Practice questions for the AWS SAP-C02 (Solutions Architect Professional) exam, Chapter 1.
-
Q1. Q76. A digital marketing company has multiple AWS accounts that
belong to various teams. The creative team uses an Amazon S3 bucket in
its AWS account to securely store images and media files that are used
as content for the company's marketing campaigns. The creative team
wants to share the S3 bucket with the strategy team so that the strategy
team can view the objects A solutions architect has created an IAM role
that is named strategy_reviewer in the Strategy account. The solutions
architect also has set up a custom AWS Key Management Service (AWS KMS)
key in the Creative account and has associated the key with the S3
bucket. However, when users from the Strategy account assume the IAM
role and try to access objects in the S3 bucket, they receive an Access
Denied error. The solutions architect must ensure that users in the
Strategy account can access the S3 bucket. The solution must provide
these users with only the minimum permissions that they need. Which
combination of steps should the solutions architect take to meet these
requirements? (Select THREE.)
- A. Create a bucket policy that includes read permissions for the S3
bucket. Set the principal of the bucket policy to the account ID of the
Strategy account.
- B. Update the strategy_reviewer IAM role to grant full permissions for
the S3 bucket and to grant decrypt permissions for the custom KMS key
- C. Update the custom KMS key policy in the Creative account to grant
decrypt permissions to the strategy_reviewer IAM role
- D. Create a bucket policy that includes read permissions for the S3
bucket. Set the principal of the bucket policy to an anonymous user.
- E. Update the custom KMS key policy in the Creative account to grant
encrypt permissions to the strategy_reviewer IAM role.
- F. Update the strategy_reviewer IAM role to grant read permissions for
the S3 bucket and to grant decrypt permissions for the custom KMS key.
View question →
-
Q2. Q77. A retail company is hosting an ecommerce website on AWS across
multiple AWS Regions. The company wants the website to be operational at
all times for online purchases The website stores data in an Amazon RDS
for MySQL DB instance.Which solution will provide the HIGHEST availability for the database?
- A. Configure automated backups on Amazon RDS. In the case of disruption,
promote an automated backup to be a standalone DB instance. Direct
database traffic to the promoted DB instance. Create a replacement read
replica that has the promoted DB instance as its source
- B. Configure global tables and read replicas on Amazon RDS. Activate the
cross-Region scope. In the case of disruption, use AWS Lambda to copy
the read replicas from one Region to another Region
- C. Configure global tables and automated backups on Amazon RDS. In the
case of disruption,use AWS Lambda to copy the read replicas from one
Region to another Region
- D. Configure read replicas on Amazon RDS In the case of disruption,
promote a cross-Region read replica to be a standalone DB instance
Direct database traffic to the promoted DB instance. Create a
replacement read replica that has the promoted DB instance as its source
View question →
-
Q3. Q78. An external audit of a company's serverless application reveals
IAM policies that grant too many permissions. These policies are
attached to the company's AWS Lambda execution roles Hundreds of the
company's Lambda functions have broad access permissions, such as full
access to Amazon S3 buckets and Amazon DynamoDB tables. The company wants
each function to have only the minimum permissions that the function
needs to complete its task.A solutions architect must determine which permissions each Lambda
function needs. What should the solutions architect do to meet this
requirement with the LEAST amount of effort?
- A. Set up Amazon CodeGuru to profile the Lambda functions and search for
AWS API calls Create an inventory of the required API calls and resources for each Lambda function Create new IAM
access policies for each Lambda function Review the new policies to ensure that they meet the company's business
requirements
- B. Turn on AWS CloudTrail logging for the AWS account. Use AWS identity
and Access Management Access Analyzer to generate IAM access policies based on the activity recorded in the
CloudTrail log Review the generated policies to ensure that they meet
the company's business requirements
- C. Turn on AWS Cloudrail logging for the AWS account. Create a script to
parse the CloudTrail log, search for AWS API calls by Lambda execution role,and create a summary report Review the
report Create IAM access polices that provide more restrictive permissions for each Lambda function
- D. Turn on AWS CloudTrail logging for the AWS account Export the
CloudTrail logs to Amazon S3 Use Amazon EMR to process the CloudTrail logs in Amazon S3 and produce a report of API
calls and resources used by each execution role,Create a new IAM access policy for each role Export the generated roles
to an S3 bucket Review the generated policies to ensure that they meet the company's business requirements
View question →
-
Q4. Q79. A company has introduced a new policy that allows employees to
work remotely from their homes if they connect by using a VPN. The
company is hosting internal applications with VPCS in multiple AWS
accounts Currently, the applications are accessible from the Company's
on-premises office network through an AWS Site-to-Site VPN connection
The VPC in the company's main AWS account has peering connections
established with VPCS in other AWS accounts.A solutions architect must design a scalable AWS Client VPN solution for
employees to use while they work from homeWhat is the MOST cost-effective solution that meets these requirements?
- A. Create a Client VPN endpoint in each AWS account. Configure required
routing that allows access to internal applications
- B. Create a client VPN endpoint in the main AWS account Configure
required routing that allows access to internalapplications
- C. Create a Client VPN endpoint in the main AWS account Provision a
transit gateway that is connected to each AWSaccount Configure required routing that allows access to internal
applications
- D. Create a Client VPN endpoint in the main AWS account. Establish
connectivity between the Client VPN endpoint and the AWS Site-to-Site
VPN
View question →
-
Q5. Q80. A company is refactoring its on-premises order-processing
platform in the AWS Cloud. The platform includes a web front end that is
hosted on a fleet of VMs, RabbitMQ to connect the front end to the
backend, and a Kubernetes cluster to run a containerized backend system
to process the orders. The company does not want to make any major
changes to the application. Which solution will meet these requirements
with the LEAST operational overhead? 2022032562
- A. Create an AMI of the web server VM. Create an Amazon EC2Auto Scaling
group that uses the AMI and an Application Load Balancer. Set up Amazon
MQ to replace the on-premises messaging queue.Configure Amazon Elastic Kubernetes Service (Amazon EKS) to host the
order-processing backend.
- B. Create a custom AWS Lambda runtime to mimic the web server
environment. Create an Amazon API Gateway API to replace the front-end
web servers, Set up Amazon MQ to replace the on-premises messaging
queue. Configure Amazon Elastic Kubernetes Service (Amazon EKS) to host
the order- processing backend
- C. Create an AMl of the web server VM. Create an Amazon EC2 Auto Scaling
group that uses the AMI and an Application Load Balancer. Set up Amazon
MQ to replace the on-premises messaging queue.Install Kubernetes on a
fleet of different EC2 instances to host the order-processing backend
- D. Create an AMI of the web server VM. Create an Amazon EC2 Auto Scaling
group that uses the AMI and an Application Load Balancer. Set up an
Amazon Simple Queue Service (Amazon SQS) queue to replace the
on-premises messaging queue. Configure Amazon Elastic Kubernetes Service
(Amazon EKS) to host the order-processing backend
View question →
-
Q6. Q81. A company has hundreds of AWS accounts. The company recently
implemented a centralized internal process for purchasing new Reserved
Instances and modifying existing Reserved Instances. This process
requires all business units that want to purchase or modify Reserved
Instances to submit requests to a dedicated team for procurement.
Previously, business units directly purchased or modified Reserved
Instances in their own respective AWS accounts autonomously. A solutions
architect needs to enforce the new process in the most secure way
possible. Which combination of steps should the solutions architect take
to meet these requirements? (Select TWO.)
- A. Ensure that all AWS accounts are part of an organization in AWS
Organizations with all features enabled.
- B. Use AWS Config to report on the attachment of an IAM policy that
denies access to the ec2:PurchaseReservedlnstancesOffering action and
the ec2:ModifyReservedlnstances action.
- C. In each AWS account, create an IAM policy that denies the
ec2:PurchaseReservedlnstancesOffering action and the
ec2:ModifyReservedlnstances action.
- D. Create an SCP that denies the ec2:PurchaseReservedinstancesOffering
action and the ec2:ModifyReservedlnstances action. Attach the SCP to
each OU of the organization.
- E. Ensure that all AWS accounts are part of an organization in AWS
Organizations that uses the consolidated billing feature.
View question →
-
Q7. Q82. A company wants to migrate to AWS. The company wants to use a
multi-account structure with centrally managed access to all accounts
and applications. The company also wants to keep the traffic on a
private network. Multi-factor authentication (MFA)is required at login,
and specific roles are assigned to user groups.The company must create separate accounts for development, staging,
production, and shared network. The production account and the shared
network account must have connectivity to all accounts The development
account and the staging account must have access only to each other.
Which combination of steps should a solutions architect take to meet
these requirements? (Select THREE)
- A. Deploy a landing zone environment by using AWS Control Tower. Enroll
accounts and invite existing accounts into the resulting organization in
AWS Organizations.
- B. Enable AWS Security Hub in all accounts to manage cross-account
access. Collect findings through AWS CloudTrail to force MFA login.
- C. Create transit gateways and transit gateway VPC attachments in each
account. Configure appropriate route tables.
- D. Set up and enable AWS Single Sign-On. Create appropriate permission
sets with required MFA for existing accounts.
- E. Enable AWS Control Tower in all accounts to manage routing between
accounts. Collect findings through AWS CloudTrail to force MFA login.
- F. Create IAM users and groups. Configure MFA for all users. Set up
Amazon Cognito user pools and identity pools to manage access to
accounts and between accounts
View question →
-
Q8. Q83. A solutions architect has developed a web application that uses
an Amazon API Gateway Regional endpoint and an AWS Lambda function. The
consumers of the web application are all close to the AWS Region where
the application will be deployed. The Lambda function only queries an
Amazon Aurora MySQL database. The solutions architect has configured the
database to have three read replicas. During testing, the application
does not meet performance requirements. Under high load, the application
opens a large number of database connections. The solutions architect
must improve the application's performance.Which actions should the solutions architect take to meet these
requirements? (Select TWO.)
- A. Use the cluster endpoint of the Aurora database.
- B. Use RDS Proxy to set up a connection pool to the reader endpoint of
the Aurora database.
- C. Use the Lambda Provisioned Concurrency feature.
- D. Move the code for opening the database connection in the Lambda
function outside of the event handler.
- E. Change the API Gateway endpoint to an edge-optimized endpoint.
View question →
-
Q9. Q84. A company recently deployed an application on AWS. The
application uses Amazon DynamoDB. The company measured the application
load and configured the RCUs and WCUs on the DynamoDB table to match the
expected peak load. The peak load occurs once a week fora 4-hour period
and is double the average load. The application load is close to the
average load for the rest of the week. The access pattern includes many
more writes to the table than reads of the table. A solutions architect
needs to implement a solution to minimize the cost of the table.Which solution will meet these requirements?
- A. Use AWS Application Auto Scaling to increase capacity during the peak
period. Purchase reserved RCUs and WCUs to match the average load.
- B. Configure on-demand capacity mode for the table.
- C. Configure DynamoDB Accelerator (DAX) in front of the table. Reduce
the provisioned read capacity to match the new peak load on the table.
- D. Configure DynamoDB Accelerator (DAX) in front of the table. Configure
on-demand capacity mode for the table.
View question →
-
Q10. Q85. A company wants to use a third-party software-as-a-service
(SaaS) application. The third-party SaaS application is consumed through
several API calls. The third-party SaaS application also runs on AWS
inside a VPC.The company will consume the third-party SaaS application from inside a
VPC. The company has internal security policies that mandate the use of
private connectivity that does not traverse the internet No resources
that run in the company VPC are allowed to be accessed from outside the
company's VPC. All permissions must conform to the principles of least
privilege.Which solution meets these requirements?
- A. Create an AWS PrivateLink interface VPC endpoint. Connect this
endpoint to the endpoint service that the third-party SaaS application
provides. Create a security group to limit the access to the endpoint.Associate the security group with the endpoint.
- B. Create an AWS Site-to-Site VPN connection between the third-party
SaaS application and the company VPC. Configure network ACLs to limit
access across the VPN tunnels.
- C. Create a VPC peering connection between the third-party SaaS
application and the company VPC.Update route tables by adding the needed routes for the peering
connection.
- D. Create an AWS PrivateLink endpoint service. Ask the third-party SaaS
provider to create an interface VPC endpoint for this endpoint service.
Grant permissions for the endpoint service to the specific account of
the third-party SaaS provider.
View question →
-
Q11. Q86. A company is running a web application in the AWS Cloud. The
application consists of dynamic content that is created on a set of
Amazon EC2 instances. The EC2 instances run in an Auto Scaling group
that is configured as a target group for an Application Load Balancer
(ALB). The company is using an Amazon CloudFront distribution to
distribute the application globally. The CloudFront distribution uses
the ALB as an origin. The company uses Amazon Route 53 for DNS and has
created an A record of www.example.com for the CloudFront distribution.
