Practice questions for the AWS SAP-C02 (Solutions Architect Professional) exam, Chapter 2.
-
Q1. Q151. A company runs a new application as a static website in Amazon
S3. The company has deployed the application to a production AWS account
and uses Amazon CloudFront to deliver the website. The website calls an
Amazon API Gateway REST API. An AWS Lambda function backs each API
method. The company wants to create a CSV report every 2 weeks to show
each API Lambda function's recommended configured memory, recommended
cost, and the price difference between current configurations and the
recommendations. The company will store the reports in an S3 bucket.
Which solution will meet these requirements with the LEAST development
time?
- A. Create a Lambda function that extracts metrics data for each API
Lambda function from Amazon CloudWatch Logs for the 2-week period.
Collate the data into tabular format. Store the data as a .csv file in
an S3 bucket. Create an Amazon EventBridge rule to schedule the Lambda
function to run every 2 weeks
- B. Opt in to AWS Compute Optimizer. Create a Lambda function that calls
the ExportLambdaFunctionRecommendations operation. Export the .csv file
to an S3 bucket Create an Amazon EventBridge rule to schedule the Lambda
function to run every 2 weeks
- C. Opt in to AWS Compute Optimizer. Set up enhanced infrastructure
metrics. Within the Compute Optimizer console, schedule a job to export
the Lambda recommendations to a.csv file. Store the file in an S3 bucket
every 2 weeks
- D. Purchase the AWS Business Support plan for the production account.
Opt in to AWS Compute Optimizer for AWS Trusted Advisor checks. In the
Trusted Advisor console. schedule a job to export the cost optimization
checks to a.csv file. Store the file in an S3 bucket every 2 weeks
View question →
-
Q2. Q152. A solutions architect is redesigning a three-tier application
that a company hosts on premises. The application provides personalized
recommendations based on user profiles. The company already has an AWS
account and has configured a VPC to host the application. The frontend
is a Java-based application that runs in on-premises VMs. The company
hosts a personalization model on a physical application server and uses
TensorFlow to implement the model. The personalization model uses
artificial intelligence and machine learning (AI/ML). The company stores
user information in a Microsoft SQL Server database. The web application
calls the personalization model, which reads the user profiles from the
database and provides recommendations. The company wants to migrate the
redesigned application to AWS. Which solution will meet this requirement
with the LEAST operational overhead?
- A. Use AWS Server Migration Service (AWS SMS) to migrate the on-premises
physical application server and the web application VMs to AWS. Use AWS
Database Migration Service (AWS DMS) to migrate the SQL Server database
to Amazon RDS for SQL Server
- B. Export the personalization model. Store the model artifacts in Amazon
S3. Deploy the model to Amazon SageMaker and create an endpoint Host the
Java application in AWS Elastic Beanstalk. Use AWS Database Migration
Service (AWS DMS) to migrate the SQL Server database to Amazon RDS for
SQL Serve
- C. Use AWS Application Migration Service to migrate the on-premises
personalization model and VMs to Amazon EC2 instances in Auto Scaling
groups. Use AWS Database Migration Service (AWS DMS) to migrate the SQL
Server database to an EC2 instance
- D. Containerize the personalization model and the Java application. Use
Amazon Elastic Kubernetes Service (Amazon EKS) managed node groups to
deploy the model and the application to Amazon EKS.
Host the node groups in a VPC. Use AWS Database Migration Service (AWS
DMS) to migrate the SQL Server database to Amazon RDS for SQL Server
View question →
-
Q3. Q153. A company is planning to migrate 1000 on-premises servers to
AWS. The servers run on several VMware clusters in the company's data
center As part of the migration plan, the company wants to gather serve
metrics such as CPU details, RAM usage operating system information, and
running processes. The company then wants to query and analyze the data.
Which solution will meet these requirements?
- A. Deploy and configure the AWS Agentless Discovery Connector virtual
appliance on the on-premises hosts. Configure Data Exploration in AWS
Migration Hub. Use AWS Glue to perform an ETL job against the data.
Query the data by using Amazon S3 Select
- B. Export only the VM performance information from the on-premises
hosts. Directly import the required data into AWS Migration Hub. Update
any missing information in Migration Hub. Query the data by using Amazon
QuickSight
- C. Create a script to automatically gather the server information from
the on-premises hosts. Use the AWS CLI to run the
put-resource-attributes command to store the detailed server data in AWS
Migration Hub.
Query the data directly in the Migration Hub console
- D. Deploy the AWS Application Discovery Agent to each on-premises
server. Configure Data Exploration in AWS Migration Hub. Use Amazon
Athena to run predefined queries against the data in Amazon S3
View question →
-
Q4. Q154. A company recently completed the migration from an on-premises
data center to the AWS Cloud by using a replatforming strategy. One of
the migrated servers is running a legacy Simple Mail Transfer Protocol
(SMTP) service that a critical application relies upon.
The application sends outbound email messages to the company's
customers. The legacy SMTP server does not support TLS encryption and
uses TCP port 25. The application can use SMTP only. The company decides
to use Amazon Simple Email Service (Amazon SES) and to decommission the
legacy SMTP server. The company has created and validated the SES
domain.The company has lifted the SES limits.
What should the company do to modify the application to send email
messages from Amazon SES?
- A. Configure the application to connect to Amazon SES by using TLS
Wrapper. Create an IAM role that has ses:SendEmail and ses:SendRawEmail
permissions. Attach the IAM role to an Amazon EC2 instance
- B. Configure the application to connect to Amazon SES by using STARTTLS.
Obtain Amazon SES SMTP credentials. Use the credentials to authenticate
with Amazon SES
- C. Configure the application to use the SES API to send email messages.
Create an IAM role that has ses:SendEmail and ses:SendRawEmail
permissions. Use the IAM role as a service role for Amazon SES
- D. Configure the application to use AWS SDKs to send email messages.
Create an IAM user for Amazon SES. Generate API access keys. Use the
access keys to authenticate with Amazon SES
View question →
-
Q5. Q155. A company is updating an application that customers use to make
online orders. The number of attacks on the application by bad actors
has increased recently.
The company will host the updated application on an Amazon Elastic
Container Service (Amazon ECS) cluster. The company will use Amazon
DynamoDB to store application data. A public Application Load
Balancer(ALB) will provide end users with access to the application. The
company must prevent prevent attacks and ensure business continuity with
minimal service interruptions during an ongoing attack. Which
combination of steps will meet these requirements MOST
cost_effectively? (Select TWO.)
- A. Create an Amazon CloudFront distribution with the ALB as the origin.
Add a custom header and random value on the CloudFront domain. Configure
the ALB to conditionally forward traffic if the header and value match
- B. Deploy the application in two AWS Regions. Configure Amazon Route 53
to route to both Regions with equal weight
- C. Configure auto scaling for Amazon ECS tasks. Create a DynamoDB
Accelerator (DAX) cluster
- D. Configure Amazon ElastiCache to reduce overhead on DynamoDB
- E. Deploy an AWS WAF web ACL that includes an appropriate rule group.
Associate the web ACL with the Amazon CloudFront distribution
View question →
-
Q6. Q156. A company runs an intranet application on premises. The company
wants to configure a cloud backup of the application. The company has
selected AWS Elastic Disaster Recovery for this solution. The company
requires that replication traffic does not travel through the public
internet. The application also must not be accessible from the internet.
The company does not want this solution to consume all available network
bandwidth because other applications require bandwidth. Which
combination of steps will meet these requirements?(Select THREE.)
- A. Create a VPC that has at least two private subnets, two NAT gateways,
and a virtual private gateway
- B. Create a VPC that has at least two public subnets, a virtual private
gateway, and an internet gateway
- C. Create an AWS Site-to-Site VPN connection between the on-premises
network and the target AWS network
- D. Create an AWS Direct Connect connection and a Direct Connect gateway
between the on-premises network and the target AWS network
- E. During configuration of the replication servers, select the option to
use private IP addresses for data replication
- F. During configuration of the launch settings for the target
servers,select the option to ensure that the Recovery instance's
private IP address matches the source serve's private IP address
View question →
-
Q7. Q157. A company uses Amazon S3 to store files and images in a variety
of storage classes. The company's S3 costs have increased substantially
during the past year.
A solutions architect needs to review data trends for the past 12 months
and identify the appropriate storage class for the objects.
Which solution will meet these requirements?
- A. Download AWS Cost and Usage Reports for the last 12 months of S3
usage. Review AWS Trusted Advisor recommendations for cost savings
- B. Use S3 storage class analysis. Import data trends into an Amazon
QuickSight dashboard to analyze storage trends
- C. Use Amazon S3 Storage Lens. Upgrade the default dashboard to include
advanced metrics for storage trends
- D. Use Access Analyzer for S3. Download the Access Analyzer for S3
report for the last 12 months. Import the .csv file to an Amazon
QuickSight dashboard
View question →
-
Q8. Q158. A company is building a serverless application that runs on an
AWS Lambda function that is attached to a VPC.The company needs to
integrate the application with a new service from an external provider.
