Q1225. Acompany has an application that generates text files based on customer data.The company stores the text files in an Amazon S3 bucket. The company must detect any personally identifiable information (PII) in the text files as quickly as possible.Which solution will meet these requirements?
- A. Configure an AWS Lambda function to send the text files from the S3 bucket to Amazon Comprehend.Configure Comprehend to scan the text files and return a result.
- B. Configure an AWS Lambda function to send the text files from the S3 bucket to Amazon Polly.Configure Amazon Polly to scan the text files and return a result.
- C. Enable Amazon Kendra,and set the S3 bucket as the source.Create an index,and configure an AWS Lambda function to scan the index to detect PII.
- D. Configure an AWS Lambda function to send the text files from the S3 bucket to Amazon Textract.Configure Amazon Textract to scan the text files and return a result.
View question →
Q26. Q1226. A company runs an application on a group of Amazon EC2 instances behind an Application Load Balancer (ALB). The company wants to protect the application against layer 7 DDoS attacks.Which solution will meet this requirement?
- A. Associate AWS Shield Standard with the ALB.
- B. Create an AWS WAF web ACL and add a custom rule.Associate the web ACL with the ALB.
- C. Create an AWS WAF web ACL and add an AWS managed rule. Associate the web ACL to the ALB
- D. Create an Amazon CloudFront distribution and set the ALB as the origin. Configure the application DNS record to point to the CloudFront distribution instead of the ALB As
View question →
Q27. Q1227. A company runs a Python script on an employee's laptop to transform and update data that is stored in an Amazon RDS database.The company wants to migrate the transformation workload to the AWS Cloud. The solution must run the Python script every 30 minutes. Each run of the script takes approximately 20 seconds to update the data in the RDS database.Which solution will meet these requirements MOST cost-effectively?
- A. Launch an Amazon EC2 On-Demand Instance to run the Python script. Configure the EC2 instance to access the RDS database. Configure a cron job to invoke the Python script.
- B. Launch an Amazon EC2 Spot Instance to run the Python script. Configure the EC2 instance to access the RDS database. Configure a cron job to invoke the Python script.
- C. Configure an AWS Lambda function to access the RDS database. Use Amazon EventBridge Scheduler to invoke the Lambda function.
- D. Configure an AWS Lambda function to access the RDS database. Configure the Lambda function with provisioned concurrency. Use an Amazon API Gateway HTTP API to invoke the Lambda function.
View question →
Q28. Q1228. A company needs to establish a connection from its on-premises data center to AWS. The company needs to connect all of its VPCs that are located in different AWS Regions with transitive routing capabilities between VPC networks.The company also must reduce network outbound traffic costs,increase bandwidth throughput, and provide a consistent network experience for end users.Which solution will meet these requirements?
- A. Create an AWS Site-to-Site VPN connection between the on-premises data center and a new central VPC. Create VPC peering connections that initiate from the central VPC to all other VPCs.
- B. Create an AWS Direct Connect connection between the on-premises data center and AWS. Provision a transit VIF, and connect it to a Direct Connect gateway. Connect the Direct Connect gateway to all the other VPCs by using a transit gateway in each Region.
- C. Create an AWS Site-to-Site VPN connection between the on-premises data center and a new central VPC.Use a transit gateway with dynamic routing. Connect the transit gateway to all other VPCs.
- D. Create an AWS Direct Connect connection between the on-premises data center and AWS. Establish an AWS Site-to-Site VPN connection between all VPCs in each Region. Create VPC peering connections that initiate fron the central VPC to all other VPCs.
View question →
Q29. Q1229. A company is building an internal expense management tool for employees. After employees enter their expense data into a form, the tool sends report data to a third-party REST API for validation and approval. The company must protect sensitive data from specific fields when the reports are sent to the third-party API.Which solution will meet these requirements?
- A. Update the tool to use Amazon Simple Notification Service (Amazon SNS) to send reports.Add a data protection policy to Amazon SNS. Use managed data identifier rules to mask the sensitive data.
- B. Update the tool to upload the reports to Amazon S3. Configure Amazon Macie to use managed data identifier rules to detect the sensitive data. Create an AWS Lambda function to mask the sensitive data.Invoke Amazon Simple Notification Service (Amazon SNS) to send the reports.
- C. Update the tool to upload the reports to Amazon Simple Queue Service (Amazon SQS).Configure an AWS Glue DataBrew job to use a ruleset to tag sensitive data with a metadata tag. Create an AWS Lambda function to mask tagged data. UseAmazon Simple Notification Service (Amazon SNS) to send the reports.
- D. Update the tool to use Amazon Simple Notification Service (Amazon SNS) to send the reports. Add a data protection policy to Amazon SNS. Create a custom data identifier rule to mask the sensitive data.Attach the rules to the data protection policy
View question →
Q30. Q1230. A solutions architect needs to save a particular automated database snapshot from an Amazon RDS for Microsoft SQL Server DB instance for longer than the maximum number of days Which solution will meet these requirements in the MOST operationally efficient way?
- A. Create a manual copy of the snapshot.
- B. Export the contents of the snapshot to an Amazon S3 bucket.
- C. Change the retention period of the snapshot to 45 days.
- D. Create a native SQL Server backup.Save the backup to an Amazon S3 bucket.
View question →
Q31. Q1231. A company recently migrated a data warehouse to AWS. The company has an AWS Direct Connect connection to AWS Company users query the data warehouse by using a visualization tool.The average size of the queries that the data warehouse returns is 50 MB. The average visualization that the visualization tool produces is 500 KB in size.The result sets that the data warehouse returns are not cached.The company wants to optimize costs for data transfers between the data warehouse and the company.Which solution will meet this requirement?
- A. Host the visualization tool on premises. Connect to the data warehouse directly through the internet.
- B. Host the visualization tool in the same AWS Region as the data warehouse. Access the visualization tool through the internet.
- C. Host the visualization tool on premises. Connect to the data warehouse through the Direct Connect connection.
- D. Host the visualization tool in the same AWS Region as the data warehouse. Access the visualization tool through the Direct Connect connection.
View question →
Q32. Q1232. A company is running an on-premises application comprised of a web tier, an application tier,and a MySQL database tier. The database is used primarily during business hours with random activity peaks throughout the day. A solutions architect needs to improve the availability and reduce the cost of the MySQL database tier as part of the company's migration to AWS.Which MySQL database option would meet these requirements?
- A. Amazon RDS for MySQL with Multi-AZ
- B. Amazon Aurora Serverless MySQL cluster
- C. Amazon Aurora MySQL cluster
- D. Amazon RDS for MySQL with read replica
View question →
Q33. Q1233. A company is running a two-tier web-based application in an on-premises data center. The application layer consists of a single server running a stateful application.The application connects to a PostgreSQL database running on a separate server.The application's user base is expected to grow significantly,so the company is migrating the application and database to AWS.The solution will use Amazon Aurora PostgreSQL,Amazon EC2 Auto Scaling,and Elastic Load Balancing. Which solution will provide a consistent user experience that will allow the application and database tiers to scale?
- A. Enable Aurora Auto Scaling for Aurora Replicas. Use a Network Load Balancer with the least outstanding requests routing algorithm and sticky sessions enabled.
- B. Enable Aurora Auto Scaling for Aurora writers. Use an Application Load Balancer with the round robin routing algorithm and sticky sessions enabled.
- C. Enable Aurora Auto Scaling for Aurora Replicas. Use an Application Load Balancer with the round robin routing algorithm and sticky sessions enabled.
- D. Enable Aurora Auto Scaling for Aurora writers. Use a Network Load Balancer with the least outstanding requests routing algorithm and sticky sessions enabled.
View question →
Q34. Q1234. A company is running a serverless ecommerce application on AWS. The application uses Amazon APl Gateway to invoke AWS Lambda Java functions. The Lambda functions connect to an Amazon RDS for MySQL database to store data During a recent sale event,a sudden increase in web traffic resulted in poor APl performance and database connection failures.The company needs to implement a solution to minimize the latency for the Lambda functions and to support bursts in traffic. Which solution will meet these requirements with the LEAST amount of change to the application?
- A. Update the code of the Lambda functions so that the Lambda functions open the database connection outside of the function handler. Increase the provisioned concurrency for the Lambda functions.
- B. Create an RDS Proxy endpoint for the database. Store database secrets in AWS Secrets Manager. Set up the required IAM permissions. Update the Lambda functions to connect to the RDS Proxy endpoint.Increase the provisioned concurrency for the Lambda functions.