A solutions architect must configure the application so that it is
highly available and fault tolerant.Which solution meets these requirements?
- A. Provision a full, secondary application deployment in a different AWS
Region. Update the Route 53Arecord to be a failover record. Add both of
the CloudFront distributions as values. Create Route 53 health checks
- B. Provision an ALB, an Auto Scaling group, and EC2instances in a
different AWS Region. Update the CloudFront distribution, and create a
second origin for the new ALB. Create an origin group for the two
origins. Configure one origin as primary and one origin as secondary.
- C. Provision an Auto Scaling group and EC2 instances in a different AWS
Region. Create a second target for the new Auto Scaling group in the
ALB. Set up the failover routing algorithm on the ALB
- D. Provision a full, secondary application deployment in a different AWS
Region. Create a second CloudFront distribution, and add the new
application setup as an origin. Create an AWS Global Accelerator
accelerator.Add both of the CloudFront distributions as endpoints
View question →
-
Q12. Q87. A company is migrating some of its applications to AWS. The
company wants to migrate and modernize the applications quickly after it
finalizes networking and security strategies. The company has set up an
AWS Direct Connect connection in a central network account. The company
expects to have hundreds of AWS accounts and VPCs in the near future.
The corporate network must be able to access the resources on AWS
seamlessly and also must be able to communicate with all the VPCs The
company also wants to route its cloud resources to the internet through
its on- premises data center.
Which combination of steps will meet these requirements? (Select THREE.)
- A. Create a Direct Connect gateway in the central account. In each of
the accounts, create an association proposal by using the Direct Connect
gateway and the account ID for every virtual private gateway
- B. Create a Direct Connect gateway and a transit gateway in the central
network account Attach the transit gateway to the Direct Connect gateway
by using a transit VIF
- C. Provision an internet gateway Attach the internet gateway to subnets.
Allow internet traffic through the gateway
- D. Share the transit gateway with other accounts. Attach VPCs to the
transit gateway
- E. Provision VPC peering as necessary
- F. Provision only private subnets. Open the necessary route on the
transit gateway and customer gateway to allow outbound internet traffic
from AWS to flow through NAT services that run in the data center
View question →
-
Q13. Q88. An application is using an Amazon RDS for MySQL Multi-AZ DB
instance in the us-east-1 Region After a failover test, the application
lost the connections to the database and could not re-establish the
connections. After a restart of the application, the application
re-established the connections. A solutions architect must implement a
solution so that the application can re-establish connections to the
database without requiring a restart.Which solution will meet these requirements?
- A. Create an Amazon Aurora MySQL Serverless v1 DB instance Migrate the
RDS DB instance to the Aurora Serverless v1 DB instance Update the
connection settings in the application to point to the Aurora reader
endpoint
- B. Create an RDS proxy. Configure the existing RDS endpoint as a target
Update the connection settings in the application to point to the RDS
proxy endpoint
- C. Create a two-node Amazon Aurora MySQL DB cluster. Migrate the RDS DB
instance to the Aurora DB cluster. Create an RDS proxy. Configure the
existing RDS endpoint as a target. Update the connection settings in the
application to point to the RDS proxy endpoint
- D. Create an Amazon S3 bucket. Export the database to Amazon S3 by using
AWS Database Migration Service (AWS DMS). Configure Amazon Athena to use
the S3 bucket as a data store. Install the latest Open Database
Connectivity (ODBC) driver for the application Update the connection
settings in the application to point to the Athena endpoint
View question →
-
Q14. Q89. A company has several AWS accounts A development team is
building an automation framework for cloud govemance and remediation
processes. The automation framework uses AWS Lambda functions in a
centralized account. A solutions architect must implement a least
privilege permissions policy that allows the Lambda functions to nun in
each of the company's AWS accounts. Which combination of steps will
meet these requirements? (Select TWO)
- A. In the centralized account, create an IAM role that has the Lambda
service as a trusted entity. Add an inline policy to assume the roles of
the other AWS accounts
- B. In the other AWS accounts, create an IAM role that has minimal
permissions. Add the centralized account's Lambda IAM role as a trusted
entity.
- C. In the centralized account, create an IAM role that has roles of the
other accounts as trusted entities.Provide minimal permissions
- D. In the other AWS accounts, create an IAM role that has permissions to
assume the role of the centralized account Add the Lambda service as a
trusted entity
- E. In the other AWS accounts, create an IAM role that has minimal
permissions Add the Lambda service as a trusted entity
View question →
-
Q15. Q90. A company is planning to store a large number of archived
documents and make the documents available to employees through the
corporate intranet Employees will access the system by connecting
through a client VPN service that is attached to a VPC. The data must
not be accessible to the public. The documents that the company is
storing are copies of data that is held on physical media elsewhere. The
number of requests will be low Availability and speed of retrieval are
not concerns of the company. Which solution will meet these requirements
at the LOWEST cost?
- A. Create an Amazon S3 bucket Configure the S3 bucket to use the S3 One
Zone-Infrequent Access (S3 One Zone-IA) storage class as default.
Configure the S3 bucket for website hosting. Create an S3 interface
endpoint. Configure the S3 bucket to allow access only through that
endpoint
- B. Launch an Amazon EC2 instance that runs a web server. Attach an
Amazon Elastic File System (Amazon EFS) file system to store the
archived data in the EFS One Zone-Infrequent Access (EFS One Zone-IA)
storage class. Configure the instance security groups to allow access
only from private networks
- C. Launch an Amazon EC2 instance that runs a web server. Attach an
Amazon Elastic Block Store (Amazon EBS) volume to store the archived
data Use the Cold HDD (sc1) volume type. Configure the instance security
groups to allow access only from private networks
- D. Create an Amazon S3 bucket. Configure the S3 bucket to use the S3
Glacier Deep Archive storage class as default Configure the S3 bucket
for website hosting. Create an S3interface endpoint. Configure the S3
bucket to allow access only through that endpoint
View question →
-
Q16. Q91. A company has migrated its forms-processing application to AWS.
When users interact with the application, they upload scanned forms as
files through a web application. A database stores user metadata and
references to files that are stored in Amazon S3. The web application
runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.When forms are uploaded, the application sends notifications to a team
through Amazon Simple Notification Service (Amazon SNS).A team member
then logs in and processes each form. The team member performs data
validation on the form and extracts relevant data before entering the
information into another system that uses an API.A solutions architect needs to automate the manual processing of the
forms. The solution must provide accurate form extraction, minimize time
to market, and minimize long-term operational overhead.Which solution will meet these requirements?
- A. Develop custom libraries to perform optical character recognition
(OCR) on the forms. Deploy the libraries to an Amazon Elastic Kubemetes
Service (Amazon EKS) cluster as an application tier. Use this tier to
process the forms when forms are uploaded. Store the output in Amazon
S3. Parse this output by extracting the data into an Amazon DynamoDB
table. Submit the data to the target system's API. Host the new
application tier on EC2 instances.
- B. Extend the system with an application tier that uses AWS Step
Functions and AWS Lambda. Configure this tier to use artificial
intelligence and machine learning (Al/ML) models that are trained and
hosted on an EC2 instance to perform optical character recognition (OCR)
on the forms when forms are uploaded.Store the output in Amazon S3. Parse this output by extracting the data
that is required within the application tier. Submit the data to the
target system's API.
- C. Host a new application tier on EC2 instances. Use this tier to call
endpoints that host artificial intelligence and machine learning (Al/ML)
models that are trained and hosted in Amazon SageMaker to perform
optical character recognition (OCR) on the forms. Store the output in
Amazon ElastiCache.Parse this output by extracting the data that is required within the
application tier. Submit the data to the target system's API.
- D. Extend the system with an application tier that uses AWS Step
Functions and AWS Lambda. Configure this tier to use Amazon Textract and
Amazon Comprehend to perform optical character recognition (OCR) on the
forms when forms are uploaded. Store the output in Amazon S3. Parse this
output by extracting the data that is required within the application
tier. Submit the data to the target system's API
View question →
-
Q17. Q92. An adventure company has launched a new feature on its mobile
app. Users can use the feature to upload their hiking and rafting photos
and videos anytime. The photos and videos are stored in Amazon S3
Standard storage in an S3 bucket and are served through Amazon
CloudFront. The company needs to optimize the cost of the storage.A
solutions architect discovers that most of the uploaded photos and
videos are accessed infrequently after 30 days. However, some of the
uploaded photos and videos are accessed frequently after 30 days. The
solutions architect needs to implement a solution that maintains
millisecond retrieval availability of the photos and videos at the
lowest possible cost.Which solution will meet these requirements?
- A. Configure S3 Intelligent-Tiering on the S3 bucket.
- B. Configure an S3 Lifecycle policy to transition image objects and
video objects from S3 Standard to S3 Glacier Deep Archive after 30 days.
- C. Replace Amazon S3 with an Amazon Elastic File System (Amazon EFS)
file system that is mounted on Amazon EC2 instances.
- D. Add a Cache-Control: max-age header to the S3image objects and
S3video objects. Set the header to 30 days.
View question →
-
Q18. Q93. A company has an asynchronous HTTP application that is hosted as
an AWS Lambda function.A public Amazon API Gateway endpoint invokes the
Lambda function. The Lambda function and the API Gateway endpoint reside
in the us-east-1 Region.A solutions architect needs to redesign the
application to support failover to another AWS Region.Which solution will meet these requirements?
- A. Create an API Gateway endpoint in the us-west-2 Region to direct
traffic to the Lambda function in us- east-1.Configure Amazon Route 53to
use a failover routing policy to route traffic for the two API Gateway
endpoints.
- B. Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure
API Gateway to direct traffic to the SQS queue instead of to the Lambda
function. Configure the Lambda function to pull messages from the queue
for processing.
- C. Deploy the Lambda function to the us-west-2 Region. Create an API
Gateway endpoint in us-west-2 to direct traffic to the Lambda function
in us-west-2. Configure AWS Global Accelerator and an Application Load
Balancer to manage traffic across the two API Gateway endpoints.
- D. Deploy the Lambda function and an API Gateway endpoint to the
us-west-2 Region. Configure Amazon Route 53to use a failover routing
policy to route traffic for the two API Gateway endpoints.
View question →
-
Q19. Q94. A company is hosting a critical application on a single Amazon
EC2 instance. The application uses an Amazon ElastiCache for Redis
single-node cluster for an in-memory data store. The application uses an
Amazon RDS for MariaDB DB instance for a relational database. For the
application to function, each piece of the infrastructure must be
healthy and must be in an active state. A solutions architect needs to
improve the application's architecture so that the infrastructure can
automatically recover from failure with the least possible downtime.
Which combination of steps will meet these requirements? (Select THREE.)
- A. Use an Elastic Load Balancer to distribute traffic across multiple
EC2 instances. Ensure that the EC2 instances are part of an Auto Scaling
group that has a minimum capacity of two instances.
- B. Use an Elastic Load Balancer to distribute traffic across multiple
EC2 instances. Ensure that the EC2 instances are configured in unlimited
mode.
- C. Modify the DB instance to create a read replica in the same
Availability Zone. Promote the read replicato be the primary DB instance
in failure scenarios.
- D. Modify the DB instance to create a Multi-AZ deployment that extends
across two Availability Zones.
- E. Create a replication group for the ElastiCache for Redis cluster.
Configure the cluster to use an Auto Scaling group that has a minimum
capacity of two instances.
- F. Create a replication group for the ElastiCache for Redis cluster.
Enable Multi-AZ on the cluster.
View question →
-
Q20. Q95. A company is hosting a monolithic REST-based API for a mobile
app on five Amazon EC2 instances in public subnets of a VPC. Mobile
clients connect to the API by using a domain name that is hosted on
Amazon Route 53. The company has created a Route 53 multivalue answer
routing policy with the IP addresses of all the EC2 instances. Recently,
the app has been overwhelmed by large and sudden increases to traffic.
The app has not been able to keep up with the traffic. A solutions
architect needs to implement a solution so that the app can handle the
new and varying load. Which solution will meet these requirements with
the LEAST operational overhead?
- A. Separate the API into individual AWS Lambda functions. Configure an
Amazon API Gateway RESTAPI with Lambda integration for the backend.
Update the Route 53 record to point to the API Gateway API.
- B. Containerize the API logic. Create an Amazon Elastic Kubernetes
Service (Amazon EKS) cluster. Run the containers in the cluster by using
Amazon EC2. Create a Kubernetes ingress. Update the Route 53 record to
point to the Kubernetes ingress.