The external provider supports only requests that come from public IPv4
addresses that are in an allow list. The company must provide a single
public IP address to the external provider before the application can
start using the new service.Which solution will give the application the ability to access the new
service?
- A. Deploy a NAT gateway. Associate an Elastic IP address with the NAT
gateway. Configure the VPC to use the NAT gateway
- B. Deploy an egress-only internet gateway. Associate an Elastic IP
address with the egress-only internet gateway. Configure the elastic
network interface on the Lambda function to use the egress-only internet
gateway
- C. Deploy an internet gateway. Associate an Elastic IP address with the
internet gateway. Configure the Lambda function to use the internet
gateway
- D. Deploy an internet gateway. Associate an Elastic IP address with the
internet gateway. Configure the default route in the public VPC route
table to use the internet gateway
View question →
-
Q9. Q159. A solutions architect wants to cost-optimize and appropriately
size Amazon EC2 instances in a single AWS account. The solutions
architect wants to ensure that the instances are optimized based on CPU,
memory, and network metricsWhich combination of steps should the solutions architect take to meet
these requirements? (Select TWO.)
- A. Purchase AWS Business Support or AWS Enterprise Support for the
account
- B. Turn on AWS Trusted Advisor and review any "Low Utilization Amazon
EC2 Instances" recommendations
- C. Install the Amazon CloudWatch agent and configure memory metric
collection on the EC2 instances
- D. Configure AWS Compute Optimizer in the AWS account to receive
findings and optimization recommendations
- E. Create an EC2 Instance Savings Plan for the AWS Regions, instance
families, and operating systems of interest
View question →
-
Q10. Q160. A company gives users the ability to upload images from a
custom application.The upload process invokes an AWS Lambda function
that processes and stores the image in an Amazon S3 bucket The
application invokes the Lambda function by using a specific function
version ARN. The Lambda function accepts image processing parameters by
using environment variables. The company often adjusts the environment
variables of the Lambda function to achieve optimal image processing
output. The company tests different parameters and publishes a new
function version with the updated environment variables after validating
results. This update process also requires frequent changes to the
custom application to invoke the new function version ARN. These changes
cause interruptions for users. A solutions architect needs to simplify
this process to minimize disruption to users. Which solution will meet
these requirements with the LEAST operational overhead?
- A. Directly modify the environment variables of the published Lambda
function version.Use the $LATEST version to test image processing
parameters
- B. Create an Amazon DynamoDB table to store the image processing
parameters. Modify the Lambda function to retrieve the image processing
parameters from the DynamoDB table
- C. Directly code the image processing parameters within the Lambda
function and remove the environment variables. Publish a new function
version when the company updates the parameters
- D. Create a Lambda function alias. Modify the client application to use
the function alias ARN. Reconfigure the Lambda alias to point to new
versions of the function when the company finishes testing
View question →
-
Q11. Q161. A company has an organization in AWS Organizations that
includes a separate AWS account for each of the company's departments.
Application teams from different departments develop and deploy
solutions independently
The company wants to reduce compute costs and manage costs appropriately
across departments. The company also wants to improve visibility into
billing for individual departments.The company does not want to lose
operational flexibility when the company selects compute resources.
Which solution will meet these requirements?
- A. Use AWS Budgets for each department. Use Tag Editor to apply tags to
appropriate resources.
Purchase EC2 Instance Savings Plans
- B. Configure AWS Organizations to use consolidated billing. Implement a
tagging strategy that identifies departments. Use SCPs to apply tags to
appropriate resources. Purchase EC2 Instance Savings Plans
- C. Configure AWS Organizations to use consolidated billing. Implement a
tagging strategy that identifies departments. Use Tag Editor to apply
tags to appropriate resources. Purchase Compute Savings Plans
- D. Use AWS Budgets for each department. Use SCPs to apply tags to
appropriate resources. Purchase Compute Savings Plans
View question →
-
Q12. Q162. A company is developing a new serverless API by using Amazon
API Gateway and AWS Lambda.The company integrated the Lambda functions
with API Gateway to use several shared libraries and custom classes.
A solutions architect needs to simplify the deployment of the solution
and optimize for code reuse.
Which solution will meet these requirements?
- A. Deploy the shared libraries and custom classes into a Docker image.
Store the image in an S3 bucket Create a Lambda layer that uses the
Docker image as the source. Deploy the API's Lambda functions as Zip
packages. Configure the packages to use the Lambda layer
- B. Deploy the shared libraries and custom classes to a Docker image.
Upload the image to Amazon Elastic Container Registry (Amazon ECR).
Create a Lambda layer that uses the Docker image as the source. Deploy
the API's Lambda functions as Zip packages. Configure the packages to
use the Lambda layer
- C. Deploy the shared libraries and custom classes to a Docker container
in Amazon Elastic Container Service (Amazon ECS) by using the AWS
Fargate launch type. Deploy the API's Lambda functions as Zip packages.
Configure the packages to use the deploved container as a Lambda layer
- D. Deploy the shared libraries,custom classes, and code for the API's
Lambda functions to a Docker image. Upload the image to Amazon Elastic
Container Registry (Amazon ECR). Configure the API's Lambda functions
to use the Docker image as the deployment package
View question →
-
Q13. Q163. A delivery company needs to migrate its third-party route
planning application to AWS. The third party supplies a supported Docker
image from a public registry. The image can run in as many containers as
required to generate the route map.
The company has divided the delivery area into sections with supply hubs
so that delivery drivers travel the shortest distance possible from the
hubs to the customers. To reduce the time necessary to generate route
maps, each section uses its own set of Docker containers with a custom
configuration that processes orders only in the section's area.
The company needs the ability to allocate resources cost-effectively
based on the number of running containers
Which solution will meet these requirements with the LEAST operational
overhead?
- A. Create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on
Amazon EC2. Use the Amazon EKS CLI to launch the planning application in
pods by using the --tags option to assign a custom tag to the pod
- B. Create an Amazon Elastic Kubernetes Service(Amazon EKS) cluster on
AWS Fargate. Use the Amazon EKS CLI to launch the planning application.
Use the AWS CLI tag-resource API call to assign a custom tag to the pod
- C. Create an Amazon Elastic Container Service (Amazon ECS) cluster on
Amazon EC2. Use the AWS CLI with run-tasks set to true to launch the
planning application by using the --tags option to assign a custom tag
to the task
- D. Create an Amazon Elastic Container Service (Amazon ECS) cluster on
AWS Fargate. Use the AWS CLI run-task command and set
enableECSManagedTags to true to launch the planning application.
Use the --tags option to assign a custom tag to the task
View question →
-
Q14. Q164. A company runs an application on AWS. The company curates data
from several different sources. The company uses proprietary algorithms
to perform data transformations and aggregations. After the company
performs ETL processes, the company stores the results in Amazon
Redshift tables. The company sells this data to other companies. The
company downloads the data as files from the Amazon Redshift tables and
transmits the files to several data customers by using FTP. The number
of data customers has grown significantly. Management of the data
customers has become difficult. The company will use AWS Data Exchange
to create a data product that the company can use to share data with
customers. The company wants to confirm the identities of the customers
before the company shares data. The customers also need access to the
most recent data when the company publishes the data.Which solution will meet these requirements with the LEAST operational
overhead?
- A. Use AWS Data Exchange for APIs to share data with customers.
Configure subscription verification. In the AWS account of the company
that produces the data, create an Amazon API Gateway Data API service
integration with Amazon Redshift Require the data customers to subscribe
to the data product
- B. In the AWS account of the company that produces the data, create an
AWS Data Exchange datashare by connecting AWS Data Exchange to the
Redshift cluster. Configure subscription verification. Require the data
customers to subscribe to the data product
- C. Download the data from the Amazon Redshift tables to an Amazon S3
bucket periodically. Use AWS Data Exchange for S3 to share data with
customers. Configure subscription verification. Require the data
customers to subscribe to the data product
- D. Publish the Amazon Redshift data to an Open Data on AWS Data
Exchange. Require the customers to subscribe to the data product in AWS
Data Exchange. In the AWS account of the company that produces the data,
attach IAM resource-based policies to the Amazon Redshift tables to
allow access only to verified AWS accounts
View question →
-
Q15. Q165. A company needs to monitor a growing number of Amazon S3
buckets across two AWS Regions. The company also needs to track the
percentage of objects that are encrypted in Amazon S3. The company needs
a dashboard to display this information for internal compliance teams.
Which solution will meet these requirements with the LEAST operational
overhead?
- A. Create a new S3 Storage Lens dashboard in each Region to track bucket
and encryption metrics Aggregate data from both Region dashboards into a
single dashboard in Amazon QuickSight for the compliance teams
- B. Deploy an AWS Lambda function in each Region to list the number of
buckets and the encryption status of objects. Store this data in Amazon
S3. Use Amazon Athena queries to display the data on a custom dashboard
in Amazon QuickSight for the compliance teams
- C. Use the S3 Storage Lens default dashboard to track bucket and
encryption metrics. Give the compliance teams access to the dashboard
directly in the S3 console
- D. Create an Amazon EventBridge rule to detect AWS CloudTrail events for
S3 object creation. Configure the rule to invoke an AWS Lambda function
to record encryption metrics in Amazon DynamoDB. Use Amazon QuickSight
to display the metrics in a dashboard for the compliance teams
View question →
-
Q16. Q166. A company is using Amazon OpenSearch Service to analyze data.