- C. Create a custom parameter group. Increase the value of the max_connections parameter. Associate the custom parameter group with the RDS DB instance and schedule a reboot. Increase the reserved concurrency for the Lambda functions.
- D. Create an RDS Proxy endpoint for the database. Store database secrets in AWS Secrets Manager. Set up the required IAM permissions. Update the Lambda functions to connect to the RDS Proxy endpoint.Increase the reserved concurrency for the Lambda functions
View question →
Q35. Q1235. A company is worried about potential DDoS attacks. The company has a web application that runs on Amazon EC2 instances.The application uses Amazon S3 to serve static content such as images and videos.A solutions architect must create a resilient architecture that can withstand DDoS attacks. Which solution will meet these requirements MOST cost-effectively?
- A. Create an Amazon CloudWatch alarm that invokes an AWS Lambda function when an EC2 instance's CPU utilization reaches 90%. Program the Lambda function to update security groups that are attached to the EC2 instance to deny inbound ports 80 and 443.
- B. Put the EC2 instances into an Auto Scaling group behind an Elastic Load Balancing (ELB) load balancer. Use Amazon CloudFront with Amazon S3 as an origin.
- C. Set up a warm standby disaster recovery (DR) environment.Fail over to the warm standby DR environment if a DDoS attack is detected on the application.
- D. Subscribe to AWS Shield Advanced. Configure permissions to allow the Shield Response Team to manage resources on the cor(pany's behalf during a DDoS event.
View question →
Q36. Q1236. A security audit reveals that Amazon EC2 instances are not being patched regularly. A solutions architect needs to provide a solution that will run regular security scans across a large fleet of EC2 instances. The solution should also patch the EC2 instances on a regular schedule and provide a report of each instance's patch status.Which solution will meet these requirements?
- A. Set up Amazon Macie to scan the EC2 instances for software vulnerabilities. Set up a cron job on each EC2 instance to patch the instance on a regular schedule.
- B. Turn on Amazon GuardDuty in the account.Configure GuardDuty to scan the EC2 instances for software vulnerabilities. Set up AWS Systems Manager Session Manager to patch the EC2 instances on a regular schedule.
- C. Set up Amazon Detective to scan the EC2 instances for software vulnerabilities. Set up an Amazon EventBridge scheduled rule to patch the EC2 instances on a regular schedule.
- D. Turn on Amazon Inspector in the account. Configure Amazon Inspector to scan the EC2 instances for software vulnerabilities. Set up AWS Systems Manager Patch Manager to patch the EC2 instances on a regular schedule.
View question →
Q37. Q1237. A company has an application that uses dozens of Amazon DynamoDB tables to store data. Auditors find that the tables do not comply with the company's data protection policy. The company's retention policy states that all data must be backed up twice each month: once at midnight on the 15th day of the month and again at midnight on the 25th day of the month. The company must retain the backups for 3 months.Which combination of steps should a solutions architect take to meet these requirements?(Select TWO.)
- A. Use the DynamoDB on-demand backup capability to create a backup plan. Configure a lifecycle policy to expire backups after 3 months.
- B. Use AWS DataSync to create a backup plan. Add a backup rule that includes a retention period of 3 months.
- C. Use AWS Backup to create a backup plan. Add a backup rule that includes a retention period of 3 months.
- D. Set the backup frequency by using a cron schedule expression. Assign each DynamoDB table to the backup plan.
- E. Set the backup frequency by using a rate schedule expression. Assign each DynamoDB table to the backup plan.
View question →
Q38. Q1238. A company has more than 100 AWS accounts that need Amazon RDS instances.The company wants to build an automated solution to deploy the RDS instances with specific compliance parameters.The data does not need to be replicated. The company needs to create the databases within 1 day. Which solution will meet these requirements in the MOST operationally efficient way?
- A. Create RDS resources by using AWS CloudFormation. Share the CloudFormation template with each account.
- B. Create an RDS snapshot. Share the snapshot with each account. Deploy the snapshot into each account.
- C. Use AWS CloudFormation to create RDS instances in each account. Run AWS Database Migration Service(AWS DMS)replication to each of the created instances
- D. Create a script by using the AWS CLI to copy the RDS instance into the other accounts from a template account.
View question →
Q39. Q1239. A company uses Amazon RDS for PostgreSQL to run its applications in the us-east-1 Region.The company also uses machine learning (ML)models to forecast annual revenue based on near real-time reports. The reports are generated by using the same RDS for PostgreSQL database.The database performance slows during business hours. The company needs to improve database performance.Which solution will meet these requirements MOST cost-effectively?
- A. Create a cross-Region read replica. Configure the reports to be generated from the read replica.
- B. Activate Multi-AZ DB instance deployment for RDS for PostgreSQL. Configure the reports to be generated from the standby database.
- C. Use AWS Data Migration Service (AWS DMS) to logically replicate data to a new database.Configure the reports to be generated from the new database.
- D. Create a read replica in us-east-1. Configure the reports to be generated from the read replica.
View question →
Q40. Q1240. A company has an organization in AWS Organizations.The company runs Amazon EC2 instances across four AWS accounts in the root organizational unit (OU).There are three nonproduction accounts and one production account. The company wants to prohibit users from launching EC2 instances of a certain size in the nonproduction accounts. The company has created a service control policy (SCP) to deny access to launch instances that use the prohibited typesWhich solutions to deploy the SCP will meet these requirements?(Select TWO.)
- A. Attach the SCP to the root OU for the organization.
- B. Attach the SCP to the three nonproduction Organizations member accounts
- C. Attach the SCP to the Organizations management account.
- D. Create an OU for the production account. Attach the SCP to the OU.Move the production member account into the new OU.
- E. Create an OU for the required accounts. Attach the SCP to the OU.Move the nonproduction member accounts into the new OU.
View question →
Q41. Q1241. A cloud engineer wants to use AWS Systems Manager Session Manager to access an Amazon EC2 instance. The EC2 instance runs in a private VPC that does not have an internet gateway.Which solution will meet these requirements?
- A. Generate a new EC2 key pair. Stop the EC2 instance and assign the new key to the instance. Relaunch the EC2 instance.
- B. Move the EC2 instance to a public subnet.
- C. Create an inbound rule in the security group that is assigned to the EC2 instance. Configure the inbound rule to allow Session Manager to connect to the EC2 instance.
- D. Create an lAM role that grants Amazon EC2 permission to access Systems Manager. Associate the lAM role with the EC2 instance profile of the EC2 instance.
View question →
Q42. Q1242. A company runs a serverless application that uses Amazon RDS as a backend database on AWS. The application sometimes experiences an unpredictable increase in traffic. During traffic spikes,the application frequently opens and closes connections to the database. The traffic spikes cause the application to receive errors from the database or to run out of connections. The company needs to ensure that the application is always scalable and highly available.Which solution will meet these requirements WITHOUT any changes to the application code?
- A. Increase the maximum number of connections in the parameter group of the RDS database.
- B. Enable Multi-AZ deployment for the RDS database instance to handle connection management.
- C. Deploy Amazon RDS Proxy between the serverless application and Amazon RDS
- D. Purchase Reserved Instances for Amazon RDS to ensure that the database is highly available during peak load traffic.
View question →
Q43. Q1243. A company is using a 1 TB Amazon RDS for PostgreSQL DB instance to store user data. During a security review,a security engineer sees that the DB instance is not encrypted at rest. How should a solutions architect correct this issue with the LEAST amount of downtime and no data loss?
- A. Modify the DB instance by using the RDS management console, and enable encryption.Apply the changes immediately.
- B. Create a manual DB instance snapshot and then create an encrypted copy of that snapshot. Use this snapshot to create a new encrypted DB instance. Modify the application to connect to the new DB instance.
- C. Create a new encrypted DB instance and use AWS Database Migration Service (AWS DMS) to migrate the existing database to the encrypted DB instance. Once the instances are in sync,modify the application to connect to the new DB instance.
- D. Create an encrypted read replica. Once the read replica is in sync, promote it to primary.Modify the application to connect to the new primary instance.
View question →
Q44. Q1244. A company wants to migrate a Microsoft SQL Server database server from an on-premises data center to AWS. The company needs access to the operating system of the SQL Server database.Which solution will meet these requirements?
- A. Migrate the database to Amazon Aurora Serverless.
