AWS SAA-C03 Chapter 6 Practice Questions (65 Questions)

Practice questions for the AWS SAA-C03 (Solutions Architect Associate) exam, Chapter 6.

1. Q1. Q366. A company uses AWS Cost Explorer to monitor its AWS costs. The company notices that Amazon Elastic Block Store (Amazon EBS) storage and snapshot costs increase every month. However, the company does not purchase additional EBS storage every month. The company wants to optimize monthly costs for its current storage usage.Which solution will meet these requirements with the LEAST operational overhead?

   • A. Use logs in Amazon CloudWatch Logs to monitor the storage utilization of Amazon EBS. Use Amazon EBS Elastic Volumes to reduce the size of the EBS volumes
   • B. Use a custom script to monitor space usage. Use Amazon EBS Elastic Volumes to reduce the size of the EBS volumes
   • C. Delete all expired and unused snapshots to reduce snapshot costs
   • D. Delete all nonessential snapshots. Use Amazon Data Lifecycle Manager to create and manage the snapshots according to the company's snapshot policy requirements

   View question →

2. Q2. Q367. A company stores a large volume of image files in an Amazon S3 bucket. The images need to be readily available for the first 180 days. The images are infrequently accessed for the next 180 days After 360 days, the images need to be archived but must be available instantly upon request After 5 years, only auditors can access the images. The auditors must be able to retrieve the images within 12 hours. The images cannot be lost during this process.A developer will use S3 Standard storage for the first 180 days. The developer needs to configure an S3 Lifecycle ruleWhich solution will meet these requirements MOST cost-effectively?

   • A. Transition the objects to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 180 days, S3 Glacier Instant Retrieval after 360 days, and S3 Glacier Deep Archive after 5 years
   • B. Transition the objects to S3 One Zone-Infrequent Access (S3 One Zone-IA) after 180 days. S3 Glacier Flexible Retrieval after 360 days. and S3 Glacier Deep Archive after 5 years
   • C. Transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 180 days. S3 Glacier Instant Retrieval after 360 days. and S3 Glacier Deep Archive after 5 years
   • D. Transition the objects to S3 Standard-Infrequent Access (S3 Standard-IA) after 180 days, S3 Glacier Flexible Retrieval after 360 days, and S3 Glacier Deep Archive after 5 years

   View question →

3. Q3. Q368. A solutions architect is designing a company's disaster recovery (DR) architecture. The company has a MySQL database that runs on an Amazon EC2 instance in a private subnet with scheduled backup. The DR design needs to include multiple AWS Regions.Which solution will meet these requirements with the LEAST operational overhead?

   • A. Migrate the MySQL database to multiple EC2 instances. Configure a standby EC2 instance in the DR Region. Turn on replication
   • B. Migrate the MySQL database to Amazon RDS. Use a Multi-AZ deployment. Turn on read replication for the primary DB instance in the different Availability Zones
   • C. Migrate the MySQL database to an Amazon Aurora global database. Host the primary DB cluster in the primary Region. Host the secondary DB cluster in the DR Region
   • D. Store the scheduled backup of the MySQL database in an Amazon S3 bucket that is configured for S3 Cross-Region Replication (CRR). Use the data backup to restore the database in the DR Region

   View question →

4. Q4. Q369. A company uses storage area network (SAN) storage to runs its application on premises. The company is building a disaster recovery(DR) plan. The company wants to keep the backup data in the AWS Cloud. In the event of a disaster, the company wants to use Amazon Elastic Block Store (Amazon EBS) to restore the data and the application in the AWS Cloud.Which solution will meet these requirements MOST cost_effectively'

   • A. Take snapshots of the on-premises SAN storage. Copy the data to Amazon S3. During a disaster, create an EBS volume directly from the snapshot that is stored in Amazon S3
   • B. Use EBS direct APIs to create incremental EBS snapshots from the on-premises SAN storage. Use the EBS snapshot to create EBS volumes during a disaster
   • C. Create an asynchronous replication from the on-premises SAN storage to an EBS volume. During a disaster, create an Amazon EC2 instance. Attach the EBS volume to the instance
   • D. Use AWS DataSync to periodically copy the data from the on-premises SAN storage to Amazon S3.During a disaster, create an Amazon EC2 instance. Attach a new EBS volume to the EC2 instance Copy the data directly from Amazon S3 to the EBS volume

   View question →

5. Q5. Q370. A data analytics company wants to migrate its batch processing system to AWS. The company receives thousands of small data files periodically during the day through FTP. An on-premises batch job processes the data files overnight. However, the batch job takes hours to finish running The company wants the AWS solution to process incoming data files as soon as possible with minimal changes to the FTP clients that send the files. The solution must delete the incoming data files after the files have been processed successfully. Processing for each file needs to take 3-8 minutes Which solution will meet these requirements in the MOST operationally efficient way?

   • A. Use an Amazon EC2 instance that runs an FTP server to store incoming files as objects in Amazon S3 Glacier Flexible Retrieval. Configure a job queue in AWS Batch. Use Amazon EventBridge rules to invoke the job to process the objects nightly from S3 Glacier Flexible Retrieval. Delete the objects after the job has processed the objects
   • B. Use an Amazon EC2 instance that runs an FTP server to store incoming files on an Amazon Elastic Block Store (Amazon EBS) volume. Configure a job queue in AWS Batch. Use Amazon EventBridge rules to invoke the job to process the files nightly from the EBS volume. Delete the files after the job has processed the files
   • C. Use AWS Transfer Family to create an FTP server to store incoming files on an Amazon Elastic Block Store (Amazon EBS) volume. Configure a job queue in AWS Batch. Use an Amazon S3 event notification when each file arrives to invoke the job in AWS Batch. Delete the files after the job has processed the files
   • D. Use AWS Transfer Family to create an FTP server to store incoming files in Amazon S3 Standard.Create an AWS Lambda function to process the files and to delete the files after they are processed.Use an S3 event notification to invoke the Lambda function when the files arrive

   View question →

6. Q6. Q371. A company is building a new web-based customer relationship management application. The application will use several Amazon EC2 instances that are backed by Amazon Elastic Block Store (Amazon EBS) volumes behind an Application Load Balancer (ALB). The application will also use an Amazon Aurora database. All data for the application must be encrypted at rest and in transit Which solution will meet these requirements?

   • A. Use AWS Key Management Service (AWS KMS) certificates on the ALB to encrypt data in transit. Use AWS Certificate Manager (ACM) to encrypt the EBS volumes and Aurora database storage at rest
   • B. Use the AWS root account to log in to the AWS Management Console. Upload the company's encryption certificates. While in the root account, select the option to turn on encryption for all data at rest and in transit for the account
   • C. Use AWS Key Management Service (AWS KMS) to encrypt the EBS volumes and Aurora database storage at rest. Attach an AWS Certificate Manager (ACM) certificate to the ALB to encrypt data in transit
   • D. Use BitLocker to encrypt all data at rest Import the company's TLS certificate keys to AWS Key Management Service (AWS KMS). Attach the KMS keys to the ALB to encrypt data in transit

   View question →

7. Q7. Q372. A company runs its applications on Amazon EC2 instances that are backed by Amazon Elastic Block Store (Amazon EBS). The EC2 instances run the most recent Amazon Linux release. The applications are experiencing availability issues when the company's employees store and retrieve filles that are 25 GB or larger. The company needs a solution that does not require the company to transfer files between EC2 instances. The files must be available across many EC2 instances and across multiple Availability Zones.Which solution will meet these requirements?