The company loads data into an OpenSearch Service cluster with 10 data
nodes from an Amazon S3 bucket that uses S3 Standard storage.The data
resides in the cluster for 1 month for read. only analysis. After 1
month, the company deletes the index that contains the data from the
cluster.For compliance purposes, the company must retain a copy of all
input data. The company is concerned about ongoing costs and asks a
solutions architect to recommend a new solution.Which solution will meet these requirements MOST cost-effectively?
- A. Replace all the data nodes with UltraWarm nodes to handle the
expected capacity. Transition the input data from S3 Standard to S3
Glacier Deep Archive when the company loads the data into the cluster
- B. Reduce the number of data nodes in the cluster to 2. Add UltraWarm
nodes to handle the expected capacity. Configure the indexes to
transition to UltraWarm when OpenSearch Service ingests the
data.Transition the input data to S3 Glacier Deep Archive after 1 month
by using an S3 Lifecycle policy
- C. Reduce the number of data nodes in the cluster to 2. Add UltraWarm
nodes to handle the expected capacity. Configure the indexes to
transition to UltraWarm when OpenSearch Service ingests the data.Add cold storage nodes to the cluster. Transition the indexes from
UltraWarm to cold storage. Delete the input data from the S3 bucket
after 1 month by using an S3 Lifecycle policy
- D. Reduce the number of data nodes in the cluster to 2. Add
instance-backed data nodes to handle the expected capacity. Transition
the input data from S3 Standard to S3 Glacier Deep Archive when the
company loads the data into the cluster
View question →
-
Q17. Q167. A company uses a service to collect metadata from applications
that the company hosts on premises. Consumer devices such as TVs and
internet radios access the applications. Many older devices do not
support certain HTTP headers and exhibit errors when these headers are
present in responses. The company has configured an on-premises load
balancer to remove the unsupported headers from responses sent to older
devices, which the company identified by the User-Agent headers. The
company wants to migrate the service to AWS, adopt serverless
technologies. and retain the ability to support the older devices. The
company has already migrated the applications into a set of AWS Lambda
functions.Which solution will meet these requirements?
- A. Create an Amazon CloudFront distribution for the metadata service.
Create an Application Load Balancer (ALB). Configure the CloudFront
distribution to forward requests to the ALB. Configure the ALB to invoke
the correct Lambda function for each type of request. Create a
CloudFront function to remove the problematic headers based on the value
of the User-Agent header
- B. Create an Amazon API Gateway REST API for the metadata service.
Configure API Gateway to invoke the correct Lambda function for each
type of request. Modify the default gateway responses to remove the
problematic headers based on the value of the User-Agent header
- C. Create an Amazon API Gateway HTTP API for the metadata service.
Configure API Gateway to invoke the correct Lambda function for each
type of request. Create a response mapping template to remove the
problematic headers based on the value of the User-Agent. Associate the
response data mapping with the HTTP API
- D. Create an Amazon CloudFront distribution for the metadata service.
Create an Application Load Balancer (ALB). Configure the CloudFront
distribution to forward requests to the ALB. Configure the ALB to invoke
the correct Lambda function for each type of request. Create a
Lambda@Edge function that will remove the problematic headers in
response to viewer requests based on the value of the User-Agent header
View question →
-
Q18. Q168. A software as a service (SaaS) based company provides a case
management solution to customers. As part of the solution, the company
uses a standalone Simple Mail Transfer Protocol (SMTP) server to send
email messages from an application.The application also stores an email
template for acknowledgement email messages that populate customer data
before the application sends the email message to the customer.The company plans to migrate this messaging functionality to the AWS
Cloud and needs to minimize operational overhead.Which solution will meet these requirements MOST cost-effectively?
- A. Set up an SMTP server on Amazon EC2 instances by using an AMI from
the AWS Marketplace. Store the email template in an Amazon S3 bucket.
Create an AWS Lambda function to retrieve the template from the S3
bucket and to merge the customer data from the application with the
template. Use an SDK in the Lambda function to send the email message
- B. Set up Amazon Simple Email Service(Amazon SES) to send email
messages. Store the email template in an Amazon S3 bucket. Create an AWS
Lambda function to retrieve the template from the S3 bucket and to merge
the customer data from the application with the template. Use an SDK in
the Lambda function to send the email message
- C. Set up an SMTP server on Amazon EC2 instances by using an AMI from
the AWS Marketplace. Store the email template in Amazon Simple Email
Service (Amazon SES) with parameters for the customer data. Create an
AWS Lambda function to call the SES template and to pass customer data
to replace the parameters. Use the AWS Marketplace SMTP server to send
the email message
- D. Set up Amazon Simple Email Service (Amazon SES) to send email
messages. Store the email template on Amazon SES with parameters for the
customer data. Create an AWS Lambda function to call the
SendTemplatedEmail API operation and to pass customer data to replace
the parameters and the email destination
View question →
-
Q19. Q169. A company has an application that runs as a ReplicaSet of
multiple pods in an Amazon Elastic Kubernetes Service (Amazon EKS)
cluster. The EKS cluster has nodes in multiple Availability Zones.The
application generates many small files that must be accessible across
all running instances of the application.The company needs to back up
the files and retain the backups for 1 year. Which solution will meet
these requirements while providing the FASTEST storage performance?
- A. Create an Amazon Elastic File System (Amazon EFS) file system and a
mount target for each subnet that contains nodes in the EKS cluster.
Configure the ReplicaSet to mount the file system. Direct the
application to store files in the file system Configure AWS Backup to
back up and retain copies of the data for 1 year
- B. Create an Amazon Elastic Block Store (Amazon EBS) volume.Enable the
EBS Multi-Attach feature.Configure the ReplicaSet to mount the EBS volume. Direct the application
to store files in the EBS volume. Configure AWS Backup to back up and
retain copies of the data for 1 year
- C. Create an Amazon S3 bucket. Configure the ReplicaSet to mount the S3
bucket. Direct the application to store files in the S3 bucket.
Configure S3 Versioning to retain copies of the data. Configure an S3
Lifecycle policy to delete objects after 1 year
- D. Configure the ReplicaSet to use the storage available on each of the
running application pods to store the files locally. Use a third-party
tool to back up the EKS cluster for 1 year
View question →
-
Q20. Q170. A company needs to audit the security posture of a newly
acquired AWS account. The company's data security team requires a
notification only when an Amazon S3 bucket becomes publicly exposed. The
company has already established an Amazon Simple Notification Service
(Amazon SNS) topic that has the data security team's email address
subscribed.Which solution will meet these requirements?
- A. Create an S3 event notification on all S3 buckets for the is Public
event. Select the SNS topic as the target for the event notifications
- B. Create an analyzer in AWS Identity and Access Management Access
Analyzer. Create an Amazon EventBridge rule for the event type "Access
Analyzer Finding" with a filter for "isPublic : true." Select the SNS
topic as the EventBridge rule target
- C. Create an Amazon EventBridge rule for the event type "Bucket-Level
API Call via CloudTrail" with a filter for "PutBucketPolicy" . Select
the SNS topic as the EventBridge rule target
- D. Activate AWS Config and add the cloudtrail-s3-dataevents-enabled
rule. Create an Amazon EventBridge rule for the event type "Config
Rules Re-evaluation Status" with a filter for "NON COMPLIANT" Select
the SNS topic as the EventBridge rule target
View question →
-
Q21. Q171. A company is migrating a document processing workload to AWS.
The company has updated many applications to natively use the Amazon S3
API to store, retrieve, and modify documents that a processing server
generates at a rate of approximately 5 documents every second. After the
document processing is finished, customers can download the documents
directly from Amazon S3 During the migration, the company discovered
that it could not immediately update the processing server that
generates many documents to support the S3 API. The server runs on Linux
and requires fast local access to the files that the server generates
and modifies. When the server finishes processing, the files must be
available to the public for download within 30 minutes.Which solution will meet these requirements with the LEAST amount of
effort?
- A. Migrate the application to an AWS Lambda function. Use the AWS SDK
for Java to generate, modify, and access the files that the company
stores directly in Amazon S3
- B. Set up an Amazon S3 File Gateway and configure a file share that is
linked to the document store.Mount the file share on an Amazon EC2 instance by using NFS. When
changes occur in Amazon S3.initiate a RefreshCache API call to update the S3 File Gateway
- C. Configure Amazon FSx for Lustre with an import and export policy.
Link the new file system to an S3 bucket. Install the Lustre client and
mount the document store to an Amazon EC2 instance by using NFS
- D. Configure AWS DataSync to connect to an Amazon EC2 instance.