- B. Migrate the database Amazon RDS for SQL Server.
- C. Migrate the database to Amazon EC2 instances that run SQL Server.
- D. Migrate the database to Amazon Redshift.
View question →
Q45. Q1245. A solutions architect is provisioning an Amazon Elastic File System (Amazon EFS) file system to provide shared storage across multiple Amazon EC2 instances.The instances all exist in the same VPC across multiple Availability Zones.There are two instances in each Availability Zone.The solutions architect must make the file system accessible to each instance with the lowest possible latencyWhich solution will meet these requirements?
- A. Create a mount target for the EFS file system in the VPC. Use the mount target to mount the file system on each of the instances.
- B. Create a mount target for the EFS file system in one Availability Zone of the VPC. Use the mount target to mount the file system on the instances in that Availability Zone. Share the directory with the other instances.
- C. Create a mount target for each instance. Use each mount target to mount the EFS file system on each respective instance.
- D. Create a mount target in each Availability Zone of the VPC. Use the mount target to mount the EFS file system on the instances in the respective Availability Zone.
View question →
Q46. Q1246. A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 to route traffic.The company also has a static website that is configured in an Amazon S3 bucket.A solutions architect must use the static website as a backup to the web application.The failover to the static website must be fully automated.Which combination of actions will meet these requirements? (Select TWO.)
- A. Create a primary failover routing policy record. Configure the value to be the ALB.
- B. Create an AWS Lambda function to switch from the primary website to the secondary website when the health check fails
- C. Create a primary failover routing policy record. Configure the value to be the ALB. Associate the record with a Route 53 health check.
- D. Create a secondary failover routing policy record. Configure the value to be the static website.Associate the record with a Route 53 health check.
- E. Create a secondary failover routing policy record. Configure the value to be the static website.
View question →
Q47. Q1247. A company has an Amazon RDS for Microsoft SQL Server database that supports a serverless application.The database constantly has a high number of new database connections. A few times each week, the database reaches the maximum number of connections and experiences performance problems, A solutions architect needs to improve the performance efficiency of the database.Which solution will meet this requirement?
- A. Create an Amazon API Gateway APl to pass connections to the database. Configure the application to connect to the database through the APl instead of connecting directly to the database
- B. Use RDS Proxy to create a proxy. Configure the application to connect to the database through the proxy instead of connecting directly to the database.
- C. Create an Amazon Aurora DB cluster.Turn on connection pooling on the DB cluster. Migrate the data to the DB cluster.Cut over the application to the new database.
- D. Create an RDS for SQL Server Multi-AZ database. Configure the application to connect to the Multi-AZ endpoint instead of directly to the database.
View question →
Q48. Q1248. An ecommerce company runs a PostgreSQL database on an Amazon EC2 instance. The database stores data in Amazon Elastic Block Store (Amazon EBS) volumes.The daily peak input/output transactions per second (lOPS) do not exceed 15,000 IOPS. The company wants to migrate the database to Amazon RDS for PostgreSQL and to provision disk IOPS performance that is independent of disk storage capacity.Which solution will meet these requirements MOST cost-effectively?
- A. Configure General Purpose SSD (gp2) EBS volumes.Provision a 5 TiB volume
- B. Configure Provisioned IOPS SSD (io1) EBS volumes.Provision 15,000 IOPS
- C. Configure General Purpose SSD (gp3) EBS volumes. Provision 15,000 IOPS
- D. Configure magnetic EBS volumes to achieve maximum IOPS
View question →
Q49. Q1249. An online food delivery company wants to optimize its storage costs.The company has been collecting operational data for the last 10 years in a data lake that was built on Amazon S3 by using a Standard storage class. The company does not keep data that is older than 7 years.A solutions architect frequently uses data from the past 6 months for reporting and runs queries on data from the last 2 years about once a month. Data that is more than 2 years old is rarely accessed and is only used for audit purposes. Which combination of solutions will optimize the company's storage costs?(Select TWO.)
- A. Create an S3 Lifecycle configuration rule to transition data that is older than 6 months to the S3 Standard-lnfrequent Access(S3 Standard-lA) storage class. Create another S3 Lifecycle configuration rule to transition data that is older than 2 years to the S3 Glacier Deep Archive storage class.
- B. Create an S3 Lifecycle configuration rule to transition data that is older than 6 months to the S3 One Zone-lnfrequent Access (S3 One Zone-lA) storage class. Create another S3 Lifecycle configuration rule to transition data that is older than 2 years to the S3 Glacier Flexible Retrieval storage class.
- C. Use the S3 Intelligent-Tiering storage class to store data instead of the S3 Standard storage class.
- D. Create an S3 Lifecycle expiration rule to delete data that is older than 7 years.
- E. Create an S3 Lifecycle configuration rule to transition data that is older than 7 years to the S3 Glacier Deep Archive storage class.
View question →
Q50. Q1250. A company needs to securely store credentials that an application that runs on an Amazon EC2 instance uses to access an Amazon RDS DB instance. The company must rotate the credentials every 3 months Which solution will meet these requirements with LEAST operational overhead?
- A. Store the credentials in an AWS Systems Manager Parameter Store parameter. Use an AWS KMS key to encrypt the parameter. Create an lAM role that has read access to the parameter. Configure a 3- month rotation schedule for theparameter. Allow the lAM role decrypt access to the KMS key.Assign the lAM role to the EC2 instance.
- B. Store the credentials in an AWS Systems Manager Parameter Store parameter. Use an AWS KMS key to encrypt the parameter. Create an IAM policy that allows read access to the parameter. Configure a 3- month rotation schedule for the parameter. Add decrypt permissions for the KMS key to the lAM policy.Assign the lAM policy to the EC2 instance.
- C. Store the database credentials in an AWS Secrets Manager secret. Configure a 3-month rotation schedule for the secret. Create an IAM role that has permissions to access the secret. Assign the IAM role to the EC2 instance.
- D. Store the database credentials in an AWS Systems Manager Parameter Store parameter. Use an AWS Lambda function to rotate the credentials every 3 months. Create an lAM role that has permissions to access the parameter. Assign the lAM role to the EC2 instance
View question →
Q51. Q1251. A solutions architect needs to configure secure access to Amazon EC2 instances that run in private subnets in a VPC. Company policy states that the VPC must have internet access. The solution must provide company developers with the ability to log in to EC2 instances securely while complying with the company policy.Which solution will meet these requirements?
- A. Attach a virtual private gateway to the VPC.Use the virtual private gateway to create an AWS Site-to- Site VPN connection between the VPC and the company's office. Instruct developers to access the EC2 instances through the VPN tunnel by connecting to the instances' private IP addresses
- B. Enable AWS Client VPN within the VPC. Install and configure client VPN software on each developer's laptop.Instruct developers how to use the client VPN software to securely connect to the EC2 instances.
- C. Configure an Amazon EC2 VPC endpoint within the VPC. Update route tables to send all EC2 traffic through the VPC endpoint. Instruct the developers to connect to the EC2 instances through the VPC endpoint.
- D. Use VPC endpoints to implement AWS Systems Manager Session Manager within the VPC.Instruct developers to use the Session Manager console to access the EC2 instances within the VPC
View question →
Q52. Q1252. A company has customer data in CSV format. The company stores the data in Amazon S3 and catalogs the data in an AWS Glue Data Catalog.The company has an Amazon Redshift cluster that contains historical call center data. The cluster has a heavy load, and the company does not want to load any new data into the cluster.The company wants to JOlN the customer data that is in Amazon S3 with the historical call center data that is in Amazon Redshift. The company will use a daily batch process that takes multiple hours to run.Which solution will meet these requirements with the LEAST operational overhead?
- A. Unload the historical call center data from Amazon Redshift to Amazon S3 by using an AWS Lambda function. Perform the JOIN with the customer data that resides in Amazon S3 by using AWS Glue ETL scripts
- B. Export the historical call center data from Amazon Redshift to an Amazon EC2 instance by using the AWS CLI. Perform the JOIN with the customer data that resides in Amazon S3 by using AWS Glue ETL scripts
- C. Create an external table by using Amazon Redshift Spectrum for the customer data that resides in Amazon S3. Perform the JOlN with the historical call center data by using Amazon Redshift.
- D. Export the historical call center data from Amazon Redshift to an Amazon EMR cluster by using Apache Sqoop. Perform the JOlN with the customer data that resides in Amazon S3 by using Apache Hive.