- C. Create an Auto Scaling group. Place all the EC2 instances in the Auto
Scaling group. Configure the Auto Scaling group to perform scaling
actions that are based on CPU utilization. Create an AWS Lambda function
that reacts to Auto Scaling group changes and updates the Route 53
record.
- D. Create an Application Load Balancer (ALB) in front of the API. Move
the EC2instances to private subnets in the VPC.Add the EC2 instances as
targets for the ALB. Update the Route 53 record to point to the ALB.
View question →
-
Q21. Q96. A company is running an application in the AWS Cloud. The
application collects and stores alarge amount of unstructured data in an
Amazon S3 bucket. The S3 bucket contains several terabytes of data and
uses the S3 Standard storage class. The data increases in size by
several gigabytes every day. The company needs to query and analyze the
data. The company does not access data that is more than 1 year old.
However, the company must retain all the data indefinitely for
compliance reasons. Which solution will meet these requirements MOST
cost-effectively?
- A. Use S3 Select to query the data. Create an S3Lifecycle policy to
transition data that is more than 1 year old to S3 Glacier Deep Archive.
- B. Use Amazon Redshift Spectrum to query the data. Create an S3
Lifecycle policy to transition data that is more than 1 year old to S3
Glacier Deep Archive.
- C. Use an AWS Glue Data Catalog and Amazon Athena to query the data.
Create an S3 Lifecycle policy to transition data that is more than 1
year old to S3 Glacier Deep Archive.
- D. Use Amazon Redshift Spectrum to query the data. Create an S3
Lifecycle policy to transition data that is more than 1 year old to S3
Intelligent-Tiering
View question →
-
Q22. Q97. A video processing company has an application that downloads
images from an Amazon S3 bucket, processes the images, stores a
transformed image in a second S3 bucket, and updates metadata about the
image in an Amazon DynamoDB table. The application is written in Nodejs
and runs by using an AWS Lambda function. The Lambda function is invoked
when a new image is uploaded to Amazon S3. The application ran without
incident for a while. However, the size of the images has grown
significantly. The Lambda function is now failing frequently with
timeout errors. The function timeout is set to its maximum value.A
solutions architect needs to refactor the application's architecture to
prevent invocation failures. The company does not want to manage the
underlying infrastructure. Which combination of steps should the
solutions architect take to meet these requirements? (Select TWO.)
- A. Modify the application deployment by building a Docker image that
contains the application code.Publish the image to Amazon Elastic Container Registry (Amazon ECR)
- B. Create a new Amazon Elastic Container Service (Amazon ECS) task
definition with a compatibility type of AWS Fargate. Configure the task
definition to use the new image in Amazon Elastic Container Registry
(Amazon ECR).Adjust the Lambda function to invoke an ECS task by using
the ECS task definition when a new file arrives in Amazon S3
- C. Create an AWS Step Functions state machine with a Parallel state to
invoke the Lambda function.Increase the provisioned concurrency of the Lambda function
- D. Create anew Amazon Elastic Container Service (Amazon ECS) task
definition with a compatibility type of Amazon EC2. Configure the task
definition to use the new image in Amazon Elastic Container Registry
(Amazon ECR).Adjust the Lambda function to invoke an ECS task by using
the ECS task definition when a new file arrives in Amazon S3
- E. Modify the application to store images on Amazon Elastic File System
(Amazon EFS) and to store metadata on an Amazon RDS DB instance. Adjust
the Lambda function to mount the EFS file share.
View question →
-
Q23. Q98. A solutions architect is auditing the security setup of an AWS
Lambda function for a company. The Lambda function retrieves the latest
changes from an Amazon Aurora database. The Lambda function and the
database run in the same VPC. Lambda environment variables are providing
the database credentials to the Lambda function.The Lambda function aggregates data and makes the data available in an
Amazon S3 bucket that is configured for server-side encryption with AWS
KMS managed encryption keys (SSE-KMS). The data must not travel across
the internet. If any database credentials become compromised, the
company needs a solution that minimizes the impact of the compromise.What should the solutions architect recommend to meet these
requirements?
- A. Enable IAM database authentication on the Aurora DB cluster. Change the IAM role for the Lambda function to allow the function to access the database by using IAM database authentication. Deploy a gateway VPC endpoint for Amazon S3 in the VPC.
- B. Enable IAM database authentication on the Aurora DB cluster. Change the IAM role for the Lambda function to allow the function to access the database by using IAM database authentication.Enforce HTTPS on the connection to Amazon S3 during data transfers.
- C. Save the database credentials in AWS Systems Manager Parameter Store.
Set up password rotation on the credentials in Parameter Store. Change
the IAM role for the Lambda function to allow the function to access
Parameter Store. Modify the Lambda function to retrieve the credentials
from Parameter Store.Deploy a gateway VPC endpoint for Amazon S3 in the VPC.
- D. Save the database credentials in AWS Secrets Manager. Set up password
rotation on the credentials in Secrets Manager. Change the IAM role for
the Lambda function to allow the function to access Secrets Manager.
Modify the Lambda function to retrieve the credentials from Secrets
Manager. Enforce HTTPS on the connection to Amazon S3 during data
transfers.
View question →
-
Q24. Q99. A company is running a traditional web application on Amazon EC2
instances. The company needs to refactor the application as
microservices that run on containers. Separate versions of the
application exist in two distinct environments: production and testing.
Load for the application is variable, but the minimum load and the
maximum load are known.A solutions architect needs to design the updated
application with a serverless architecture that minimizes operational
complexity. Which solution will meet these requirements MOST
cost-effectively?
- A. Upload the container images to AWS Lambda as functions. Configure a
concurrency limit for the associated Lambda functions to handle the
expected peak load. Configure two separate Lambda integrations within
Amazon API Gateway: one for production and one for testing.
- B. Upload the container images to Amazon Elastic Container Registry
(Amazon ECR). Configure two auto scaled Amazon Elastic Container Service
(Amazon ECS) clusters with the Fargate launch type to handle the
expected load. Deploy tasks from the ECR images. Configure two separate
Application Load Balancers to direct traffic to the ECS clusters.
- C. Upload the container images to Amazon Elastic Container Registry
(Amazon ECR). Configure two auto scaled Amazon Elastic Kubernetes
Service (Amazon EKS) clusters with the Fargate launch type to handle the
expected load. Deploy tasks from the ECR images. Configure two separate
Application Load Balancers to direct traic to the EKS clusters.
- D. Upload the container images to AWS Elastic Beanstalk. In Elastic
Beanstalk, create separate environments and deployments for production
and testing. Configure two separate Application Load Balancers to direct
traffic to the Elastic Beanstalk deployments
View question →
-
Q25. Q100. A company that uses AWS Organizations allows developers to
experiment on AWS. As part of the landing zone that the company has
deployed, developers use their company email address to request an
account. The company wants to ensure that developers are not launching
costly services or running services unnecessarily. The company must give
developers a fixed monthly budget to limit their AWS costs. Which
combination of steps will meet these requirements? (Select THREE.)AWS的考试报名【中文】还是【英文】？回答：预约考试的时候报名【中文】，在真正考试的过程中可以看英文原题，如果是报名的时候选择【英文】考试，那么在考试过程中只有【英文】题，不能看【中文】题目！所以母语是中文的考生，强烈建议报名【中文】的考试，考试时可以【中英文】对照。
问：考试的时候ABCD顺序变吗？答：AWS考试的时候选项顺序与题库完全一致，不会乱序，所以说能背好答案的ABCD也一样可以通过。
注意：英文题库是考试原题，一字不差，中文题库是英文翻译过来的，用谷歌翻译工具翻译，只能说与真正考试中的中文意思差不多，但不保证一字不差，中文翻译仅供给考生辅助理解，以英文原题库为准。
不管报名中文还是英文的考试，最后出来的证书都是一样的。
AWS报名预约中文考试，考试的时候可以看英文，也就是中英文对照（进入考试后，随时可以启用中英文对照），每一题的ABCD选项中文与英文是一致的，顺序不变！！！
所以请预约简体中文的考试（考试时是中英对照）！（务必注意，凡使用本小程序备考的考生请预约中英文对照的考试，背题就背好英文题目，题库上面的中文翻译是提供给考生理解参考使用，谢谢）请预约简体中文的考试（考试时是可以看中文也可以看英文）！可以用英文题目盖住中文题，（务必注意，凡使用本小程序备考的考生请预约中英文对照的考试，背题就背好英文题目，题库上面的中文翻译是提供给考生理解参考使用，谢谢）
重要事情说三遍：请预约中英文对照的考试！请预约中英文对照的考试！请预约中英文对照的考试！
不管你是在美国、日本、澳洲还是加拿大.....都预约简体中文就正确.考出来的证书都一样在AWS英文官网可查。
- A. Create an SCP to set a fixed monthly account usage limit. Apply the
SCP to the developer accounts.
- B. Use AWS Budgets to create a fixed monthly budget for each
developer's account as part of the account creation process.
- C. Create an SCP to deny access to costly services and components. Apply
the SCP to the developer accounts.
- D. Create an IAM policy to deny access to costly services and
components. Apply the IAM policy to the developer accounts.
- E. Create an AWS Budgets alert action to terminate services when the
budgeted amount is reached.
Configure the action to terminate all services.
- F. Create an AWS Budgets alert action to send an Amazon Simple
Notification Service (Amazon SNS) notification when the budgeted amount
is reached. Invoke an AWS Lambda function to terminate all services.
View question →
-
Q26. Q101. A company wants to migrate its workloads from on premises to
AWS. The workloads run on Linux and Windows. The company has a large
on-premises infrastructure that consists of physical machines and VMs
that host numerous applications.The company must capture details about the system configuration, system
performance, running processes, and network connections of its
on-premises workloads. The company also must divide the on- premises
applications into groups for AWS migrations. The company needs
recommendations for Amazon EC2 instance types so that the company can
run its workloads on AWS in the most cost-effective manner. Which
combination of steps should a solutions architect take to meet these
requirements? (Select THREE.)题外话：AWS认证，对于非技术人员来说难度比较大，每一题都需要花好几分钟阅读，阅读耗费大量的时间和精力，从而对本职工作造成影响，若非技术人员对考试捷径有需求的联系微信：ANYPASS ，我们会协助你不费吹灰之力轻松通过(，当然了若是技术人员有需求的话也可以联系！！！
- A. Assess the existing applications by installing AWS Application
Discovery Agent on the physical machines and VMs.
- B. Assess the existing applications by installing AWS Systems Manager
Agent on the physical machines and VMs
- C. Group servers into applications for migration by using AWS Systems
Manager Application Manager.
- D. Group servers into applications for migration by using AWS Migration
Hub
- E. Generate recommended instance types and associated costs by using AWS
Migration Hub.
- F. Import data about server sizes into AWS Trusted Advisor. Follow the
recommendations for cost optimization.
View question →
-
Q27. Q102. A publishing company's design team updates the icons and other
static assets that an ecommerce web application uses. The company serves
the icons and assets from an Amazon S3 bucket that is hosted in the
company's production account. The company also uses a development
account that members of the design team can accessAfter the design team tests the static assets in the development
account, the design team needs to load the assets into the S3 bucket in
the production account. A solutions architect must provide the design
team with access to the production account without exposing other parts
of the web application to the risk of unwanted changesWhich combination of steps will meet these requirements? (Select THREE.)
- A. In the production account, create a new IAM policy that allows read
and write access to the S3 bucket
- B. In the development account, create a new IAM policy that allows read
and write access to the S3 bucket.
- C. In the production account, create a role. Attach the new policy to
the role. Define the development account as a trusted entity
- D. In the development account, create a role. Attach the new policy to
the role. Define the production account as a trusted entity.
- E. In the development account, create a group that contains all the IAM
users of the design team. Attach a different IAM policy to the group to
allow the sts:AssumeRole action on the role in the production account
- F. In the development account, create a group that contains all the IAM
users of the design team.Attach a different IAM policy to the group to
allow the sts:AssumeRole action on the role in the development account
View question →
-
Q28. Q103. A company has a multi-tier web application that runs on a fleet
of Amazon EC2 instances behind an Application Load Balancer (ALB). The
instances are in an Auto Scaling group. The ALB and the Auto Scaling
group are replicated in a backup AWS Region. The minimum value and the
maximum value for the Auto Scaling group are set to zero.An Amazon RDS
Multi-AZ DB instance stores the application's data. The DB instance has
a read replica in the backup Region The application presents an endpoint
to end users by using an Amazon Route 53 record.The company needs to reduce its RTO to less than 15 minutes by giving
the application the ability to automatically fail over to the backup
Region. The company does not have a large enough budget for an
active-active strategyWhat should a solutions architect recommend to meet these requirements?
