AWS SAA-C03 Chapter 4 Practice Questions (105 Questions)

Practice questions for the AWS SAA-C03 (Solutions Architect Associate) exam, Chapter 4.

1. Q1. Q196. A hospital wants to create digital copies for its large collection of historical written records. The hospital will continue to add hundreds of new documents each day. The hospital's data team will scan the documents and will upload the documents to the AWS CloudA solutions architect must implement a solution to analyze the documents, extract the medical information, and store the documents so that an application can run SQL queries on the data. The solution must maximize scalability and operational efficiencyWhich combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

   • A. Write the document information to an Amazon EC2 instance that runs a MySQl database
   • B. Write the document information to an Amazon S3 bucket. Use Amazon Athena to query the data
   • C. Create an Auto Scaling group of Amazon EC2 instances to run a custom application that processes the scanned files and extracts the medical information
   • D. Create an AWS Lambda function that runs when new documents are uploaded. Use Amazon Rekognition to convert the documents to raw text. Use Amazon Transcribe Medical to detect and extract relevant medical information from the text
   • E. Create an AWS Lambda function that runs when new documents are uploaded. Use Amazon Textract to convert the documents to raw text. Use Amazon Comprehend Medical to detect and extract relevant medical information from the text

   View question →

2. Q2. Q197. A company serves a dynamic website from a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB).The website needs to support multiple languages to serve customers around the world. The website's architecture is running in the us-west-1 Region and is exhibiting high request latency for users that are located in other parts of the worldThe website needs to serve requests quickly and efficiently regardless of a user's location. However, the company does not want to recreate the existing architecture across multiple Regions What should a solutions architect do to meet these requirements?

   • A. Replace the existing architecture with a website that is served from an Amazon S3 bucket. Configure an Amazon CloudFront distribution with the S3 bucket as the origin. Set the cache behavior settings to cache based on the Accept-Language request header.
   • B. Configure an Amazon CloudFront distribution with the ALB as the origin. Set the cache behavior settings to cache based on the Accept-Language request header
   • C. Create an Amazon API Gateway API that is integrated with the ALB. Configure the API to use the HTTP integration type. Setup an API Gateway stage to enable the API cache based on the Accept-Language request header
   • D. Launch an EC2 instance in each additional Region and configure NGlNX to act as a cache server for that Region. Put all the EC2 instances and the ALB behind an Amazon Route 53 record set with a geolocation routing policy.

   View question →

3. Q3. Q198. A company runs a shopping application that uses Amazon DynamoDB to store customer information. In case of data corruption, a solutions architect needs to design a solution that meets a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 1 hour. What should the solutions architect recommend to meet these requirements?

   • A. Configure DynamoDB global tables. For RPO recovery, point the application to a different AWS Region.
   • B. Configure DynamoDB point-in-time recovery. For RPO recovery,restore to the desired point in time.
   • C. Export the DynamoDB data to Amazon S3 Glacier on a daily basis. For RPO recovery, import the data from S3 Glacier to DynamoDB.
   • D. Schedule Amazon Elastic Block Store (Amazon EBS) snapshots for the DynamoDB table every 15 minutes. For RPO recovery, restore the DynamoDB table by using the EBS snapshot.

   View question →

4. Q4. Q199. A company has implemented a self-managed DNS solution on three Amazon EC2 instances behind a Network Load Balancer (NLB) in the us-west-2 Region. Most of the company's users are located in the United States and Europe. The company wants to improve the performance and availability of the solution. The company launches and configures three EC2 instances in the eu-west-1 Region and adds the EC2 instances as targets for a new NLB.Which solution can the company use to route traffic to all the EC2 instances?

   • A. Create an Amazon Route 53 geolocation routing policy to route requests to one of the two NLBs. Create an Amazon CloudFront distribution. Use the Route 53 record as the distribution's origin.
   • B. Create a standard accelerator in AWS GlobalAccelerator. Create endpoint groups in us-west-2 and eu- west-1.Add the two NLBs as endpoints for the endpoint groups.
   • C. Attach Elastic IP addresses to the six EC2 instances. Create an Amazon Route 53 geolocation routing policy to route requests to one of the six EC2 instances. Create an Amazon CloudFront distribution. Use the Route 53record as the distribution's origin.
   • D. Replace the two NLBs with two Application Load Balancers (ALBs). Create an Amazon Route 53latency routing policy to route requests to one of the two ALBs. Create an Amazon CloudFront distribution. Use the Route 53record as the distribution's origin.

   View question →

5. Q5. Q200. A company is building an ecommerce web application on AWS. The application sends information about new orders to an Amazon API Gateway RESTAPI to process. The company wants to ensure that orders are processed in the order that they are received.Which solution will meet these requirements?

   • A. Use an API Gateway integration to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when the application receives an order. Subscribe an AWS Lambda function to the topic to perform processing.
   • B. Use an API Gateway integration to send a message to an Amazon Simple Queue Service (Amazon SQS) FIFO queue when the application receives an order. Configure the SQS FIFO queue to invoke an AWS Lambda function for processing
   • C. Use an API Gateway authorizer to block any requests while the application processes an order
   • D. Use an API Gateway integration to send a message to an Amazon Simple Queue Service (Amazon SQS) standard queue when the application receives an order. Configure the SQS standard queue to invoke an AWS Lambda function for processing.

   View question →

6. Q6. Q201. A reporting team receives files each day in an Amazon S3 bucket. The reporting team manually reviews and copies the files from this initial S3 bucket to an analysis S3 bucket each day at the same time to use with Amazon QuickSight Additional teams are starting to send more files in larger sizes to the initial S3 bucketThe reporting team wants to move the files automatically to the analysis S3 bucket as the files enter the initial S3 bucket. The reporting team also wants to use AWS Lambda functions to run pattern-matching code on the copied data. In addition, the reporting team wants to send the data files to a pipeline in Amazon SageMaker PipelinesWhat should a solutions architect do to meet these requirements with the LEAST operational overhead?

   • A. Create a Lambda function to copy the files to the analysis S3 bucket Create an S3 event notification for the analysis S3 bucket. Configure Lambda and SageMaker Pipelines as destinations of the event notification. Configure s3:ObjectCreated:Put as the event type
   • B. Create a Lambda function to copy the files to the analysis S3 bucket Configure the analysis S3 bucket to send event notifications to Amazon EventBridge (Amazon CloudWatch Events) Configure an ObjectCreated rule in EventBridge (CloudWatch Events).Configure Lambda and SageMaker Pipelines as targets for the rule
   • C. Configure S3 replication between the S3 buckets. Create an S3 event notification for the analysis S3 bucket. Configure Lambda and SageMaker Pipelines as destinations of the event notification. Configures3:ObiectCreated:Put as the event type
   • D. Configure S3 replication between the S3 buckets. Configure the analysis S3 bucket to send event notifications to Amazon EventBridge (Amazon CloudWatch Events). Configure an ObjectCreated rule in EventBridge (CloudWatch Events). Configure Lambda and SageMaker Pipelines as targets for the rule

   View question →

7. Q7. Q202. A company needs to keep user transaction data in an Amazon DynamoDB table. The company must retain the data for 7 years.What is the MOST operationally efficient solution that meets these requirements?

   • A. Use DynamoDB point-in-time recovery to back up the table continuously.
   • B. Use AWS Backup to create backup schedules and retention policies for the table.
   • C. Create an on-demand backup of the table by using the DynamoDB console. Store the backup in an Amazon S3bucket. Set an S3Lifecycle configuration for the S3 bucket.
   • D. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to invoke an AWS Lambda function.Configure the Lambda function to back up the table and to store the backup in an Amazon S3 bucket Set an S3 Lifecycle configuration for the S3 bucket

   View question →

8. Q8. Q203. A company wants to move its application to a serverless solution. The serverless solution needs to analyze existing and new data by using SQL. The company stores the data in an Amazon S3 bucket The data requires encryption and must be replicated to a different AWS Region. Which solution will meet these requirements with the LEAST operational overhead?

   • A. Create a new S3 bucket. Load the data into the new S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use Amazon Athena to query the data.
   • B. Create a new S3 bucket Load the data in to the new S3 bucket Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS) Use Amazon RDS to query the data.
   • C. Load the data into the existing S3 bucket. Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with Amazon S3 managed encryption keys (SSE-s3). Use Amazon Athena to query the data.
   • D. Load the data into the existing S3 bucket Use S3 Cross-Region Replication (CRR) to replicate encrypted objects to an S3 bucket in another Region. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Use Amazon RDS to query the data.

   View question →

9. Q9. Q204. A company is planning to move its data to an Amazon S3 bucket. The data must be encrypted when it is stored in the S3 bucket. Additionally, the encryption key must be automatically rotated every year. Which solution will meet these requirements with the LEAST operational overhead?

   • A. Move the data to the S3 bucket. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Use the built-in key rotation behavior of SSE-S3 encryption keys.
   • B. Create an AWS Key Management Service (AWS KMS) customer managed key Enable automatic key rotation. Set the S3 bucket's default encryption behavior to use the customer managed KMS key Move the data to the S3 bucket.
   • C. Create an AWS Key Management Service (AWS KMS) customer managed key Set the S3 bucket's default encryption behavior to use the customer managed KMS key. Move the data to the S3 bucket.Manually rotate the KMS key every year.
   • D. Encrypt the data with customer key material before moving the data to the S3 bucket. Create an AWS Key Management Service (AWS KMS) key without key material. Import the customer key material into the KMS key. Enable automatic key rotation.

   View question →

10. Q10. Q205. A company's application integrates with multiple software-as-a-service (SaaS) sources for data collection. The company runs Amazon EC2 instances to receive the data and to upload the data to an Amazon S3 bucket for analysis. The same EC2 instance that receives and uploads the data also sends a notification to the user when an upload is complete. The company has noticed slow application performance and wants to improve the performance as much as possibleWhich solution will meet these requirements with the LEAST operational overhead?

    • A. Create an Auto Scaling group so that EC2 instances can scale out. Configure an S3 event notification to send events to an Amazon Simple Notification Service (Amazon SNS) topic when the upload to the S3 bucket is complete
    • B. Create an Amazon AppFlow flow to transfer data between each SaaS source and the S3 bucket Configure an S3 event notification to send events to an Amazon Simple Notification Service (Amazon SNS) topic when the upload to the S3 bucket is complete
    • C. Create an Amazon EventBridge (Amazon CloudWatch Events) rule for each SaaS source to send output data. Configure the S3bucket as the rule's target. Create a second EventBridge (CloudWatch Events) rule to send events when the upload to the S3 bucket is complete. Configure an Amazon Simple Notification Service (Amazon SNS) topic as the second rule's target.
    • D. Create a Docker container to use instead of an EC2 instance. Host the containerized application on Amazon Elastic Container Service (Amazon ECS) Configure Amazon CloudWatch Container Insights to send events to an Amazon Simple Notification Service (Amazon SNS) topic when the upload to the S3 bucket is complete

    View question →

11. Q11. Q206. A company is running a popular social media website. The website gives users the ability to upload images to share with other users. The company wants to make sure that the images do not contain inappropriate content. The company needs a solution that minimizes development effort. What should a solutions architect do to meet these requirements?

    • A. Use Amazon Comprehend to detect inappropriate content. Use human review for low-confidence predictions.
    • B. Use Amazon Rekognition to detect inappropriate content. Use human review for low-confidence predictions
    • C. Use Amazon SageMaker to detect inappropriate content. Use ground truth to label low-confidence predictions.
    • D. Use AWS Fargate to deploy a custom machine learning model to detect inappropriate content. Use ground truth to label low-confidence predictions.

    View question →

12. Q12. Q207. A company's infrastructure consists of Amazon EC2 instances and an Amazon RDS DB instance in a single AWS Region. The company wants to back up its data in a separate Region. Which solution will meet these requirements with the LEAST operational overhead?