   • A. Migrate all the files to an Amazon S3 bucket. Instruct the employees to access the files from the S3 bucket
   • B. Take a snapshot of the existing EBS volume. Mount the snapshot as an EBS volume across the EC2 instances. Instruct the employees to access the files from the EC2 instances
   • C. Mount an Amazon Elastic File System (Amazon EFS) file system across all the EC2 instances. Instruct the employees to access the files from the EC2 instances
   • D. Create an Amazon Machine Image (AMl) from the EC2 instances. Configure new EC2 instances from the AMI that use an instance store volume. Instruct the employees to access the files from the EC2 instances

   View question →

8. Q8. Q373. A company wants to migrate an on-premises data center to AWS. The data center hosts a storage server that stores data in an NFS-based file system. The storage server holds 200 GB of data.The company needs to migrate the data without interruption to existing services. Multiple resources in AWS must be able to access the data by using the NFS protocol.Which combination of steps will meet these requirements MOST cost-effectively? (Select TWO.)

   • A. Create an Amazon FSx for Lustre file system
   • B. Create an Amazon Elastic File System (Amazon EFS) file system
   • C. Create an Amazon S3 bucket to receive the data
   • D. Manually use an operating system copy command to push the data into the AWS destination
   • E. Install an AWS DataSync agent in the on-premises data center. Use a DataSync task between the the on-premises location and AWS

   View question →

9. Q9. Q374. A company has an application that is backed by an Amazon DynamoDB table. The company's compliance requirements specify that database backups must be taken every month, must be available for 6 months, and must be retained for 7 years.Which solution will meet these requirements?

   • A. Create an AWS Backup plan to back up the DynamoDB table on the first day of each month. Specify a lifecycle policy that transitions the backup to cold storage after 6 months. Set the retention period for each backup to 7 years
   • B. Create a DynamoDB on-demand backup of the DynamoDB table on the first day of each month.Transition the backup to Amazon S3 Glacier Flexible Retrieval after 6 months. Create an S3 Lifecycle policy to delete backups that are older than 7 years
   • C. Use the AWS SDK to develop a script that creates an on-demand backup of the DynamoDB table. Set up an Amazon EventBridge rule that runs the script on the first day of each month. Create a second script that will run on the second day of each month to transition DynamoDB backups that are older than 6 months to cold storage and to delete backups that are older than 7 years
   • D. Use the AWS CLI to create an on-demand backup of the DynamoDB table. Set up an Amazon EventBridge rule that runs the command on the first day of each month with a cron expression. Specify in the command to transition the backups to cold storage after 6 months and to delete the backups after 7 years

   View question →

10. Q10. Q375. A company has a web application that runs on premises. The application experiences latency issues during peak hours. The latency issues occur twice each month. At the start of a latency issue, the application's CPU utilization immediately increases to 10 times its normal amount. The company wants to migrate the application to AWS to improve latency. The company also wants to scale the application automatically when application demand increases. The company will use AWS Elastic Beanstalk for application deployment.Which solution will meet these requirements?

    • A. Configure an Elastic Beanstalk environment to use burstable performance instances in unlimited mode.Configure the environment to scale based on requests
    • B. Configure an Elastic Beanstalk environment to use compute optimized instances. Configure the environment to scale based on requests
    • C. Configure an Elastic Beanstalk environment to use compute optimized instances. Configure the environment to scale on a schedule
    • D. Configure an Elastic Beanstalk environment to use burstable performance instances in unlimited mode.Configure the environment to scale on predictive metrics

    View question →

11. Q11. Q376. A gaming company uses Amazon DynamoDB to store user information such as geographic location, player data, and leaderboards. The company needs to configure continuous backups to an Amazon S3 bucket with a minimal amount of coding. The backups must not affect availability of the application and must not affect the read capacity units (RCUs) that are defined for the table.Which solution meets these requirements?

    • A. Use an Amazon EMR cluster. Create an Apache Hive job to back up the data to Amazon S3
    • B. Export the data directly from DynamoDB to Amazon S3 with continuous backups. Turn on point-in-time recovery for the table
    • C. Configure Amazon DynamoDB Streams. Create an AWS Lambda function to consume the stream and export the data to an Amazon S3 bucket
    • D. Create an AWS Lambda function to export the data from the database tables to Amazon S3 on a regular basis. Turn on point-in-time recovery for the table

    View question →

12. Q12. Q377. A company is moving its data and applications to AWS during a multiyear migration project The company wants to securely access data on Amazon S3 from the company's AWS Region and from the company's on- premises location. The data must not traverse the internet. The company has established an AWS Direct Connect connection between its Region and its on-premises location.Which solution will meet these requirements?

    • A. Create gateway endpoints for Amazon S3. Use the gateway endpoints to securely access the data from the Region and the on-premises location
    • B. Create a gateway in AWS Transit Gateway to access Amazon S3 securely from the Region and the on- premises location
    • C. Create interface endpoints for Amazon S3. Use the interface endpoints to securely access the data from the Region and the on-premises location
    • D. Use an AWS Key Management Service (AWS KMS) key to access the data securely from the Region and the on-premises location

    View question →

13. Q13. Q378. A company collects 10 GB of telemetry data daily from various machines. The company stores the data in an Amazon S3 bucket in a source data account.The company has hired several consulting agencies to use this data for analysis. Each agency needs read access to the data for its analysts. The company must share the data from the source data account by choosing a solution that maximizes security and operational efficiency.Which solution will meet these requirements?

    • A. Configure S3 global tables to replicate data for each agency
    • B. Make the S3 bucket public for a limited time. Inform only the agencies
    • C. Configure cross-account access for the S3 bucket to the accounts that the agencies own
    • D. Set up an IAM user for each analyst in the source data account. Grant each user access to the S3 bucket

    View question →

14. Q14. Q379. A media company hosts its website on AWS. The website application's architecture includes a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB) and a database that is hosted on Amazon Aurora. The company's cybersecurity team reports that the application is vulnerable to SQL injection.How should the company resolve this issue?

    • A. Use AWS WAF in front of the ALB. Associate the appropriate web ACLs with AWS WAF
    • B. Create an ALB listener rule to reply to SQL injections with a fixed response
    • C. Subscribe to AWS Shield Advanced to block all SQL injection attempts automatically
    • D. Set up Amazon Inspector to block all SQL injiection attempts automatically

    View question →

15. Q15. Q380. An Amazon EventBridge rule targets a third-party API. The third-party API has not received any incoming traffic. A solutions architect needs to determine whether the rule conditions are being met and if the rule's target is being invoked.Which solution will meet these requirements?