- A. Reconfigure the application's Route 53 record with a latency-based
routing policy that load balances traffic between the two ALBS. Create
an AWS Lambda function in the backup Region to promote the read replica
and modify the Auto Scaling group values. Create an Amazon CloudWatch
alarm that is based on the HTTPCode_Target_5XX Count metric for the
ALB in the primary Region. Configure the CloudWatch alarm to invoke the
Lambda function
- B. Create an AWS Lambda function in the backup Region to promote the
read replica and modify the Auto Scaling group values. Configure Route
53 with a health check that monitors the web application and sends an
Amazon Simple Notification Service (Amazon SNS) notification to the
Lambda function when the health check status is unhealthy. Update the
application's Route 53 record with a failover policy that routes
traffic to the ALB in the backup Region when a health check failure
occurs
- C. Configure the Auto Scaling group in the backup Region to have the
same values as the Auto Scaling group in the primary Region. Reconfigure
the application's Route 53 record with a latency-based routing policy
that load balances traffic between the two ALBS. Remove the read
replica. Replace the read replica with a standalone RDS DB instance.
Confiaure Cross-Reaion Replication between the RDS DB instances by using
snapshots and Amazon S3
- D. Configure an endpoint in AWS Global Accelerator with the two ALBS as
equal weighted targets. Create an AWS Lambda function in the backup
Region to promote the read replica and modify the Auto Scaling group
values. Create an Amazon CloudWatch alarm that is based on the
HTTPCode_Target_5XX_Count metric for the ALB in the primary Region.
Configure the CloudWatch alarm to invoke the Lambda function.
View question →
-
Q29. Q104. A company uses an on-premises data analytics platform. The
system is highly available in a fully redundant configuration across 12
servers in the company's data center. The system runs scheduled jobs,
both hourly and daily, in addition to one-time requests from users.
Scheduled jobs can take between 20 minutes and 2 hours to finish running
and have tight SLAs. The scheduled jobs account for 65% of the system
usage. User jobs typically finish running in less than 5 minutes and
have no SLA. The user jobs account for 35% of system usage. During
system failures, scheduled jobs must continue to meet SLAs. However,
user jobs can be delayed. A solutions architect needs to move the system
to Amazon EC2instances and adopt a consumption-based model to reduce
costs with no long-term commitments. The solution must maintain high
availability and must not affect the SLAs.Which solution will meet these requirements MOST cost-effectively?
- A. Split the 12 instances across two Availability Zones in the chosen
AWS Region. Run two instances in each Availability Zone as On-Demand
Instances with Capacity Reservations. Run four instances in each
Availability Zone as Spot Instances.
- B. Split the 12 instances across three Availability Zones in the chosen
AWS Region. In one of the Availability Zones, runall four instances as On-Demand Instances with Capacity Reservations.
Run the remaining instances as Spot Instances.
- C. Split the 12 instances across three Availability Zones in the chosen
AWS Region. Run two instances in each Availability Zone as On-Demand
Instances with a Savings Plan. Run two instances in each Availability
Zone as Spot Instances.
- D. Split the 12 instances across three Availability Zones in the chosen
AWS Region. Run three instances in each Availability Zone as On-Demand
Instances with Capacity Reservations. Run one instance in each
Availability Zone as a Spot Instance.
View question →
-
Q30. Q105. A company that has multiple AWS accounts is using AWS
Organizations. The company's AWS accounts host VPCs,Amazon
EC2instances, and containers.The company's compliance team has deployed a security tool in each VPC
where the company has deployments. The security tools run on
EC2instances and send information to the AWS account that is dedicated
for the compliance team. The company has tagged all the
compliance-related resources with a key of "costCenter" and a value of
"compliance.",The company wants to identify the cost of the security tools that are
running on the EC2 instances so that the company can charge the
compliance team's AWS account. The costcalculation must be as accurate
as possible.What should a solutions architect do to meet these requirements?
- A. In the management account of the organization, activate the
costCenter user-defined tag. Configure monthly AWS Cost and Usage
Reports to save to an Amazon S3 bucket in the management account.Use the tag breakdown in the report to obtain the total cost for the
costCenter tagged resources.
- B. In the member accounts of the organization, activate the costCenter
user-defined tag. Configure monthly AWS Costand Usage Reports to save to
an Amazon S3 bucket in the management account.Schedule a monthly AWS Lambda function to retrieve the reports and
calculate the total costfor the costCenter tagged resources.
- C. In the member accounts of the organization, activate the costCenter
user-defined tag. From the management account, schedule a monthly AWS
Cost and Usage Report. Use the tag breakdown in the report to calculate
the total cost for the costCenter tagged resources.
- D. Create a custom report in the organization view in AWS Trusted
Advisor. Configure the report to generate a monthly billing summary for
the costCenter tagged resources in the compliance team's AWS account.
View question →
-
Q31. Q106. A company's solutions architect is reviewing a web application
that runs on AWS. The application references static assets in an Amazon
S3 bucket in the us-east-1 Region. The company needs resiliency across
multiple AWS Regions. The company already has created an S3 bucket in a
second Region. Which solution will meet these requirements with the
LEAST operational overhead?
- A. Configure the application to write each object to both S3 buckets.
Set up an Amazon Route 53public hosted zone with a record set by using a
weighted routing policy for each S3bucket. Configure the application to
reference the objects by using the Route 53 DNS name.
- B. Create an AWS Lambda function to copy objects from the S3 bucket in
us-east-1to the S3 bucket in the second Region. Invoke the Lambda
function each time an object is written to the S3 bucket in us-east- 1.Set up an Amazon CloudFront distribution with an origin group that
contains the two S3 buckets as origins.
- C. Configure replication on the S3 bucket in us-east-1to replicate
objects to the S3 bucket in the second Region. Set up an Amazon
CloudFront distribution with an origin group that contains the two S3
buckets as origins.
- D. Configure replication on the S3 bucket in us-east-1to replicate
objects to the S3 bucket in the second Region. If failover is required,
update the application code to load S3 objects from the S3 bucket in the
second Region.
View question →
-
Q32. Q107. A government solution runs on a fleet of more than 2,000 Amazon
EC2 instances. Each EC2 instance runs highly secure software on Windows
Server OS with an AWS Systems Manager Agent(SSM Agent) installed. The
TCP/443 inbound port is open to the fleet of instances. All the other
inbound ports are closed.Currently, any changes to the port
configuration requires a lengthy multi-level review process. Which
solution will provide secure access to run scripts on the fleet of
instances with the LEAST amount of administrative overhead?
- A. Configure AWS OpsWorks for Puppet Enterprise with a connection to the
SSM Agent on the instances Manage the scripts by using Puppet stacks
- B. Open the required ports. Manage the fleet of instances by using
Session Manager, a capability of AWS Systems Manager
- C. Add interface endpoints and an IAM role. Manage the fleet of
instances by using Run Command, a capability of AWS Systems Manager.
- D. Open Port TCP/22 and copy scripts onto each instance. Manage
instances at scale by using scripts
View question →
-
Q33. Q108. A company recently migrated a web application from an
on-premises data center to the AwS Cloud. The web application
infrastructure consists of an Amazon CloudFront distribution that routes
to an Application Load Balancer (ALB), with Amazon Elastic Container
Service (Amazon ECS) to process requests. A recent security audit
revealed that the web application is accessible by using both CloudFront
and ALB endpoints. However, the company requires that the web
application must be accessible only by using the CloudFront endpoint.
Which solution will meet this requirement with the LEAST amount of
effort?
- A. Create a new security group and attach it to the CloudFront
distribution. Update the ALB security group ingress to allow access only
from the CloudFront security group
- B. Update ALB security group ingress to allow access only from the
com.amazonaws.global.cloudfront.origin-facing CloudFront managed prefix
list
- C. Create a com.amazonaws.region.elasticloadbalancing VPC interface
endpoint for Elastic Load Balancing. Update the ALB scheme from
internet-facing to internal
- D. Extract CloudFront IPs from the AWS provided ip-ranges json document.
Update ALB security group ingress to allow access only from CloudFront
IPs
View question →
-
Q34. Q109. A company has developed APIs that use Amazon API Gateway with
Regional endpoints. The APIs call AWS Lambda functions that use API
Gateway authentication mechanisms. After a design review, a solutions
architect identifies a set of APIs that do not require public access.
The solutions architect must design a solution to make the set of APIs
accessible only from a VPC. All APIs need to be called with an
authenticated user.Which solution will meet these requirements with the LEAST amount of
effort?
- A. Create an internal Application Load Balancer (ALB). Create a target
group. Select the Lambda function to call. Use the ALB DNS name to call
the API from the VPC
- B. Remove the DNS entry that is associated with the API in API Gateway.
Create a hosted zone in Amazon Route 53. Create a CNAME record in the
hosted zone. Update the API in API Gateway with the CNAME record. Use
the CNAME record to call the API from the VPC
- C. Update the API endpoint from Regional to private in API Gateway.
Create an interface VPC endpoint in the VPC. Create a resource policy,
and attach it to the API. Use the VPC endpoint to call the API from the
VPC
- D. Deploy the Lambda functions inside the VPC. Provision an EC2
instance,and install an Apache server.From the Apache server, call the Lambda functions. Use the internal
CNAME record of the EC2 instance to call the API from the VPC
View question →
-
Q35. Q110. A company has its cloud infrastructure on AWS. A solutions
architect needs to define the infrastructure as code. The infrastructure
is currently deployed in one AWS Region.The company's business
expansion plan includes deployments in multiple Regions across multiple
AWS accounts. What should the solutions architect do to meet these
requirements?
- A. Use AWS CloudFormation templates. Add IAM policies to control the
various accounts. Deploy the templates across the multiple Regions
- B. Use AWS Organizations. Deploy AWS CloudFormation templates from the
management account. Use AWS Control Tower to manage deployments across
accounts
- C. Use AWS Organizations and AWS CloudFormation StackSets. Deploy a
CloudFormation template from an account that has the necessary IAM
permissions
- D. Use nested stacks with AWS CloudFormation templates. Change the
Region by using nested stacks
View question →
-
Q36. Q111. A retail company has structured its AWS accounts to be part of
an organization in AWS Organizations. The company has set up
consolidated billing and has mapped its departments to the following
OUs: Finance Sales, Human Resources (HR), Marketing, and Operations.
Each OU has multiple AWS accounts, one for each environment within a
department. These environments are development. test.pre-production. and
Production.The HR department is releasing a new system that will launch in 3
months. In preparation. the HR department has purchased several Reserved
Instances (RIs) in its production AWS account. The HR department will
install the new application on this account. The HR department wants to
make sure that other departments cannot share the RI discountsWhich solution will meet these requirements?
- A. In the AWS Billing and Cost Management console for the HR
department's production account, turn off RI sharing
- B. Remove the HR department's production AWS account from the
organization. Add the account to the consolidating billing configuration
only
- C. In the AWS Billing and Cost Management console, use the
organization's management account to turn off RI sharing for the HR
department's production AWS account
- D. Create an SCP in the organization to restrict access to the RIs.
Apply the SCP to the OUs of the other departments
View question →
-
Q37. Q112. A company has an organization in AWS Organizations that
includes multiple AWS accounts. Each account has a single VPC.In an
account named Shared Services, there is a transit gateway that is
connected to a Direct Connect gateway that provides access to the
company's on-premises network.The company configured AWS Resource
Access Manager (AWS RAM) to share the transit gateway to all the
accounts that are in the organization. The company has attached all the
VPCs to the transit gateway to facilitate routing between each other.
The company uses a DNS server for on-premises servers.There are a pair
of DNS servers on premises and in the Shared Services account VPC.The
company discovers that Amazon EC2 instances that the company starts
within the VPCs are not able to resolve addresses in the private
on-premises domain. Which solution will allow EC2 instances in all VPCs
to resolve on-premises addresses'
- A. Define an Amazon Route 53 Resolver outbound endpoint for the
on-premises domain in the Shared Services account VPC. Configure the
outbound endpoint to use the IP addresses of the DNS servers for the
on-premises domain. Configure a forwarder on the DNS servers to point to
the internal DNS resolver of the VPC
- B. Create an Amazon Route 53 private hosted zone for the on-premises
domain in the Shared Services account VPC. Configure AWS Resource Access
Manager (AWS RAM) to share the hosted zone to all accounts in the
organization. Associate the Route 53 private hosted zone with each VPC
- C. Define an Amazon Route 53 Resolver outbound endpoint for the
on-premises domain in the Shared Services account VPC. Configure the
outbound endpoint to use the IP addresses of the DNS servers for the
on-premises domain. Configure AWS Resource Access Manager (AWS RAM) to
share the Route 53 Resolver rule to all accounts in the organization.