    • A. Use AWS Backup to copy EC2 backups and RDS backups to the separate Region.
    • B. Use Amazon Data Lifecycle Manager (Amazon DLM) to copy EC2 backups and RDS backups to the separate Region.
    • C. Create Amazon Machine Images (AMIs) of the EC2 instances. Copy the AMIs to the separate Region.Create a read replica for the RDS DB instance in the separate Region.
    • D. Create Amazon Elastic Block Store (Amazon EBS) snapshots. Copy the EBS snapshots to the separate Region. Create RDS snapshots. Export the RDS snapshots to Amazon S3. Configure S3 Cross-Region Replication (CRR) to the separate Region.

    View question →

13. Q13. Q208. An ecommerce company wants to launch a one-deal-a-day website on AWS. Each day will feature exactly one product on sale for a period of 24 hours. The company wants to be able to handle millions of requests each hour with millisecond latency during peak hours.Which solution will meet these requirements with the LEAST operational overhead?

    • A. Use Amazon S3 to host the full website in different S3 buckets.Add Amazon CloudFront distributions.Set the S3 buckets as origins for the distributions. Store the order data in Amazon S3.
    • B. Deploy the full website on Amazon EC2instances that run in Auto Scaling groups across multiple Availability Zones. Add an Application Load Balancer (ALB) to distribute the website traffic. Add another ALB for the backend APIs. Store the data in Amazon RDS for MySQL.
    • C. Migrate the full application to run in containers. Host the containers on Amazon Elastic Kubernetes Service (Amazon EKS). Use the Kubernetes Cluster Autoscaler to increase and decrease the number of pods to process bursts in traffic. Store the data in Amazon RDS for MySQL.
    • D. Use an Amazon S3 bucket to host the website's static content. Deploy an Amazon CloudFront distribution. Set the S3 bucket as the origin. Use Amazon API Gateway and AWS Lambda functions for the backend APIs. Store the data in Amazon DynamoDB.

    View question →

14. Q14. Q209. A company wants to migrate its on-premises data center to AWS.According to the company's compliance requirements, the company can use only the ap-northeast-3 Region. Company administrators are not permitted to connect VPCs to the internetWhich solutions will meet these requirements? (Select TWO)

    • A. Use AWS Control Tower to implement data residency guardrails to deny internet access and deny access to all AWS Regions except ap-northeast-3
    • B. Use rules in AWS WAF to prevent internet access. Deny access to all AWS Regions exceptap- northeast-3 in the AWS account settings.
    • C. Use AWS Organizations to configure service control policies (SCPs) that prevent VPCs from gaining internet access. Deny access to all AWS Regions except ap-northeast-3.
    • D. Create an outbound rule for the network ACL in each VPC to deny all traffic from 0.0.0.0/0. Create an IAM policy for each user to prevent the use of any AWS Region other than ap-northeast-3
    • E. Use AWS Config to activate managed rules to detect and alert for internet gateways and to detect and alert for new resources deployed outside of ap-northeast-3.

    View question →

15. Q15. Q210. A company runs an Oracle database on premises.As part of the company's migration to AWS, the company wants to upgrade the database to the most recent available version. The company also wants to set up disaster recovery (DR) for the database. The company needs to minimize the operational overhead for normal operations and DR setup. The company also needs to maintain access to the database's underlying operating system.Which solution will meet these requirements?

    • A. Migrate the Oracle database to an Amazon EC2 instance. Set up database replication to a different AWS Region.
    • B. Migrate the Oracle database to Amazon RDS for Oracle. Activate cross-Region automated backups to replicate the snapshots to another AWS Region
    • C. Migrate the Oracle database to Amazon RDS Custom for Oracle. Create a read replica for the database in another AWS Region.
    • D. Migrate the Oracle database to Amazon RDS for Oracle. Create a standby database in another Availability Zone.

    View question →

16. Q16. Q211. A company hosts its application on AWS. The company uses Amazon Cognito to manage users. When users log in to the application, the application fetches required data from Amazon DynamoDB by using a REST API that is hosted in Amazon API Gateway. The company wants an AWS managed solution that will control access to the REST API to reduce development efforts. Which solution will meet these requirements with the LEAST operational overhead?

    • A. Configure an AWS Lambda function to be an authorizer in API Gateway to validate which user made the request.
    • B. For each user, create and assign an API key that must be sent with each request. Validate the key by using an AWS Lambda function.
    • C. Send the user's email address in the header with every request. Invoke an AWS Lambda function to validate that the user with that email address has proper access.
    • D. Configure an Amazon Cognito user pool authorizer in API Gateway to allow Amazon Cognito to validate each request.

    View question →

17. Q17. Q212. A hospital recently deployed a RESTful API with Amazon API Gateway and AWS Lambda. The hospital uses API Gateway and Lambda to upload reports that are in PDF format and JPEG format. The hospital needs to modify the Lambda code to identify protected health information (PHI) in the reports. Which solution will meet these requirements with the LEAST operational overhead?

    • A. Use existing Python libraries to extract the text from the reports and to identify the PHI from the extracted text.
    • B. Use Amazon Textract to extract the text from the reports. Use Amazon SageMaker to identify the PHI from the extracted text
    • C. Use Amazon Textract to extract the text from the reports. Use Amazon Comprehend Medical to identify the PHI from the extracted text.
    • D. Use Amazon Rekognition to extract the text from the reports. Use Amazon Comprehend Medical to identify the PHI from the extracted text

    View question →

18. Q18. Q213. A company needs to configure a real-time data ingestion architecture for its application. The company needs an API, a process that transforms data as the data is streamed, and a storage solution for the data. Which solution will meet these requirements with the LEAST operational overhead?

    • A. Deploy an Amazon EC2 instance to host an API that sends data to an Amazon Kinesis data stream.Create an Amazon Kinesis Data Firehose delivery stream that uses the Kinesis data stream as a data source. Use AWS Lambda functions to transform the data. Use the Kinesis Data Firehose delivery stream to send the data to Amazon S3
    • B. Deploy an Amazon EC2 instance to host an API that sends data to AWS Glue. Stop source/destination checking on the EC2 instance. Use AWS Glue to transform the data and to send the data to Amazon S3
    • C. Configure an Amazon API Gateway API to send data to an Amazon Kinesis data stream. Create an Amazon Kinesis Data Firehose delivery stream that uses the Kinesis data stream as a data source. Use AWS Lambda functions to transform the data. Use the Kinesis Data Firehose delivery stream to send the data to Amazon S3.
    • D. Configure an Amazon API Gateway API to send data to AWS Glue. Use AWS Lambda functions to transform the data. Use AWS Glue to send the data to Amazon S3.

    View question →

19. Q19. Q214. A company is launching a new application and will display application metrics on an Amazon CloudWatch dashboard. The company's product manager needs to access this dashboard periodically. The product manager does not have an AWS account. A solutions architect must provide access to the product manager by following the principle of least privilege.Which solution will meet these requirements?

    • A. Share the dashboard from the CloudWatch console. Enter the product manager's email address, and complete the sharing steps. Provide a shareable link for the dashboard to the product manager.
    • B. Create an IAM user specifically for the product manager. Attach the CloudWatchReadOnlyAccess AWS managed policy to the user. Share the new login credentials with the product manager. Share the browser URL of the correct dashboard with the product manager.
    • C. Create an IAM user for the company's employees Attach the ViewOnlyAccess AWS managed policy to the IAM user. Share the new login credentials with the product manager. Ask the product manager to navigate to the CloudWatch console and locate the dashboard by name in the Dashboards section
    • D. Deploy a bastion server in a public subnet. When the product manager requires access to the dashboard, start the server and share the RDP credentials. On the bastion server, ensure that the browser is configured to open the dashboard URL with cached AWS credentials that have appropriate permissions to view the dashboard.

    View question →

20. Q20. Q215. A company has a data ingestion workflow that consists of the following:*An Amazon Simple Notification Service (Amazon SNS) topic for notifications about new data deliveries *An AWS Lambda function to process the data and record metadata The company observes that the ingestion workflow fails occasionally because of network connectivity issues. When such a failure occurs,the Lambda function does not ingest the corresponding data unless the company manually reruns the job. Which combination of actions should a solutions architect take to ensure that the Lambda function ingests all data in the future? (Select TWO.)

    • A. Deploy the Lambda function in multiple Availability Zones.
    • B. Create an Amazon Simple Queue Service (Amazon SQS) queue, and subscribe it to the SNS topic.
    • C. Increase the CPU and memory that are allocated to the Lambda function.
    • D. Increase provisioned throughput for the Lambda function.
    • E. Modify the Lambda function to read from an Amazon Simple Queue Service (Amazon SQS) queue.

    View question →

21. Q21. Q216. A company wants to improve its ability to clone large amounts of production data into a test environment in the same AWS Region. The data is stored in Amazon EC2instances on Amazon Elastic Block Store (Amazon EBS) volumes. Modifications to the cloned data must not affect the production environment. The software that accesses this data requires consistently high IO performance.A solutions architect needs to minimize the time that is required to clone the production data into the test environment.Which solution will meet these requirements?

    • A. Take EBS snapshots of the production EBS volumes. Restore the snapshots onto EC2instance store volumes in the test environment
    • B. Configure the production EBS volumes to use the EBS Multi-Attach feature. Take EBS snapshots of the production EBS volumes. Attach the production EBS volumes to the EC2 instances in the test environment.
    • C. Take EBS snapshots of the production EBS volumes. Create and initialize new EBS volumes. Attach the new EBS volumes to EC2 instances in the test environment before restoring the volumes from the production EBS snapshots.
    • D. Take EBS snapshots of the production EBS volumes. Turn on the EBS fast snapshot restore feature on the EBS snapshots. Restore the snapshots into new EBS volumes. Attach the new EBS volumes to EC2instances in the test environment

    View question →

22. Q22. Q217. A company runs a highly available image-processing application on Amazon EC2 instances in a single VPC. The EC2instances run inside several subnets across multiple Availability Zones. The EC2 instances do not communicate with each other. However, the EC2 instances download images from Amazon S3 and upload images to Amazon S3 through a single NAT gateway. The company is concerned about data transfer charges.What is the MOST cost-effective way for the company to avoid Regional data transfer charges?

    • A. Launch the NAT gateway in each Availability Zone.
    • B. Replace the NAT gateway with a NAT instance.
    • C. Deploy a gateway VPC endpoint for Amazon S3.
    • D. Provision an EC2 Dedicated Host to run the EC2 instances.

    View question →

23. Q23. Q218. A company runs an ecommerce application on Amazon EC2instances behind an Application Load Balancer. The instances run in an Amazon EC2Auto Scaling group across multiple Availability Zones. The Auto Scaling group scales based on CPU utilization metrics. The ecommerce application stores the transaction data in a MySQL 8.0 database that is hosted on a large EC2 instance.The database's performance degrades quickly as application load increases. The application handles more read requests than write transactions. The company wants a solution that will automatically scale the database to meet the demand of unpredictable read workloads while maintaining high availability.Which solution will meet these requirements?

    • A. Use Amazon Redshift with a single node for leader and compute functionality.
    • B. Use Amazon RDS with a Single-AZ deployment. Configure Amazon RDS to add reader instances in a different Availability Zone.
    • C. Use Amazon Aurora with a Multi-AZ deployment. Configure Aurora Auto Scaling with Aurora Replicas.
    • D. Use Amazon ElastiCache for Memcached with EC2 Spot Instances.

    View question →

24. Q24. Q219. A company has more than 5 TB of file data on Windows file servers that run on premises. Users and applications interact with the data each day.The company is moving its Windows workloads to AWS. As the company continues this process, the company requires access to AWS and on-premises file storage with minimum latency. The company needs a solution that minimizes operational overhead and requires no significant changes to the existing file access patterns. The company uses an AWS Site-to-Site VPN connection for connectivity to AWS What should a solutions architect do to meet these requirements?