Configure a task to synchronize the generated files to and from Amazon
S3
View question →
-
Q22. Q172. Example Corp. has an on-premises data center and a VPC named VPC A in the Example Corp. AWS account. The on-premises network connects to VPC A through an AWS Site-To-Site VPN. The on-premises servers can properly access VPC A.Example Corp. just acquired AnyCompany, which has a VPC named VPC B, There is no IP address overlap among these networks.Example Corp. has peered VPC Aand VPC B,Example Corp. wants to connect from its on-premise servers to VPC B.Example Corp. has properly set up the network ACL and security groups.Which solution will meet this requirement with the LEAST operational effort?
- A. Create a transit gateway. Attach the Site-to-Site VPN, VPC A, and VPC B to the transit gateway.Update the transit gateway route tables for all networks to add IP range routes for all other networks
- B. Create a transit gateway. Create a Site-to-Site VPN connectionbetween the on-premises network and VPC B, and connect the VPN connection to the transit gateway. Add a route to direct traffic to the peered VPCs, and add an authorization rule to give clients access to the VPCs A and B
- C. Update the route tables for the Site-to-Site VPN and both VPCs for all three networks. Configure BGP propagation for all three networks. Wait for up to 5 minutes for BGP propagation to finish
- D. Modify the Site-to-Site VPN's virtual private gateway definition to include VPC A and VPC B. Split the two routers of the virtual private getaway between the two VPCs
View question →
-
Q23. Q173. A company has a critical application in which the data tier is
deployed in a single AWS Region. The data tier uses an Amazon DynamoDB
table and an Amazon Aurora MySQL DB cluster. The current Aurora MySQL
engine version supports a global database. The application tier is
already deployed in two Regions Company policy states that critical
applications must have application tier components and data tier
components deployed across two Regions. The RTO and RPO must be no more
than a few minutes each. A solutions architect must recommend a solution
to make the data tier compliant with company policy. Which combination
of steps will meet these requirements?(Select TWO.)
- A. Add another Region to the Aurora MySQL DB cluster
- B. Add another Region to each table in the Aurora MySQL DB cluster
- C. Set up scheduled cross-Region backups for the DynamoDB table and the
Aurora MySQL DB cluster
- D. Convert the existing DynamoDB table to a global table by adding
another Region to its configuration
- E. Use Amazon Route 53 Application Recovery Controller to automate
database backup and recovery to the secondary Region
View question →
-
Q24. Q174. A company wants to migrate to AWS. The company is running
thousands of VMs in a VMware ESXi environment. The company has no
configuration management database and has little knowledge about the
utilization of the VMware portfolio.
A solutions architect must provide the company with an accurate
inventory so that the company can plan for a cost-effective migration.
Which solution will meet these requirements with the LEAST operational
overhead?
- A. Use AWS Systems Manager Patch Manager to deploy Migration Evaluator
to each VM. Review the collected data in Amazon QuickSight. Identify
servers that have high utilization Remove the servers that have high
utilization from the migration list. Import the data to AWS Migration
Hub
- B. Export the VMware portfolio to a .csv file. Check the disk
utilization for each server. Remove servers that have high utilization.
Export the data to AWS Application Migration Service.
Use AWS Server Migration Service (AWS SMS) to migrate the remaining
servers
- C. Deploy the Migration Evaluator agentless collector to the ESXi
hypervisor. Review the collected data in Migration Evaluator. Identify
inactive servers. Remove the inactive servers from the migration list.
Import the data to AWS Migration Hub
- D. Deploy the AWS Application Migration Service Agent to each VM. When
the data is collected, use Amazon Redshift to import and analyze the
data. Use Amazon QuickSight for data visualization
View question →
-
Q25. Q175. A company has an application that runs on Amazon EC2 instances.
A solutions architect is designing VPC infrastructure in an AWS Region
where the application needs to access an Amazon. Aurora DB cluster. The
EC2 instances are all associated with the same security group.The DB
cluster is associated with its own security group.The solutions architect needs to add rules to the security groups to
provide the application with least privilege access to the DB cluster.Which combination of steps will meet these requirements?(Select TWO.)
- A. Add an inbound rule to the EC2 instances' security group. Specify
the DB cluster's security group as the source over the default Aurora
port
- B. Add an outbound rule to the EC2 instances' security group. Specify
the DB cluster's security group as the destination over the default
Aurora port
- C. Add an inbound rule to the DB cluster's security group. Specify the
EC2 instances' security group as the source over the default Aurora
port
- D. Add an outbound rule to the DB cluster's security group. Specify the
EC2 instances' security group as the destination over the default
Aurora port
- E. Add an outbound rule to the DB cluster's security group. Specify the
EC2 instances' security group as the destination over the ephemeral
ports
View question →
-
Q26. Q176. A solutions architect needs to assess a newly acquired
company's portfolio of applications and databases. The solutions
architect must create a business case to migrate the portfolio to AWS.
The newly acquired company runs applications in an on-premises data
center. The data center is not well documented. The solutions architect
cannot immediately determine how many applications and databases exist.
Traffic for the applications is variable. Some applications are batch
processes that run at the end of each month.
The solutions architect must gain a better understanding of the
portfolio before a migration to AWS can begin.
Which solution will meet these requirements?
- A. Use AWS Server Migration Service (AWS SMS) and AWS Database Migration
Service (AWS DMS) to evaluate migration. Use AWS Service Catalog to
understand application and database dependencies
- B. Use AWS Application Migration Service. Run agents on the on-premises
infrastructure. Manage the agents by using AWS Migration Hub. Use AWS
Storage Gateway to assess local storage needs and database dependencies
- C. Use Migration Evaluator to generate a list of servers. Build a report
for a business case. Use AWS Migration Hub to view the portfolio. Use
AWS Application Discovery Service to gain an understanding of
application dependencies
- D. Use AWS Control Tower in the destination account to generate an
application portfolio. Use AWS Server Migration Service (AWS SMS) to
generate deeper reports and a business case. Use a landing zone for core
accounts and resources
View question →
-
Q27. Q177. A company uses an AWS CodeCommit repository. The company must
store a backup copy of the data that is in the repository in a second
AWS Region.Which solution will meet these requirements?
- A. Configure AWS Elastic Disaster Recovery to replicate the CodeCommit
repository data to the second Region
- B. Use AWS Backup to back up the CodeCommit repository on an hourly
schedule. Create a cross- Region copy in the second Region.
- C. Create an Amazon EventBridge rule to invoke AWS CodeBuild when the
company pushes code to the repository. Use CodeBuild to clone the
repository. Create a zip file of the content. Copy the file to an S3
bucket in the second Region
- D. Create an AWS Step Functions workflow on an hourly schedule to take a
snapshot of the CodeCommit repository. Configure the workflow to copy
the snapshot to an S3 bucket in the second Region
View question →
-
Q28. Q178. A company wants to containerize a multi-tier web application
and move the application from an on- premises data center to AWS. The
application includes web, application, and database tiers. The company
needs to make the application fault tolerant and scalable. Some
frequently accessed data must always be available across application
servers. Frontend web servers need session persistence and must scale to
meet increases in traffic.Which solution will meet these requirements with the LEAST ongoing
operational overhead?
- A. Run the application on Amazon Elastic Container Service (Amazon ECS)
on AWS Fargate. Use Amazon Elastic File System (Amazon EFS) for data
that is frequently accessed between the web and application tiers. Store
the frontend web server session data in Amazon Simple Queue Service
(Amazon SQS)
- B. Run the application on Amazon Elastic Container Service (Amazon ECS)
on Amazon EC2. Use Amazon ElastiCache for Redis to cache frontend web
server session data. Use Amazon Elastic Block Store (Amazon EBS) with
Multi-Attach on EC2 instances that are distributed across multiple
Availability Zones
- C. Run the application on Amazon Elastic Kubernetes Service (Amazon
EKS). Configure Amazon EKS to use managed node groups. Use ReplicaSets
to run the web servers and applications. Create an Amazon Elastic File
System (Amazon EFS) file system. Mount the EFS file system across all
EKS pods to store frontend web server session data
- D. Deploy the application on Amazon Elastic Kubernetes Service (Amazon
EKS). Configure Amazon EKS to use managed node groups. Run the web
servers and application as Kubernetes deployments in the EKS cluster.
Store the frontend web server session data in an Amazon DynamoDB table.
Create an Amazon Elastic File System (Amazon EFS) volume that all
applications will mount at the time of deployment
View question →
-
Q29. Q179. A company is deploying AWS Lambda functions that access an
Amazon RDS for PostgreSQL database. The company needs to launch the
Lambda functions in a QA environment and in a production environment.
The company must not expose credentials within application code and must
rotate passwords automatically.
Which solution will meet these requirements?
- A. Store the database credentials for both environments in AWS Systems
Manager Parameter Store.
Encrypt the credentials by using an AWS Key Management Service (AWS KMS)
key Within the application code of the Lambda functions, pull the
credentials from the Parameter Store parameter by using the AWS SDK for
Python (Boto3). Add a role to the Lambda functions to provide access to
the Parameter Store parameter
- B. Store the database credentials for both environments in AWS Secrets
Manager with distinct key entry for the QA environment and the
production environment. Turn on rotation Provide a reference to the
Secrets Manager key as an environment variable for the Lambda functions
- C. Store the database credentials for both environments in AWS Key
Management Service (AWS KMS).