    • A. Check for metrics in Amazon CloudWatch in the namespace for AWS/Events
    • B. Review events in the Amazon Simple Queue Service (Amazon SQS) dead-letter queue
    • C. Check for the events in Amazon CloudWatch Logs
    • D. Check the trails in AWS CloudTrail for the EventBridae events

    View question →

16. Q16. Q381. A company manages multiple AWS accounts in an organization in AWS Organizations. The company's applications run on Amazon EC2 instances in multiple AWS Regions.The company needs a solution to simplify the management of security rules across the accounts in its organization. The solution must apply shared security group rules, audit security groups, and detect unused and redundant rules in VPC security groups across all AWS environments.Which solution will meet these requirements with the MOST operational efficiency?

    • A. Use AWS Firewall Manager to create a set of rules based on the security requirements. Replicate the rules to all the AWS accounts and Regions
    • B. Use AWS CloudFormation StackSets to provision VPC security groups based on the specifications across multiple accounts and Regions. Deploy AWS Network Firewall to define the firewall rules to control network traffic across multiple accounts and Regions
    • C. Use AWS CloudFormation StackSets to provision VPC security groups based on the specifications across multiple accounts and Regions. Configure AWS Config and AWS Lambda to evaluate compliance information and to automate enforcement across all accounts and Regions
    • D. Use AWS Network Firewall to build policies based on the security requirements. Centrally apply the new policies to all the VPCs and accounts

    View question →

17. Q17. Q382. A company has 15 employees. The company stores employee start dates in an Amazon DynamoDB table. The company wants to send an email message to each employee on the day of the employee's work anniversary.Which solution will meet these requirements with the MOST operational efficiency?

    • A. Create a script that scans the DynamoDB table and uses Amazon Simple Notification Service (Amazon SNS) to send email messages to employees when necessary. Use a cron job to run this script every day on an Amazon EC2 instance
    • B. Create a script that scans the DynamoDB table and uses Amazon Simple Queue Service (Amazon SQS) to send email messages to employees when necessary. Use a cron job to run this script every day on an Amazon EC2 instance
    • C. Create an AWS Lambda function that scans the DynamoDB table and uses Amazon Simple Notification Service (Amazon SNS) to send email messages to employees when necessary. Schedule this Lambda function to run every day
    • D. Create an AWS Lambda function that scans the DynamoDB table and uses Amazon Simple Queue Service (Amazon SQS) to send email messages to employees when necessary. Schedule this Lambda function to run every day

    View question →

18. Q18. Q383. A company is building a new furniture inventory application. The company has deployed the application on a fleet of Amazon EC2 instances across multiple Availability Zones. The EC2 instances run behind an Application Load Balancer(ALB) in their VPC.A solutions architect has observed that incoming traffic seems to favor one EC2 instance, resulting in latency for some requests.What should the solutions architect do to resolve this issue?

    • A. Disable session affinity (sticky sessions) on the ALE
    • B. Replace the ALB with a Network Load Balancer
    • C. Increase the number of EC2 instances in each Availability Zone
    • D. Adjust the frequency of the health checks on the ALB's target group

    View question →

19. Q19. Q384. A company manages an application that stores data on an Amazon RDS for PostgreSQL Multi-AZ DB instance. Increases in traffic are causing performance problems. The company determines that database queries are the primary reason for the slow performance.What should a solutions architect do to improve the application's performance?

    • A. Serve read traffic from the Multi-AZ standby replica
    • B. Configure the DB instance to use Transfer Acceleration
    • C. Create a read replica from the source DB instance. Serve read traffic from the read replica
    • D. Use Amazon Kinesis Data Firehose between the application and Amazon RDS to increase the concurrency of database requests

    View question →

20. Q20. Q385. A company runs an application on AWS. The application receives inconsistent amounts of usage.The application uses AWS Direct Connect to connect to an on-premises MySQL-compatible database.The on- premises database consistently uses a minimum of 2 GiB of memory. The company wants to migrate the on-premises database to a managed AWS service. The company wants to use auto scaling capabilities to manage unexpected workload increases. Which solution will meet these requirements with the LEAST administrative overhead?

    • A. Provision an Amazon DynamoDB database with default read and write capacity settings
    • B. Provision an Amazon Aurora database with a minimum capacity of 1 Aurora capacity unit (ACU)
    • C. Provision an Amazon Aurora Serverless v2 database with a minimum capacity of 1 Aurora capacity unit (ACU)
    • D. Provision an Amazon RDS for MySQL database with 2 GiB of memory

    View question →

21. Q21. Q386. A gaming company has a web application that displays scores. The application runs on Amazon EC2 instances behind an Application Load Balancer. The application stores data in an Amazon RDS for MySQL database. Users are starting to experience long delays and interruptions that are caused by database read performance. The company wants to improve the user experience while minimizing changes to the application's architecture.What should a solutions architect do to meet these requirements?

    • A. Use Amazon ElastiCache in front of the database
    • B. Use RDS Proxy between the application and the database
    • C. Migrate the application from EC2 instances to AWS Lambda
    • D. Migrate the database from Amazon RDS for MySQL to Amazon DynamoDB

    View question →

22. Q22. Q387. A company recently migrated its web application to the AWS Cloud. The company uses an Amazon EC2 instance to run multiple processes to host the application. The processes include an Apache web server that serves static content. The Apache web server makes requests to a PHP application that uses a local Redis server for user sessions.The company wants to redesign the architecture to be highly available and to use AWS managed solutions.Which solution will meet these requirements?

    • A. Use AWS Elastic Beanstalk to host the static content and the PHP application. Configure Elastic Beanstalk to deploy its EC2 instance into a public subnet. Assign a public IP address
    • B. Use AWS Lambda to host the static content and the PHP application. Use an Amazon API Gateway REST API to proxy requests to the Lambda function. Set the API Gateway CORS configuration to respond to the domain name. Configure Amazon ElastiCache for Redis to handle session information
    • C. Keep the backend code on the EC2 instance. Create an Amazon ElastiCache for Redis cluster that has Multi-AZ enabled. Configure the ElastiCache for Redis cluster in cluster mode. Copy the frontend resources to Amazon S3. Configure the backend code to reference the EC2 instance
    • D. Configure an Amazon CloudFront distribution with an Amazon S3 endpoint to an S3 bucket that is configured to host the static content. Configure an Application Load Balancer that targets an Amazon Elastic Container Service (Amazon ECS) service that runs AWS Fargate tasks for the PHP application.Configure the PHP application to use an Amazon ElastiCache for Redis cluster that runs in multiple Availability Zones

    View question →

23. Q23. Q388. A company deploys an application on five Amazon EC2 instances. An Application Load Balancer (ALB) distributes traffic to the instances by using a target group. The average CPU usage on each of the instances is below 10% most of the time. with occasional surges to 65%. A solutions architect needs to implement a solution to automate the scalability of the application. The solution must optimize the cost of the architecture and must ensure that the application has enough CPU resources when surges occur.Which solution will meet these requirements?