    • A. Deploy and configure Amazon FSx for Windows File Server on AWS. Move the on-premises file data to FSx for Windows File Server. Reconfigure the workloads to use FSx for Windows File Server on AWS.
    • B. Deploy and configure an Amazon S3 File Gateway on premises. Move the on-premises file data to the S3 File Gateway. Reconfigure the on-premises workloads and the cloud workloads to use the S3 File Gateway
    • C. Deploy and configure an Amazon S3 File Gateway on premises. Move the on-premises file data to Amazon S3. Reconfigure the workloads to use either Amazon S3 directly or the S3 File Gateway, depending on each workload's location.
    • D. Deploy and configure Amazon FSx for Windows File Server on AWS. Deploy and configure an Amazon FSx File Gateway on premises. Move the on-premises file data to the FSx File Gateway Configure the cloud workloads to use FSx for Windows File Server on AWS. Configure the on-premises workloads to use the FSx File Gateway.

    View question →

25. Q25. Q220. A company's containerized application runs on an Amazon EC2instance. The application needs to download security certificates before it can communicate with other business applications. The company wants a highly secure solution to encrypt and decrypt the certificates in near real time. The solution also needs to store data in highly available storage after the data is encrypted. Which solution will meet these requirements with the LEAST operational overhead?

    • A. Create AWS Secrets Manager secrets for encrypted certificates. Manually update the certificates as needed. Control access to the data by using fine-grained IAM access
    • B. Create an AWS Lambda function that uses the Python cryptography library to receive and perform encryption operations. Store the function in an Amazon S3 bucket
    • C. Create an AWS Key Management Service (AWS KMS) customer managed key. Allow the EC2 role to use the KMS key for encryption operations. Store the encrypted data on Amazon S3
    • D. Create an AWS Key Management Service (AWS KMS) customer managed key. Allow the EC2 role to use the KMS key for encryption operations. Store the encrypted data on Amazon Elastic Block Store (Amazon EBS) volumes

    View question →

26. Q26. Q221. A company has registered its domain name with Amazon Route 53. The company uses Amazon API Gateway in the ca-central-1 Region as a public interface for its backend microservice APIs. Third-party services consume the APIs securely. The company wants to design its API Gateway URL with the company's domain name and corresponding certificate so that the third-party services can use HTTPS.Which solution will meet these requirements?

    • A. Create stage variables in API Gateway with Name="Endpoint-URL" and Value="Company Domain Name" to overwrite the default URL. Import the public certificate associated with the company's domain name into AWS Certificate Manager (ACM).
    • B. Create Route 53 DNS records with the company's domain name. Point the alias record to the Regional API Gateway stage endpoint. Import the public certificate associated with the company's domain name into AWS Certificate Manager (ACM) in the us-east-1 Region.
    • C. Create a Regional API Gateway endpoint Associate the API Gateway endpoint with the company's domain name. Import the public certificate associated with the company's domain name into AWS Certificate Manager (ACM) in the same Region. Attach the certificate to the API Gateway endpoint.Configure Route 53to route traffic to the API Gateway endpoint.
    • D. Create a Regional API Gateway endpoint Associate the API Gateway endpoint with the company's domain name. Import the public certificate associated with the company's domain name into AWS Certificate Manager (ACM) in the us-east-1 Region. Attach the certificate to the API Gateway APIs.Create Route 53 DNS records with the company's domain name. Point an A record to the company's domain name.

    View question →

27. Q27. Q222. A company is developing an application that provides order shipping statistics for retrieval by a RESTAPI. The company wants to extract the shipping statistics, organize the data into an easy-to-read HTML format, and send the report to several email addresses at the same time every morning. Which combination of steps should a solutions architect take to meet these requirements? (Select TWO)

    • A. Configure the application to send the data to Amazon Kinesis Data Firehose.
    • B. Use Amazon Simple Email Service (Amazon SES) to format the data and to send the report by email.
    • C. Create an Amazon EventBridge (Amazon CloudWatch Events) scheduled event that invokes an AWS Glue job to query the application's API for the data.
    • D. Create an Amazon EventBridge (Amazon CloudWatch Events) scheduled event that invokes an AWS Lambda function to query the application's API for the data
    • E. Store the application data in Amazon S3 Create an Amazon Simple Notification Service (Amazon SNS) topic as an S3 event destination to send the report by email

    View question →

28. Q28. Q223. A company has a web application that is based on Java and PHP. The company plans to move the application from on premises to AWS. The company needs the ability to test new site features frequently. The company also needs a highly available and managed solution that requires minimum operational overhead.Which solution will meet these requirements?

    • A. Create an Amazon S3 bucket. Enable static web hosting on the S3 bucket Upload the static content to the S3 bucket Use AWS Lambda to process all dynamic content.
    • B. Deploy the web application to an AWS Elastic Beanstalk environment. Use URL swapping to switch between multiple Elastic Beanstalk environments for feature testing
    • C. Deploy the web application to Amazon EC2 instances that are configured with Java and PHP. Use Auto Scaling groups and an Application Load Balancer to manage the website's availability.
    • D. Containerize the web application. Deploy the web application to Amazon EC2 instances. Use the AWS Load Balancer Controller to dynamically route traffic between containers that contain the new site features for testing

    View question →

29. Q29. Q224. An image-processing company has a web application that users use to upload images. The application uploads the images into an Amazon S3 bucket. The company has set up S3 event notifications to publish the object creation events to an Amazon Simple Queue Service (Amazon SQS) standard queue. The SQS queue serves as the event source for an AWS Lambda function that processes the images and sends the results to users through email.Users report that they are receiving multiple email messages for every uploaded image. A solutions architect determines that SQS messages are invoking the Lambda function more than once, resulting in multiple email messages.What should the solutions architect do to resolve this issue with the LEAST operational overhead?

    • A. Set up long polling in the SQS queue by increasing the ReceiveMessage wait time to 30 seconds
    • B. Change the SQS standard queue to an SQS FIFO queue. Use the message deduplication ID to discard duplicate messages
    • C. Increase the visibility timeout in the SQS queue to a value that is greater than the total of the function timeout and the batch window timeout.
    • D. Modify the Lambda function to delete each message from the SQS queue immediately after the message is read before processing.

    View question →

30. Q30. Q225. A company hosts a containerized web application on a fleet of on-premises servers that process incoming requests. The number of requests is growing quickly. The on-premises servers cannot handle the increased number of requests. The company wants to move the application to AWS with minimum code changes and minimum development effort.Which solution will meet these requirements with the LEAST operational overhead?

    • A. Use AWS Fargate on Amazon Elastic Container Service (Amazon ECS) to run the containerized web application with Service Auto Scaling. Use an Application Load Balancer to distribute the incoming requests.
    • B. Use two Amazon EC2 instances to host the containerized web application. Use an Application Load Balancer to distribute the incoming requests.
    • C. Use AWS Lambda with a new code that uses one of the supported languages. Create multiple Lambda functions to support the load. Use Amazon API Gateway as an entry point to the Lambda functions.
    • D. Use a high performance computing (HPC) solution such as AWS ParallelCluster to establish an HPC cluster that can process the incoming requests at the appropriate scale.

    View question →

31. Q31. Q226. A company wants to migrate its on-premises application to AWS. The application produces output files that vary in size from tens of gigabytes to hundreds of terabytes. The application data must be stored in a standard file system structure. The company wants a solution that scales automatically, is highly available, and requires minimum operational overhead.Which solution will meet these requirements?

    • A. Migrate the application to run as containers on Amazon Elastic Container Service (Amazon ECS). Use Amazon S3for storage.
    • B. Migrate the application to run as containers on Amazon Elastic Kubernetes Service (Amazon EKS). Use Amazon Elastic Block Store (Amazon EBS) for storage.
    • C. Migrate the application to Amazon EC2 instances in a Multi-AZ Auto Scaling group. Use Amazon Elastic File System (Amazon EFS) for storage.
    • D. Migrate the application to Amazon EC2 instances in a Multi-AZ Auto Scaling group. Use Amazon Elastic Block Store (Amazon EBS) for storage.

    View question →

32. Q32. Q227. A company is running an SMB file server in its data center. The file server stores large files that are accessed frequently for the first few days after the files are created. After 7 days, the files are rarely accessed.The total data size is increasing and is close to the company's total storage capacity.A solutions architect must increase the company's available storage space without losing low-latency access to the most recently accessed files. The solutions architect must also provide file lifecycle management to avoid future storage issues.Which solution will meet these requirements?

    • A. Use AWS DataSync to copy data that is older than 7 days from the SMB file server to AWS
    • B. Create an Amazon S3 File Gateway to extend the company's storage space. Create an S3 Lifecycle policy to transition the data to S3 Glacier Deep Archive after 7 days
    • C. Create an Amazon FSx for Windows File Server file system to extend the company's storage space.
    • D. Install a utility on each user's computer to access Amazon S3 Create an S3 Lifecycle policy to transition the data to S3 Glacier Flexible Retrieval after 7 days.

    View question →

33. Q33. Q228. A company is building an application in the AWS Cloud. The application will store data in Amazon S3buckets in two AWS Regions. The company must use an AWS Key Management Service (AWS KMS) customer managed key to encrypt all data that is stored in the S3 buckets The data in both S3 buckets must be encrypted and decrypted with the same KMS key. The data and the key must be stored in each of the two Regions.Which solution will meet these requirements with the LEAST operational overhead?

    • A. Create an S3 bucket in each Region Configure the S3 buckets to use server-side encryption with Amazon S3managed encryption keys (SSE-S3). Configure replication between the S3 buckets
    • B. Create a customer managed multi-Region KMS key. Create an S3 bucket in each Region Configure replication between the S3buckets. Configure the application to use the KMS key with client-side encryption.
    • C. Create a customer managed KMS key and an S3 bucket in each Region. Conigure the S3 buckets to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) Configure replication between the S3 buckets
    • D. Create a customer managed KMS key and an S3 bucket in each Region. Configure the S3 buckets to use server-side encryption with AWS KMS keys (SSE-KMS). Configure replication between the S3 buckets.

    View question →

34. Q34. Q229. A company needs to run a critical application on AWS. The company needs to use Amazon EC2 for the application's database. The database must be highly available and must fail over automatically if a disruptive event occurs.Which solution will meet these requirements?

    • A. Launch two EC2 instances, each in a different Availability Zone in the same AWS Region. Install the database on both EC2instances. Configure the EC2 instances as a cluster. Set up database replication.
    • B. Launch an EC2 instance in an Availability Zone. Install the database on the EC2 instance. Use an Amazon Machine Image (AMI) to back up the data. Use AWS CloudFormation to automate provisioning of the EC2 instance if a disruptive event occurs
    • C. Launch two EC2 instances, each in a different AWS Region. Install the database on both EC2 instances. Set up database replication. Fail over the database to a second Region.
    • D. Launch an EC2 instance in an Availability Zone. Install the database on the EC2 instance. Use an Amazon Machine Image (AMI) to back up the data. Use EC2 automatic recovery to recover the instance if a disruptive event occurs.

    View question →

35. Q35. Q230. A company provides a Voice over Internet Protocol (VolP) service that uses UDP connections. The service consists of Amazon EC2 instances that run in an Auto Scaling group. The company has deployments across multiple AWS Regions.The company needs to route users to the Region with the lowest latency. The company also needs automated failover between Regions.Which solution will meet these requirements?