Turn on rotation. Provide a reference to the credentials that are stored
in AWS KMS as an environment variable for the Lambda functions
- D. Create separate S3 buckets for the QA environment and the production
environment. Turn on server- side encryption with AWS KMS keys (SSE-KMS)
for the S3 buckets. Use an object naming pattern that gives each Lambda
function's application code the ability to pull the correct credentials
for the function's corresponding environment. Grant each Lambda
function's execution role access to Amazon S3
View question →
-
Q30. Q180. A manufacturing company is building an inspection solution for
its factory. The company has IP cameras at the end of each assembly
line. The company has used Amazon SageMaker to train a machine learning
(ML) model to identify common defects from still images.
The company wants to provide local feedback to factory workers when a
defect is detected. The company must be able to provide this feedback
even if the factory's internet connectivity is down. The company has a
local Linux server that hosts an API that provides local feedback to the
workers. How should the company deploy the ML model to meet these
requirements?
- A. Set up an Amazon Kinesis video stream from each IP camera to AWS. Use
Amazon EC2 instances to take still images of the streams. Upload the
images to an Amazon S3 bucket.
Deploy a SageMaker endpoint with the ML model Invoke an AWS Lambda
function to call the inference endpoint when new images are uploaded.
Configure the Lambda function to call the local API when a defect is
detected
- B. Deploy AWS loT Greengrass on the local server. Deploy the ML model to
the Greengrass server.
Create a Greengrass component to take still images from the cameras and
run inference. Configure the component to call the local API when a
defect is detected
- C. Order an AWS Snowball device. Deploy a SageMaker endpoint, the ML
model, and an Amazon EC2 instance on the Snowball device. Take still
images from the cameras. Run inference from the EC2 instance. Configure
the instance to call the local API when a defect is detected
- D. Deploy Amazon Monitron devices on each IP camera. Deploy an Amazon
Monitron Gateway on premises. Deploy the ML model to the Amazon Monitron
devices. Use Amazon Monitron health state alarms to call the local API
from an AWS Lambda function when a defect is detected
View question →
-
Q31. Q181. A delivery company is running a serverless solution in the AWS
Cloud. The solution manages user data, delivery information, and past
purchase details. The solution consists of several microservices. The
central user service stores sensitive data in an Amazon DynamoDB table.
Several of the other microservices store a copy of parts of the
sensitive data in different storage services. The company needs the
ability to delete user information upon request. As soon as the central
user service deletes a user, every other microservice must also delete
its copy of the data immediately.
Which solution will meet these requirements?
- A. Activate DynamoDB Streams on the DynamoDB table. Create an AWS Lambda
trigger for the DynamoDB stream that will post events about user
deletion in an Amazon Simple Queue Service (Amazon SQS) queue. Configure
each microservice to poll the queue and delete the user from the
DynamoDB table
- B. Set up DynamoDB event notifications on the DynamoDB table. Create an
Amazon Simple Notification Service (Amazon SNS) topic as a target for
the DynamoDB event notification.
Configure each microservice to subscribe to the SNS topic and to delete
the user from the DynamoDB table
- C. Configure the central user service to post an event on a custom
Amazon EventBridge event bus when the company deletes a user. Create an
EventBridge rule for each microservice to match the user deletion event
pattern and invoke logic in the microservice to delete the user from the
DynamoDB table
- D. Configure the central user service to post a message on an Amazon
Simple Queue Service (Amazon SQS) queue when the company deletes a user.
Configure each microservice to create an event filter on the SQS queue
and to delete the user from the DynamoDB table
View question →
-
Q32. Q182. A company has multiple business units that each have separate
accounts on AWS. Each business unit manages its own network with several
VPCs that have CIDR ranges that overlap. The company's marketing team
has created a new internal application and wants to make the application
accessible to all the other business units. The solution must use
private IP addresses only. Which solution will meet these requirements
with the LEAST operational overhead?
- A. Instruct each business unit to add a unique secondary CIDR range to
the business unit's VPC. Peer the VPCs and use a private NAT gateway in
the secondary range to route traffic to the marketing team
- B. Create an Amazon EC2 instance to serve as a virtual appliance in the
marketing account's VPC. Create an AWS Site-to-Site VPN connection
between the marketing team and each business unit's VPC.
Perform NAT where necessary
- C. Create an AWS PrivateLink endpoint service to share the marketing
application. Grant permission to specific AWS accounts to connect to the
service. Create interface VPC endpoints in other accounts to access the
application by using private IP addresses
- D. Create a Network Load Balancer (NLB) in front of the marketing
application in a private subnet. Create an API Gateway API. Use the
Amazon API Gateway private integration to connect the API to the NLB.
Activate IAM authorization for the API. Grant access to the accounts of
the other business units
View question →
-
Q33. Q183. A company has deployed an application on AWS Elastic Beanstalk.
The application uses Amazon Aurora for the database layer. An Amazon
CloudFront distribution serves web requests and includes the Elastic
Beanstalk domain name as the origin server. The distribution is
configured with an alternate domain name that visitors use when they
access the application Each week, the company takes the application out
of service for routine maintenance. During the time that the application
is unavailable, the company wants visitors to receive an informational
message instead of a CloudFront error message. A solutions architect
creates an Amazon S3 bucket as the first step in the process. Which
combination of steps should the solutions architect take next to meet
the requirements? (Select THREE)
- A. Upload static informational content to the S3 bucket
- B. Create a new CloudFront distribution. Set the S3 bucket as the origin
- C. Set the S3 bucket as a second origin in the original CloudFront
distribution. Configure the distribution and the S3 bucket to use an
origin access identity (OAI)
- D. During the weekly maintenance, edit the default cache behavior to use
the S3 origin. Revert the change when the maintenance is complete
- E. During the weekly maintenance. create a cache behavior for the S3
origin on the new distribution. Set the path pattern to *. Set the
precedence to 0. Delete the cache behavior when the maintenance is
complete
- F. During the weekly maintenance, configure Elastic Beanstalk to serve
traffic from the S3 bucket
View question →
-
Q34. Q184. A company hosts a VPN in an on-premises data center. Employees
currently connect to the VPN to access files in their Windows home
directories. Recently, there has been a large growth in the number of
employees who work remotely. As a result, bandwidth usage for
connections into the data center has begun to reach 100% during business
hours.
The company must design a solution on AWS that will support the growth
of the company's remote workforce, reduce the bandwidth usage for
connections into the data center, and reduce operational overhead.
Which combination of steps will meet these requirements with the LEAST
operational overhead? (Select TWO.)
- A. Create an AWS Storage Gateway Volume Gateway. Mount a volume from the
Volume Gateway to the on-premises file server
- B. Migrate the home directories to Amazon FSx for Windows File Server
- C. Migrate the home directories to Amazon FSx for Lustre
- D. Migrate remote users to AWS Client VPN
- E. Create an AWS Direct Connect connection from the on-premises data
center to AWS
View question →
-
Q35. Q185. A company manufactures smart vehicles. The company uses a
custom application to collect vehicle data. The vehicles use the MQTT
protocol to connect to the application. The company processes the data
in 5- minute intervals. The company then copies vehicle telematics data
to on-premises storage. Custom applications analyze this data to detect
anomalies.
The number of vehicles that send data grows constantly. Newer vehicles
generate high volumes of data. The on-premises storage solution is not
able to scale for peak traffic, which results in data loss. The company
must modernize the solution and migrate the solution to AWS to resolve
the scaling challenges. Which solution will meet these requirements with
the LEAST operational overhead?
- A. Use AWS loT Greengrass to send the vehicle data to Amazon Managed
Streaming for Apache Kafka (Amazon MSK). Create an Apache Kafka
application to store the data in Amazon S3. Use a pretrained model in
Amazon SageMaker to detect anomalies
- B. Use AWS loT Core to receive the vehicle data. Configure rules to
route data to an Amazon Kinesis Data Firehose delivery stream that
stores the data in Amazon S3. Create an Amazon Kinesis Data Analytics
application that reads from the delivery stream to detect anomalies
- C. Use AWS loT FleetWise to collect the vehicle data. Send the data to
an Amazon Kinesis data stream.
Use an Amazon Kinesis Data Firehose delivery stream to store the data in
Amazon S3. Use the built-in machine learning transforms in AWS Glue to
detect anomalies
- D. Use Amazon MQ for RabbitMQ to collect the vehicle data. Send the data
to an Amazon Kinesis Data Firehose delivery stream to store the data in
Amazon S3. Use Amazon Lookout for Metrics to detect anomalies
View question →
-
Q36. Q186. A company developed a pilot application by using AWS Elastic
Beanstalk and Java. To save costs during development, the company's
development team deployed the application into a single-instance
environment Recent tests indicate that the application consumes more CPU
than expected. CPU utilization is regularly greater than 85%, which
causes some performance bottlenecks. A solutions architect must mitigate
the performance issues before the company launches the application to
productionWhich solution will meet these requirements with the LEAST operational
overhead?