View question →
Q53. Q1253. Alarge company requires a data backup strategy. The solution must replicate long-term backups from a source AWS account to a dedicated backup AWS account.All backups must be encrypted.The encryption keys must be available for both encryption and decryption operations in the source account and the backun account.Only specific AWS accounts,resource,and users must have access permissions for the encryption keys.Which solution will meet these requirements?
- A. Deploy a third-party encryption solution from the AWS Marketplace in the source account to manage the encryption keys. Create an AWS Lambda function that is invoked by a custom event to replicate backups to the backup account.
- B. Use AWS-managed AWS KMS keys that have default policies for encryption.Create an AWS Lambda function that is invoked by AWS Backup events that have a status of COMPLETED in Amazon EventBridge. Configure the function to replicate backups to the backup account.
- C. Deploy an AWS CloudHSM cluster in the source account to manage the encryption keys. Create an AWS Lambda function that is invoked by AWS Backup events that have a status of COMPLETED in Amazon EventBridge. Configure the function to replicate backups to the backup account.
- D. Use customer-managed AWS KMS keys that have appropriate policies attached in both the source account and the backup account. Configure AWS Backup to automate the backup and replication process.
View question →
Q54. Q1254. A gaming company has a web application that displays game scores. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB).The application stores data in an Amazon RDS for MySQL database.Users are experiencing long delays and interruptions that are caused by degraded database read performance.The company wants to improve the user experience.Which solution will meet this requirement?
- A. Use an Amazon ElastiCache (Redis OSS) cache in front of the database.
- B. Use Amazon RDS Proxy between the application and the database.
- C. Migrate the application from EC2 instances to AWS Lambda functions
- D. Use an Amazon Aurora Global Database to create multiple read replicas across multiple AWS Regions
View question →
Q55. Q1255. A company creates daily and monthly business metrics from data that partners provide.Each day,the partners deliver JSON data files to an Amazon S3 bucket that the company owns.The S3 object keys use Apache Hive style date partitions.The company uses an Amazon EventBridge rule to invoke an AWS Lambda function that reads all objects in the S3 bucket to aggregate the daily and monthly metricsThe company performs occasional analysis that requires access to historical data. As more data has accumulated, the Lambda function is timing out frequently.A solutions architect must prevent the Lambda function timeoutsWhich solution will meet these requirements with the LEAST operational overhead?
- A. Update the EventBridge rule to invoke AWS Step Functions to retry the Lambda function if the function fails.
- B. Modify the Lambda function to delete older S3 objects during the daily processing
- C. Modify the Lambda function to query the S3 objects by using Amazon Athena with date filters.
- D. Create an AWS Glue job to invoke the Lambde function. Update the EventBridge rule to invoke the AWS Glue job
View question →
Q56. Q1256. A company sends AWS CloudTrail logs from multiple AWS accounts to an Amazon S3 bucket in a centralized account. The company must store the CloudTrail logs and must be able to query the logs at any time.Which solution will meet these requirements?
- A. Store the CloudTrail logs in an Amazon S3 bucket. Create an Amazon Athena table that includes the CloudTrail logs.Query the CloudTrail logs from Athena.
- B. Configure an Amazon Neptune instance to manage the CloudTrail logs. Use Neptune to query the CloudTrail logs.
- C. Configure CloudTrail to send the logs to an Amazon DynamoDB table. Create a dashboard in Amazon QuickSight to query the logs in the table
- D. Use Amazon Athena to create an Athena notebook. Configure CloudTrail to send the logs to the notebook. Use Athena to query the logs
View question →
Q57. Q1257. A company uses AWS WAF to protect its web applications. A solutions architect configures a web ACL that uses several rules, including a rule that inspects the HTTP request body for malicious content.The solutions architect notices that the web ACL is not inspecting large HTTP POST requests properly. As a result, suspicious activities are not being detected.Some large HTTP POST requests are more than 8 MB in size.The solutions architect must ensure that the web ACL inspects the large HTTP POST requests properly.Which solution will meet this requirement?
- A. Create two custom AWS WAF rules. Configure one rule to block all oversized requests. Configure the second rule with a higher priority to allow large requests from legitimate hosts.
- B. Enable AWS Shield Advanced. Reconfigure the web ACL to block oversized requests by using Shield Advanced.
- C. Verify that the Content-Type header is correctly set in the HTTP requests that AWS WAF rules inspect.
- D. Create an AWS Lambda function to preprocess the large requests before AWS rules inspect the requests
View question →
Q58. Q1258. A company uses Amazon Route 53 as its DNS provider.The company hosts a website both on premises and in the AWS Cloud.The company's on-premises data center is near the us-west-1 Region. The company hosts the website on AWS in the eu-central-1 Region.The company wants to optimize load times for the website as much as possible.Which solution will meet these requirements?
- A. Create a DNS record with a failover routing policy that routes all primary traffic to eu-central-1.Configure the routing policy to use the on-premises data center as the secondary location.
- B. Create a DNS record with an IP-based routing policy. Configure specific IP ranges to return the value for the eu-central-1 website. Configure all other IP ranges to return the value for the on-premises website.
- C. Create a DNS record with a latency-based routing policy. Associate the record for the on-premises data center with us-west-1.
- D. Create a DNS record with a weighted routing policy. Split the traffic evenly between eu-central-1 and the on-premises data center.
View question →
Q59. Q1259. A healthcare company is designing a system to store and manage logs in the AWS Cloud.The system ingests and stores logs that are in JSON format. The logs contain sensitive patient information.The company must identify any sensitive data.The company must be able to search the log data by using SQL queries.Which solution will meet these requirements?
- A. Store the logs in an Amazon S3 bucket. Configure Amazon Macie to discover sensitive data. Use Amazon Athena to query the logs.
- B. Store the logs in an Amazon Elastic Block Store (Amazon EBS) volume. Create an application that uses Amazon SageMaker Al to detect sensitive data. Use Amazon RDS to query the logs.
- C. Store the logs in Amazon DynamoDB. Use AWS Key Management Service (AWS KMS) to discover sensitive data. Use Amazon Redshift Spectrum to query the logs.
- D. Store the logs in an Amazon S3 bucket. Use Amazon Inspector to discover sensitive data. Use Amazon Athena to query the logs.
View question →
Q60. Q1260. A solutions architect is using Amazon EC2 instances to host an application. The solutions architect needs to grant permissions for the application to access an Amazon DynamoDB table.Which solution will meet this requirement?
- A. Create access keys to access the DynamoDB table. Assign the access keys to the EC2 instance profile.
- B. Create an EC2 key pair to access the DynamoDB table. Assign the key pair to the EC2 instance profile.
- C. Create an IAM user to access the DynamoDB table. Assign the IAM user to the EC2 instance profile.
- D. Create an IAM role to access the DynamoDB table.Assign the IAM role to the EC2 instance profile.
View question →
Q61. Q1261. A company hosts a production database on an Amazon Elastic Block Store (Amazon EBS) backed Amazon EC2 instance. As part of an annual disaster recovery exercise,the company needs to restore recent EBS snapshots to a new EC2 instance in a second Availability Zone.After the snapshots are restored to EBS volumes,the resulting volumes must deliver all of their provisioned performance.The company must perform validation tests on the restored data as quickly as possible.Which configuration will meet these requirements?
- A. Enable EBS fast snapshot restore (FSR) on the snapshots for the second Availability Zone. Create new EBS volumes in the second Availability Zone from the snapshots. Attach the new EBS volumes to a new EC2 instance.
- B. Enable EBS fast snapshot restore(FSR) on the snapshots for the current Availability Zone. Create new EBS volumes in the second Availability Zone from the snapshots. Attach the new EBS volumes to a new EC2 instance.
- C. Specify Provisioned lOPS on the snapshots. Create new EBS volumes in the second Availability Zone from the snapshots. Attach the new EBS volumes to a new EC2 instance.
- D. Specify Provisioned lOPS on the existing EBS volumes.Create the snapshots.After the snapshots are completed, create new EBS volumes in the second Availability Zone from the snapshots.Attach the new EBS volumes to a new EC2 instance
View question →
Q62. Q1262. A company needs to process data from multiple users. The company stores the data in a relational database.A solutions architect needs to extract the data, use business rules to transform the data,and store the data in Amazon S3.The solutions architect must ensure that the data is encrypted during processing.Which solution will meet these requirements with the LEAST operational effort?