    • A. Create an Amazon CloudWatch alarm that enters the ALARM state when the CPUUtilization metric is less than 20%. Create an AWS Lambda function that the CloudWatch alarm invokes to terminate one of the EC2 instances in the ALB target group
    • B. Create an EC2 Auto Scaling group. Select the existing ALB as the load balancer and the existing target group as the target group. Set a target tracking scaling policy that is based on the ASGAverageCPUUtilization metric. Set the minimum instances to 2, the desired capacity to 3, the maximum instances to 6, and the target value to 50%. Add the EC2 instances to the Auto Scaling group
    • C. Create an EC2 Auto Scaling group. Select the existing ALB as the load balancer and the existing target group as the target group. Set the minimum instances to 2, the desired capacity to 3, and the maximum instances to 6. Add the EC2 instances to the Auto Scaling group
    • D. Create two Amazon CloudWatch alarms. Configure the first CloudWatch alarm to enter the ALARM state when the average CPUUtilization metric is below 20%. Configure the second CloudWatch alarm to enter the ALARM state when the average CPUUtilization metric is above 50%. Configure the alarms to publish to an Amazon Simple Notification Service (Amazon SNS) topic to send an email message After receiving the message. log in to decrease or increase the number of EC2 instances that are running

    View question →

24. Q24. Q389. An ecommerce company stores terabytes of customer data in the AWS Cloud. The data contains personally identifiable information (Pll). The company wants to use the data in three applications. Only one of the applications needs to process the Pll.The PlI must be removed before the other two applications process the data.Which solution will meet these requirements with the LEAST operational overhead?

    • A. Store the data in an Amazon DynamoDB table. Create a proxy application layer to intercept and process the data that each application requests
    • B. Store the data in an Amazon S3 bucket. Process and transform the data by using S3 Object Lambda before returning the data to the requesting application
    • C. Process the data and store the transformed data in three separate Amazon S3 buckets so that each application has its own custom dataset. Point each application to its respective S3 bucket.
    • D. Process the data and store the transformed data in three separate Amazon DynamoDB tables so that each application has its own custom dataset. Point each application to its respective DynamoDB table

    View question →

25. Q25. Q390. A company recently migrated to the AWS Cloud. The company wants a serverless solution for large-scale parallel on-demand processing of a semistructured dataset. The data consists of logs. media files. Sales transactions, and loT sensor data that is stored in Amazon S3. The company wants the solution to process thousands of items in the dataset in parallel.Which solution will meet these requirements with the MOST operational efficiency?

    • A. Use the AWS Step Functions Map state in Inline mode to process the data in parallel
    • B. Use the AWS Step Functions Map state in Distributed mode to process the data in parallel
    • C. Use AWS Glue to process the data in parallel
    • D. Use several AWS Lambda functions to process the data in parallel

    View question →

26. Q26. Q391. A solutions architect is designing a new service behind Amazon API Gateway. The request patterns for the service will be unpredictable and can change suddenly from 0 requests to over 500 per second. The total size of the data that needs to be persisted in a backend database is currently less than 1 GB with unpredictable future growth Data can be queried using simple key-value requests. Which combination of AWS services would meet these requirements? (Select TWO )

    • A. AWS Fargate
    • B. AWS Lambda
    • C. Amazon DynamoDB
    • D. Amazon EC2 Auto Scaling
    • E. MySQL-compatible Amazon Aurora

    View question →

27. Q27. Q392. A company is hosting a website behind multiple Application Load Balancers. The company has different distribution rights for its content around the world. A solutions architect needs to ensure that users are served the correct content without violating distribution rights. Which configuration should the solutions architect choose to meet these requirements?

    • A. Configure Amazon CloudFront with AWS WAF.
    • B. Configure Application Load Balancers with AWS WAF.
    • C. Configure Amazon Route 53 with a geolocation policy.
    • D. Configure Amazon Route 53 with a geoproximity routing policy.

    View question →

28. Q28. Q393. A solution architect is performing a security review of a recently migrated workload. The workload is a web application that consists of amazon EC2 instances in an Auto Scaling group behind an Application Load balancer. The solution architect must improve the security posture and minimize the impact of a DDoS attack on resources.Which solution is MOST effective?

    • A. Configure an AWS WAF ACL with rate-based rules Create an Amazon CloudFront distribution that points to the Application Load Balancer. Enable the EAF ACL on the CloudFront distribution
    • B. Create a custom AWS Lambda function that adds identified attacks into a common vulnerability pool to capture a potential DDoS attack. use the identified information to modify a network ACL to block access.
    • C. Enable VPC Flow Logs and store then in Amazon S3. Create a custom AWS Lambda functions that parses the logs looking for a DDoS attack. Modify a network ACL to block identified source IP addresses.
    • D. Enable Amazon GuardDuty and , configure findings written 10 Amazon GloudWatch Create an event with Cloud Watch Events for DDoS alerts that triggers Amazon Simple Notification Service (Amazon SNS) Have Amzon SNS invoke a custom AWS lambda function that parses the logs looking for a DDoS attack Modify a network ACL to block identified source IP addresses

    View question →

29. Q29. Q394. A company has an application workflow that uses an AWS Lambda function to download and decrypt files from Amazon S3. These files are encrypted using AWS Key Management Service Customer Master Keys (AWS KMS CMKs).A solutions architect needs to design a solution that will ensure the required permissions are set correctly. Which combination of actions accomplish this? (Select TWO.)

    • A. Attach the kms.decrypt permission to the Lambda function's resource policy.
    • B. Grant the decrypt permission for the Lambda IAM role in the KMS key's policy.
    • C. Grant the decrypt permission for the Lambda resource policy in the KMS key's policy.
    • D. Create a new IAM policy with the kms:decrypt permission and attach the policy to the Lambda function.
    • E. Create a new IAM role with the kms decrypt permission and attach the execution role to the Lambda function.

    View question →

30. Q30. Q395. A company has applications hosted on Amazon EC2 instances with IPv6 addresses. The applications must initiate communications with other external applications using the internet. However, the company's security policy states that any external service cannot initiate a connection to the EC2 instances. What should a solutions architect recommend to resolve this issue?

    • A. Create a NAT gateway and make it the destination of the subnet's route table
    • B. Create an internet gateway and make it the destination of the subnet's route table
    • C. Create a virtual private gateway and make it the destination of the subnet's route table
    • D. Create an egress-only internet gateway and make it the destination of the subnet's route table

    View question →

31. Q31. Q396. A company wants to monitor its AWS costs for financial review. The cloud operations team is designing an architecture in the AWS Organizations master account to query AWS Cost and Usage Reports for all member accounts.The team must run this query once a month and provide a detailed analysis of the bill. Which solution is the MOST scalable and cost-effective way to meet these requirements?

    • A. Enable Cost and Usage Reports in the master account.Deliver reports to Amazon KinesisUse Amazon EMR tor analysis.
    • B. Enable Cost and Usage Reports in the master account.Deliver the reports to Amazon S3Use Amazon Athena for analysis.
    • C. Enable Cost and Usage Reports for member accounts.Deliver the reports to Amazon S3Use Amazon Redshift for analysis.
    • D. Enable Cost and Usage Reports for member accounts.Deliver the reports to Amazon KinesisUse Amazon QuicKSight for analysis.

    View question →

32. Q32. Q397. A solutions architect needs to host a high performance computing (HPC) workload in the AWS Cloud. The workload will run on hundreds of Amazon EC2 instances and will require parallel access to a shared file system to enable distributed processing of large datasets. Datasets will be accessed across multiple instances simultaneously.The workload requires access latency within 1 ms.After processing has completed, engineer will need access to the dataset for manual postprocessing.Which solution will meet these requirements?