- A. Create a new Elastic Beanstalk application. Select a load-balanced
environment type. Select all Availability Zones. Add a scale-out rule
that will run if the maximum CPU utilization is over 85% for 5 minutes
- B. Create a second Elastic Beanstalk environment. Apply the
traffic-splitting deployment policy. Specify a percentage of incoming
traffic to direct to the new environment if the average CPU utilization
is over 85%for 5 minutes
- C. Modify the existing environment's capacity configuration to use a
load-balanced environment type.
Select all Availability Zones. Add a scale-out rule that will run if the
average CPU utilization is over 85% for 5 minutes
- D. Select the Rebuild environment action with the load balancing option.
Select all Availability Zones. Add a scale-out rule that will run if the
sum CPU utilization is over 85% for 5 minutes
View question →
-
Q37. Q187. A company runs a microservice as an AWS Lambda function.
The microservice writes data to an on- premises SQL database that
supports a limited number of concurrent connections. When the number of
Lambda function invocations is too high, the database crashes and causes
application downtime. The company has an AWS Direct Connect connection
between the company's VPC and the on-premises data center. The company
wants to protect the database from crashes.Which solution will meet these requirements?
- A. Write the data to an Amazon Simple Queue Service (Amazon SQS) queue.
Configure the Lambda function to read from the queue and write to the
existing database. Set a reserved concurrency limit on the Lambda
function that is less than the number of connections that the database
supports
- B. Create a new Amazon Aurora Serverless DB cluster. Use AWS DataSync to
migrate the data from the existing database to Aurora Serverless.
Reconfigure the Lambda function to write to Aurora
- C. Create an Amazon RDS Proxy DB instance. Attach the RDS Proxy DB
instance to the Amazon RDS DB instance. Reconfigure the Lambda function
to write to the RDS Proxy DB instance
- D. Write the data to an Amazon Simple Notification Service (Amazon SNS)
topic. Invoke the Lambda function to write to the existing database when
the topic receives new messages. Configure provisioned concurrency for
the Lambda function to be equal to the number of connections that the
database supports
View question →
-
Q38. Q188. A company is running a compute workload by using Amazon EC2
Spot Instances that are in an Auto Scaling group. The launch template
uses two placement groups and a single instance type. Recently, a
monitoring system reported Auto Scaling instance launch failures that
correlated with longer wait times for system users. The company needs to
improve the overall reliability of the workload.
Which solution will meet this requirement?
- A. Replace the launch template with a launch configuration to use an
Auto Scaling group that uses attribute-based instance type selection.
- B. Create a new launch template version that uses attribute-based
instance type selection. Configure the Auto Scaling group to use the new
launch template version.
- C. Update the launch template Auto Scaling group to increase the number
of placement groups.
- D. Update the launch template to use a larger instance type.
View question →
-
Q39. Q189. A company is building a solution in the AWS Cloud. Thousands of
devices will connect to the solution and send data. Each device needs to
be able to send and receive data in real time over the MQTT protocol.
Each device must authenticate by using a unique X 509 certificate. Which
solution will meet these requirements with the LEAST operational
overhead?
- A. Set up AWS loT Core. For each device, create a corresponding Amazon
MQ queue and provision a certificate. Connect each device to Amazon MQ
- B. Create a Network Load Balancer (NLB) and configure it with an AWS
Lambda authorizer. Run an MQTT broker on Amazon EC2 instances in an Auto
Scaling group. Set the Auto Scaling group as the target for the NLB.
Connect each device to the NLB
- C. Set up AWS loT Core. For each device, create a corresponding AWS loT
thing and provision a certificate. Connect each device to AWS loT Core
- D. Set up an Amazon API Gateway HTTP API and a Network Load Balancer
(NLB). Create integration between API Gateway and the NLB. Configure a
mutual TLS certificate authorizer on the HTTP API.
Run an MQTT broker on an Amazon EC2 instance that the NLB targets.
Connect each device to the NLB
View question →
-
Q40. Q190. A company is hosting a three-tier web application in an
on-premises environment. Due to a recent surge in traffic that resulted
in downtime and a significant financial impact, company management has
ordered that the application be moved to AWS. The application is written
in .NET and has a dependency on a MySQL database. A solutions architect
must design a scalable and highly available solution to meet the demand
of 200,000 daily users.
Which steps should the solutions architect take to design an appropriate
solution?
- A. Use AWS Elastic Beanstalk to create a new application with a web
server environment and an Amazon RDS MySQL Multi-AZ DB instance.The
environment should launch a Network Load Balancer (NLB) in front of an
Amazon EC2 Auto Scaling group in multiple Availability Zones. Use an
Amazon Route 53 alias record to route traffic from the company's domain
to the NLB
- B. Use AWS CloudFormation to launch a stack containing an Application
Load Balancer (ALB) in front of an Amazon EC2 Auto Scaling group
spanning three Availability Zones. The stack should launch a Multi- AZ
deployment of an Amazon Aurora MySQL DB cluster with a Retain deletion
policy. Use an Amazon Route 53 alias record to route traffic from the
company's domain to the ALB
- C. Use AWS Elastic Beanstalk to create an automatically scaling web
server environment that spans two separate Regions with an Application
Load Balancer (ALB)
in each Region. Create a Multi-AZ deployment of an Amazon Aurora MySQL
DB cluster with a cross- Region read replica. Use Amazon Route 53 with a
geoproximity routing policy to route traffic between the two Regions
- D. Use AWS CloudFormation to launch a stack containing an Application
Load Balancer (ALB) in front of an Amazon ECS cluster of Spot Instances
spanning three Availability Zones.The stack should launch an Amazon RDS
MySQL DB instance with a Snapshot deletion policy. Use an Amazon Route
53 alias record to route traffic from the company's domain to the ALB
View question →
-
Q41. Q191. A company uses a Grafana data visualization solution that runs
on a single Amazon EC2 instance to monitor the health of the company's
AWS workloads. The company has invested time and effort to create
dashboards that the company wants to preserve. The dashboards need to be
highly available and cannot be down for longer than 10 minutes. The
company needs to minimize ongoing maintenance. Which solution will meet
these requirements with the LEAST operational overhead?
- A. Migrate to Amazon CloudWatch dashboards. Recreate the dashboards to
match the existing Grafana dashboards. Use automatic dashboards where
possible
- B. Create an Amazon Managed Grafana workspace. Configure a new Amazon
CloudWatch data source.
Export dashboards from the existing Grafana instance. Import the
dashboards into the new workspace
- C. Create an AMI that has Grafana pre-installed. Store the existing
dashboards in Amazon Elastic File System (Amazon EFS). Create an Auto
Scaling group that uses the new AMI. Set the Auto Scaling group's
minimum, desired, and maximum number of instances to one Create an
Application Load Balancer that serves at least two Availability Zones
- D. Configure AWS Backup to back up the EC2 instance that runs Grafana
once each hour. Restore the EC2 instance from the most recent snapshot
in an alternate Availability Zone when required
View question →
-
Q42. Q192. A company has millions of objects in an Amazon S3 bucket. The
objects are in the S3 Standard storage class. All the S3 objects are
accessed frequently. The number of users and applications that access
the objects is increasing rapidly. The objects are encrypted with
server-side encryption with AWS KMS keys (SSE-KMS).
A solutions architect reviews the company's monthly AWS invoice and
notices that AWS KMS costs are increasing because of the high number of
requests from Amazon S3. The solutions architect needs to optimize costs
with minimal changes to the application.
Which solution will meet these requirements with the LEAST operational
overhead?
- A. Create a new S3 bucket that has server-side encryption with
customer-provided keys (SSE-C) as the encryption type. Copy the existing
objects to the new S3 bucket Specify SSE-C
- B. Create a new S3 bucket that has server-side encryption with Amazon S3
managed keys(SSE-S3) as the encryption type Use S3 Batch Operations to
copy the existing objects to the new S3 bucket Specify SSE-S3
- C. Use AWS CloudHSM to store the encryption keys. Create a new S3
bucket. Use S3 Batch Operations to copy the existing objects to the new
S3 bucket Encrypt the objects by using the keys from CloudHSM
- D. Use the S3 Intelligent-Tiering storage class for the S3 bucket Create
an S3 Intelligent-Tiering archive configuration to transition objects
that are not accessed for 90 days to S3 Glacier Deep Archive
View question →
-
Q43. Q193. A company has loT sensors that monitor traffic patterns
throughout a large city. The company wants to read and collect data from
the sensors and perform aggregations on the data. A solutions architect
designs a solution in which the loT devices are streaming to Amazon
Kinesis Data Streams. Several applications are reading from the stream.
However, several consumers are experiencing throttling and are
periodically encountering a ReadProvisionedThroughputExceeded erro.
Which actions should the solutions architect take to resolve this issue?
(Select THREE.)