Associate the Route 53 Resolver rule with each VPC
- D. Define an Amazon Route 53 Resolver inbound endpoint for the
on-premises domain in the Shared Services account VPC. Configure the
inbound endpoint to use the IP addresses of the DNS servers for the
on-premises domain. Configure AWS Resource Access Manager (AWS RAM) to
share the Route 53 Resolver rule to all accounts in the organization.
Associate the Route 53 Resolver rule with each VPC
View question →
-
Q38. Q113. A company is running an application in the AWS Cloud. The
company's security team must approve the creation of all new IAM users.
When a new IAM user is created, all access for the user must be removed
automatically. The security team must then receive a notification to
approve the user. The company has a multi-Region AWS CloudTrail trail in
the AWS account.
Which combination of steps will meet these requirements?(Select THREE.)
- A. Create an Amazon EventBridge rule. Define a pattern with the
detail-type value set to AWS API Call via CloudTrail and an eventName of
CreateUser
- B. Configure CloudTrail to send a notification for the CreateUser event
to an Amazon Simple Notification Service (Amazon SNS) topic
- C. Invoke a container that runs in Amazon Elastic Container Service
(Amazon ECS) with AWS Fargate technology to remove access
- D. Invoke an AWS Step Functions state machine to remove access
- E. Use Amazon Simple Notification Service(Amazon SNS) to notify the
security team
- F. Use Amazon Pinpoint to notify the security team
View question →
-
Q39. Q114. An international delivery company hosts a delivery management
system on AWS. Drivers use the system to upload confirmation of
delivery. Confirmation includes the recipient's signature or a photo of
the package with the recipient. The driver's handheld device uploads
signatures and photos through FTP to a single Amazon EC2 instance.Each
handheld device saves a file in a directory based on the signed-in user,
and the file name matches the delivery number. The EC2 instance then
adds metadata to the file after querying a central database to pull
delivery information.The file is then placed in Amazon S3 for archiving.
As the company expands, drivers report that the system is rejecting
connections.The FTP server is having problems because of dropped
connections and memory issues. In response to these problems,a system
engineer schedules a cron task to reboot the EC2 instance every 30
minutes. The billing team reports that files are not always in the
archive and that the central system is not always updated. A solutions
architect needs to design a solution that maximizes scalability to
ensure that the archive always receives the files and that systems are
always updated. The handheld devices cannot be modified, so the company
cannot deploy a new application.Which solution will meet these requirements?
- A. Create an AMI of the existing EC2 instance. Create an Auto Scaling
group of EC2 instances behind an Application Load Balancer. Configure
the Auto Scaling group to have a minimum of three instances
- B. Use AWS Transfer Family to create an FTP server that places the files
in Amazon Elastic File System (Amazon EFS). Mount the EFS volume to the
existing EC2 instance. Point the EC2 instance to the new path for file
processing
- C. Use AWS Transfer Family to create an FTP server that places the files
in Amazon S3. Use an S3 event notification through Amazon Simple
Notification Service (Amazon SNS) to invoke an AWS Lambda function.
Configure the Lambda function to add the metadata and update the
delivery system
- D. Update the handheld devices to place the files directly in Amazon S3.
Use an S3 event notification through Amazon Simple Queue Service (Amazon
SQS) to invoke an AWS Lambda function. Configure the Lambda function to
add the metadata and update the delivery system
View question →
-
Q40. Q115. A company is running a critical application that uses an Amazon
RDS for MySQL database to store data.The RDS DB instance is deployed in
Multi-AZ mode.A recent RDS database failover test caused a 40-second outage to the
application. A solutions architect needs to design a solution to reduce
the outage time to less than 20 seconds. Which combination of steps
should the solutions architect take to meet these requirements?(Select
THREE.)
- A. Use Amazon ElastiCache for Memcached in front of the database
- B. Use Amazon ElastiCache for Redis in front of the database
- C. Use RDS Proxy in front of the database
- D. Migrate the database to Amazon Aurora MySQL
- E. Create an Amazon Aurora Replica
- F. Create an RDS for MySQL read replica
View question →
-
Q41. Q116. A company uses AWS Organizations for a multi-account setup in
the AWS Cloud. The company uses AWS Control Tower for governance and
uses AWS Transit Gateway for VPC connectivity across accounts. In an AWS
application account, the company's application team has deployed a web
application that uses AWS Lambda and Amazon RDS. The company's database
administrators have a separate DBA account and use the account to
centrally manage all the databases across the organization.The database
administrators use an Amazon EC2 instance that is deployed in the DBA
account to access an RDS database that is deployed in the application
account.The application team has stored the database credentials as secrets in
AWS Secrets Manager in the application account. The application team is
manually sharing the secrets with the database administrators. The
secrets are encrypted by the default AWS managed key for Secrets Manager
in the application account. A solutions architect needs to implement a
solution that gives the database administrators access to the database
and eliminates the need to manually share the secrets.Which solution will meet these requirements?
- A. Use AWS Resource Access Manager (AWS RAM) to share the secrets from
the application account with the DBA account. In the DBA account, create
an IAM role that is named DBA-Admin.Grant the role the required
permissions to access the shared secrets.Attach the DBA-Admin role to
the EC2 instance for access to the cross-account secrets
- B. In the application account, create an IAM role that is named
DBA-Secret. Grant the role the required permissions to access the
secrets. In the DBA account, create an IAM role that is named DBA-Admin.Grant the DBA-Admin role the reguired permissions to assume the
DBA-Secret role in the application account. Attach the DBA-Admin role to
the EC2 instance for access to the cross-account secrets
- C. In the DBA account, create an IAM role that is named DBA-Admin. Grant
the role the required permissions to access the secrets and the default
AWS managed key in the application account. In the application account,
attach resource-based policies to the key to allow access from the DBA
account Attach the DBA-Admin role to the EC2 instance for access to the
cross-account secrets
- D. In the DBA account, create an IAM role that is named DBA-Admin. Grant
the role the required permissions to access the secrets in the
application account. Attach an SCP to the application account to allow
access to the secrets from the DBA account. Attach the DBA-Admin role to
the EC2 instance for access to the cross account secrets
View question →
-
Q42. Q117. A company is planning to migrate its business-critical
applications from an on-premises data center to AWS. The company has an
on-premises installation of a Microsoft SQL Server Always On cluster.
The company wants to migrate to an AWS managed database service. A
solutions architect must design a heterogeneous database migration on
AWSWhich solution will meet these requirements?
- A. Migrate the SQL Server databases to Amazon RDS for MySQL by using
backup and restore utilities
- B. Use an AWS Snowball Edge Storage Optimized device to transfer data to
Amazon S3. Set up Amazon RDS for MySQLUse S3 integration with SQL Server features, such as BULK INSERT
- C. Use the AWS Schema Conversion Tool to translate the database schema
to Amazon RDS for MySQL.Then use AWSDatabase Migration Service (AWS DMS) to migrate the data from
on-premises databases to Amazon RDS
- D. Use AWS DataSync to migrate data over the network between on-premises
storage and Amazon S3.Set up Amazon RDS for MySQL. Use S3 integration with SQL Server
features. such as BULK INSERT
View question →
-
Q43. Q118. A company is running an application in the AWS Cloud. The
application runs on containers in an Amazon Elastic Container Service
(Amazon ECS) cluster.The ECS tasks use the Fargate launch type.The
application's data is relational and is stored in Amazon Aurora MySQL.
To meet regulatory requirements, the application must be able to recover
to a separate AWS Region in the event of an application failure. In case
of a failure, no data can be lost.Which solution will meet these requirements with the LEAST amount of
operational overhead?
- A. Provision an Aurora Replica in a different Region
- B. Set up AWS DataSync for continuous replication of the data to a
different Region
- C. Set up AWS Database Migration Service (AWS DMS) to perform a
continuous replication of the data to a different Region
- D. Use Amazon Data Lifecycle Manager (Amazon DLM) to schedule a snapshot
every 5 minutes
View question →
-
Q44. Q119. A company has deployed an Amazon Connect contact center.
Contact center agents are reporting large numbers of computer-generated
calls.The company is concerned about the cost and productivity effects
of these calls. The company wants a solution that will allow agents to
flag the call as spam and automatically block the numbers from going to
an agent in the future.What is the MOST operationally efficient solution to meet these
requirements?
- A. Customize the Contact Control Panel (CCP) by adding a flag call
button that will invoke an AWS Lambda function that calls the
UpdateContactAttributes API.Use an Amazon DynamoDB table to store the spam numbers. Modify the
contact flows to look for the updated attribute and to use a Lambda
function to read and write to the DynamoDB table
- B. Use a Contact Lens for Amazon Connect rule that will look for spam
calls. Use an Amazon DynamoDB table to store the spam numbers. Modify
the contact flows to look for the rule and to invoke an AWS Lambda
function to read and write to the DynamoDB table
- C. Use an Amazon DynamoDB table to store the spam numbers. Create a
quick connect that the agents can transfer the spam call to from the
Contact Control Panel(CCP). Modify the quick connect contact flow to
invoke an AWS Lambda function to write to the DynamoDB table
- D. Modify the initial contact flow to ask for caller input. If the agent
does not receive input, the agent should mark the caller as spam. Use an
AmazonDynamoDB table to store the spam numbers. Use an AWS Lambda function to
read and write to the DynamoDB table
View question →
-
Q45. Q120. A company consists of two separate business units. Each
business unit has its own AWS account within a single organization in
AWS Organizations. The business units regularly share sensitive
documents with each other. To facilitate sharing, the company created an
Amazon S3 bucket in each account and configured two-way replication
between the S3 buckets. The S3 buckets have millions of objects
Recently, a security audit identified that neither S3 bucket has
encryption at rest enabled. Company policy requires that all documents
must be stored with encryption at rest. The company wants to implement
server-side encryption with Amazon S3 managed encryption keys (SSE-S3)
What is the MOST operationally efficient solution that meets these
requirements'
- A. Turn on SSE-S3 on both S3 buckets.Use S3 Batch Operations to copy and
encrypt the objects in the same location
- B. Create an AWS Key Management Service (AWS KMS) key in each
account.Turn on server-side encryption with AWS KMS keys(SSE-KMS)on each
S3 bucket by using the corresponding KMS key in that AWS account.
Encrypt the existing objects by using an S3 copy command in the AWS CLI
- C. Turn on SSE-S3 on both S3 buckets.Encrypt the existing objects by
using an S3 copy command in the AWS CLI
- D. Create an AWS Key Management Service (AWS KMS) key in each account.
Turn on server-side encryption with AWS KMS keys (SSE-KMS) on each S3
bucket by using the corresponding KMS key in that AWS account. Use S3
Batch Operations to copy the objects into the same location
View question →
-
Q46. Q121. A manufacturing company has developed a process to gather
factory floor device telemetry. The company uses AWS Control Tower. The
company also uses an AWS CloudFormation stack to provision a new VPC for
each factory location with a set of containers in Amazon Elastic
Container Service (Amazon ECS) and Amazon CloudWatch.
The company is now acquiring another manufacturing company that has
geographically remote plants. The company wants to modernize these
plants. One of the tasks is to apply the same telemetry-gathering
process. The network latency that results from connecting the devices
directly to the services in the AWS network is very high which can
affect reliability.
How can the company integrate the new plants into the existing
architecture?
- A. Use AWS Control Tower to create new OUs to add new accounts for the
new plants. Deploy the ECS containers and CloudWatch into the accounts
- B. Request an AWS Snowball Edge device for the newly acquired plants.
Connect the device to AwS loT Core and register all the factory floor
devices through AWS IoT Core. Map the devices into the existing VPC and
connect the devices to the ECS containers
- C. Request and install an AWS Outposts server in the newly acquired
plants. Within the Outposts server, use the CloudFormation stack to
provision required VPC and ECS containers to connect to the devices.