- A. Use AWS Glue ETL jobs that use AWS KMS to provide built-in encryption. Configure an AWS Glue job to transform the data. Store the transformed data in a separate S3 bucket for each user. Encrypt each bucket with a KMS key that is specific to each user.
- B. Use Amazon EMR clusters with encryption settings. Create one cluster for each user. Use AWS KMS keys to encrypt the data at rest and in transit.
- C. Use AWS Database Migration Service (AWS DMS) with encryption enabled. Configure one replication task for each user to extract and load data into a separate S3 bucket for each user. Encrypt each bucket with a KMS key that is specific to each user.
- D. Use AWS Lambda functions that run in response to database changes. Process data in memory, with encryption enabled. Write the processed data to Amazon S3. Use server-side encryption (SSE).
View question →
Q63. Q1263. A company has an application that processes information from documents that users upload. When a user uploads a new document to an Amazon S3 bucket, an AWS Lambda function is invoked. The Lambda function processes information from the documents.The company discovers that the application did not process many recently uploaded documents. The company wants to ensure that the application processes each document with retries if there is an error during the first attempt to process the document.Which solution will meet these requirements?
- A. Create an Amazon API Gateway REST API that has a proxy integration to the Lambda function. Update the application to send requests to the REST API.
- B. Configure a replication policy on the S3 bucket to stage the documents in another S3 bucket that an AWS Batch job processes on a daily schedule.
- C. Deploy an Application Load Balancer in front of the Lambda function that processes the documents.
- D. Configure an Amazon Simple Queue Service (Amazon SQS) queue as an event source for the Lambda function. Configure an S3 event notification on the S3 bucket to send new document upload events to the SQS queue.
View question →
Q64. Q1264. A company is planning to improve the performance of a three-tier application by adding a cache layer to a MariaDB database. To ensure high availability, the company must create replicas of the primary cache node.Which solution will meet this requirement?
- A. Create an Amazon ElastiCache(Redis OSS) cache. Configure the application to connect to the cache.
- B. Deploy an Amazon CloudFront distribution, and set the application server as the origin. Configure a cache policy and an origin request policy.
- C. Create an Amazon DynamoDB Accelerator(DAX) cluster. Configure the application to connect to the DAX cluster.
- D. Create an Amazon ElastiCache(Memcached) cache. Configure the application to connect to the cache.
View question →
Q65. Q1265. A company runs an enterprise resource planning(ERP) system on Amazon EC2 instances in a single AWS Region. Users connect to the ERP system by using a public API that is hosted on the EC2 instances. International users report slow API response times from their data centers.A solutions architect needs to improve API response times for the international all users.Which solution will meet these requirements MOST cost-effectively?
- A. Set up an AWS Direct Connect connection that has a public virtual interface(VIF) to connect each user's data center to the EC2 instances. Create a Direct Connect gateway for the ERP system API to route user API requests.
- B. Deploy Amazon API Gateway endpoints in multiple Regions. Use Amazon Route 53 latency-based routing to route requests to the nearest endpoint. Configure a VPC peering connection between the Regions to connect to the ERP system.
- C. Set up AWS Global Accelerator. Configure listeners for the necessary ports. Configure endpoint groups for the appropriate Regions to distribute traffic. Create an endpoint in each group for the API.
- D. Use AWS Site-to-Site VPN to establish dedicated VPN tunnels between multiple Regions and user networks. Route traffic to the API through the VPN connections.
View question →
Q66. Q1266. A company uses AWS to run its workloads. The company uses AWS Organizations to manage its accounts. The company needs to identify which departments are responsible for specific costs.New accounts are constantly created in the Organizations account structure. The Organizations continuous integration and continuous delivery (CI/CD) framework already adds the populated department tag to the AWSresources. The company wants to use an AWS Cost Explorer report to identify the service costs by department from all AWS accounts.Which combination of steps will meet these requirements with the MOST operational efficiency?(Select TWO.)
- A. Activate the aws:createdBy cost allocation tag and the department cost allocation tag in the management account.
- B. Create a new cost and usage report in Cost Explorer. Group by the department cost allocation tag.Apply a filter to see all linked accounts and services.
- C. Activate only the department cost allocation tag in the management account.
- D. Create a new cost and usage report in Cost Explorer. Group by the department cost allocation tag without any other filters.
- E. Activate only the aws:createdBy cost allocation tag in the management account.
View question →
Q67. Q1267. A company is building a new web application on AWS. The application needs to consume files from a legacy on-premises application that runs a batch process and outputs approximately 1 GB of data every night to an NFS file mount.A solutions architect needs to design a storage solution that requires minimal changes to the legacy application and keeps costs low.Which solution will meet these requirements MOST cost-effectively?
- A. Deploy an Outpost in AWS Outposts to the on-premises location where the legacy application is stored.Configure the legacy application and the web application to store and retrieve the files in Amazon S3 on the Outpost.
- B. Deploy an AWS Storage Gateway Volume Gateway on premises. Point the legacy application to the Volume Gateway. Configure the web application to use the Amazon S3 bucket that the Volume Gateway uses.
- C. Deploy an Amazon S3 interface endpoint on AWS. Reconfigure the legacy application to store the files directly on an Amazon S3 endpoint. Configure the web application to retrieve the files from Amazon S3.
- D. Deploy an Amazon S3 File Gateway on premises. Point the legacy application to the File Gateway.Configure the web application to retrieve the files from the S3 bucket that the File Gateway uses.
View question →
Q68. Q1268. A company is building a serverless application to process clickstream data from its website. The clickstream data is sent to an Amazon Kinesis Data Streams data stream from the application web servers. The company wants to enrich the clickstream data by joining the clickstream data with customer profile data from an Amazon Aurora Multi-AZ database. The company wants to use Amazon Redshift to analyze the enriched data. The solution must be highly available.Which solution will meet these requirements?
- A. Use an AWS Lambda function to process and enrich the clickstream data. Use the same Lambda function to write the clickstream data to Amazon S3. Use Amazon Redshift Spectrum to query the enriched data in Amazon S3.
- B. Use an Amazon EC2 Spot Instance to poll the data stream and enrich the clickstream data. Configure the EC2 instance to use the COPY command to send the enriched results to Amazon Redshift.
- C. Use an Amazon Elastic Container Service(Amazon ECS) task with AWS Fargate Spot capacity to poll the data stream and enrich the clickstream data. Configure an Amazon EC2 instance to use the COPY command to send the enriched results to Amazon Redshift.
- D. Use Amazon Data Firehose to load the clickstream data from Kinesis Data Streams to Amazon S3. Use AWS Glue crawlers to infer the schema and populate the AWS Glue Data Catalog. Use Amazon Athena to query the raw data in Amazon S3.
View question →
Q69. Q1269. A company is developing software that uses a PostgreSQL database schema. The company needs to configure development environments and test environments for its developers.Each developer at the company uses their own development environment, which includes a PostgreSQL database. On average, each development environment is used for an 8-hour workday. The test environments will be used for load testing that can take up to 2 hours each day.Which solution will meet these requirements MOST cost-effectively?
- A. Configure development environments and test environments with their own Amazon Aurora Serverless v2 PostgreSQL database.
- B. For each development environment, configure an Amazon RDS for PostgreSQL Single-AZ DB instance. For the test environment, configure a single Amazon RDS for PostgreSQL Multi-AZ DB instance.
- C. Configure development environments and test environments with their own Amazon Aurora PostgreSQL DB cluster.
- D. Configure an Amazon Aurora global database. Allow developers to connect to the database with their own credentials.
View question →
Q70. Q1270. A company hosts an Amazon EC2 instance in a private subnet in a new VPC. The VPC also has a public subnet that has the default route set to an internet gateway. The private subnet does not have outbound internet access.The EC2 instance needs to have the ability to download monthly security updates from an outside vendor.However,the company must block any connections that are initiated from the internet.Which solution will meet these requirements?
- A. Configure the private subnet route table to use the internet gateway as the default route.
- B. Create a NAT gateway in the public subnet. Configure the private subnet route table to use the NAT gateway as the default route.
- C. Create a NAT instance in the private subnet. Configure the private subnet route table to use the NAT instance as the default route.
- D. Create a NAT instance in the private subnet. Configure the private subnet route table to use the internet gateway as the default route.
View question →
Q71. Q1271. A company is deploying a new gaming application on Amazon EC2 instances. The gaming application needs to have access to shared storage.The company requires a high-performance solution to give the application the ability to use an existing custom protocol to access shared storage. The solution must ensure low latency and must be operationally efficient.Which solution will meet these requirements?