- A. Reshard the stream to increase the number of shards in the stream
- B. Use the Kinesis Producer Library (KPL) Adjust the polling frequency
- C. Use consumers with the enhanced fan-out feature
- D. Reshard the stream to reduce the number of shards in the stream
- E. Use an error retry and exponential backoff mechanism in the consumer
logic
- F. Configure the stream to use dynamic partitioning
View question →
-
Q44. Q194. A company is designing an AWS Organizations structure. The
company wants to standardize a process to apply tags across the entire
organization. The company will require tags with specific values when a
user creates a new resource. Each of the company's OUs will have unique
tag values.Which solution will meet these requirements?
- A. Use an SCP to deny the creation of resources that do not have the
required tags Create a tag policy that includes the tag values that the
company has assigned to each OU. Attach the tag policies to the OUs
- B. Use an SCP to deny the creation of resources that do not have the
required tags. Create a tag policy that includes the tag values that the
company has assigned to each OU. Attach the tag policies to the
organization's management account
- C. Use an SCP to allow the creation of resources only when the resources
have the required tags. Create a tag policy that includes the tag values
that the company has assigned to each OU. Attach the tag policies to the
OUs
- D. Use an SCP to deny the creation of resources that do not have the
required tags. Define the list of tags.Attach the SCP to the OUs
View question →
-
Q45. Q195. A company wants to use AWS for disaster recovery for an
on-premises application. The company has hundreds of Windows-based
servers that run the application. All the servers mount a common share.
The company has an RTO of 15 minutes and an RPO of 5 minutes. The
solution must support native failover and falback capabilities.Which solution will meet these requirements MOST cost-effectively?
- A. Create an AWS Storage Gateway File Gateway. Schedule daily Windows
server backups. Save the data to Amazon S3. During a disaster, recover
the on-premises servers from the backup. During failback, run the
on-premises servers on Amazon EC2 instances
- B. Create a set of AWS CloudFormation templates to create
infrastructure. Replicate all data to Amazon Elastic File System (Amazon
EFS) by using AWS DataSync During a disaster, use AWS CodePipeline to
deploy the templates to restore the on- premises servers. Fail back the
data by using DataSync
- C. Create an AWS Cloud Development Kit (AWS CDK) pipeline to stand up a
multi-site active-active environment on AWS. Replicate data into Amazon
S3 by using the S3 sync command. During a disaster, swap DNS endpoints
to point to AWS Fail back the data by using the S3 sync command
- D. Use AWS Elastic Disaster Recovery to replicate the on-premises
servers. Replicate data to an Amazon FSx for Windows File Server file
system by using AWS DataSync. Mount the file system to AWS servers.
During a disaster, fail over the on: premises servers to AWS. Fail back
to new or existing servers by using Elastic Disaster Recovery
View question →
-
Q46. Q196. A company runs a processing engine in the AWS Cloud The engine
processes environmental data from logistics centers to calculate a
sustainability index. The company has millions of devices in logistics
centers that are spread across Europe. The devices send information to
the processing engine through a RESTful APi.
The API experiences unpredictable bursts of traffic. The company must
implement a solution to process all data that the devices send to the
processing engine. Data loss is unacceptable.
Which solution will meet these requirements?
- A. Create an Application Load Balancer (ALB) for the RESTful API. Create
an Amazon Simple Queue Service (Amazon SQS) queue. Create a listener and
a target group for the ALB. Add the SQS queue as the target Use a
container that runs in Amazon Elastic Container Service (Amazon ECS)
with the Fargate launch type to process messages in the queue
- B. Create an Amazon API Gateway HTTP API that implements the RESTful
API. Create an Amazon Simple Queue Service (Amazon SQS) queue. Create an
API Gateway service integration with the SQS queue. Create an AWS Lambda
function to process messages in the SQS queue
- C. Create an Amazon API Gateway REST API that implements the RESTful API
Create a fleet of Amazon EC2 instances in an Auto Scaling group. Create
an API Gateway Auto Scaling group proxy integration.
Use the EC2 instances to process incoming data
- D. Create an Amazon CloudFront distribution for the RESTful API. Create
a data stream in Amazon Kinesis Data Streams Set the data stream as the
origin for the distribution. Create an AWS Lambda function to consume
and process data in the data stream
View question →
-
Q47. Q197. A company has migrated an application from on premises to
AWS.The application frontend is a static website that runs on two Amazon
EC2 instances behind an Application Load Balancer (ALB). The application
backend is a Python application that runs on three EC2 instances behind
another ALB. The EC2 instances are large, general purpose On-Demand
Instances that were sized to meet the on-premises specifications for
peak usage of the application.
The application averages hundreds of thousands of requests each month.
However, the application is used mainly during lunchtime and receives
minimal traffic during the rest of the day. A solutions architect needs
to optimize the infrastructure cost of the application without
negatively affecting the application availability.
Which combination of steps will meet these requirements?(Select TWO.)
- A. Change all the EC2 instances to compute optimized instances that have
the same number of cores as the existing EC2 instances
- B. Move the application frontend to a static website that is hosted on
Amazon S3
- C. Deploy the application frontend by using AWS Elastic Beanstalk. Use
the same instance type for the nodes
- D. Change all the backend EC2 instances to Spot Instances
- E. Deploy the backend Python application to general purpose burstable
EC2 instances that have the same number of cores as the existing EC2
instances
View question →
-
Q48. Q198. A company's solutions architect is analyzing costs of a
multi-application environment. The environment is deployed across
multiple Availability Zones in a single AWS Region. After a recent
acquisition, the company manages two organizations in AWS Organizations.
The company has created multiple service provider applications as AWS
PrivateLink-powered VPC endpoint services in one organization. The
company has created multiple service consumer applications in the other
organization Data transfer charges are much higher than the company
expected, and the solutions architect needs to reduce the costs. The
solutions architect must recommend guidelines for developers to follow
when they deploy services. These guidelines must minimize data transfer
charges for the whole environment.Which guidelines meet these requirements? (Select TWO)
- A. Use AWS Resource Access Manager to share the subnets that host the
service provider applications with other accounts in the organization
- B. Place the service provider applications and the service consumer
applications in AWS accounts in the same organization
- C. Turn off cross-zone load balancing for the Network Load Balancer in
all service provider application deployments
- D. Ensure that service consumer compute resources use the Availability
Zone-specific endpoint service by using the endpoint's local DNS name
- E. Create a Savings Plan that provides adequate coverage for the
organization's planned inter-Availability Zone data transfer usage
View question →
-
Q49. Q199. A media storage application uploads user photos to Amazon S3
for processing. End users are reporting that some uploaded photos are
not being processed properly. The Application Developers trace the logs
and find that AWS Lambda is experiencing execution issues when thousands
of users are on the system simultaneously. Issues are caused by:
* Limits around concurrent executions.
* The performance of Amazon DynamoDB when saving data. Which actions
can be taken to increase the performance and reliability of the
application? (Choose two.)
- A. Evaluate and adjust the read capacity units (RCUs) for the DynamoDB
tables.
- B. Evaluate and adjust the write capacity units (WCUs) for the DynamoDB
tables.
- C. Add an Amazon ElastiCache layer to increase the performance of Lambda
functions
- D. Configure a dead letter queue that will reprocess failed or timed-out
Lambda functions.
- E. Use S3 Transfer Acceleration to provide lower-latency access to end
users.
View question →
-
Q50. Q200. A company wants to manage the costs associated with a group of
20 applications that are critical, by migrating to AWS. The applications
are a mix of Java and Node.js spread across different instance clusters.
The company wants to minimize costs while standardizing by using a
single deployment methodology. Most of the applications are part of
month-end processing routines with a small number of concurrent users,
but they are occasionally run at other times. Average application memory
consumption is less than 1 GB, though some applications use as much as5 GB of memory during peak processing. The most important application
in the group is a billing report written in Java that accesses multiple
data sources and often for several hours.
Which is the MOST cost-effective solution?
- A. Deploy a separate AWS Lambda function for each application. Use AWS
CloudTrail logs and Amazon CloudWatch alarms to verify completion of
critical jobs.
- B. Deploy Amazon ECS containers on Amazon EC2 with Auto Scaling
configured for memory utilization of 75%. Deploy an ECS task for each
application being migrated with ECS task scaling. Monitor services and
hosts by using Amazon CloudWatch.
- C. Deploy AWS Elastic Beanstalk for each application with Auto Scaling
to ensure that all requests have sufficient resources. Monitor each AWS
Elastic Beanstalk deployment with using CloudWatch alarms.
- D. Deploy a new amazon EC2 instance cluster that co-hosts all
applications by using EC2 Auto Scaling and Application Load Balancers.
Scale cluster size based on a custom metric set on instance memory
utilization. Purchase 3-year Reserved instance reservations equal to the
GroupMaxSize parameter of the Auto Scaling group.
View question →
-
Q51. Q201. During an audit, a Security team discovered that a development
team was putting IAM user secret access keys in their code and then
committing it to an AWS Code Commit repository. The Security team wants
to automatically find and remediate instances of this security
Vulnerability. Which solution will ensure that the credentials are
appropriately secured automatically?