Connect to CloudWatch in the AWS Region
- D. Use Amazon EC2 Dedicated Instances. Use the CloudFormation stack to
provision required VPC and ECS containers. Connect to CloudWatch in the
AWS Region
View question →
-
Q47. Q122. A financial company is planning to migrate its web application
from on premises to AWS. The company uses a third-party security tool to
monitor the inbound traffic to the application.The company has used the
security tool for the last 15 years, and the tool has no cloud solutions
available from its vendor.The company's security team is concerned
about how to integrate the security tool with AWS technology. The
company plans to deploy the application migration to AWS on Amazon EC2
instances.The EC2 instances will run in an Auto Scaling group in a
dedicated VPC. The company needs to use the security tool to inspect all
packets that come in and out of the VPC. This inspection must occur in
real time and must not affect the application's performance. A
solutions architect must design a target architecture on AWS that is
highly available within an AWS Region.Which combination of steps should the solutions architect take to meet
these requirements? (Select TWO)
- A. Deploy the security tool on EC2 instances in a new Auto Scaling group
in the existing VPC
- B. Deploy the web application behind a Network Load Balancer
- C. Deploy an Application Load Balancer in front of the security tool
instances
- D. Provision a Gateway Load Balancer for each Availability Zone to
redirect the traffic to the security tool
- E. Provision a transit gateway to facilitate communication between VPCs
View question →
-
Q48. Q123. A company runs its application in the eu-west-1 Region and has
one account for each of its environments:
development, testing, and production. All the environments are running
24 hours a day,7 days a week by using stateful Amazon EC2 instances and
Amazon RDS for MySQL databases. The databases are between 500 GB and 800
GB in size.
The development team and testing team work on business days during
business hours, but the production environment operates 24 hours a day,7
days a week. The company wants to reduce costs. All resources are tagged
with an environment tag with either development, testing, or production
as the key. What should a solutions architect do to reduce costs with
the LEAST operational effort?
- A. Create an Amazon EventBridge rule that runs once every day. Configure
the rule to invoke one AWS Lambda function that starts or stops
instances based on the tag,day, and time
- B. Create an Amazon EventBridge rule that runs every business day in the
evening. Configure the rule to invoke an AWS Lambda function that stops
instances based on the tag. Create a second EventBridge rule that runs
every business day in the morning. Configure the second rule to invoke
another Lambda function that starts instances based on the tag
- C. Create an Amazon EventBridge rule that runs every business day in the
evening. Configure the rule to invoke an AWS Lambda function that
terminates instances based on the tag. Create a second EventBridge rule
that runs every business day in the morning. Configure the second rule
to invoke another Lambda function that restores the instances from their
last backup based on the tag
- D. Create an Amazon EventBridge rule that runs every hour. Configure the
rule to invoke one AWS Lambda function that terminates or restores
instances from their last backup based on the tag, day, and time
View question →
-
Q49. Q124. A financial services company receives a regular data feed from
its credit card servicing partner. Approximately 5,000 records are sent
every 15 minutes in plaintext. delivered over HTTPS directly into an
Amazon S3 bucket with server-side encryption. This feed contains
sensitive credit card primary account number (PAN) data.
The company needs to automatically mask the PAN before sending the data
to another S3 bucket for additional internal processing. The company
also needs to remove and merge specific fields, and then transform the
record into JSON format Additionally, extra feeds are likely to be added
in the future, so any design needs to be easily expandable.
Which solutions will meet these requirements'?
- A. Invoke an AWS Lambda function on file delivery that extracts each
record and writes it to an Amazon SQS queue. Invoke another Lambda
function when new messages arrive in the SQS queue to process the
records, writing the results to a temporary location in Amazon S3.
Invoke a final Lambda function once the SQS queue is empty to transform
the records into JSON format and send the results to another S3 bucket
for internal processing
- B. Invoke an AWS Lambda function on file delivery that extracts each
record and writes it to an Amazon SQS queue. Configure an AWS Fargate
container application to automatically scale to a single instance when
the SQS queue contains messages. Have the application process each
record, and transform the record into JSON format. When the queue is
empty, send the results to another S3 bucket for internal processing and
scale down the AWS Fargate instance
- C. Create an AWS Glue crawler and custom classifier based on the data
feed formats and build a table definition to match. Invoke an AWS Lambda
function on file delivery to start an AWS Glue ETL job to transform the
entire record according to the processing and transformation
requirements. Define the output format as JSON. Once complete, have the
ETL job send the results to another S3 bucket for internal processing
- D. Create an AWS Glue crawler and custom classifier based upon the data
feed formats and build a table definition to match. Perform an Amazon
Athena query on file delivery to start an Amazon EMR ETL job to
transform the entire record according to the processing and
transformation requirements. Define the output format as JSON. Once
complete, send the results to another S3 bucket for internal processing
and scale down the EMR cluster.
View question →
-
Q50. Q125. A company is processing videos in the AWS Cloud by using Amazon
EC2 instances in an Auto Scaling group. It takes 30 minutes to process a
video Several EC2 instances scale in and out depending on the number of
videos in an Amazon Simple Queue Service(Amazon SQS) queue. The company
has configured the SQS queue with a redrive policy that specifies a
target dead-letter queue and a maxReceiveCount of 1.The company has set
the visibility timeout for the SQS queue to 1 hour. The company has set
up an Amazon CloudWatch alarm to notify the development team when there
are messages in the dead-letter queue.
Several times during the day, the development team receives notification
that messages are in the dead- letter queue and that videos have not
been processed properly. An investigation finds no errors in the
application logs
How can the company solve this problem?
- A. Turn on termination protection for the EC2 instances
- B. Update the visibility timeout for the SQS queue to 3 hours
- C. Configure scale-in protection for the instances during processing
- D. Update the redrive policy and set maxReceiveCount to 0
View question →
-
Q51. Q126. A solutions architect is investigating an issue in which a
company cannot establish new sessions in Amazon WorkSpaces. An initial
analysis indicates that the issue involves user profiles. The Amazon
WorkSpaces environment is configured to use Amazon FSx for Windows File
Server as the profile share storage.The FSx for Windows File Server file
system is configured with 10 TB of storage. The solutions architect
discovers that the file system has reached its maximum capacity. The
solutions architect must ensure that users can regain access.The
solution also must prevent the problem from occurring again.
Which solution will meet these requirements?
- A. Remove old user profiles to create space. Migrate the user profiles
to an Amazon FSx for Lustre file system
- B. Increase capacity by using the update-file-system command. Implement
an Amazon CloudWatch metric that monitors free space. Use Amazon
EventBridge to invoke an AWS Lambda function to increase capacity as
required.
- C. Monitor the file system by using the FreeStorageCapacity metric in
Amazon CloudWatch. Use AWS Step Functions to increase the capacity as
required
- D. Remove old user profiles to create space. Create an additional FSx
for Windows File Server file system.
Update the user profile redirection for 50% of the users to use the new
file system
View question →
-
Q52. Q127. A company has VPC flow logs enabled for its NAT gateway. The
company is seeing Action = ACCEPT for inbound traffic that comes from
public IP address 198.51.100.2 destined for a private Amazon EC2
instance.
A solutions architect must determine whether the traffic represents
unsolicited inbound connections from the internet. The first two octets
of the VPC CIDR block are 203.0, Which set of steps should the solutions
architect take to meet these requirements?
- A. Open the AWS CloudTrail console. Select the log group that contains
the NAT gateway's elastic network interface and the private instance's
elastic network interface. Run a query to filter with the destination
address set as "like 203.0" and the source address set as "like51.100.2". Run the stats command to filter the sum of bytes
transferred by the source address and the destination address
- B. Open the Amazon CloudWatch console. Select the log group that
contains the NAT gateway's elastic network interface and the private
instance's elastic network interface. Run a query to filter with the
destination address set as "like 203.0" and the source address set as
"like 198.51.100.2". Run the stats command to filter the sum of bytes
transferred by the source address and the destination address
- C. Open the AWS CloudTrail console. Select the log group that contains
the NAT gateway's elastic network interface and the private instance's
elastic network interface. Run a query to filter with the destination
address set as "like 198.51.100.2" and the source address set as
"like 203.0". Run the stats command to filter the sum of bytes
transferred by the source address and the destination address
- D. Open the Amazon CloudWatch console. Select the log group that
contains the NAT gateway's elastic network interface and the private
instance's elastic network interface. Run a query to filter with the
destination address set as "like 198.51.100.2" and the source address
set as "like 203.0". Run the stats command to filter the sum of bytes
transferred by the source address and the destination address
View question →
-
Q53. Q128. A company has a legacy monolithic application that is critical
to the company's business. The company hosts the application on an
Amazon EC2 instance that runs Amazon Linux 2. The company's application
team receives a directive from the legal department to back up the data
from the instance's encrypted Amazon Elastic Block Store (Amazon EBS)
volume to an Amazon S3 bucket. The application team does not have the
administrative SSH key pair for the instance.The application must
continue to serve the users.Which solution will meet these requirements?
- A. Attach a role to the instance with permission to write to Amazon S3.
Use the AWS Systems Manager Session Manager option to gain access to the
instance and run commands to copy data into Amazon S3
- B. Create an image of the instance with the reboot option turned on.
Launch a new EC2 instance from the image. Attach a role to the new
instance with permission to write to Amazon S3. Run a command to copy
data into Amazon S3
- C. Take a snapshot of the EBS volume by using Amazon Data Lifecycle
Manager (Amazon DLM). Copy the data to Amazon S3
- D. Create an image of the instance. Launch a new EC2 instance from the
image. Attach a role to the new instance with permission to write to
Amazon S3. Run a command to copy data into Amazon S3
View question →
-
Q54. Q129. A company is hosting a critical application on a single Amazon
EC2 instance.The application uses an Amazon ElastiCache for Redis
single-node cluster for an in-memory data store The application uses an
Amazon RDS for MariaDB DB instance for a relational database. For the
application to function, each piece of the infrastructure must be
healthy and must be in an active state.
A solutions architect needs to improve the application's architecture
so that the infrastructure can automatically recover from failure with
the least possible downtime.
Which combination of steps will meet these requirements? (Select THREE.)
- A. Use an Elastic Load Balancer to distribute traffic across multiple
EC2 instances. Ensure that the EC2 instances are part of an Auto Scaling
group that has a minimum capacity of two instances
- B. Use an Elastic Load Balancer to distribute traffic across multiple
EC2 instances. Ensure that the EC2 instances are configured in unlimited
mode
- C. Modify the DB instance to create a read replica in the same
Availability Zone. Promote the read replica to be the primary DB
instance in failure scenarios
- D. Modify the DB instance to create a Multi_AZ deployment that extends
across two Availability Zones
- E. Create a replication group for the ElastiCache for Redis cluster.
Configure the cluster to use an Auto Scaling group that has a minimum
capacity of two instances
- F. Create a replication group for the ElastiCache for Redis cluster.
Enable Multi-AZ on the cluster
View question →
-
Q55. Q130. A company has an environment that has a single AWS account. A
solutions architect is reviewing the environment to recommend what the
company could improve, specifically in terms of access to the AWS
Management Console.The company's IT support workers currently access
the console for administrative tasks, authenticating with named IAM
users that have been mapped to their job role.The IT support workers no longer want to maintain both their Active
Directory and IAM user accounts. They want to be able to access the
console by using their existing Active Directory credentials. The
solutions architect is using AWS IAM Identity Center (AWS Single
Sign-On) to implement this functionality.Which solution will meet these requirements MOST cost-effectively?
- A. Create an organization in AWS Organizations. Turn on the IAM Identity
Center feature in Organizations.Create and configure a directory in AWS Directory Service for Microsoft
Active Directory (AWS Managed Microsoft AD) with a two-way trust to the
company's on-premises Active Directory. Configure IAM Identity Center
and set the AWS Managed Microsoft AD directory as the identity source.
Create permission sets and map them to the existing groups within the
AWS Managed Microsoft AD directory
- B. Create an organization in AWS Organizations.Turn on the IAM Identity
Center feature in Organizations.Create and configure an AD Connector to connect to the company's
on-premises Active Directory.Configure IAM Identity Center and select the AD Connector as the
identity source. Create permission sets and map them to the existing
groups within the company's Active Directory
- C. Create an organization in AWS Organizations.Turn on all features for
the organization. Create and configure a directory in AWS Directory
Service for Microsoft Active Directory (AWS Managed Microsoft AD) with a
two-way trust to the company's on-premises Active Directory. Configure
IAM Identity Center and select the AWS Managed Microsoft AD directory as
the identity source.Create permission sets and map them to the existing groups within the
AWS Managed Microsoft AD directory
- D. Create an organization in AWS Organizations. Turn on all features for
the organization. Create and configure an AD Connector to connect to the
company's on-premises Active Directory Configure IAM Identity Center
and set the AD Connector as the identity source.Create permission sets
and map them to the existing groups within the company's Active
Directory.