    • A. Use Amazon Elastic File System (Amazon EFS) as a shared file system Access the dataset from Amazon EFS.
    • B. Mount an Amazon S3 bucket to serve as the shared file system Perform postprocessing directly from the S3 bucket
    • C. Use Amazon FSx for Lustre as a shared file system.Link the file system to an Amazon S3 bucket for postprocessing.
    • D. Configure AWS Resource Access Manager to share an Amazon S3 bucket so that it can be mounted to all instances for processing and postprocessing

    View question →

33. Q33. Q398. A development team is creating an event-based application that uses AWS Lambda functions. Events will be generated when files are added to an Amazon S3 bucket. The development team currently has Amazon Simple Notification Service (Amazon SNS) configured as the event target from Amazon S3. What should a solution architect do to process the events from Amazon S3 in a scalable why?

    • A. Create an SNS subscription that processes the event in Amazon Elastic Container Service (Amazon ECS) before the event runs in Lambda.
    • B. Create an SNS subscription that processes the event in Amazon Elastic Kubermetes Service (Amazon EKS) before the event runs in Lambda.
    • C. Create on SNS subscription that sends the event to AWS Server Migration Service (AWS SQS).Configure the SQS queue to trigger a Lambda function.
    • D. Create an SNS subscription that sends the event to AWS Server Migration Service (AWS SMS).Configure the Lambda function to poll from the SMS event

    View question →

34. Q34. Q399. A company Is creating a new application that will store a large amount of data. The data will be analyzed hourly and will be modified by several Amazon EC2 Linux instances that are deployed across multiple Availability Zones.The needed amount of storage space will continue to grow for the next 6 months Which storage solution should a solutions architect recommend to meet these requirements?

    • A. Store the data in Amazon S3 Glacier.Update the S3 Glacier vault policy to allow access to the application instances.
    • B. Store the data in an Amazon Elastic Block Store (Amazon EBS) volume Mount the EBS volume on the application instances.
    • C. Store the data in an amazon Elastic File System (Amazon EFS) file system.Mount the file system on the application instances
    • D. Store the data in an Amazon Elastic Block Store (Amazon ESS) Provisioned IOPS volume shared between the application instances

    View question →

35. Q35. Q400. A weather forecasting company needs to process hundreds of gigabytes of data with sub-millisecond latency. The company has a high performance computing (HPC) environment in its data center and wants to expand its forecasting capabilities. A solutions architect must identify a highly available cloud storage solution that can handle large amounts of sustained throughput Files that are stored in the solution should be accessible to thousands of compute instances that will simultaneously access and process the entire dataset.What should the solutions architect do to meet these requirements?

    • A. Use Amazon FSx for Lustre scratch file systems.
    • B. Use Amazon FSx for Lustre persistent file systems.
    • C. Use Amazon Elastic File System (Amazon EFS) with Bursting Throughput mode.
    • D. Use Amazon Elastic File System (Amazon EFS) with Provisioned Throughput mode

    View question →

36. Q36. Q401. A company wants to provide users with access to AWS resources. The company has 1,500 users and manages their access to on-premises resources through Active Directory user groups on the corporate network. However, the company does not want users to have to maintain another identity to access the resources. A solutions architect must manage user access to the AWS resources while preserving access to the on-premises resources.What should the solutions architect do to meet these requirements?

    • A. Create an IAM user for each user in the company. Attach the appropriate policies to each user.
    • B. Use Amazon Cognito with an Active Directory user pool Create roles with the appropriate policies attached.
    • C. Define cross-account roles with the appropriate policies attached. Map the roles to the Active Directory groups.
    • D. Configure Security Assertion Markup Language (SAML)20-based federation. Create roles with the appropriate policies attached. Map the roles to the Active Directory groups.

    View question →

37. Q37. Q402. A company runs several websites on AWS for its different brands. Each website generates tens of gigabytes of web traffic logs each day.A solutions architect needs to design a scalable solution to give the company's developers the ability to analyze traffic patterns across all the company's websites. This analysis by the developers will occur on demand once a week over the course of several months. The solution must support queries with standard SQL.Which solution will meet these requirements MOST cost-effectively?

    • A. Store the logs in Amazon S3. Use Amazon Athena for analysis
    • B. Store the logs in Amazon RDS. Use a database client for analysis
    • C. Store the logs in Amazon OpenSearch Service (Amazon Elasticsearch Service). Use Amazon OpenSearch Service (Amazon Elasticsearch Service) for analysis.
    • D. Store the logs in an Amazon EMR cluster. Use a supported open-source framework for SQL-based analysis.

    View question →

38. Q38. Q403. A company wants to migrate two DNS servers to AWS. The servers host a total of approximately 200 zones and receive 1 million requests each day on average. The company wants to maximize availability while minimizing the operational overhead that is related to the management of the two servers. What should a solutions architect recommend to meet these requirements?

    • A. Create 200 new hosted zones in the Amazon Route 53 console. Import zone files
    • B. Launch a single large Amazon EC2 instance. Import zone files. Configure Amazon CloudWatch alarms and notifications to alert the company about any downtime.
    • C. Migrate the servers to AWS by using AWS Server Migration Service (AWS SMS).Configure Amazon CloudWatch alarms and notifications to alert the company about any downtime
    • D. Launch an Amazon EC2instance in an Auto Scaling group across two Availability Zones. Import zone files. Set the desired capacity to 1and the maximum capacity to 3 for the Auto Scaling group. Configure scaling alarms to scale based on CPU utilization.

    View question →

39. Q39. Q404. A solutions architect launches an Amazon EC2 instance inside a new VPC. The solutions architect configures network ACL rules and security group rules that allow the appropriate traffic to flow to and from the instance. An Elastic IP address is associated with the instance. The solutions architect needs to be able to access the instance from the internet.Which combination of actions should the solutions architect take to accomplish this goal? (Select TWO)

    • A. Create an internet gateway. Attach the internet gateway to the VPC
    • B. Create an internet gateway. Attach the internet gateway to the instance's subnet
    • C. Create an internet gateway Attach the internet gateway to the instance
    • D. Add a route to the route table of the instance's subnet. Route traffic from the instance's subnet to the internet gateway
    • E. Add a route to the route table of the instance's subnet Route traffic from the internet gateway to the instance's subnet

    View question →

40. Q40. Q405. A company wants to run a gaming application on Amazon EC2 instances that are part of an Auto Scaling group in the AWS Cloud. The application will transmit data by using UDP packets. The company wants to ensure that the application can scale out and in as traffic increases and decreases. What should a solutions architect do to meet these requirements?

    • A. Attach a Network Load Balancer to the Auto Scaling group.
    • B. Attach an Application Load Balancer to the Auto Scaling group.
    • C. Deploy an Amazon Route 53 record set with a weighted policy to route traffic appropriately
    • D. Deploy a NAT instance that is configured with port forwarding to the EC2 instances in the Auto Scaling group

    View question →

41. Q41. Q406. An ecommerce company has an order-processing application that uses Amazon API Gateway and an AWS Lambda function. The application stores data in an Amazon Aurora PostgreSQL database.During a recent sales event, a sudden surge in customer orders occurred. Some customers experienced timeouts, and the application did not process the orders of those customers. A solutions architect determined that the CPU utilization and memory utilization were high on the database because of a large number of open connections. The solutions architect needs to prevent the timeout errors while making the least possible changes to the application.Which solution will meet these requirements?