- A. Create an Amazon FSx File Gateway. Create a file share that uses the existing custom protocol.Connect the EC2 instances that host the application to the file share.
- B. Create an Amazon EC2 Windows instance. Install and configure a Windows file share role on the instance. Connect the EC2 instances that host the application to the file share.
- C. Create an Amazon Elastic File System(Amazon EFS) file system. Configure the file system to support Lustre. Connect the EC2 instances that host the application to the file system.
- D. Create an Amazon FSx for Lustre file system. Connect the EC2 instances that host the application to the file system.
View question →
Q72. Q1272. A company runs a serverless architecture that supports multiple projects and resources in the company's AWS account. The company wants to use resource tags to monitor and analyze costs contributed by individual projects to the company's AWS bill.Which solution will meet these requirements?
- A. Use AWS Budgets to set budgets for each project based on the tags assigned to resources.
- B. Use AWS Billing Conductor to configure reports for each project based on the tags assigned to resources.
- C. Use AWS Pricing Calculator to model cost reports for each project based on the tags assigned to resources.
- D. Use AWS Cost Explorer to create custom cost allocation reports based on the tags assigned to resources.
View question →
Q73. Q1273. A company has a transaction-processing application that is backed by an Amazon RDS MySQL database. When the load on the application increases, a large number of database connections are opened and closed frequently, which causes latency for the database transactions.A solutions architect determines that the root cause of the latency is poor connection handling by the application. The solutions architect cannot modify the application code. The solutions architect needs to manage database connections to improve the database performance during periods of high load.Which solution will meet these requirements?
- A. Upgrade the database instance to a larger instance type to handle a large number of database connections.
- B. Configure Amazon RDS storage autoscaling to dynamically increase the provisioned IOPS.
- C. Use Amazon RDS Proxy to pool and share database connections.
- D. Convert the database instance to a Multi-AZ deployment.
View question →
Q74. Q1274. A company runs an application as a task in an Amazon Elastic Container Service(Amazon ECS) cluster. The application must have read and write access to a specific group of Amazon S3 buckets. The S3 buckets are in the same AWS Region and AWS account as the ECS cluster. The company needs to grant the application access to the S3 buckets according to the principle of least privilege.Which combination of solutions will meet these requirements?(Select TWO.)
- A. Add a tag to each bucket. Create an IAM policy that includes a StringEquals condition that matches the tags and values of the buckets.
- B. Create an IAM policy that lists the full Amazon Resource Name(ARN) for each S3 bucket.
- C. Attach the IAM policy to the instance role of the ECS task.
- D. Create an IAM policy that includes a wildcard Amazon Resource Name(ARN) that matches all combinations of the S3 bucket names.
- E. Attach the IAM policy to the task role of the ECS task.
View question →
Q75. Q1275. A company has an application that runs on Amazon EC2 instances within a private subnet in a VPC. The instances access data in an Amazon S3 bucket in the same AWS Region. The VPC contains a NAT gateway in a public subnet to access the S3 bucket. The company wants to reduce costs by replacing the NAT gateway without compromising security or redundancy.Which solution meets these requirements?
- A. Replace the NAT gateway with a NAT instance.
- B. Replace the NAT gateway with an internet gateway.
- C. Replace the NAT gateway with a gateway VPC endpoint.
- D. Replace the NAT gateway with an AWS Direct Connect connection.
View question →
Q76. Q1276. A solutions architect is designing a multi-Region disaster recovery(DR) strategy for a company. The company runs an application on Amazon EC2 instances in Auto Scaling groups that are behind an Application Load Balancer(ALB). The company hosts the application in the company's primary and secondary AWS Regions.The application must respond to DNS queries from the secondary Region if the application in the primary Region fails. Only one Region must serve traffic at a time.Which solution will meet these requirements?
- A. Create an outbound endpoint in Amazon Route 53 Resolver. Create forwarding rules that determine how queries will be forwarded to DNS resolvers on the network. Associate the rules with VPCs in each Region.
- B. Create primary and secondary DNS records in Amazon Route 53. Configure health checks and a failover routing policy.
- C. Create a traffic policy in Amazon Route 53. Use a geolocation routing policy and a value type of ELB Application Load Balancer.
- D. Create an Amazon Route 53 profile. Associate DNS resources to the profile. Associate the profile with VPCs in each Region.
View question →
Q77. Q1277. A company is redesigning its data intake process. In the existing data intake process, the company receives data transfers and uploads the data to an Amazon S3 bucket every night. The company has AWS Glue crawlers and AWS Glue jobs that prepare the data for a machine leaning(ML) workflow.The company needs a low-code solution to run multiple AWS Glue jobs in sequence and provide a visual workflow.Which solution will meet these requirements?
- A. Use an Amazon EC2 instance to run a cron job and a script to check for the S3 files and call the AWS Glue jobs.Create an Amazon CloudWatch dashboard to visualize the workflow.
- B. Use Amazon EventBridge to call an AWS Step Functions workflow for the AWS Glue jobs. Use Step Functions to create a visual workflow.
- C. Use S3 Event Notifications to invoke a series of AWS Lambda functions and AWS Glue jobs in sequence. Use Amazon QuickSight to create a visual workflow.
- D. Create an Amazon Elastic Container Service(Amazon ECS) task that contains a Python script that manages the AWS Glue jobs and creates a visual workflow. Use Amazon EventBridge Scheduler to start the ECS task.
View question →
Q78. Q1278. A company runs a web application on Amazon EC2 instances. The application also uses an Amazon DynamoDB table. The application generates sporadic HTTP 500 errors. The DynamoDB table is operating in on-demand mode, and other applications use the table without any issues.A solutions architect wants to resolve the HTTP 500 errors without disrupting in the web application.Which solution will meet these requirements?
- A. Configure DynamoDB to support larger write requests for increased throughput.
- B. Enable DynamoDB Streams to monitor changes in the table.
- C. Configure the application to use exponential backoff and retries to query the table.
- D. Configure the application to use strongly consistent reads.
View question →
Q79. Q1279. A company has deployed an application to a group of Amazon EC2 instances. The company's credential management system uses on- premises Active Directory domain controllers. The company needs a solution that allows developers to use existing Active Directory credentials to manage the Amazon EC2 instances by assuming an IAM role.Which solution will meet these requirements?
- A. Migrate the developer's Active Directory accounts to a third-party identity provider(IdP) that can generate JSON Web JSON Web Tokens(JWT).
- B. Configure a set of EC2 instances to act as Active Directory controllers. Migrate the developers to the new Active Directory instances.
- C. Deploy an AWS Directory Service Simple AD directory. Create a trust relationship between Simple AD and the existing Active Directory controllers.
- D. Configure the on-premises Active Directory controllers to use Active Directory Federation Services(AD FS). Configure AWS IAM Identity Center to connect to AD FS.
View question →
Q80. Q1280. A solutions architect needs to verify that an Amazon EventBridge rule is working correctly. The rule is configured to send events to a target.Which solution will meet this requirement with the LEAST operational overhead?
- A. Check the Amazon CloudWatch TriggeredRules metric in the AWS/Events namespace.
- B. Send logs for the EventBridge rule to Amazon CloudWatch Logs.
- C. Create a dead-1etter queue in Amazon Simple Queue Service(Amazon SQS) to capture failed events.
- D. Enable AWS CloudTrail, and check for EventBridge API calls.
View question →
Q81. Q1281. A company has a service that produces event data. The company wants to use AWS to process the event data as it is received. The data is written in a specific order that must be maintained throughout processing. The company wants to implement a solution that minimizes operational overhead.How should a solutions architect accomplish this?
- A. Create an Amazon Simple Queue Service(Amazon SQS) FIFO queue to hold messages. Set up an AWS Lambda function to process messages from the queue.
- B. Create an Amazon Simple Notification Service(Amazon SNS) topic to deliver notifications containing payloads to process. Configure an AWS Lambda function as a subscriber.
- C. Create an Amazon Simple Queue Service(Amazon SQS) standard queue to hold messages. Set up an AWS Lambda function to process messages from the queue independently.
- D. Create an Amazon Simple Notification Service(Amazon SNS) topic to deliver notifications containing payloads to process. Configure an Amazon Simple Queue Service (Amazon SQS) queue as a subscriber.