View question →
-
Q56. Q131. A company is using an on-premises Active Directory service for
user authentication.The company wants to use the same authentication
service to sign in to the company's AWS accounts, which are using AWS
Organizations. AWS Site-to-Site VPN connectivity already exists between
the on-premises environment and all the company's AWS accounts.The company's security policy requires conditional access to the
accounts based on user groups and roles.User identities must be managed
in a single location.Which solution will meet these requirements?
- A. Configure AWS IAM Identity Center (AWS Single Sign-On) to connect to
Active Directory by using SAML 2.0. Enable automatic provisioning by
using the System for Cross-domain Identity Management (SCIM) v2.O
protocol.Grant access to the AWS accounts by using attribute-based
access controls (ABACs)
- B. Configure AWS IAM Identity Center (AWS Single Sign-On) by using IAM
Identity Center as an identity source.Enable automatic provisioning by
using the System for Cross-domain Identity Management (SCIM) v2.O
protocol. Grant access to the AWS accounts by using IAM Identity Center
permission sets
- C. In one of the company's AWS accounts,configure AWS Identity and
Access Management (IAM) to use a SAML 2.O identity provider. Provision
IAM users that are mapped to the federated users. Grant access that
corresponds to appropriate groups in Active Directory. Grant access to
the required AWS accounts by using cross-account IAM users
- D. In one of the company's AWS accounts,configure AWS Identity and
Access Management (IAM) to use an OpenID Connect (OIDC)identity
provider. Provision IAM roles that grant access to the AWS account for
the federated users that correspond to appropriate groups in Active
Directory. Grant access to the required AWS accounts by using
cross-account IAMroles
View question →
-
Q57. Q132. A company is providing weather data over a REST-based API to
several customers. The API is hosted by Amazon API Gateway and is
integrated with different AWS Lambda functions for each API
operation.The company uses Amazon Route 53 for DNS and has created a
resource record of weather.example.com. The company stores data for the
API in Amazon DynamoDB tables. The company needs a solution that will
give the API the ability to fail over to a different AWS Region.Which solution will meet these requirements?
- A. Deploy a new set of Lambda functions in a new Region. Update the APl
Gateway API to use an edge- optimized APl endpoint with Lambda functions
from both Regions as targets Convert the DynamoDB tables to global
table:
- B. Deploy a new API Gateway API and Lambda functions in another Region.
Change the Route 53 DNS record to a multivalue answer. Add both API
Gateway APIs to the answer. Enable target health monitoring. Convert the
DynamoDB tables to global tables
- C. Deploy a new API Gateway API and Lambda functions in another Region.
Change the Route 53 DNS record to a failover record. Enable target
health monitoring. Convert the DynamoDB tables to global tables
- D. Deploy a new API Gateway API in a new Region. Change the Lambda
functions to global functions.Change the Route 53 DNS record to a multivalue answer. Add both API
Gateway APls to the answer.Enable target health monitoring. Convert the DynamoDB tables to global
tables
View question →
-
Q58. Q133. A company's factory and automation applications are running in
a single VPC. More than 20 applications run on a combination of Amazon
EC2, Amazon Elastic Container Service (Amazon ECS), and Amazon RDSThe company has software engineers spread across three teams. One of the
three teams owns each application, and each team is responsible for the
cost and performance of all of its applications. Team resources have
tags that represent their application and team.The teams use IAM access
for daily activities.The company needs to determine which costs on the monthly AWs bill are
attributable to each application or team.The company also must be able
to create reports to compare costs from the last 12 months and to help
forecast costs for the next 12 months. A solutions architect must
recommend an AWs Billing and Cost Management solution that provides
these cost reports.Which combination of actions will meet these requirements?(Select THREE.
- A. Activate the user-defined cost allocation tags that represent the
application and the team
- B. Activate the AWS generated cost allocation tags that represent the
application and the team
- C. Create a cost category for each application in Billing and Cost
Management
- D. Activate IAM access to Billing and Cost Management
- E. Create a cost budget
- F. Enable Cost Explorer
View question →
-
Q59. Q134. A retail company is operating its ecommerce application on
AWS.The application runs on Amazon EC2 instances behind an Application
Load Balancer (ALB).The company uses an Amazon RDS DB instance as the
database backend. Amazon CloudFront is configured with one origin that
points to the ALB.Static content is cached. Amazon Route 53 is used to
host all public zones.After an update of the application, the ALB occasionally returns a 502
status code(Bad Gateway) error. The root cause is malformed HTTP headers
that are returned to the ALB.The webpage returns successfully when a
solutions architect reloads the webpage immediately after the error
occurs.While the company is working on the problem, the solutions architect
needs to provide a custom error page instead of the standard ALB error
page to visitors.Which combination of steps will meet this requirement with the LEAST
amount of operational overhead? (Select TWO.)
- A. Create an Amazon S3 bucket. Configure the S3 bucket to host a static
webpage. Upload the custom error pages to Amazon S3
- B. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function if
the ALB health check response Target.FailedHealthChecks is greater than Configure the Lambda function to modify the forwarding rule at the
ALB to point to a publicly accessible web server
- C. Modify the existing Amazon Route 53 records by adding health checks.
Configure a fallback target if the health check fails. Modify DNS
records to point to a publicly accessible webpage
- D. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function if
the ALB health check response Elb.InternalError is greater than 0.
Configure the Lambda function to modify the forwarding rule at the ALB
to point to a public accessible web server.
- E. Add a custom error response by configuring a CloudFront custom error
page. Modify DNS records to point to a publicly accessible web page
View question →
-
Q60. Q135. A company has registered 10 new domain names. The company uses
the domains for online marketing.The company needs a solution that will
redirect online visitors to a specific URL for each domain. All domains
and target URLs are defined in a JSON document. All DNS records are
managed by Amazon Route 53.A solutions architect must implement a redirect service that accepts
HTTP and HTTPS requests.Which combination of steps should the solutions architect take to meet
these requirements with the LEAST amount of operational effort? (Select
THREE.)
- A. Create a dynamic webpage that runs on an Amazon EC2 instance.
Configure the webpage to use the JSON document in combination with the
event message to look up and respond with a redirect URL
- B. Create an Application Load Balancer that includes HTTP and HTTPS
listeners
- C. Create an AWS Lambda function that uses the JSON document in
combination with the event message to look up and respond with a
redirect URL
- D. Use an Amazon API Gateway API with a custom domain to publish an AWS
Lambda function
- E. Create an Amazon CloudFront distribution. Deploy a Lambda@Edge
function
- F. Create an SSL certificate by using AWS Certificate Manager (ACM).
Include the domains as Subject Alternative Names.
View question →
-
Q61. Q136. A company has an loT platform that runs in an on-premises
environment. The platform consists of a server that connects to loT
devices by using the MQTT protocol.The platform collects telemetry data
from the devices at least once every 5 minutes. The platform also stores
device metadata in a MongoDB cluster.An application that is installed on an on-premises machine runs periodic
jobs to aggregate and transform the telemetry and device metadata. The
application creates reports that users view by using another web
application that runs on the same on-premises machine.The periodic jobs
take 120-600 seconds to run However, the web application is always
running.The company is moving the platform to AWS and must reduce the
operational overhead of the stack.Which combination of steps will meet these requirements with the LEAST
operational overhead? (Select THREE.)
- A. Use AWS Lambda functions to connect to the loT devices
- B. Configure the loT devices to publish to AWS loT Core
- C. Write the metadata to a self-managed MongoDB database on an Amazon
EC2 instance
- D. Write the metadata to Amazon DocumentDB(with MongoDB compatibility)
- E. Use AWS Step Functions state machines with AWS Lambda tasks to
prepare the reports and to write the reports to Amazon S3. Use Amazon
CloudFront with an S3 origin to serve the reports
- F. Use an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with
Amazon EC2 instances to prepare the reports. Use an ingress controller
in the EKS cluster to serve the reports
View question →
-
Q62. Q137. A company is designing its network configuration in the AWS
Cloud. The company uses AWS Organizations to manage a multi-account
setup. The company has three OUs.Each OU contains more than 100 AWS
accounts. Each account has a single VPC, and all the VPCs in each OU are
in the same AWS Region.The CIDR ranges for all the AWS accounts do not overlap. The company
needs to implement a solution in which VPCs in the same OU can
communicate with each other but cannot communicate with VPCs in other
OUsWhich solution will meet these requirements with the LEAST operational
overhead?
- A. Create an AWS CloudFormation stack set that establishes VPC peering
between accounts in each OU.Provision the stack set in each OU
- B. In each OU, create a dedicated networking account that has a single
VPC. Share this VPC with all the other accounts in the OU by using AWS
Resource Access Manager (AWS RAM). Create a VPC peering connection
between the networking account and each account in the OU
- C. Provision a transit gateway in an account in each OU. Share the
transit gateway across the organization by using AWS Resource Access
Manager (AWS RAM). Create transit gateway VPC attachments for each VPC
- D. In each OU, create a dedicated networking account that has a single
VPC. Establish a VPN connection between the networking account and the
other accounts in the OU. Use third-party routing software to route
transitive traffic between the VPCs
View question →
-
Q63. Q138. A company is running an application that uses an Amazon
ElastiCache for Redis cluster as a caching layer. A recent security
audit revealed that the company has configured encryption at rest for
ElastiCache. However, the company did not configure ElastiCache to use
encryption in transit. Additionally, users can access the cache without
authentication.A solutions architect must make changes to require user authentication
and to ensure that the company is using end-to-end encryption.Which solution will meet these requirements?
- A. Create an AUTH token. Store the token in AWS System Manager Parameter
Store, as an encrypted parameter. Create a new cluster with AUTH, and
configure encryption in transit. Update the application to retrieve the
AUTH token from Parameter Store when necessary and to use the AUTH token
for authentication
- B. Create an AUTH token. Store the token in AWS Secrets Manager.
Configure the existing cluster to use the AUTH token, and configure
encryption in transit. Update the application to retrieve the AUTH token
from Secrets Manager when necessary and to use the AUTH token for
authentication
- C. Create an SSL certificate. Store the certificate in AWS Secrets
Manager. Create a new cluster, and configure encryption in transit.
Update the application to retrieve the SSL certificate from Secrets
Manager when necessary and to use the certificate for authentication
- D. Create an SSL certificate. Store the certificate in AWS Systems
Manager Parameter Store, as an encrypted advanced parameter. Update the
existing cluster to configure encryption in transit. Update the
application to retrieve the SSL certificate from Parameter Store when
necessary and to use the certificate for authentication
View question →
-
Q64. Q139. A company runs a customer service center that accepts calls and
automatically sends all customers a managed, interactive, two-way
experience survey by text message. The applications that support the
customer service center run on machines that the company hosts in an
on-premises data center. The hardware that the company uses is old, and
the company is experiencing downtime with the system.The company wants
to migrate the system to AWS to improve reliability.Which solution will meet these requirements with the LEAST ongoing
operational overhead?
- A. Use Amazon Connect to replace the old call center hardware. Use
Amazon Pinpoint to send text message surveys to customers
- B. Use Amazon Connect to replace the old call center hardware. Use
Amazon Simple Notification Service (Amazon SNS) to send text message
surveys to customers
- C. Migrate the call center software to Amazon EC2 instances that are in
an Auto Scaling group. Use the EC2 instances to send text message
surveys to customers
- D. Use Amazon Pinpoint to replace the old call center hardware and to
send text message surveys to customers
View question →
-
Q65. Q140. A retail company is operating its ecommerce application on
AWS.The application runs on Amazon EC2 instances behind an Application
Load Balancer (ALB) The company uses an Amazon RDS DB instance as the
database backend. Amazon CloudFront is configured with one origin that
points to the ALB. Static content is cached.Amazon Route 53 is used to
host all public zones.After an update of the application,the ALB occasionally returns a 502
status code (Bad Gateway) error. The root cause is malformed HTTP
headers that are returned to the ALB. The webpage returns successfully
when a solutions architect reloads the webpage immediately after the
error occurs..While the company is working on the problem, the solutions architect
needs to provide a custom error page instead of the standard ALB error
page to visitors.Which combination of steps will meet this requirement with the LEAST
amount of operational overhead? (Select TWO.)
- A. Create an Amazon S3 bucket. Configure the S3 bucket to host a static
webpage. Upload the custom error pages to Amazon S3
- B. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function if
the ALB health check response Target.FailedHealthChecks is greater than
O Configure the Lambda function to modify the forwarding rule at the ALB
to point to a publicly accessible web server.
- C. Modify the existing Amazon Route 53 records by adding health checks.