    • A. Deploy a Network Load Balancer (NLB) and an associated target group. Associate the target group with the Auto Scaling group. Use the NLB as an AWS Global Accelerator endpoint in each Region
    • B. Deploy an Application Load Balancer (ALB) and an associated target group. Associate the target group with the Auto Scaling group. Use the ALB as an AWS Global Accelerator endpoint in each Region.
    • C. Deploy a Network Load Balancer (NLB) and an associated target group. Associate the target group with the Auto Scaling group. Create an Amazon Route 53latency record that points to aliases for each NLB.Create an Amazon CloudFront distribution that uses the latency record as an origin.
    • D. Deploy an Application Load Balancer (ALB) and an associated target group. Associate the target group with the Auto Scaling group. Create an Amazon Route 53 weighted record that points to aliases for each ALB. Deploy an Amazon CloudFront distribution that uses the weighted record as an origin.

    View question →

36. Q36. Q231. A company's order system sends requests from clients to Amazon EC2instances. The EC2 instances process the orders and then store the orders in a database on Amazon RDS. Users report that they must reprocess orders when the system fails. The company wants a resilient solution that can process orders automatically if a system outage occurs.What should a solutions architect do to meet these requirements?

    • A. Move the EC2 instances into an Auto Scaling group. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to target an Amazon Elastic Container Service (Amazon ECS) task.
    • B. Move the EC2 instances into an Auto Scaling group behind an Application Load Balancer (ALB) Update the order system to send messages to the ALB endpoint.
    • C. Move the EC2 instances into an Auto Scaling group. Configure the order system to send messages to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the EC2 instances to consume messages from the queue.
    • D. Create an Amazon Simple Notification Service (Amazon SNS) topic Create an AWS Lambda function, and subscribe the function to the SNS topic. Configure the order system to send messages to the SNS topic. Send a command to the EC2 instances to process the messages by using AWS Systems Manager Run Command.

    View question →

37. Q37. Q232. A company needs to review its AWS Cloud deployment to ensure that its Amazon S3 buckets do not have unauthorized configuration changes.What should a solutions architect do to accomplish this goal?

    • A. Turn on AWS Config with the appropriate rules.
    • B. Turn on AWS Trusted Advisor with the appropriate checks.
    • C. Turn on Amazon Inspector with the appropriate assessment template.
    • D. Turn on Amazon S3 server access logging. Configure Amazon EventBridge (Amazon CloudWatch Events).

    View question →

38. Q38. Q233. An application runs on an Amazon EC2 instance in a VPC. The application processes logs that are stored in an Amazon S3 bucket. The EC2 instance needs to access the S3 bucket without connectivity to the internet.Which solution will provide private network connectivity to Amazon S3?

    • A. Create a gateway VPC endpoint to the S3 bucket
    • B. Stream the logs to Amazon CloudWatch Logs. Export the logs to the S3 bucket
    • C. Create an instance profile on Amazon EC2 to allow S3 access.
    • D. Create an Amazon API Gateway API with a private link to access the S3 endpoint.

    View question →

39. Q39. Q234. The customers of a finance company request appointments with financial advisors by sending text messages. A web application that runs on Amazon EC2 instances accepts the appointment requests. The text messages are published to an Amazon Simple Queue Service (Amazon SQS) queue through the web application. Another application that runs on EC2 instances then sends meeting invitations and meeting confirmation email messages to the customers.After successful scheduling, this application stores the meeting information in an Amazon DynamoDB database.As the company expands, customers report that their meeting invitations are taking longer to arrive. What should a solutions architect recommend to resolve this issue?

    • A. Add a DynamoDB Accelerator (DAX) cluster in front of the DynamoDB database.
    • B. Add an Amazon API Gateway API in front of the web application that accepts the appointment requests.
    • C. Add an Amazon CloudFront distribution. Set the origin as the web application that accepts the appointment requests.
    • D. Add an Auto Scaling group for the application that sends meeting invitations. Configure the Auto Scaling group to scale based on the depth of the SQS queue

    View question →

40. Q40. Q235. A company is designing an application. The application uses an AWS Lambda function to receive information through Amazon API Gateway and to store the information in an Amazon Aurora PostgreSQL database.During the proof-of-concept stage, the company has to increase the Lambda quotas significantly to handle the high volumes of data that the company needs to load into the database.A solutions architect must recommend anew design to improve scalability and minimize the configuration effort.Which solution will meet these requirements?

    • A. Refactor the Lambda function code to Apache Tomcat code that runs on Amazon EC2instances.Connect the database by using native Java Database Connectivity (JDBC) drivers
    • B. Change the platform from Aurora to Amazon DynamoDB. Provision a DynamoDB Accelerator (DAX) cluster. Use the DAX client SDK to point the existing DynamoDB API calls at the DAX cluster.
    • C. Set up two Lambda functions. Configure one function to receive the information. Configure the other function to load the information into the database. Integrate the Lambda functions by using Amazon Simple Notification Service (Amazon SNS).
    • D. Set up two Lambda functions. Configure one function to receive the information. Configure the other function to load the information into the database. Integrate the Lambda functions by using an Amazon Simple Queue Service (Amazon SQS)queue.

    View question →

41. Q41. Q236. A company stores call transcript files on a monthly basis. Users access the files randomly within 1 year of the call, but users access the files infrequently after 1year. The company wants to optimize its solution by giving users the ability to query and retrieve files that are less than 1 year old as quickly as possible.A delay in retrieving older files is acceptable.Which solution will meet these requirements MOST cost-effectively?

    • A. Store individual files with tags in Amazon S3 Glacier Instant Retrieval. Query the tags to retrieve the files from S3 Glacier Instant Retrieval.
    • B. Store individual files in Amazon S3 Intelligent-Tiering. Use S3 Lifecycle policies to move the files to S3 Glacier Flexible Retrieval after 1year.Query and retrieve the files that are in Amazon S3 by using Amazon Athena Query and retrieve the files that are in S3 Glacier by using S3 Glacier Select.
    • C. Store individual files with tags in Amazon S3 Standard Storage. Store search metadata for each archive in Amazon S3 Standard storage. Use S3Lifecycle policies to move the files to S3 Glacier Instant Retrieval after 1 year. Query and retrieve the files by searching for metadata from Amazon S3.
    • D. Store individual files in Amazon S3 Standard storage. Use S3Lifecycle policies to move the files to S3 Glacier Deep Archive after 1year. Store search metadata in Amazon RDS. Query the files from Amazon RDS. Retrieve the files from S3 Glacier Deep Archive.

    View question →

42. Q42. Q237. A company uses 50 TB of data for reporting. The company wants to move this data from on premises to AWS. A custom application in the company's data center runs a weekly data transformation job. The company plans to pause the application until the data transfer is complete and needs to begin the transfer process as soon as possible.The data center does not have any available network bandwidth for additional workloads. A solutions architect must transfer the data and must configure the transformation job to continue to run in the AWS Cloud.Which solution will meet these requirements with the LEAST operational overhead?

    • A. Use AWS DataSync to move the data. Create a custom transformation job by using AWS Glue.
    • B. Order an AWS Snowcone device to move the data. Deploy the transformation application to the device
    • C. Order an AWS Snowball Edge Storage Optimized device. Copy the data to the device. Create a custom transformation job by using AWS Glue.
    • D. Order an AWS Snowball Edge Storage Optimized device that includes Amazon EC2 compute. Copy the data to the device. Create anew EC2 instance on AWS to run the transformation application.

    View question →

43. Q43. Q238. A company's website uses an Amazon EC2 instance store for its catalog of items. The company wants to make sure that the catalog is highly available and that the catalog is stored in a durable location.What should a solutions architect do to meet these requirements?

    • A. Move the catalog to Amazon ElastiCache for Redis.
    • B. Deploy a larger EC2 instance with a larger instance store.
    • C. Move the catalog from the instance store to Amazon S3 Glacier Deep Archive.
    • D. Move the catalog to an Amazon Elastic File System (Amazon EFS) fle system.

    View question →

44. Q44. Q239. A company has a production workload that runs on 1,000Amazon EC2 Linux instances. The workload is powered by third-party software. The company needs to patch the third-party software on all EC2 instances as quickly as possible to remediate a critical security vulnerability.What should a solutions architect do to meet these requirements?

    • A. Create an AWS Lambda function to apply the patch to all EC2 instances.
    • B. Configure AWS Systems Manager Patch Manager to apply the patch to all EC2 instances.
    • C. Schedule an AWS Systems Manager maintenance window to apply the patch to all EC2 instances.
    • D. Use AWS Systems Manager Run Command to run a custom command that applies the patch to all EC2 instances.

    View question →

45. Q45. Q240. A company uses AWS Organizations to create dedicated AWS accounts for each business unit to manage each business unit's account independently upon request. The root email recipient missed a notification that was sent to the root user email address of one account. The company wants to ensure that all future notifications are not missed. Future notifications must be limited to account administrators.Which solution will meet these requirements?

    • A. Configure the company's email server to forward notification email messages that are sent to the AWS account root user email address to all users in the organization.
    • B. Configure all AWS account root user email addresses as distribution lists that go to a few administrators who can respond to alerts. Configure AWS account alternate contacts in the AWS Organizations console or programmatically.
    • C. Configure all AWS account root user email messages to be sent to one administrator who is responsible for monitoring alerts and forwarding those alerts to the appropriate groups.
    • D. Configure all existing AWS accounts and all newly created accounts to use the same root user email address. Configure AWS account alternate contacts in the AWS Organizations console or programmatically

    View question →

46. Q46. Q241. A company runs multiple Windows workloads on AWS. The company's employees use Windows file shares that are hosted on two Amazon EC2 instances. The file shares synchronize data between themselves and maintain duplicate copies. The company wants a highly available and durable storage solution that preserves how users currently access the files.What should a solutions architect do to meet these requirements?

    • A. Migrate all the data to Amazon S3. Set up IAM authentication for users to access files.
    • B. Set up an Amazon S3 File Gateway. Mount the S3 File Gateway on the existing EC2 instances.
    • C. Extend the file share environment to Amazon FSx for Windows File Server with a Multi-AZ configuration.Migrate all the data to FSx for Windows File Server.
    • D. Extend the file share environment to Amazon Elastic File System (Amazon EFS) with a Multi-AZ configuration. Migrate all the data to Amazon EFS.

    View question →

47. Q47. Q242. A company has an AWS Glue extract, transform, and load (ETL) job that runs every day at the same time. The job processes XML data that is in an Amazon S3 bucket New data is added to the S3 bucket every day.A solutions architect notices that AWS Glue is processing all the data during each run.What should the solutions architect do to prevent AWS Glue from reprocessing old data?

    • A. Edit the job to use job bookmarks.
    • B. Edit the job to delete data after the data is processed.
    • C. Edit the job by setting the NumberOfWorkers field to 1.
    • D. Use a FindMatches machine learning (ML) transform.

    View question →

48. Q48. Q243. A company is migrating applications to AWS. The applications are deployed in different accounts. The company manages the accounts centrally by using AWS Organizations. The company's security team needs a single sign-on (SSO) solution across all the company's accounts. The company must continue managing the users and groups in its on-premises self-managed Microsoft Active DirectoryWhich solution will meet these requirements?

    • A. Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console. Create a one-way forest trust or a one-way domain trust to connect the company's self-managed Microsoft Active Directory with AWS SSO by using AWS Directory Service for Microsoft Active Directory.
    • B. Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console. Create a two-way forest trust to connect the company's self-managed Microsoft Active Directory with AWS SSO by using AWS Directory Service for Microsoft Active Directory
    • C. Use AWS Directory Service. Create a two-way trust relationship with the company's self-managed Microsoft Active Directory.
    • D. Deploy an identity provider (ldP) on premises. Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console.

    View question →

49. Q49. Q244. A company is building a web-based application running on Amazon EC2 instances in multiple Availability Zones. The web application will provide access to a repository of text documents totaling about 900 TB in size. The company anticipates that theweb application will experience periods of high demand. A solutions architect must ensure that the storage component for the text documents can scale to meet the demand of the application at all times. The company is concerned about the overall cost of the solution.Which storage solution meets these requirements MOST cost-effectively?