    • A. Configure provisioned concurrency for the Lambda function. Modify the database to be a global database in multiple AWS Regions.
    • B. Use Amazon RDS Proxy to create a proxy for the database. Modify the Lambda function to use the RDS Proxy endpoint instead of the database endpoint.
    • C. Create a read replica for the database in a different AWS Region. Use query string parameters in API Gateway to route traffic to the read replica.
    • D. Migrate the data from Aurora PostgreSQL to Amazon DynamoDB by using AWS Database Migration Service (AWS DMS). Modify the Lambda function to use the DynamoDB table.

    View question →

42. Q42. Q407. A company is building an Amazon Elastic Kubernetes Service (Amazon EKS) cluster for its workloads All secrets that are stored in Amazon EKS must be encrypted in the Kubernetes etcd key-value store.Which solution will meet these requirements?

    • A. Create a new AWS Key Management Service(AWS KMS) key. Use AWS Secrets Manager to manage,rotate,and store all secrets in Amazon EKS
    • B. Create a new AWS Key Management Service(AWS KMS) key.Enable Amazon EKS KMS secrets encryption on the Amazon EKS cluster
    • C. Create the Amazon EKS cluster with default options. Use the Amazon Elastic Block Store (Amazon EBS) Container Storage Interface(CSl) driver as an add-on
    • D. Create a new AWS Key Management Service (AWS KMS) key with the alias/aws/ebs alias Enable default Amazon Elastic Block Store(Amazon EBS) volume encryption for the account.

    View question →

43. Q43. Q408. A research company uses on-premises devices to generate data for analysis. The company wants to use the AWS Cloud to analyze the data. The devices generate .csv files and support writing the data to an SMB file share.Company analysts must be able to use SQL commands to query the data. The analysts will run queries periodically throughout the day.Which combination of steps will meet these requirements MOST cost-effectively?(Select THREE.)

    • A. Deploy an AWS Storage Gateway on premises in Amazon S3 File Gateway mode
    • B. Deploy an AWS Storage Gateway on premises in Amazon FSx File Gateway mode
    • C. Set up an AWS Glue crawler to create a table based on the data that is in Amazon S3
    • D. Set up an Amazon EMR cluster with EMR File System(EMRFS)to query the data that is in Amazon S3.Provide access to analysts
    • E. Set up an Amazon Redshift cluster to query the data that is in Amazon S3.Provide access to analysts
    • F. Set up Amazon Athena to query the data that is in Amazon S3.Provide access to analysts

    View question →

44. Q44. Q409. A company wants to use high-performance computing and artificial intelligence to improve its fraud prevention and detection technology. The company requires distributed processing to complete a single workload as quickly as possible.Which solution will meet these requirements?

    • A. Use Amazon Elastic Kubernetes Service(Amazon EKS) and multiple containers
    • B. Use AWS ParallelCluster and the Message Passing Interface (MPl) libraries
    • C. Use an Application Load Balancer and Amazon EC2 instances
    • D. Use AWS Lambda functions

    View question →

45. Q45. Q410. A company has an application that ingests incoming messages. Dozens of other applications and microservices then quickly consume these messages. The number of messages varies drastically and sometimes increases suddenly to 100,000 each second. The company wants to decouple the solution and increase scalability.Which solution meets these requirements?

    • A. Persist the messages to Amazon Kinesis Data Analytics. Configure the consumer applications to read and process the messages.
    • B. Deploy the ingestion application on Amazon EC2 instances in an Auto Scaling group to scale the number of EC2 instances based on CPU metrics.
    • C. Write the messages to Amazon Kinesis Data Streams with a single shard. Use an AWS Lambda function to preprocess messages and store them in Amazon DynamoDB. Configure the consumer applications to read from DynamoDB to process the messages.
    • D. Publish the messages to an Amazon Simple Notification Service (Amazon SNS) topic with multiple Amazon Simple Queue Service (Amazon SOS) subscriptions. Configure the consumer applications to process the messages from the queues.

    View question →

46. Q46. Q411. A company has an on-premises application that generates a large amount of time-sensitive data that is backed up to Amazon S3. The application has grown and there are user complaints about internet bandwidth limitations. A solutions architect needs to design a long-term solution that allows for both timely backups to Amazon S3 and with minimal impact on internet connectivity for internal users.Which solution meets these requirements?

    • A. Establish AWS VPN connections and proxy all traffic through a VPC gateway endpoint.
    • B. Establish a new AWS Direct Connect connection and direct backup traffic through this new connection.
    • C. Order daily AWS Snowball devices. Load the data onto the Snowball devices and return the devices to AWS each day.
    • D. Submit a support ticket through the AWS Management Console. Request the removal of S3 service limits from the account.

    View question →

47. Q47. Q412. A company recently signed a contract with an AWS Managed Service Provider (MSP) Partner for help with an application migration initiative. A solutions architect needs ta share an Amazon Machine Image (AMI) from an existing AWS account with the MSP Partner's AWS account. The AMI is backed by Amazon Elastic Block Store (Amazon EBS) and uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt EBS volume snapshots.What is the MOST secure way for the solutions architect to share the AMI with the MSP Partner's AWS account?

    • A. Make the encrypted AMI and snapshots publicly available. Modify the key policy to allow the MSP Partner's AWS account to use the key.
    • B. Modify the launchPermission property of the AMI. Share the AMI with the MSP Partner's AWS account only. Modify the key policy to allow the MSP Partner's AWS account to use the key.
    • C. Modify the launchPermission property of the AMI. Share the AMI with the MSP Partner's AWS account only. Modify the key policy to trust a new KMS key that is owned by the MSP Partner for encryption.
    • D. Export the AMI from the source account to an Amazon S3 bucket in the MSP Partner's AWS account, Encrypt the S3 bucket with a new KMS key that is owned by the MSP Partner. Copy and launch the AMI in the MSP Partner's AWS account.

    View question →

48. Q48. Q413. A company hosts multiple production applications. One of the applications consists of resources from Amazon EC2, AWS Lambda, Amazon RDS, Amazon Simple Notification Service (Amazon SNS), and Amazon Simple Queue Service (Amazon SQS) across multiple AWS Regions. All company resources are tagged with a tag name of pplication?and a value that corresponds to each application. A solutions architect must provide the quickest solution for identifying all of the tagged components.Which solution meets these requirements?

    • A. Use AWS CloudTrail to generate a list of resources with the application tag.
    • B. Use the AWS CLI to query each service across all Regions to report the tagged components.
    • C. Run a query in Amazon CloudWatch Logs Insights to report on the components with the application tag.
    • D. Run a query with the AWS Resource Groups Tag Editor to report on the resources globally with the application tag.

    View question →

49. Q49. Q414. A company needs to export its database once a day to Amazon S3 for other teams to access. The exported object size varies between 2 GB and 5 GB. The S3 access pattern for the data is variable and changes rapidly. The data must be immediately available and must remain accessible for up to 3 months. The company needs the most cost-effective solution that will not increase retrieval time.Which S3 storage class should the company use to meet these requirements?