View question →
Q82. Q1282. A company is building a new web application that serves static and dynamic content from an API. The company wants to minimize latency for users who access the application from around the world.Which solution will meet these requirements MOST cost-effectively?
- A. Deploy the static content to an Amazon S3 bucket. Use an Amazon API Gateway HTTP API to serve the dynamic content. Create an Amazon CloudFront distribution that uses the S3 bucket and the HTTP API as origins. Enable caching for static content.
- B. Deploy the static content to an Amazon S3 bucket. Provide the bucket website endpoint to users. Use an Amazon API Gateway HTTP API with caching enabled to serve the dynamic content.
- C. Deploy the static content to an Amazon S3 bucket. Use two Amazon EC2 instances as web servers.Deploy an Application Load Balancer to distribute traffic. Create an Amazon CloudFront distribution in front of the S3 bucket to cache static content.
- D. Deploy the static content to an Amazon S3 bucket. Provide the bucket website endpoint to users.Create an Amazon CloudFront distribution in front of the S3 bucket to cache static content.
View question →
Q83. Q1283. A company hosts a training website on a fleet of Amazon EC2 instances that run web server software. The company anticipates that a new training product will be extremely popular and will receive high user traffic. The training product consists of dozens of training videos that are hosted on the website.A solutions architect must minimize the load on the company's web servers.Which solution will meet this requirement?
- A. Store the videos in Amazon ElastiCache(Redis OSS). Update the web servers to serve the videos by using the ElastiCache API.
- B. Store the videos in an Amazon Elastic File System(Amazon EFS) volume. Create a user data script to mount the EFS volume to the web servers.
- C. Store the videos in an Amazon S3 bucket. Configure an Amazon CloudFront distribution, and set the S3 bucket as the origin. Create an origin access control(OAC) to secure access to the S3 bucket.
- D. Store the videos in an Amazon S3 bucket. Create an AWS Storage Gateway Amazon S3 File Gateway to access the S3 bucket. Create a user data script to mount the S3 File Gateway to the web servers.
View question →
Q84. Q1284. A company wants to receive an email notification when IAM users are added to or deleted from an AWS account.Which solution will meet these requirements?
- A. Enable Amazon Inspector. Create an Amazon EventBridge rule that responds to Amazon Inspector findings. Set the target as an Amazon Simple Notification Service(Amazon SNS) topic. Set the company's email address as a subscriber to the SNS topic.
- B. Enable Amazon GuardDuty. Create an Amazon EventBridge rule that responds to GuardDuty findings.Configure an event pattern of Impact:IAMUser/AnomalousBehavior. Set the target as an Amazon Simple Notification Service(Amazon SNS) topic. Set the company's email address as a subscriber to the SNS topic.
- C. Enable Amazon Macie. Create an Amazon EventBridge rule that responds to Macie findings. Set the target as an Amazon Simple Notification Service(Amazon SNS) topic. Set the company's email address as a subscriber to the SNS topic.
- D. Enable management events in AWS CloudTrai1. Create an Amazon EventBridge rule that responds to AWS API calls through CloudTrail. Configure an event pattern for CreateUser and DeleteUser actions.Set the target as an Amazon Simple Notification Service(Amazon SNS) topic. Set the company's email address as a subscriber to the SNS topic.
View question →
Q85. Q1285. A company that has on-premises data centers in several locations wants to migrate its workloads to AWS. The company currently runs custom applications on various operating systems by using various hypervisors on hundreds of virtual machines(VMs). Some of the applications include relational databases.A solutions architect needs to assess the existing workloads and infrastructure to plan the migration to AWS. The solutions architect must track the progress of the migration.Which solution will meet these requirements in the MOST operationally-efficient way?
- A. Install AWS Application Discovery Service to collect details about the VMs. Use AWS Database Migration Service(AWS DMS) to migrate the databases.
- B. Install AWS Application Migration Service to collect details about the existing workloads. Use AWS Database Migration Service(AWS DMS) to migrate the databases.
- C. Install AWS Application Discovery Service to collect details about the VMs. Use AWS Migration Hub to track the progress of the application migrations across multiple AWS services.
- D. Use the AWS Migration Hub API to create a script that runs from a centralized server to programmatically collect all data from on- premises servers. Use AWS Application Migration Service to track migration progress.
View question →
Q86. Q1286. A company's solutions architect is designing an AWS multi-account solution that uses AWS Organizations. The solutions architect has organized the company's accounts into organizational units(OUs).The solutions architect needs a solution that will identify any changes to the OU hierarchy. The solution also needs to notify the company's operations team of any changes.Which solution will meet these requirements with the LEAST operational overhead?
- A. Provision the AWS accounts by using AWS Control Tower. Use account drift notifications to identify the changes to the OU hierarchy.
- B. Provision the AWS accounts by using AWS Control Tower. Use AWS Config aggregated rules to identify the changes to the OU hierarchy.
- C. Use AWS Service Catalog to create accounts in Organizations. Use an AWS CloudTrail organization trail to identify the changes to the OU hierarchy.
- D. Use AWS CloudFormation templates to create accounts in Organizations. Use the drift detection operation on a stack to identify the changes to the OU hierarchy.
View question →
Q87. Q1287. A company runs a content management system on an Amazon Elastic Container Service(Amazon ECS) cluster. The system allows visitors to provide feedback about the company's products by uploading documents and photos of the products to an Amazon S3 bucket. The company has a workflow on AWS that processes uploaded documents to perform sentiment analysis of photos and text. The processing workflow calls multiple AWS services. The company needs a solution to automate the processing workflow. The solution must handle any failed uploads.Which solution will meet these requirements with the LEAST effort?
- A. Use S3 Event Notifications to publish events to an Amazon Simple Notification Service(Amazon SNS) topic. Deploy a web application on the Amazon ECS cluster to subscribe to the SNS topic and listen for events to orchestrate the processing workflow.
- B. Use S3 Event Notifications to publish events to an Amazon Simple Queue Service(Amazon SQS) queue. Configure long polling. Deploy an Amazon EC2 instance that runs a script to orchestrate the processing workflow.
- C. Use S3 Event Notifications to publish events to an Amazon Simple Queue Service(Amazon SQS) queue. Create an ECS cluster that scales based on the number of messages in the queue. Configure the cluster to orchestrate the processing workflow.
- D. Use S3 Event Notifications to invoke an Amazon EventBridge rule. Configure the rule to initiate an AWS Step Functions workflow that orchestrates the processing workflow.
View question →
Q88. Q1288. A company is designing a stock trading application that provides trading insights to customers. The company needs a solution to revoke access for inactive users who have not logged in to the application for over 180 days.Which solution will meet this requirement?
- A. Use an OpenID Connect(OIDC) provider to authenticate users. Store user login metadata in Amazon RDS. Create an AWS Glue DataBrew job that checks a user's last login time and disables the user record if the last login date is more than 180 days in the past.
- B. Use Amazon Cognito to authenticate users. Store user login date and time from AWS CloudTrail events in Amazon DynamoDB. Schedule an Amazon EventBridge event to invoke an AWS Lambda function every day to deactivate users whose last login date is more than 180 days in the past.
- C. Use Amazon Cognito to authenticate users. Store user login metadata in Amazon DocumentDB(with MongoDB compatibility). Define a TTL of 180 days for the sign-in time attribute. Configure an AWS Glue crawler to check users who have an expired TTL for login date and to invoke an AWS Lambda function to deactivate the users.
- D. Use a Kerberos-based identity provider(IdP) to authenticate users. Store user login metadata in an encrypted Amazon S3 bucket. Configure an AWS Glue crawler to catalog the user login metadata. Use Amazon Athena to query the data catalog for last login details. Delete data that is older than 180 days.
View question →
Q89. Q1289. A company runs an application on Amazon EC2 instances. The application needs to access an Amazon RDS database. The company wants to grant the EC2 instances access permissions to the RDS database while following the principle of least privilege.Which solution will meet these requirements?
- A. Create an IAM user that has a policy that grants administrative permissions. Use the IAM user's access keys on the EC2 instances to access the RDS database.
- B. Create an IAM user that has a policy that grants the minimum required permissions to access the RDS database. Embed the IAM user's access keys on the EC2 instances to access the RDS database.
- C. Create an IAM role that has a policy that grants the minimum required permissions to access the RDS database. Attach the IAM role access key and the IAM role secret key to the EC2 instance profile.