    • A. Amazon Elastic Block Store (Amazon EBS)
    • B. Amazon Elastic File System (Amazon EFS)
    • C. Amazon OpenSearch Service (Amazon Elasticsearch Service)
    • D. Amazon S3

    View question →

50. Q50. Q245. A company has an application that runs on Amazon EC2instances and uses an Amazon Aurora database. The EC2instances connect to the database by using user names and passwords that are stored locally in a file. The company wants to minimize the operational overhead of credential management. What should a solutions architect do to accomplish this goal?

    • A. Use AWS Secrets Manager. Turn on automatic rotation.
    • B. Use AWS Systems Manager Parameter Store. Turn on automatic rotation.
    • C. Create an Amazon S3 bucket to store objects that are encrypted with an AWS Key Management Service (AWS KMS) encryption key. Migrate the credential file to the S3 bucket. Point the application to the S3 bucket.
    • D. Create an encrypted Amazon Elastic Block Store (Amazon EBS) volume for each EC2instance. Attach the new EBS volume to each EC2 instance. Migrate the credential file to the new EBS volume. Point the application to the new EBS volume.

    View question →

51. Q51. Q246. A large media company hosts a web application on AWS The company wants to start caching confidential media files so that users around the world will have reliable access to the files The content is stored in Amazon S3 buckets. The company must deliver the content quickly, regardless of where the requests originate geographically.Which solution will meet these requirements?

    • A. Use AWS DataSync to connect the S3 buckets to the web application.
    • B. Deploy AWS Global Accelerator to connect the S3 buckets to the web application.
    • C. Deploy Amazon CloudFront to connect the S3 buckets to CloudFront edge servers
    • D. Use Amazon Simple Queue Service (Amazon SQS) to connect the S3 buckets to the web application.

    View question →

52. Q52. Q247. A company is implementing a new business application. The application runs on two Amazon EC2 instances and uses an Amazon S3 bucket for document storage. A solutions architect needs to ensure that the EC2 instances can access the S3 bucket.What should the solutions architect do to meet this requirement?

    • A. Create an IAM role that grants access to the S3 bucket. Attach the role to the EC2 instances.
    • B. Create an IAM policy that grants access to the S3 bucket. Attach the policy to the EC2 instances.
    • C. Create an IAM group that grants access to the S3 bucket. Attach the group to the EC2 instances.
    • D. Create an IAM user that grants access to the S3 bucket. Attach the user account to the EC2 instances.

    View question →

53. Q53. Q248. A company is developing a marketing communications service that targets mobile app users. The company needs to send confirmation messages with Short Message Service(SMS) to its users.The users must be able to reply to the SMS messages.The company must store the responses for a year for analysis. What should a solutions architect do to meet these requirements?

    • A. Create an Amazon Connect contact flow to send the SMS messages. Use AWS Lambda to process the responses
    • B. Build an Amazon Pinpoint journey. Configure Amazon Pinpoint to send events to an Amazon Kinesis data stream for analysis and archiving
    • C. Use Amazon Simple Queue Service (Amazon SQS) to distribute the SMS messages. Use AWS Lambda to process the responses
    • D. Create an Amazon Simple Notification Service (Amazon SNS) FIFO topic. Subscribe an Amazon Kinesis data stream to the SNS topic for analysis and archiving

    View question →

54. Q54. Q249. A media company uses Amazon CloudFront for its publicly available streaming video content. The company wants to secure the video content that is hosted in Amazon S3 by controlling who has access. Some of the company's users are using a custom HTTP client that does not support cookies. Some of the company's users are unable to change the hardcoded URLs that they are using for access.Which services or methods will meet these requirements with the LEAST impact to the users? (Select TWO.)

    • A. Signed cookies
    • B. Signed URLs
    • C. AWS AppSync
    • D. JSON Web Token (JWT
    • E. AWS Secrets Manager

    View question →

55. Q55. Q250. A company needs a backup strategy for its three-tier stateless web application. The web application runs on Amazon EC2 instances in an Auto Scaling group with a dynamic scaling policy that is configured to respond to scaling events. The database tier runs on Amazon RDS for PostgreSQL.The web application does not require temporary local storage on the EC2 instances.The company's recovery point objective(RPO) is 2 hours.The backup strategy must maximize scalability and optimize resource utilization for this environment.Which solution will meet these requirements?

    • A. Take snapshots of Amazon Elastic Block Store (Amazon EBS) volumes of the EC2 instances and database every 2 hours to meet the RPO
    • B. Configure a snapshot lifecycle policy to take Amazon Elastic Block Store (Amazon EBS) snapshots.Enable automated backups in Amazon RDS to meet the RPO
    • C. Retain the latest Amazon Machine Images (AMIs) of the web and application tiers. Enable automated backups in Amazon RDS and use point-in-time recovery to meet the RPO
    • D. Take snapshots of Amazon Elastic Block Store (Amazon EBS) volumes of the EC2 instances every 2 hours.Enable automated backups in Amazon RDS and use point-in-time recovery to meet the RPO

    View question →

56. Q56. Q251. A financial company hosts a web application on AWS. The application uses an Amazon API Gateway Regional API endpoint to give users the ability to retrieve current stock prices. The company's security team has noticed an increase in the number of API requests.The security team is concerned that HTTP flood attacks might take the application offline.A solutions architect must design a solution to protect the application from this type of attack.Which solution meets these requirements with the LEAST operational overhead?

    • A. Create an Amazon CloudFront distribution in front of the API Gateway Regional API endpoint with a maximum TTL of 24 hours
    • B. Create a Regional AWS WAF web ACL with a rate-based rule. Associate the web ACL with the API Gateway stage
    • C. Use Amazon CloudWatch metrics to monitor the Count metric and alert the security team when the predefined rate is reached
    • D. Create an Amazon CloudFront distribution with Lambda@Edge in front of the API Gateway Regional API endpoint. Create an AWS Lambda function to block requests from IP addresses that exceed the predefined rate

    View question →

57. Q57. Q252. A company wants to migrate an Oracle database to AWS. The database consists of a single table that contains millions of geographic information systems (GlS) images that are high resolution and are identified by a geographic code.When a natural disaster occurs, tens of thousands of images get updated every few minutes. Each geographic code has a single image or row that is associated with it. The company wants a solution that is highly available and scalable during such events.Which solution meets these requirements MOST cost-effectively?

    • A. Store the images and geographic codes in a database table. Use Oracle running on an Amazon RDS Multi-AZ DB instance
    • B. Store the images in Amazon S3 buckets. Use Amazon DynamoDB with the geographic code as the key and the image S3 URL as the value
    • C. Store the images and geographic codes in an Amazon DynamoDB table. Configure DynamoDB Accelerator (DAX) during times of high load
    • D. Store the images in Amazon S3 buckets. Store geographic codes and image S3 URLs in a database table. Use Oracle running on an Amazon RDS Multi-AZ DB instance

    View question →

58. Q58. Q253. A company has launched an Amazon RDS for MySQL DB instance. Most of the connections to the database come from serverless applications Application traffic to the database changes significantly at random intervals. At times of high demand, users report that their applications experience database connection rejection errors.Which solution will resolve this issue with the LEAST operational overhead?

    • A. Create a proxy in RDS Proxy. Configure the users' applications to use the DB instance through RDS Proxy
    • B. Deploy Amazon ElastiCache for Memcached between the users' applications and the DB instance
    • C. Migrate the DB instance to a different instance class that has higher I/O capacity. Configure the users' applications to use the new DB instance
    • D. Configure Multi-AZ for the DB instance. Configure the users'applications to switch between the DB instances

    View question →

59. Q59. Q254. A solutions architect must create a disaster recovery (DR) plan for a high-volume software as a service (SaaS) platform. All data for the platform is stored in an Amazon Aurora MySQL DB cluster.The DR plan must replicate data to a secondary AWS Region.Which solution will meet these requirements MOST cost_effectively?

    • A. Use MySQL binary log replication to an Aurora cluster in the secondary Region. Provision one DB instance for the Aurora cluster in the secondary Region
    • B. Set up an Aurora global database for the DB cluster. When setup is complete, remove the DB instance from the secondary Region
    • C. Use AWS Database Migration Service (AWS DMS) to continuously replicate data to an Aurora cluster in the secondary Region. Remove the DB instance from the secondary Region
    • D. Set up an Aurora global database for the DB cluster. Specify a minimum of one DB instance in the secondary Region

    View question →

60. Q60. Q255. A company wants to give a customer the ability to use on-premises Microsoft Active Directory to download files that are stored in Amazon S3. The customer's application uses an SFTP client to download the filesWhich solution will meet these requirements with the LEAST operational overhead and no changes to the customer's application?

    • A. Set up AWS Transfer Family with SFTP for Amazon S3. Configure integrated Active Directory authentication
    • B. Set up AWS Database Migration Service (AWS DMS) to synchronize the on-premises client with Amazon S3. Configure integrated Active Directory authentication
    • C. Set up AWS DataSync to synchronize between the on-premises location and the S3 location by using AWS IAM Identity Center (AWS Single Sign-On)
    • D. Set up a Windows Amazon EC2 instance with SFTP to connect the on-premises client with Amazon S3.Integrate AWS Identity and Access Management (IAM)

    View question →

61. Q61. Q256. A company runs an application on Amazon EC2 Linux instances across multiple Availability Zones. The application needs a storage layer that is highly available and Portable Operating System Interface (POSIX)- compliant. The storage layer must provide maximum data durability and must be shareable across the EC2 instances. The data in the storage layer will be accessed frequently for the first 30 days and will be accessed infrequently after that time.Which solution will meet these requirements MOST cost-effectively?

    • A. Use the Amazon S3 Standard storage class. Create an S3 Lifecycle policy to move infrequently accessed data to S3 Glacier
    • B. Use the Amazon S3 Standard storage class. Create an S3 Lifecycle policy to move infrequently accessed data to S3 Standard-Infrequent Access(S3 Standard 1A)
    • C. Use the Amazon Elastic File System (Amazon EFS) Standard storage class. Create a lifecycle management policy to move infrequently accessed data to EFS Standard-Infrequent Access (EFS Standard-IA)
    • D. Use the Amazon Elastic File System (Amazon EFS) One Zone storage class. Create a lifecycle management policy to move infrequently accessed data to EFS One Zone-Infrequent Access(EFS One Zone-IA)

    View question →

62. Q62. Q257. An IAM user made several configuration changes to AWS resources in their company's account during a production deployment last week. A solutions architect learned that a couple of security group rules are not configured as desired. The solutions architect wants to confirm which IAM user was responsible for making changes.Which service should the solutions architect use to find the desired information?

    • A. Amazon GuardDuty
    • B. Amazon Inspector
    • C. AWS CloudTrail
    • D. AWS Config

    View question →

63. Q63. Q258. An image-hosting company stores its objects in Amazon S3 buckets.The company wants to avoid accidental exposure of the objects in the S3 buckets to the public All S3 objects in the entire AWS account need to remain privateWhich solution will meet these requirements?