    • A. S3 Intelligent-Tiering
    • B. S3 Glacier Instant Retrieval
    • C. S3 Standard
    • D. S3 Standard-Infrequent Access (S3 Standard-IA)

    View question →

50. Q50. Q415. A company is developing a new mobile app. The company must implement proper traffic filtering to protect its Application Load Balancer (ALB) against common application-level attacks, such as cross-site scripting or SQL injection. The company has minimal infrastructure and operational staff. The company needs to reduce its share of the responsibility in managing, updating, and securing servers for its AWS environment.What should a solutions architect recommend to meet these requirements?

    • A. Configure AWS WAF rules and associate them with the ALB.
    • B. Deploy the application using Amazon S3 with public hosting enabled.
    • C. Deploy AWS Shield Advanced and add the ALB as a protected resource.
    • D. Create a new ALB that directs traffic to an Amazon EC2 instance running a third-party firewall, which then passes the traffic to the current ALB.

    View question →

51. Q51. Q416. A company reporting system delivers hundreds of .csv files to an Amazon S3 bucket each day. The company must convert these files to Apache Parquet format and must store the files in a transformed data bucket.Which solution will meet these requirements with the LEAST development effort?

    • A. Create an Amazon EMR cluster with Apache Spark installed. Write a Spark application to transform the data. Use EMR File System (EMRFS) to write files to the transformed data bucket.
    • B. Create an AWS Glue crawler to discover the data. Create an AWS Glue extract, transform, and load (ETL) job to transform the data. Specify the transformed data bucket in the output step.
    • C. Use AWS Batch to create a job definition with Bash syntax to transform the data and output the data to the transformed data bucket. Use the job definition to submit a job. Specify an array job as the job type.
    • D. Create an AWS Lambda function to transform the data and output the data to the transformed data bucket. Configure an event notification for the S3 bucket. Specify the Lambda function as the destination for the event notification.

    View question →

52. Q52. Q417. A company has 700 TB of backup data stored in network attached storage (NAS) in its data center. This backup data need to be accessible for infrequent regulatory requests and must be retained 7 years. The company has decided to migrate this backup data from its data center to AWS. The migration must be complete within 1 month. The company has 500 Mbps of dedicated bandwidth on its public internet connection available for data transfer.What should a solutions architect do to migrate and store the data at the LOWEST cost?

    • A. Order AWS Snowball devices to transfer the data. Use a lifecycle policy to transition the files to Amazon S3 Glacier Deep Archive.
    • B. Deploy a VPN connection between the data center and Amazon VPC. Use the AWS CLI to copy the data from on premises to Amazon S3 Glacier.
    • C. Provision a 500 Mbps AWS Direct Connect connection and transfer the data to Amazon S3. Use a lifecycle policy to transition the files to Amazon S3 Glacier Deep Archive.
    • D. Use AWS DataSync to transfer the data and deploy a DataSync agent on premises. Use the DataSync task to copy files from the on-premises NAS storage to Amazon S3 Glacier.

    View question →

53. Q53. Q418. A company has a serverless website with millions of objects in an Amazon S3 bucket. The company uses the S3 bucket as the origin for an Amazon CloudFront distribution. The company did not set encryption on the S3 bucket before the objects were loaded. A solutions architect needs to enable encryption for all existing objects and for all objects that are added to the S3 bucket in the future.Which solution will meet these requirements with the LEAST amount of effort?

    • A. Create a new S3 bucket. Turn on the default encryption settings for the new S3 bucket. Download all existing objects to temporary local storage. Upload the objects to the new S3 bucket.
    • B. Turn on the default encryption settings for the S3 bucket. Use the S3 Inventory feature to create a .csv file that lists the unencrypted objects. Run an S3 Batch Operations job that uses the copy command to encrypt those objects.
    • C. Create a new encryption key by using AWS Key Management Service (AWS KMS). Change the settings on the S3 bucket to use server-side encryption with AWS KMS managed encryption keys (SSE-KMS).Turn on versioning for the S3 bucket.
    • D. Navigate to Amazon S3 in the AWS Management Console. Browse the S3 bucket objects. Sort by the encryption field. Select each unencrypted object. Use the Modify button to apply default encryption settings to every unencrypted object in the S3 bucket.

    View question →

54. Q54. Q419. A company has a web server running on an Amazon EC2 instance in a public subnet with an Elastic IP address. The default security group is assigned to the EC2 instance. The default network ACL has been modified to block all traffic. A solutions architect needs to make the web server accessible from everywhere on port 443.Which combination of steps will accomplish this task? (Choose two.)

    • A. Create a security group with a rule to allow TCP port 443 from source 0.0.0.0/0.
    • B. Create a security group with a rule to allow TCP port 443 to destination 0.0.0.0/0.
    • C. Update the network ACL to allow TCP port 443 from source 0.0.0.0/0.
    • D. Update the network ACL to allow inbound/outbound TCP port 443 from source 0.0.0.0/0 and to destination 0.0.0.0/0.
    • E. Update the network ACL to allow inbound TCP port 443 from source 0.0.0.0/0 and outbound TCP port 32768-65535 to destination 0.0.0.0/0.

    View question →

55. Q55. Q420. A company application is having performance issues. The application is stateful and needs to complete in- memory tasks on Amazon EC2 instances. The company used AWS CloudFormation to deploy infrastructure and used the M5 EC2 instance family. As traffic increased, the application performance degraded. Users are reporting delays when the users attempt to access the application.Which solution will resolve these issues in the MOST operationally efficient way?

    • A. Replace the EC2 instances with T3 EC2 instances that run in an Auto Scaling group. Make the changes by using the AWS Management Console.
    • B. Modify the CloudFormation templates to run the EC2 instances in an Auto Scaling group. Increase the desired capacity and the maximum capacity of the Auto Scaling group manually when an increase is necessary.
    • C. Modify the CloudFormation templates. Replace the EC2 instances with R5 EC2 instances. Use Amazon CloudWatch built-in EC2 memory metrics to track the application performance for future capacity planning.
    • D. Modify the CloudFormation templates. Replace the EC2 instances with R5 EC2 instances. Deploy the Amazon CloudWatch agent on the EC2 instances to generate custom application latency metrics for future capacity planning.

    View question →

56. Q56. Q421. A solutions architect is designing a new API using Amazon API Gateway that will receive requests from users. The volume of requests is highly variable; several hours can pass without receiving a single request. The data processing will take place asynchronously, but should be completed within a few seconds after a request is made.Which compute service should the solutions architect have the API invoke to deliver the requirements at the lowest cost?

    • A. An AWS Glue job
    • B. An AWS Lambda function
    • C. A containerized service hosted in Amazon Elastic Kubernetes Service (Amazon EKS)
    • D. A containerized service hosted in Amazon ECS with Amazon EC2

    View question →

57. Q57. Q422. A company runs an application on a group of Amazon Linux EC2 instances. For compliance reasons, the company must retain all application log files for 7 years. The log files will be analyzed by a reporting tool that must be able to access all the files concurrently.Which storage solution meets these requirements MOST cost-effectively?