- D. Create an IAM role that has a policy that grants the minimum required permissions to access the RDS database. Attach the IAM role to an EC2 instance profile. Associate the instance profile with the instances.
View question →
Q90. Q1290. A company is planning to migrate workloads from an on-premises data center to AWS. The company wants to test the migrated workloads on AWS by setting up a temporary testing environment in one AWS Region. The testing environment includes a single Amazon EC2 instance in VPC. The company does not have any bandwidth or resiliency requirements for the testing environment.The company needs to establish bidirectional connectivity between the on-premises data center and the testing environment.Which solution will meet these requirements MOST cost-effectively?
- A. Create an AWS Direct Connect connection between the on-premises data center and AWS.
- B. Create an AWS Site-to-Site VPN connection between the on-premises data center and AWS.
- C. Create multiple AWS Site-to-Site VPN connections between the on-premises data center and AWS.
- D. Create an AWS Client VPN connection between the on-premises data center and AWS.
View question →
Q91. Q1291. A company asks a solutions architect to review the architecture for its messaging application. The application uses TCP and UDP traffic. The company is planning to deploy a new VoIP feature, but its 10 test users in other countries are reporting poor call quality.The VoIP application runs on an Amazon EC2 instance with more than enough resources. The HTTP portion of the company's application behind an Application Load Balancer has no issues.What should the solutions architect recommend for the company to do to address the VoIP performance issues?
- A. Use AWS Global Accelerator.
- B. Implement Amazon CloudFront into the architecture.
- C. Use an Amazon Route 53 geoproximity routing policy.
- D. Migrate from Application Load Balancers to Network Load Balancers.
View question →
Q92. Q1292. A company uses Amazon EMR as a data platform. The company has a rule that requires all new EMR clusters to enable encryption in-transit when the clusters are launched. Users must receive notifications immediately if any rule violations are detected.Which solution will meet these requirements?
- A. Create an Amazon EventBridge event that invokes an AWS Lambda function on each new EMR cluster when the cluster launches. Configure the Lambda function to check the encryption configuration of each new cluster and to notify users if there is a rule violation.
- B. Configure Amazon GuardDuty to check for EMR clusters that do not have in-transit encryption enabled.Notify users if there is a rule violation.
- C. Create an AWS Glue job that validates cluster encryption status and notifies users if there is a rule violation.
- D. Configure an Amazon Data Firehose stream. Set Amazon EMR as the source and AWS Lambda as the destination. For each cluster creation stream record, invoke a Lambda function to validate encryption status and to notify users if there is a rule violation.
View question →
Q93. Q1293. A company is migrating a Linux-based web server group to AWS. The web servers must access shared files by using the NFS protocol. The company must not make any changes to the web server application.Which solution will meet these requirements?
- A. Create an Amazon S3 bucket to store the shared files in S3 Standard. Grant the S3 bucket access to the web servers.
- B. Configure an Amazon CloudFront distribution. Set an Amazon S3 bucket as the origin. Store the shared files in the S3 bucket.
- C. Create an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system on the web servers.
- D. Create an Amazon FSx for Windows File Server file system. Configure SMB protocol access for the web servers.
View question →
Q94. Q1294. A company is planning to deploy a managed MySQL database solution for its non-production applications. The company plans to run the system for several years on AWS. Which solution will meet these requirements MOST cost-effectively?
- A. Create an Amazon RDS for MySQL instance. Purchase a Reserved Instance.
- B. Create an Amazon RDS for MySQL instance. Use the instance on an on-demand basis.
- C. Create an Amazon Aurora MySQL cluster with writer and reader nodes. Use the cluster on an on- demand basis.
- D. Create an Amazon EC2 instance. Manually install and configure MySQL Server on the instance.
View question →
Q95. Q1295. A company wants a flexible compute solution that includes Amazon EC2 instances and AWS Fargate. The company does not want to commit to multi-year contracts.Which purchasing option will meet these requirements MOST cost-effectively?
- A. Purchase a 1-year EC2 Instance Savings Plan with the All Upfront option.
- B. Purchase a 1-year Compute Savings Plan with the No Upfront option.
- C. Purchase a 1-year Compute Savings Plan with the Partial Upfront option.
- D. Purchase a 1-year Compute Savings Plan with the All Upfront option.
View question →
Q96. Q1296. A company wants to create a long-term storage solution that will allow users to upload terabytes of images and videos. The company will use the images and videos to train machine learning(ML) models. The storage solution must be scalable and cost-optimized.Which solution will meet these requirements?
- A. Provision an Amazon S3 bucket for users to upload images and videos. Copy the data from the S3 bucket to an Amazon FSx for Lustre file system to make the data available for ML model training.
- B. Provision an Amazon S3 bucket for users to upload images and videos. Configure the S3 bucket to make the data available to Amazon SageMaker AI for ML model training. Store the data in the S3 Intelligent-Tiering storage class.
- C. Configure an Amazon SageMaker AI notebook instance with 16 GB of storage. Create a custom application to allow users to upload images and videos directly to the notebook instance.
- D. Provision an Amazon S3 bucket for users to upload images and videos. Copy the data from the S3 bucket to an Amazon Elastic File System (Amazon EFS) file system to make the data available for ML model training.
View question →
Q97. Q1297. A company has a legacy analytics application that runs on Windows Server. The company needs to migrate the application to AWS with minimal code changes. Some components of the application use the Microsoft.NET Framework 3.1,Which solution will meet these requirements?
- A. Use AWS App2Container to migrate the legacy analytics application to containers. Deploy the containers to Amazon Elastic Container Service (Amazon ECS).
- B. Convert the legacy analytics application to run by using AWS Lambda functions.
- C. Use an AWS Glue connector to run the legacy analytics application. Deploy the application to Amazon EC2 instances.
- D. Deploy an Amazon EMR cluster to run the legacy analytics application.
View question →
Q98. Q1298. A company runs a serverless application on AWS. The application consists of multiple AWS Lambda functions, Amazon API Gateway REST APIs, and other resources. The application experiences varying levels of traffic throughout each day. Peak usage occurs during business hours. The company wants to optimize costs for the application while maintaining high performance.Which solution will meet these requirements?
- A. Use AWS Compute Optimizer recommendations to optimize memory settings. Use AWS Cost Explorer to monitor and optimize costs.
- B. Use AWS Auto Scaling for the Lambda functions. Deploy the application on AWS Fargate. Use AWS Budgets to monitor costs.
- C. Use provisioned concurrency for the Lambda functions. Use AWS Compute Optimizer recommendations to optimize memory settings. Use AWS Cost Explorer to monitor costs.
- D. Use AWS X-Ray to identify performance bottlenecks. Troubleshoot requests that result in an error.Deploy the application on AWS Fargate. Use AWS Cost Explorer to monitor costs.
View question →
Q99. Q1299. A financial services company launches a new application that uses an Amazon RDS for MySQL database. The company uses the application to track stock market trends. The company needs to operate the application for only 2 hours at the end of each week. The application must be highly available during the weekly 2-hour period.Which solution will meet these requirements MOST cost-effectively?
- A. Migrate the existing RDS for MySQL database to an Aurora Serverless v2 MySQL database cluster.
- B. Migrate the existing RDS for MySQL database to an Aurora MySQL database cluster.
- C. Migrate the existing RDS for MySQL database to an Amazon EC2 instance that runs MySQL. Launch a new EC2 Spot Instance every week before the application needs to run. Terminate the Spot Instance after the 2-hour period.
- D. Migrate the existing RDS for MySQL database to an Amazon Elastic Container Service(Amazon ECS) cluster that uses MySQL container images to run tasks.
View question →
Q100. Q1300. A company is building new learning management applications on AWS. The company is using Amazon Elastic Container Service (Amazon ECS) on Amazon EC2 to host the applications. The company must ensure that container images are secure. Company administrators must receive notifications of any security vulnerabilities in the images. Which combination of solutions will meet these requirements?(Select TWO.)
- A. Modify the ECS cluster properties to use privileged mode. Enable host-based logging.
- B. Use the AWS Config conformance pack for Amazon ECS. Use AWS Config to notify administrators if any security vulnerabilities are detected.
- C. Configure AWS WAF to invoke an Amazon CloudWatch alarm when a new security vulnerability is detected.
- D. Use Amazon Inspector to scan container images in Amazon Elastic Container Registry(Amazon ECR).
- E. Use AWS Systems Manager Parameter Store to encrypt container images.
View question →