    • A. Use Amazon GuardDuty to monitor S3 bucket policies. Create an automatic remediation action rule that uses an AWS Lambda function to remediate any change that makes the objects public
    • B. Use AWS Trusted Advisor to find publicly accessible S3 buckets. Configure email notifications in Trusted Advisor when a change is detected. Manually change the S3 bucket policy if it allows public access
    • C. Use AWS Resource Access Manager to find publicly accessible S3 buckets. Use Amazon Simple Notification Service (Amazon SNS) to invoke an AWS Lambda function when a change is detected.Deploy a Lambda function that programmatically remediates the change
    • D. Use the S3 Block Public Access feature on the account level. Use AWS Organizations to create a service control policy (SCP) that prevents IAM users from changing the setting. Apply the SCP to the account

    View question →

64. Q64. Q259. A company uses Amazon EC2 instances and AWS Lambda functions to run its application.The company has VPCs with public subnets and private subnets in its AWS account. The EC2 instances run in a private subnet in one of the VPCs.The Lambda functions need direct network access to the EC2 instances for the application to work.The application will run for at least 1 year. The company expects the number of Lambda functions that the application uses to increase during that time. The company wants to maximize its savings on all application resources and to keep network latency between the services low.Which solution will meet these requirements?

    • A. Purchase an EC2 Instance Savings Plan. Optimize the Lambda functions' duration and memory usage and the number of invocations. Connect the Lambda functions to the private subnet that contains the EC2 instances
    • B. Purchase an EC2 Instance Savings Plan. Optimize the Lambda functions' duration and memory usage,the number of invocations, and the amount of data that is transferred. Connect the Lambda functions to a public subnet in the same VPC where the EC2 instances run
    • C. Purchase a Compute Savings Plan. Optimize the Lambda functions' duration and memory usage,the number of invocations, and the amount of data that is transferred. Connect the Lambda functions to the private subnet that contains the EC2 instances
    • D. Purchase a Compute Savings Plan. Optimize the Lambda functions' duration and memory usage, the number of invocations, and the amount of data that is transferred. Keep the Lambda functions in the Lambda service VPC

    View question →

65. Q65. Q260. A company runs a web application that is deployed on Amazon EC2 instances in the private subnet of a VPC. An Application Load Balancer (ALB) that extends across the public subnets directs web traffic to the EC2 instances. The company wants to implement new security measures to restrict inbound traffic from the ALB to the EC2 instances while preventing access from any other source inside or outside the private subnet of the EC2 instances.Which solution will meet these requirements?

    • A. Configure a route in a route table to direct traffic from the internet to the private IP addresses of the EC2 instances
    • B. Configure the security group for the EC2 instances to only allow traffic that comes from the security group for the ALB
    • C. Move the EC2 instances into the public subnet. Give the EC2 instances a set of Elastic IP addresses
    • D. Configure the security group for the ALB to allow any TCP traffic on any port

    View question →

66. Q66. Q261. A company wants to create a mobile app that allows users to stream slow-motion video clips on their mobile devices. Currently, the app captures video clips and uploads the video clips in raw format into an Amazon S3 bucket. The app retrieves these video clips directly from the S3 bucket. However, the videos are large in their raw format.Users are experiencing issues with buffering and playback on mobile devices. The company wants to implement solutions to maximize the performance and scalability of the app while minimizing operational overhead.Which combination of solutions will meet these requirements? (Select TWO.)

    • A. Deploy Amazon CloudFront for content delivery and caching
    • B. Use AWS DataSync to replicate the video files across AWS Regions in other S3 buckets
    • C. Use Amazon Elastic Transcoder to convert the video files to more appropriate formats
    • D. Deploy an Auto Scaling group of Amazon EC2 instances in Local Zones for content delivery and caching
    • E. Deploy an Auto Scaling group of Amazon EC2 instances to convert the video files to more appropriate formats

    View question →

67. Q67. Q262. A solutions architect needs to design a new microservice for a company's application. Clients must be able to call an HTTPS endpoint to reach the microservice.The microservice also must use AWS Identity and Access Management (IAM) to authenticate calls. The solutions architect will write the logic for this microservice by using a single AWS Lambda function that is written in Go 1.x;Which solution will deploy the function in the MOST operationally efficient way?

    • A. Create an Amazon API Gateway REST API. Configure the method to use the Lambda function. Enable IAM authentication on the API
    • B. Create a Lambda function URL for the function. Specify AWS_IAM as the authentication type
    • C. Create an Amazon CloudFront distribution. Deploy the function to Lambda@Edge. Integrate IAM authentication logic into the Lambda@Edge function
    • D. Create an Amazon CloudFront distribution. Deploy the function to CloudFront Functions. Specify AWS_IAM as the authentication type

    View question →

68. Q68. Q263. A company is migrating its on-premises workload to the AWS Cloud. The company already uses several Amazon EC2 instances and Amazon RDS DB instances.The company wants a solution that automatically starts and stops the EC2 instances and DB instances outside of business hours. The solution must minimize cost and infrastructure maintenance.Which solution will meet these requirements?

    • A. Scale the EC2 instances by using elastic resize. Scale the DB instances to zero outside of business hours
    • B. Explore AWS Marketplace for partner solutions that will automatically start and stop the EC2 instances and DB instances on a schedule
    • C. Launch another EC2 instance. Configure a crontab schedule to run shell scripts that will start and stop the existing EC2 instances and DB instances on a schedule
    • D. Create an AWS Lambda function that will start and stop the EC2 instances and DB instances. Configure Amazon EventBridge to invoke the Lambda function on a schedule

    View question →

69. Q69. Q264. A solutions architect needs to allow team members to access Amazon S3 buckets in two different AWS accounts: a development account and a production account. The team currently has access to S3 buckets in the development account by using unique IAM users that are assigned to an IAM group that has appropriate permissions in the account.The solutions architect has created an IAM role in the production account. The role has a policy that grants access to an S3 bucket in the production account.Which solution will meet these requirements while complying with the principle of least privilege?

    • A. Attach the AdministratorAccess policy to the development account users
    • B. Add the development account as a principal in the trust policy of the role in the production account
    • C. Turn off the S3 Block Public Access feature on the S3 bucket in the production account
    • D. Create a user in the production account with unique credentials for each team member

    View question →

70. Q70. Q265. A company has implemented a self-managed DNS service on AWS.The solution consists of the following -- Amazon EC2 instances in different AWS Regions;-- Endpoints of a standard accelerator in AWS Global Accelerator;The company wants to protect the solution against DDoS attacks;What should a solutions architect do to meet this requirement?

    • A. Subscribe to AWS Shield Advanced. Add the accelerator as a resource to protect
    • B. Subscribe to AWS Shield Advanced. Add the EC2 instances as resources to protect
    • C. Create an AWS WAF web ACL that includes a rate-based rule. Associate the web ACL with the accelerator.
    • D. Create an AWS WAF web ACL that includes a rate-based rule. Associate the web ACL with the EC2 instances

    View question →

71. Q71. Q266. An ecommerce company needs to run a scheduled daily job to aggregate and filter sales records for analytics. The company stores the sales records in an Amazon S3 bucket. Each object can be up to 10 GB in size. Based on the number of sales events,the job can take up to an hour to complete.The CPU and memory usage of the job are constant and are known in advance.A solutions architect needs to minimize the amount of operational effort that is needed for the job to run.Which solution meets these requirements?

    • A. Create an AWS Lambda function that has an Amazon EventBridge notification. Schedule the EventBridge event to run once a day
    • B. Create an AWS Lambda function. Create an Amazon API Gateway HTTP API, and integrate the API with the function. Create an Amazon EventBridge scheduled event that calls the API and invokes the function
    • C. Create an Amazon Elastic Container Service (Amazon ECS) cluster with an AWS Fargate launch type.Create an Amazon EventBridge scheduled event that launches an ECS task on the cluster to run the job
    • D. Create an Amazon Elastic Container Service (Amazon ECS) cluster with an Amazon EC2 launch type and an Auto Scaling group with at least one EC2 instance Create an Amazon EventBridge scheduled event that launches an ECS task on the cluster to run the job

    View question →

72. Q72. Q267. A company needs to create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to host a digital media streaming application.The EKS cluster will use a managed node group that is backed by Amazon Elastic Block Store (Amazon EBS) volumes for storage. The company must encrypt all data at rest by using a customer managed key that is stored in AWS Key Management Service (AWS KMS);Which combination of actions will meet this requirement with the LEAST operational overhead?(Select TWO.)

    • A. Use a Kubernetes plugin that uses the customer managed key to perform data encryption
    • B. After creation of the EKS cluster, locate the EBS volumes.Enable encryption by using the customer managed key
    • C. Enable EBS encryption by default in the AWS Region where the EKS cluster will be created. Select the customer managed key as the default key
    • D. Create the EKS cluster. Create an IAM role that has a policy that grants permission to the customer managed key. Associate the role with the EKS cluster
    • E. Store the customer managed key as a Kubernetes secret in the EKS cluster. Use the customer managed key to encrypt the EBS volumes

    View question →

73. Q73. Q268. A company is storing petabytes of data in Amazon S3 Standard. The data is stored in multiple S3 buckets and is accessed with varying frequency. The company does not know access patterns for all the data.The company needs to implement a solution for each S3 bucket to optimize the cost of S3 usage.Which solution will meet these requirements with the MOST operational efficiency?

    • A. Create an S3 Lifecycle configuration with a rule to transition the objects in the S3 bucket to S3 Intelligent-Tiering
    • B. Use the S3 storage class analysis tool to determine the correct tier for each object in the S3 bucket.Move each object to the identified storage tier
    • C. Create an S3 Lifecycle configuration with a rule to transition the objects in the S3 bucket to S3 Glacier Instant Retrieval
    • D. Create an S3 Lifecycle configuration with a rule to transition the objects in the S3 bucket to S3 One Zone-Infrequent Access(S3 One Zone-IA)

    View question →

74. Q74. Q269. A solutions architect is designing a two-tiered architecture that includes a public subnet and a database subnet. The web servers in the public subnet must be open to the internet on port 443.The Amazon RDS for MySQL DB instance in the database subnet must be accessible only to the web servers on port 3306;Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

    • A. Create a network ACL for the public subnet. Add a rule to deny outbound traffic to 0.0.0.0/0 on port 3306
    • B. Create a security group for the DB instance. Add a rule to allow traffic from the public subnet CIDR block on port 3306
    • C. Create a security group for the web servers in the public subnet. Add a rule to allow traffic from O.0.O.0/0 on port 443
    • D. Create a security group for the DB instance. Add a rule to allow traffic from the web servers' security group on port 3306
    • E. Create a security group for the DB instance. Add a rule to deny all traffic except traffic from the web servers' security group on port 3306

    View question →

75. Q75. Q270. An ecommerce company is experiencing an increase in user traffic.The company's store is deployed on Amazon EC2 instances as a two-tier web application consisting of a web tier and a separate database tier. As traffic increases, the company notices that the architecture is causing significant delays in sending timely marketing and order confirmation email to users.The company wants to reduce the time it spends resolving complex email delivery issues and minimize operational overhead.What should a solutions architect do to meet these requirements?

    • A. Create a separate application tier using EC2 instances dedicated to email processing
    • B. Configure the web instance to send email through Amazon Simple Email Service (Amazon SES)
    • C. Configure the web instance to send email through Amazon Simple Notification Service (Amazon SNS)
    • D. Create a separate application tier using EC2 instances dedicated to email processing. Place the instances in an Auto Scaling group

    View question →

76. Q76. Q271. A company is using Amazon Route 53 latency-based routing to route requests to its UDP-based application for users around the world. The application is hosted on redundant servers in the company's on-premises data centers in the United States, Asia, and Europe. The company's compliance requirements state that the application must be hosted on premises. The company wants to improve the performance and availability of the application.What should a solutions architect do to meet these requirements'?