    • A. Amazon Elastic Block Store (Amazon EBS)
    • B. Amazon Elastic File System (Amazon EFS)
    • C. Amazon EC2 instance store
    • D. Amazon S3

    View question →

58. Q58. Q423. A company has hired an external vendor to perform work in the company AWS account. The vendor uses an automated tool that is hosted in an AWS account that the vendor owns. The vendor does not have IAM access to the company AWS account.How should a solutions architect grant this access to the vendor?

    • A. Create an IAM role in the company account to delegate access to the vendor IAM role. Attach the appropriate IAM policies to the role for the permissions that the vendor requires.
    • B. Create an IAM user in the company account with a password that meets the password complexity requirements. Attach the appropriate IAM policies to the user for the permissions that the vendor requires.
    • C. Create an IAM group in the company account. Add the tool IAM user from the vendor account to the group. Attach the appropriate IAM policies to the group for the permissions that the vendor requires.
    • D. Create a new identity provider by choosing WS account?as the provider type in the IAM console.Supply the vendor AWS account ID and user name. Attach the appropriate IAM policies to the new provider for the permissions that the vendor requires.

    View question →

59. Q59. Q424. A company has deployed a Java Spring Boot application as a pod that runs on Amazon Elastic Kubernetes Service (Amazon EKS) in private subnets. The application needs to write data to an Amazon DynamoDB table. A solutions architect must ensure that the application can interact with the DynamoDB table without exposing traffic to the internet.Which combination of steps should the solutions architect take to accomplish this goal? (Choose two.)

    • A. Attach an IAM role that has sufficient privileges to the EKS pod.
    • B. Attach an IAM user that has sufficient privileges to the EKS pod.
    • C. Allow outbound connectivity to the DynamoDB table through the private subnets?network ACLs.
    • D. Create a VPC endpoint for DynamoDB.
    • E. Embed the access keys in the Java Spring Boot code.

    View question →

60. Q60. Q425. A company recently migrated its web application to AWS by rehosting the application on Amazon EC2 instances in a single AWS Region. The company wants to redesign its application architecture to be highly available and fault tolerant. Traffic must reach all running EC2 instances randomly.Which combination of steps should the company take to meet these requirements? (Choose two.)

    • A. Create an Amazon Route 53 failover routing policy.
    • B. Create an Amazon Route 53 weighted routing policy.
    • C. Create an Amazon Route 53 multivalue answer routing policy.
    • D. Launch three EC2 instances: two instances in one Availability Zone and one instance in another Availability Zone.
    • E. Launch four EC2 instances: two instances in one Availability Zone and two instances in another Availability Zone.

    View question →

61. Q61. Q426. A media company collects and analyzes user activity data on premises. The company wants to migrate this capability to AWS. The user activity data store will continue to grow and will be petabytes in size. The company needs to build a highly available data ingestion solution that facilitates on-demand analytics of existing data and new data with SQL.Which solution will meet these requirements with the LEAST operational overhead?

    • A. Send activity data to an Amazon Kinesis data stream. Configure the stream to deliver the data to an Amazon S3 bucket.
    • B. Send activity data to an Amazon Kinesis Data Firehose delivery stream. Configure the stream to deliver the data to an Amazon Redshift cluster.
    • C. Place activity data in an Amazon S3 bucket. Configure Amazon S3 to run an AWS Lambda function on the data as the data arrives in the S3 bucket.
    • D. Create an ingestion service on Amazon EC2 instances that are spread across multiple Availability Zones. Configure the service to forward data to an Amazon RDS Multi-AZ database.

    View question →

62. Q62. Q427. A company collects data from thousands of remote devices by using a RESTful web services application that runs on an Amazon EC2 instance. The EC2 instance receives the raw data, transforms the raw data, and stores all the data in an Amazon S3 bucket. The number of remote devices will increase into the millions soon. The company needs a highly scalable solution that minimizes operational overhead.Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)

    • A. Use AWS Glue to process the raw data in Amazon S3.
    • B. Use Amazon Route 53 to route traffic to different EC2 instances.
    • C. Add more EC2 instances to accommodate the increasing amount of incoming data.
    • D. Send the raw data to Amazon Simple Queue Service (Amazon SQS). Use EC2 instances to process the data.
    • E. Use Amazon API Gateway to send the raw data to an Amazon Kinesis data stream. Configure Amazon Kinesis Data Firehose to use the data stream as a source to deliver the data to Amazon S3.

    View question →

63. Q63. Q428. A company needs to retain its AWS CloudTrail logs for 3 years. The company is enforcing CloudTrail across a set of AWS accounts by using AWS Organizations from the parent account. The CloudTrail target S3 bucket is configured with S3 Versioning enabled. An S3 Lifecycle policy is in place to delete current objects after 3 years.After the fourth year of use of the S3 bucket, the S3 bucket metrics show that the number of objects has continued to rise. However, the number of new CloudTrail logs that are delivered to the S3 bucket has remained consistent.Which solution will delete objects that are older than 3 years in the MOST cost-effective manner?

    • A. Configure the organization centralized CloudTrail trail to expire objects after 3 years.
    • B. Configure the S3 Lifecycle policy to delete previous versions as well as current versions.
    • C. Create an AWS Lambda function to enumerate and delete objects from Amazon S3 that are older than 3 years.
    • D. Configure the parent account as the owner of all objects that are delivered to the S3 bucket.

    View question →

64. Q64. Q429. A company has an API that receives real-time data from a fleet of monitoring devices. The API stores this data in an Amazon RDS DB instance for later analysis. The amount of data that the monitoring devices send to the API fluctuates. During periods of heavy traffic, the API often returns timeout errors.After an inspection of the logs, the company determines that the database is not capable of processing the volume of write traffic that comes from the API. A solutions architect must minimize the number of connections to the database and must ensure that data is not lost during periods of heavy traffic.Which solution will meet these requirements?

    • A. Increase the size of the DB instance to an instance type that has more available memory.
    • B. Modify the DB instance to be a Multi-AZ DB instance. Configure the application to write to all active RDS DB instances.
    • C. Modify the API to write incoming data to an Amazon Simple Queue Service (Amazon SQS) queue. Use an AWS Lambda function that Amazon SQS invokes to write data from the queue to the database.
    • D. Modify the API to write incoming data to an Amazon Simple Notification Service (Amazon SNS) topic.Use an AWS Lambda function that Amazon SNS invokes to write data from the topic to the database.

    View question →

65. Q65. Q430. A company manages its own Amazon EC2 instances that run MySQL databases. The company is manually managing replication and scaling as demand increases or decreases. The company needs a new solution that simplifies the process of adding or removing compute capacity to or from its database tier as needed. The solution also must offer improved performance, scaling, and durability with minimal effort from operations.Which solution meets these requirements?

    • A. Migrate the databases to Amazon Aurora Serverless for Aurora MySQL.
    • B. Migrate the databases to Amazon Aurora Serverless for Aurora PostgreSQL.
    • C. Combine the databases into one larger MySQL database. Run the larger database on larger EC2 instances.
    • D. Create an EC2 Auto Scaling group for the database tier. Migrate the existing databases to the new environment.

    View question →