Configure a fallback target if the health check fails. Modify DNS
records to point to a publicly accessible webpage
- D. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function if
the ALB health check response EIb.InternalError is greater than 0,Configure the Lambda function to modify the forwarding rule at the ALB to point to a public accessible web server
- E. Add a custom error response by configuring a CloudFront custom error page. Modify DNS records to point to a publicly accessible web page
View question →
-
Q66. Q141. A company is running an application in the AWS Cloud. Recent
application metrics show inconsistent response times and a significant
increase in error rates Calls to third-party services are causing the
delays. Currently,the application calls third-party services
synchronously by directly invoking an AWS Lambda function.A solutions architect needs to decouple the third-party service calls
and ensure that all the cals are eventually completed.Which solution will meet these requirements?
- A. Use an Amazon Simple Queue Service(Amazon SQS) queue to store events
and invoke the Lambda function
- B. Use an AWS Step Functions state machine to pass events to the Lambda
function
- C. Use an Amazon EventBridge rule to pass events to the Lambda function,
- D. Use an Amazon Simple Notification Service (Amazon SNS) topic to store
events and invoke the Lambda function
View question →
-
Q67. Q142. A company runs an application on a fleet of Amazon EC2
instances that are in private subnets behind an internet-facing
Application Load Balancer (ALB).The ALB is the origin for an Amazon
CloudFront distribution. An AWS WAF web ACL that contains various AWS
managed rules is associated with the CloudFront distribution.The company needs a solution that will prevent internet traffic from
directly accessing the ALB. Which solution will meet these requirements
with the LEAST operational overhead?
- A. Create a new web ACL that contains the same rules that the existing
web ACL contains. Associate the new web ACL with the ALB
- B. Associate the existing web ACL with the ALB
- C. Add a security group rule to the ALB to allow traffic from the AWS
managed prefix list for CloudFront only
- D. Add a security group rule to the ALB to allow only the various
CloudFront IP address ranges
View question →
-
Q68. Q143. A company runs an loT application in the AWS Cloud.The company
has millions of sensors that collect data from houses in the United
States.The sensors use the MQTT protocol to connect and send data to a
custom MQTT broker. The MQTT broker stores the data on a single Amazon
EC2 instance.The sensors connect to the broker through the domain named
iot.example.com. The company uses Amazon Route 53 as its DNS service.
The company stores the data in Amazon DynamoDB.
On several occasions, the amount of data has overloaded the MQTT broker
and has resulted in lost sensor data.The company must improve the
reliability of the solution.
Which solution will meet these requirements?
- A. Create an Application Load Balancer (ALB) and an Auto Scaling group
for the MQTT broker. Use the Auto Scaling group as the target for the
ALB. Update the DNS record in Route 53 to an alias record.
Point the alias record to the ALB. Use the MQTT broker to store the data
- B. Set up AWS IoT Core to receive the sensor data. Create and configure
a custom domain to connect to AWS loT Core. Update the DNS record in
Route 53 to point to the AWS loT Core Data-ATS endpoint.
Configure an AWS loT rule to store the data
- C. Create a Network Load Balancer (NLB). Set the MQTT broker as the
target. Create an AWS Global Accelerator accelerator. Set the NLB as the
endpoint for the accelerator. Update the DNS record in Route 53 to a
multivalue answer record. Set the Global Accelerator IP addresses as
values. Use the MQTT broker to store the data
- D. Set up AWS loT Greengrass to receive the sensor data. Update the DNS
record in Route 53 to point to the AWS loT Greengrass endpoint.
Configure an AWS loT rule to invoke an AWS Lambda function to store the
data
View question →
-
Q69. Q144. A solutions architect is planning to migrate critical Microsoft
SQL Server databases to AWS. Because the databases are legacy
systems,the solutions architect will move the databases to a modern data
architecture.The solutions architect must migrate the databases with
near-zero downtime.Which solution will meet these requirements?
- A. Use AWS Application Migration Service and the AWS Schema Conversion
Tool (AWS SCT). Perform an in-place upgrade before the migration. Export
the migrated data to Amazon Aurora Serverless after cutover. Repoint the
applications to Amazon Aurora
- B. Use AWS Databnse Migration Service (AWS DMS) to rehost the database.
Set Amazon S3 as a target.
Set up change data capture (CDC) replication When the source-and
destination are fully synchronized, load the data from Amazon S3 into an
Amazon RDS for Microsoft SQL Server DB instance
- C. Use native database high availability tools. Connect the source
system to an Amazon RDS for Microsoft SQL Server DB instance. Configure
replication accordingly. When data replication is finished, transition
the workload to an Amazon RDS for Microsoft SQL Server DB instance
- D. Use AWS Application Migration Service. Rehost the database server on
Amazon EC2. When data replication is finished, detach the database and
move the database to an Amazon RDS for Microsoft SQL Server DB
instance.Reattach the database and then cut over all networking
View question →
-
Q70. Q145. A company is running a traditional web application on Amazon
EC2 instances. The company needs to refactor the application as
microservices that run on containers. Separate versions of the
application exist in two distinct environments: production and testing.
Load for the application is variable, but the minimum load and the
maximum load are known. A solutions architect needs to design the
updated application with a serverless architecture that minimizes
operational complexity.
Which solution will meet these requirements MOST cost-effectively?
- A. Upload the container images to AWS Lambda as functions. Configure a
concurrency limit for the associated Lambda functions to handle the
expected peakload. Configure two separate Lambda integrations within
Amazon API Gateway: one for production and one for testing
- B. Upload the container images to Amazon Elastic Container Registry
(Amazon ECR). Configure two auto scaled Amazon Elastic Container Service
(Amazon ECS) clusters with the Fargate launch type to handle the
expected load. Deploy tasks from the ECR images. Configure two separate
Application Load Balancers to direct traffic to the ECS clusters
- C. Upload the container images to Amazon Elastic Container Registry
(Amazon ECR). Configure two auto scaled Amazon Elastic Kubernetes
Service (Amazon EKS) clusters with the Fargate launch type to handle the
expected load. Deploy tasks from the ECR images. Configure two separate
Application Load Balancers to direct traffic to the EKS clusters
- D. Upload the container images to AWS Elastic Beanstalk. In Elastic
Beanstalk, create separate environments and deployments for production
and testing Configure two separate Application Load Balancers to direct
traffic to the Elastic Beanstalk deployments
View question →
-
Q71. Q146. A company's interactive web application uses an Amazon
CloudFront distribution to serve images from an Amazon S3 bucket.
Occasionally, third-party tools ingest corrupted images into the S3
bucket. This image corruption causes a poor user experience in the
application later. The company has successfully implemented and tested
Python logic to detect corrupt images.A solutions architect must recommend a solution to integrate the
detection logic with minimal latency between the ingestion and serving.Which solution will meet these requirements?
- A. Use a Lambda@Edge function that is invoked by a viewer-response
event
- B. Use a Lambda@Edge function that is invoked by an origin-response
event
- C. Use an S3 event notification that invokes an AWS Lambda function
- D. Use an S3 event notification that invokes an AWS Step Functions state
machine
View question →
-
Q72. Q147. A solutions architect needs to copy data from an Amazon S3
bucket in an AWS account to a new S3 bucket in a new AWS account. The
solutions architect must implement a solution that uses the AWS CLI.
Which combination of steps will successfully copy the data? (Select
THREE)
- A. Create a bucket policy to allow the source bucket to list its
contents and to put objects and set object ACLs in the destination
bucket. Attach the bucket policy to the destination bucket
- B. Create a bucket policy to allow a user in the destination account to
list the source bucket's contents and read the source bucket's
objects. Attach the bucket policy to the source bucket
- C. Create an IAM policy in the source account. Configure the policy to
allow a user in the source account to list contents and get objects in
the source bucket, and to list contents, put objects, and set object
ACLs in the destination bucket. Attach the policy to the user.
- D. Create an IAM policy in the destination account. Configure the policy
to allow a user in the destination account to list contents and get
objects in the source bucket, and to list contents, put objects, and set
object ACLs in the destination bucket. Attach the policy to the user
- E. Run the aws s3 sync command as a user in the source account. Specify
the source and destination buckets to copy the data
- F. Run the aws s3 sync command as a user in the destination account.
Specify the source and destination buckets to copy the data
View question →
-
Q73. Q148. A company wants to optimize AWS data-transfer costs and compute
costs across developer accounts within the company's organization in
AWS Organizations. Developers can configure VPCs and launch Amazon EC2
instances in a single AWS Region.The EC2 instances retrieve
approximately 1 TB of data each day from Amazon S3.
The developer activity leads to excessive monthly data-transfer charges
and NAT gateway processing charges between EC2 instances and S3 buckets,
along with high compute costs. The company wants to proactively enforce
approved architectural patterns for any EC2 instance and VPc
infrastructure that developers deploy within the AWS accounts. The
company does not want this enforcement to negatively affect the speed at
which the developers can perform their tasks. Which solution will meet
these requirements MOST cost-effectively?
- A. Create SCPs to prevent developers from launching unapproved EC2
instance types. Provide the developers with an AWS CloudFormation
template to deploy an approved VPC configuration with S3 interface
endpoints. Scope the developers' IAM permissions so that the developers
can launch VPC resources only with CloudFormation
- B. Create a daily forecasted budget with AWS Budgets to monitor EC2
compute costs and S3 data- transfer costs across the developer accounts.
When the forecasted cost is 75% of the actual budget cost, send an alert
to the developer teams. If the actual budget cost is 100%. create a
budget action to terminate the developers' EC2 instances and VPC
infrastructure
- C. Create an AWS Service Catalog portfolio that users can use to create
an approved VPC configuration with S3 gateway endpoints and approved EC2
instances. Share the portfolio with the developer accounts. Configure an
AWs Service Catalog launch constraint to use an approved IAM role. Scope
the developers' IAM permissions to allow access only to AWS Service
Catalog
- D. Create and deploy AWS Config rules to monitor the compliance of EC2
and VPC resources in the developer AWS accounts. If developers launch
unapproved EC2 instances or if developers create VPCs without S3 gateway
endpoints. perform a remediation action to terminate the unapproved
resources
View question →
-
Q74. Q149. A company recently acquired several other companies.Each
company has a separate AWS account with a different billing and
reporting method. The acquiring company has consolidated all the
accounts into one organization in AWS Organizations. However, the
acquiring company has found it difficult to generate a cost report that
contains meaningful groups for all the teams. The acquiring company's
finance team needs a solution to report on costs for all the companies
through a self-managed application.
Which solution will meet these requirements?
- A. Create an AWS Cost and Usage Report for the organization. Define tags
and cost categories in the report. Create a table in Amazon Athena.
Create an Amazon QuickSight dataset based on the Athena table. Share the
dataset with the finance team
- B. Create an AWS Cost and Usage Report for the organization. Define tags
and cost categories in the report. Create a specialized template in AWS
Cost Explorer that the finance department will use to build reports
- C. Create an Amazon QuickSight dataset that receives spending
information from the AWS Price List Query API. Share the dataset with
the finance team
- D. Use the AWS Price List Query API to collect account spending
information. Create a specialized template in AWS Cost Explorer that the
finance department will use to build reports
View question →
-
Q75. Q150. A company wants to use AWS to create a business continuity
solution in case the company's main on- premises application fails. The
application runs on physical servers that also run other applications.
The on- premises application that the company is planning to migrate
uses a MySQL database as a data store. All the company's on-premises
applications use operating systems that are compatible with Amazon EC2.
Which solution will achieve the company's goal with the LEAST
operational overhead?
- A. Install the AWS Replication Agent on the source servers, including
the MySQL servers. Set up replication for all servers. Launch test
instances for regular drills. Cut over to the test instances to fail
over the workload in the case of a failure event
- B. Install the AWS Replication Agent on the source servers, including
the MySQL servers. Initialize AWS Elastic Disaster Recovery in the
target AWS Region. Define the launch settings. Frequently perform
failover and failback from the most recent point in time
- C. Create AWS Database Migration Service (AWS DMS) replication servers
and a target Amazon Aurora MySQL DB cluster to host the database. Create
a DMS replication task to copy the existing data to the target DB
cluster. Create a local AWS Schema Conversion Tool (AWS SCT) change data
capture (CDC) task to keep the data synchronized. Install the rest of
the software on EC2 instances by starting with a compatible base AMI
- D. Deploy an AWS Storage Gateway Volume Gateway on premises. Mount
volumes on all on-premises servers. Install the application and the
MySQL database on the new volumes. Take regular snapshots.Install all the software on EC2 instances by starting with a compatible
base AMI. Launch a Volume Gateway on an EC2 instance. Restore the
volumes from the latest snapshot. Mount the new volumes on the EC2
instances in the case of a failure event
View question →