    • A. Configure three Network Load Balancers (NLBs) in the three AWS Regions to address the on-premises endpoints. Create an accelerator by using AWS Global Accelerator, and register the NLBs as its endpoints. Provide access to the application by using a CNAME that points to the accelerator DNS
    • B. Configure three Application Load Balancers (ALBs) in the three AWS Regions to address the on- premises endpoints. Create an accelerator by using AWS Global Accelerator, and register the ALBs as its endpoints. Provide access to the application by using a CNAME that points to the accelerator DNS
    • C. Configure three Network Load Balancers (NLBs) in the three AWS Regions to address the on-premises endpoints. In Route 53, create a latency-based record that points to the three NLBs, and use it as an origin for an Amazon CloudFront distribution. Provide access to the application by using a CNAME that points to the CloudFront DNS
    • D. Configure three Application Load Balancers (ALBs) in the three AWS Regions to address the on- premises endpoints. In Route 53, create a latency-based record that points to the three ALBs, and use it as an origin for an Amazon CloudFront distribution. Provide access to the application by using a CNAME that points to the CloudFront DNS

    View question →

77. Q77. Q272. A company hosts a multiplayer gaming application on AWS. The company wants the application to read data with sub-milisecond latency and run one-time queries on historical data.Which solution will meet these requirements with the LEAST operational overhead?

    • A. Use Amazon RDS for data that is frequently accessed. Run a periodic custom script to export the data to an Amazon S3 bucket
    • B. Store the data directly in an Amazon S3 bucket. Implement an S3 Lifecycle policy to move older data to S3 Glacier Deep Archive for long-term storage. Run one-time queries on the data in Amazon S3 by using Amazon Athena
    • C. Use Amazon DynamoDB with DynamoDB Accelerator (DAX) for data that is frequently accessed. Export the data to an Amazon S3 bucket by using DynamoDB table export. Run one-time queries on the data in Amazon S3 by using Amazon Athena
    • D. Use Amazon DynamoDB for data that is frequently accessed. Turn on streaming to Amazon Kinesis Data Streams. Use Amazon Kinesis Data Firehose to read the data from Kinesis Data Streams. Store the records in an Amazon S3 bucket.

    View question →

78. Q78. Q273. A hospital is designing a new application that gathers symptoms from patients. The hospital has decided to use Amazon Simple Queue Service(Amazon SQS) and Amazon Simple Notification Service (Amazon SNS) in the architecture.A solutions architect is reviewing the infrastructure design. Data must be encrypted at rest and in transit. Only authorized personnel of the hospital should be able to access the data.Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

    • A. Turn on server-side encryption on the SQS components. Update the default key policy to restrict key usage to a set of authorized principals
    • B. Turn on server-side encryption on the SNS components by using an AWS Key Management Service (AWS KMS) customer managed key. Apply a key policy to restrict key usage to a set of authorized principals
    • C. Turn on encryption on the SNS components. Update the default key policy to restrict key usage to a set of authorized principals. Set a condition in the topic policy to allow only encrypted connections over TLS
    • D. Turn on server-side encryption on the SQS components by using an AWS Key Management Service (AWS KMS)customer managed key. Apply a key policy to restrict key usage to a set of authorized principals. Set a condition in the queue policy to allow only encrypted connections over TLS
    • E. Turn on server-side encryption on the SQS components by using an AWS Key Management Service (AWS KMS) customer managed key. Apply an IAM policy to restrict key usage to a set of authorized principals. Set a condition in the queue policy to allow only encrypted connections over TLS

    View question →

79. Q79. Q274. A company hosts a three-tier ecommerce application on a fleet of Amazon EC2 instances.The instances run in an Auto Scaling group behind an Application Load Balancer (ALB). All ecommerce data is stored in an Amazon RDS for MariaDB Multi-AZ DB instance.The company wants to optimize customer session management during transactions. The application must store session data durably.Which solutions will meet these requirements? (Select TWO.)

    • A. Turn on the sticky sessions feature (session affinity) on the ALB
    • B. Use an Amazon DynamoDB table to store customer session information
    • C. Deploy an Amazon Cognito user pool to manage user session information
    • D. Deploy an Amazon ElastiCache for Redis cluster to store customer session information
    • E. Use AWS Systems Manager Application Manager in the application to manage user session information

    View question →

80. Q80. Q275. A university research laboratory needs to migrate 30 TB of data from an on-premises Windows file server to Amazon FSx for Windows File Server. The laboratory has a 1 Gbps network link that many other departments in the university share.The laboratory wants to implement a data migration service that will maximize the performance of the data transfer. However, the laboratory needs to be able to control the amount of bandwidth that the service uses to minimize the impact on other departments. The data migration must take place within the next 5 days.Which AWS solution will meet these requirements?

    • A. AWS Snowcone
    • B. .Amazon FSx File Gateway
    • C. AWS DataSync
    • D. AWS Transfer Family

    View question →

81. Q81. Q276. A company runs an application that receives data from thousands of geographically dispersed remote devices that use UDP The application processes the data immediately and sends a message back to the device if necessary. No data is stored.The company needs a solution that minimizes latency for the data transmission from the devices. The solution also must provide rapid failover to another AWS Region.Which solution will meet these requirements?

    • A. Configure an Amazon Route 53 failover routing policy. Create a Network Load Balancer (NLB) in each of the two Regions. Configure the NLB to invoke an AWS Lambda function to process the data
    • B. Use AWS Global Accelerator. Create a Network Load Balancer (NLB) in each of the two Regions as an endpoint. Create an Amazon Elastic Container Service (Amazon ECS) cluster with the Fargate launch type. Create an ECS service on the cluster. Set the ECS service as the target for the NLB. Process the data in Amazon ECS
    • C. Use AWS Global Accelerator. Create an Application Load Balancer (ALB) in each of the two Regions as an endpoint. Create an Amazon Elastic Container Service (Amazon ECS) cluster with the Fargate launch type. Create an ECS service on the cluster. Set the ECS service as the target for the ALB.Process the data in Amazon ECS
    • D. Configure an Amazon Route 53 failover routing policy. Create an Application Load Balancer (ALB) in each of the two Regions. Create an Amazon Elastic Container Service (Amazon ECS) cluster with the Fargate launch type. Create an ECS service on the cluster. Set the ECS service as the target for the ALB Process the data in Amazon ECS

    View question →

82. Q82. Q277. A company is building a game system that needs to send unique events to separate leaderboard, matchmaking, and authentication services concurrently.The company needs an AWS event-driven system that guarantees the order of the events.Which solution will meet these requirements?

    • A. Amazon EventBridge event bus
    • B. Amazon Simple Notification Service (Amazon SNS) FIFO topics
    • C. Amazon Simple Notification Service(Amazon SNS) standard topics
    • D. Amazon Simple Queue Service (Amazon SQS) FIFO queues

    View question →

83. Q83. Q278. An ecommerce company is running a multi-tier application on AWS. The front-end and backend tiers both run on Amazon EC2. and the database runs on Amazon RDS for MySQL. The backend tier communicates with the RDS instance. There are frequent calls to return identical datasets from the database that are causing performance slowdowns. Which action should be taken to improve the performance of the backend?

    • A. Implement Amazon SNS to store the database calls.
    • B. Implement Amazon ElastiCache to cache the large datasets.
    • C. Implement an RDS for MySQL read replica to cache database calls.
    • D. Implement Amazon Kinesis Data Firehose to stream the calls to the database.

    View question →

84. Q84. Q279. A company has a web application with sporadic usage patterns. There is heavy usage at the beginning of each month, moderate usage at the start of each week, and unpredictable usage during the week. The application consists of a web server and a MySQL database server running inside the data center. The company would like to move the application to the AWS Cloud, and needs to select a cost-effective database platform that will not require database modifications.Which solution will meet these requirements?

    • A. Amazon DynamoDB
    • B. Amazon RDS for MySQL
    • C. MySQL-compatible Amazon Aurora Serverless
    • D. MySQL deployed on Amazon EC2 in an Auto Scaling group

    View question →

85. Q85. Q280. A company is developing a real-time multiplier game that uses UDP for communications between client and servers in an Auto Scaling group Spikes in demand are anticipated during the day, so the game server platform must adapt accordingly. Developers want to store gamer scores and other non-relational data in a database solution that will scale without intervention. Which solution should a solution architect recommend?

    • A. Use Amazon Route 53 for traffic distribution and Amazon Aurora Serverless for data storage.
    • B. Use a Network Load Balancer for traffic distribution and Amazon DynamoDB on-demand for data storage.
    • C. Use a Network Load Balancer for traffic distribution and amazon Aura Global for data storage.
    • D. Use an Application Load Balancer for traffic distribution and Amazon DynamoDB global tables for data storage

    View question →

86. Q86. Q281. A solution architect must migrate a Windows internet information Services (IIS) web application to AWS. The application currently relies on a file share hosted in the user's on-premises network- attached storage (NAS). The solution architected has proposed migrating the IIS web servers Which replacement to the on- promises filo share is MOST resilient and durable?

    • A. Migrate the file Share to Amazon RDS.
    • B. Migrate the tile Share to AWS Storage Gateway
    • C. Migrate the file Share to Amazon FSx dor Windows File Server.
    • D. Migrate the tile share to Amazon Elastic File System (Amazon EFS)

    View question →

87. Q87. Q282. A company recently deployed a new auditing system to centralize information about operating system versions, patching, and installed software for Amazon EC2 instances. A solutions architect must ensure all instances provisioned through EC2 Auto Scaling groups successfully send reports to the auditing system as soon as they are launched and terminated. Which solution achieves these goals MOST efficiently?

    • A. Use a scheduled AWS Lambda function and execute a script remotely on all EC2 instances to send data to the audit system.
    • B. Use EC2 Auto Scaling lifecycle hooks to execute a custom script to send data to the audit system when instances are launched and terminated.
    • C. Use an EC2 Auto Scaling launch configuration to execute a custom script through user data to send data to the audit system when instances are launched and terminated.
    • D. Execute a custom script on the instance operating system to send data to the audit system.Configure the script to be executed by the EC2 Auto Scaling group when the instance starts and is terminated.

    View question →

88. Q88. Q283. A company has a three-tier environment on AWS that ingests sensor data from its users' devices. The traffic flows through a Network Load Balancer (NLB), then to Amazon EC2 instances for the web tier, and finally to EC2 instances for the application tier that makes database calls. What should a solutions architect do to improve the security of data in transit to the web tier?

    • A. Configure a TLS listener and add the Server Certificate on the NLB.
    • B. Configure AWS Shield Advanced and enable AWS WAF on the NLB.
    • C. Change the Load Balancer to an Application Load Balancer and attach AWS WAF to it.
    • D. Encrypt the Amazon Elastic Block Store (Amazon EBS) volume on the EC2 instances using AWS Key Management Service (AWS KMS)

    View question →

89. Q89. Q284. A company is planning to migrate a commercial off-the-shelf application from its on-premises data center to AWS, The software has a software licensing model using sockets and cores with predictable capacity and uptime requirements. The company wants to use its existing licenses, which were purchased earlier this year.Which Amazon EC2 pricing option is the MOST cost-effective?

    • A. Dedicated Reserved Hosts
    • B. Dedicated On- Demand Hosts
    • C. Dedicated Reserved Instances
    • D. Dedicated On-Demand Instances

    View question →

90. Q90. Q285. A solutions architect is creating a new VPC design. There are two public subnet for the load balancer, two private subnets for web servers, and two private subnets for MySQL. The web serves use only HTTPS. The solutions architect has already created a security group for the load Balancer allowing port 443 from 0.0 0.0/0. Company policy requires that each resource has the least access required to still be able to perform its tasks. Which additional configuration strategy should the solution architect use to meet these requirements?

    • A. Create a security group for the web servers and allow port 443 from 0.0.0.0/0.Create a security group tor the MySQL serve's aid allow port 3306 from the web servers security group.
    • B. Create a network ACL for the web servers and allow port 443 from 0.0.0.0/0.Create a network ACL for the MySQL servers and allow port 3306 from the web servers security group
    • C. Create a security group for the web servers and allow port 443 from the load balancer.Create a security group tor the MySQL servers and allow port 3306 from the web sewers security group
    • D. Create a network ACL for the web servers and allow port 443 from the web balancer.Create a network ACL for the MySQL servers and allow port 3306 from the web servers security group.

    View question →

91. Q91. Q286. A solutions architect wants all new users to have specific complexity requirements and mandatory rotation periods for IAM user passwords.What should the solutions architect do to accomplish this?

    • A. Set an overall password policy for the entire AWS account
    • B. Set a password policy for each IAM user in the AWS account.
    • C. Use third-party vendor software to set password requirements,
    • D. Attach an Amazon CloudWatch rule to the Create_newuser event to set the password with the appropriate requirements.

    View question →

92. Q92. Q287. A new employee has joined a company as a deployment engineer. The deployment engineer will be using AWS CloudFormation templates to create multiple AWS resources. A solutions architect wants the deployment engineer to perform job activities. While following the principle of least privilege. Which combination of actions should the solutions architect take to accomplish this goal? (Select TWO.)

    • A. Have the deployment engineer use AWS account roof user credentials for performing AWS CloudFormation stack operations.
    • B. Create a new IAM user for the deployment engineer and add the IAM user to a group that has the PowerUsers IAM policy attached
    • C. Create a new IAM user for the deployment engineer and add the IAM user to a group that has the Administrate/Access IAM policy attached
    • D. Create a new IAM User for the deployment engineer and add the IAM user to a group that has an IAM policy that allows AWS CloudFormation actions only
    • E. Create an IAM role for the deployment engineer to explicitly define the permissions specific to the AWS CloudFormation stack and launch stacks using Dial IAM role.

    View question →

93. Q93. Q288. A company has a large dataset for its online advertising business stored in an Amazon RDS for MySQL DB instance in a single Availability Zone. The company wants business reporting queries to run without impacting the write operations to the production DB instance.Which solution meets these requirements?

    • A. Deploy RDS read replicas to process the business reporting queries.
    • B. Scale out the DB instance horizontally by placing it behind an Elastic Load Balancer
    • C. Scale up the DB instance to a larger instance type to handle write operations and queries.
    • D. Deploy the DB instance in multiple Availability Zones to process the business reporting queries.

    View question →

94. Q94. Q289. A developer has an application that uses an AWS Lambda function to upload files to Amazon S3 and needs the required permissions to perform the task. The developer already has an IAM user with valid IAM credentials required for Amazon S3. What should a solutions architect do to grant the permissions?

    • A. Add required IAM permissions in the resource policy of the Lambda function.
    • B. Create a signed request using the existing IAM credential in the Lambda function.
    • C. Create a new IAM user and use the existing IAM credentials in the Lambda function
    • D. Create an IAM execution role with the required permissions and attach the IAM role to the Lambda function

    View question →

95. Q95. Q290. A solutions architect is designing the architecture fora software demonstration environment. The environment will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The system will experience significant increases in traffic during working hours but is not required to operate on weekends.Which combination of actions should the solutions architect take to ensure that the system can scale to meet demand? (Select TWO)

    • A. Use AWS Auto Scaling to adjust the ALB capacity based on request rate.
    • B. Use AWS Auto Scaling to scale the capacity of the VPC internet gateway.
    • C. Launch the EC2instances in multiple AWS Regions to distribute the load across Regions.
    • D. Use a target tracking scaling policy to scale the Auto Scaling group based on instance CPU utilization.
    • E. Use scheduled scaling to change the Auto Scaling group minimum, maximum, and desired capacity to zero for weekends Revert to the default values at the start of the week.

    View question →

96. Q96. Q291. A company runs a web application that is backed by Amazon RDS. A new database administrator caused data loss by accidentally editing information in a database table. To help recover from this type of incident, the company wants the ability to restore the database to its state from 5 minutes before any change within the last 30 days.Which feature should the solutions architect include in the design to meet this requirement?

    • A. Read replicas
    • B. Manual snapshots
    • C. Automated backups
    • D. Multi-AZ deployments

    View question →

97. Q97. Q292. A company is deploying a two-tier web application in a VPC. The web tier is using an Amazon EC2 Auto Scaling group with public subnets that span multiple Availability Zones. The database tier consists of an Amazon RDS for MySQL DB instance in separate private subnets. The web tier requires access to the database to retrieve product information.The web application is not working as intended. The web application reports that it cannot connect to the database. The database is confirmed to be up and running. All configurations for the network ACLs, security groups, and route tables are still in their default states. What should a solutions architect recommend to fix the application?

    • A. Add an explicit rule to the private subnet's network ACL to allow traffic from the web tier's EC2 instances.
    • B. Add a route in the VPC route table to allow traffic between the web tier's EC2 instances and the database tier.
    • C. Deploy the web tier's EC2 instances and the database tier's RDS instance into two separate VPCs, and configure VPC peering.
    • D. Add an inbound rule to the security group of the database tiers RDS instance to allow traffic from the web tier's security group.

    View question →

98. Q98. Q293. A company needs to transfer 600 TB of data from its on-premises network-attached storage (NAS) system to the AWS Cloud. The data transfer must be complete within 2 weeks. The data is sensitive and must be encrypted in transit. The company's internet connection can support an upload speed of 100 Mbps. Which solution meets these requirements MOST cost-effectively?

    • A. Use Amazon S3 multi-part upload functionality to transfer the files over HTTPS.
    • B. Create a VPN connection between the on-premises NAS system and the nearest AWS Region.Transfer the data over the VPN connection
    • C. Use the AWS Snow Family console to order several AWS Snowball Edge Storage Optimized devices.Use the devices to transfer the data to Amazon S3.
    • D. Set up a 10 Gbps AWS Direct Connect connection between the company location and the nearest AWS Region. Transfer the data over a VPN connection into the Region to store the data in Amazon S3.

    View question →

99. Q99. Q294. A company is architecting a shared storage solution for a gaming application that is hosted in the AWS Cloud. The company needs the ability to use Lustre clients to access data The solution must be fully managed.Which solution meets these requirements?

    • A. Create an AWS DataSync task that shares the data as a mountable file system. Mount the file system to the application server.
    • B. Create an AWS Storage Gateway file gateway Create a file share that uses the required client protocol Connect the application server to the file share.
    • C. Create an Amazon Elastic File System (Amazon EFS) file system, and configure it to support Lustre Attach the file system to the origin server Connect the application server to the file system.
    • D. Create an Amazon FSx for Lustre file system. Attach the file system to the origin server. Connect the application server to the file system.

    View question →

100. Q100. Q295. A company uses a payment processing system that requires messages for a particular payment ID to be received in the same order that they were sent. Otherwise, the payments might be processed incorrectly. Which actions should a solutions architect take to meet this requirement? (Select TWO)

     • A. Write the messages to an Amazon DynamoDB table with the payment ID as the partition key
     • B. Write the messages to an Amazon Kinesis data stream with the payment ID as the partition key
     • C. Write the messages to an Amazon ElastiCache for Memcached cluster with the payment ID as the key
     • D. Write the messages to an Amazon Simple Queue Service (Amazon SQS) queue. Set the message attribute to use the payment ID.
     • E. Write the messages to an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Set the message group to use the payment ID.

     View question →

101. Q101. Q296. A company wants to deploy a new public web application on AWS. The application includes a web server tier that uses Amazon EC2 instances. The application also includes a database tier that uses an Amazon RDS for MySQL DB instance.The application must be secure and accessible for global customers that have dynamic IP addresses. How should a solutions architect configure the security groups to meet these requirements?

     • A. Configure the security group for the web servers to allow inbound traffic on port 443 from 0.0.0.0/0.Configure the security group for the DB instance to allow inbound traffic on port 3306 from the security group of the web servers.
     • B. Configure the security group for the web servers to allow inbound traffic on port 443 from the IP addresses of the customers. Configure the security group for the DB instance to allow inbound traffic on port 3306 from the security group of the web servers.
     • C. Configure the security group for the web servers to allow inbound traffic on port 443 from the IP addresses of the customers. Configure the security group for the DB instance to allow inbound traffic on port 3306 from the IP addresses of the customers.
     • D. Configure the security group for the web servers to allow inbound traffic on port 443 from 00.0.0/0.Configure the security group for the DB instance to allow inbound traffic on port 3306 from 0.0.0.0/0.

     View question →

102. Q102. Q297. A company has an application that collects data from IoT sensors on automobiles. The data is streamed and stored in Amazon S3 through Amazon Kinesis Date Firehose. The data produces trillions of S3 objects each year. Each morning, the company uses the data from the previous 30 days to retrain a suite of machine learning (ML) modelsFour times each year, the company uses the data from the previous 12 months to perform analysis and train other ML models. The data must be available with minimal delay for up to 1year. After 1 year, the data must be retained for archival purposes.Which storage solution meets these requirements MOST cost-effectively?

     • A. Use the S3 Intelligent-Tiering storage class. Create an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 1 year
     • B. Use the S3 Intelligent-Tiering storage class Configure S3 Intelligent-Tiering to automatically move objects to S3 Glacier Deep Archive after 1year
     • C. Use the S3 Standard-Infrequent Access (S3 Standard-IA) storage class. Create an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 1 year
     • D. Use the S3 Standard storage class. Create an S3 Lifecycle policy to transition objects to S3 Standard- Infrequent Access (S3 Standard-IA) after 30 days, and then to S3 Glacier Deep Archive after 1 year

     View question →

103. Q103. Q298. A company runs a public three-tier web application in a VPC. The application runs on AmazonEc2 instances across multiple Availability Zones. The EC2instances that run in private subnets need to communicate with a license server over the internet. The company needs a managed solution that minimizes operational maintenance.Which solution meets these requirements?

     • A. Provision a NAT instance in a public subnet. Modify each private subnet's route table with a default route that points to the NAT instance
     • B. Provision a NAT instance in a private subnet. Modify each private subnet's route table with a default route that points to the NAT instance
     • C. Provision a NAT gateway in a public subnet. Modify each private subnet's route table with a default route that points to the NAT gateway.
     • D. Provision a NAT gateway in a private subnet. Modify each private subnet's route table with a default route that points to tr NAT gateway.

     View question →

104. Q104. Q299. A meteorological startup company has a custom web application to sell weather data to its users online. The company uses Amazon DynamoDB to store its data and wants to build a new service that sends an alert to the managers of four internal teams every time a new weather event is recorded. The company does not want this new service to affect the performance of the current application. What should a solutions architect do to meet these requirements with the LEAST amount of operational overhead?

     • A. Use DynamoDB transactions to write new event data to the table Configure the transactions to notify internal teams
     • B. Have the current application publish a message to four Amazon Simple Notification Service (Amazon SNS) topics Have each team subscribe to one topic
     • C. Enable Amazon DynamoDB Streams on the table Use triggers to write to a single Amazon Simple Notification Service (Amazon SNS) topic to which the teams can subscribe.
     • D. Add a custom attribute to each record to flag new items. Write a cron job that scans the table every minute for items that are new and notifies an Amazon Simple Queue Service (Amazon SQS) queue to which the teams can subscribe

     View question →

105. Q105. Q300. A company needs to ingest and handle large amounts of streaming data that its application generates. The application runs on Amazon EC2 instances and sends data to Amazon Kinesis Data Streams, which is configured with default settings. Every other day, the application consumes the data and writes the data to an Amazon S3 bucket for business intelligence (BI) processing. The company observes that Amazon S3 is not receiving all the data that the application sends to Kinesis Data Streams. What should a solutions architect do to resolve this issue?

     • A. Update the Kinesis Data Streams default settings by modifying the data retention period
     • B. Update the application to use the Kinesis Producer Library (KPL) to send the data to Kinesis Data Streams
     • C. Update the number of Kinesis shards to handle the throughput of the data that is sent to Kinesis Data Streams
     • D. Turn on S3 Versioning within the S3 bucket to preserve every version of every object that is ingested in the S3 bucket.

     View question →