- A. Run a script nightly using AWS Systems Manager Run Command to search
for credentials on the development instances. If found, use AWS Secrets
Manager to rotate the credentials
- B. Use a scheduled AWS Lambda function to download and scan the
application code from Code Commit If credentials are found, generate new
credentials and store them in AWS KMS
- C. Configure Amazon Macie to scan for credentials in Code Commit
repositories. If credentials are found trigger an AWS Lambda function to
disable the credentials and notify the user.
- D. Configure a Code Commit trigger to invoke an AWS Lambda function to
scan new code submissions for credentials. If credentials are found,
disable them in AWS IAM and notify the user.
View question →
-
Q52. Q202. A company uses a load balancer to distribute traffic to Amazon
EC2 instances in a single Availability Zone.The company is concerned
about security and wants a solutions architect to re-architect the
solution to meet the following requirements.
-Inbound requests must be filtered for common vulnerability attacks.
-Rejected requests must be sent to a third-party auditing application.
-All resources should be highly available.
Which solution meets these requirements?
- A. Configure a Multi-AZ Auto Scaling group using the application's AMI
Create an Application Load Balancer (ALB) and select the previously
created Auto Scaling group as the target. Use Amazon Inspector to
monitor traffic to the ALB and EC2 instances. Create a web ACL in WAF.
Create an AWS WAF using the web ACL and ALB. Use an AWS Lambda function
to frequently push the Amazon Inspector report to the third-party
auditing application.
- B. Configure an Application Load Balancer (ALB) and add the EC2
instances as targets, Create a web ACL in WAF Create an AWS WAF using
the web ACL and ALB name and enable logging with Amazon CloudWatch Logs.
Use an AWS Lambda function to frequently push the logs to the
third-party auditing application.
- C. Configure an Application Load Balancer (ALB) along with a target
group adding the EC2 instances as targets. Create an Amazon Kinesis Data
Firehose with the destination of the third-party auditing application.
Create a web ACL in WAF Create an AWS WAF using the web,ACL and ALB then
enable logging by selecting the Kinesis Data Firehose as the
destination. Subscribe to AWS Managed Rules in AWS Marketplace, choosing
the WAF as the subscriber.
- D. Configure a Multi-AZ Auto Scaling group using the application' s
AMI.Create an Application Load Balancer (ALB) and sect the previously
created Auto Scaling group as the target .Create an Amazon Kinesis Data
Firehose with a destination of the third-party auditing
application.Create a web ACL in WAF Create an AWS WAF using the WebACL
and ALB then enable logging by selecting the Kinesis Data Firehose as
the destination Subscribe to AWS Managed Rules in AWS
Marketplace,choosing the WAF as the subscriber.
View question →
-
Q53. Q203. A solutions architect needs to define a reference architecture
for a solution for three-tier applications with web, application, and
NoSQL data layers. The reference architecture must meet the following
requirements:
- High availability within an AWS Region
- Able to fail over in 1 minute to another AWS Region for disaster
recovery
- Provide the most efficient solution while minimizing the impact on
the user experience Which combination of steps will meet these
requirements? (Choose three.)
- A. Use an Amazon Route 53 weighted routing policy set to 100/0 across
the two selected Regions.
Set Time to Live (TTL) to 1 hour.
- B. Use an Amazon Route 53 failover routing policy for failover from the
primary Region to the disaster recovery Region. Set Time to Live (TTL)
to 30 seconds.
- C. Use a global table within Amazon DynamoDB so data can be accessed in
the two selected Regions.
- D. Back up data from an Amazon DynamoDB table in the primary Region
every 60 minutes and then write the data to Amazon S3.
Use S3 cross-Region replication to copy the data from the primary Region
to the disaster recovery Region.
Have a script import the data into DynamoDB in a disaster recovery
scenario.
- E. Implement a hot standby model using Auto Scaling groups for the web
and application layers across multiple Availability Zones in the
Regions.
Use zonal Reserved Instances for the minimum number of servers and
On-Demand Instances for any additional resources.
- F. Use Auto Scaling groups for the web and application layers across
multiple Availability Zones in the Regions.
Use Spot Instances for the required resources.
View question →
-
Q54. Q204. A company uses AWS Organizations to manage more than 1,000 AWS
accounts. The company has created a new developer organization There are
540 developer member accounts that must be moved to the new developer
organization. All accounts are set up with all the required information
S0 that each account can be operated as a standalone account.
Which combination of steps should. a solutions architect take to move
all of the developer accounts to the new developer organization? (Select
THREE.)
- A. Call the MoveAccount operation in the Organizations API from the old
organization's master account to migrate the developer accounts to the
new developer organization.
- B. From the master account, remove each developer account from the old
organization using the RemoveAccountFromOrganization operation in the
Organizations API
- C. From each developer account, remove the account from the old
organization using the RemoveAccountFromOrganization operation in the
Organizations API.
- D. Sign in to the new developer organization's master account and
create a placeholder member account that acts as a target for the
developer account migration.
- E. Call the InviteAccountToOrganization operation in the Organizations
API from the new developer organization's master account to send
invitations to the developer accounts.
- F. Have each developer sign in to their account and confirm to join the
new developer organization.
View question →
-
Q55. Q205. A company is creating a REST API to share information with SiX
of its partners based in the United States. The company has created an
Amazon API Gateway Regional endpoint. Each of the siX partners will
access the API once per day to post daily sales figures.After initial
deployment, the company observes 1,000 requests per second originating
from 500 different lP addresses around the world. The company believes
this traffic is originating from a botnet and wants to secure its API
while minimizing cost.
Which approach should the company take to secure its API?
- A. Create an Amazon CloudFront distribution with the API as the origin.
Create an AWS WAF web ACL with a rule to block clients that submit more
than five requests per day. Associate the web ACL with the CloudFront
distribution. Configure CloudFront with an origin access identity (OA)
and associate it with the distribution. Configure API Gateway to ensure
only the OAI can execute the POST method.
- B. Create an Amazon CloudFront distribution with the API as the origin.
Create an AWS WAF web ACL with a rule to block clients that submit more
than five requests per day. Associate the web ACL with the CloudFront
distribution. Add a custom header to the CloudFront distribution
populated with an API key, Configure the API to require an API key on
the POST method.
- C. Create an AWS WAF web ACL with a rule to allow access to the IP
addresses used by the six partners.
Associate the web ACL with the API. Create a resource policy with a
request limit and associate it with the API. Configure the API to
require an API key on the POST method .
- D. Create an AWS WAF web ACL with a rule to allow access to the lP
addresses used by the six partners.
Associate the web ACL with the API. Create a usage plan with a request
limit and associate it with the API Create an API key and add it to the
i usage plan.
View question →
-
Q56. Q206. A company operates an on-premises software-as-a-service (SaaS)
solution that ingests several files daily. The company provides multiple
public SFTP endpoints to its customers to facilitate the file transfers.
The customers and the SFTP endpoint IP addresses to their firewall allow
list for outbound traffic. Changes to the SFTP endpoint IP addresses are
not permitted. The company wants to migrate the SaaS solution to AWS and
decrease the operational overhead of the file transfer service.
Which solution meets these requirements?
- A. Register the customer-owned block of IP addresses in the company's
AWS account. Create Elastic IP addresses from the address pool and
assign them to an AWS Transfer for SFTP endpoint. Use AWS Transfer to
store the files in Amazon S3.
- B. Add a subnet containing the customer-owned block of IP addresses to a
VPC. Create Elastic IP addresses from the address pool and assign them
to an Application Load Balancer (ALB): Launch EC2 instances hosting FTP
Services in an Auto Scaling group behind the ALB. Store the files in
attached Amazon Elastic Block Store (Amazon EBS) volumes
- C. Register the customer-owned block of IP addresses with Amazon Route
53, Create alias records in Route 53 that point to a Network Load
Balancer (NLB). Launch EC2 instances hosting FTP services in an Auto
Scaling group behind the NLB Store the files in Amazon S3
- D. Register the customer-owned block of IP addresses in the company's
AWS account. Create Elastic IP addresses from the address pool and
assign them to an Amazon S3 VPC endpoint, Enable SFTP support on the S3
bucket.
View question →
-
Q57. Q207. A company has an on-premises Microsoft SQL Server database that
writes a nightly 200 GB export to a local drive.
The company wants to move the backups to more robust cloud storage on
Amazon S3. The company has set up a 10 Gbps AWS Direct Connect
connection between the on-premises data center and AWS. Which solution
meets these requirements Most cost effectively?
- A. Create a new S3 bucket Deploy an AWS Storage Gateway file gateway
within the VPC that is connected to the Direct Connect connection.
Create a new SMB file share.
Write nightly database exports to the new SMB file share.
- B. Create an Amzon FSx for Windows File Server Single-AZ file system
within the VPC that is connected to the Direct Connect connection.
Create a new SMB file share.
Write nightly database exports to an SMB file share on the Amazon FSx
file system Enable backups.
- C. Create an Amazon FSx for Windows File Server Multi-AZ system within
the VPC that is connected to the Direct Connect connection.
Create a new SMB file share.
Write nightly database exports to an SMB file share on the Amazon FSx
file system. Enable nightly backups.
- D. Create a new S3 buckets Deploy an AWS Storage Gateway volume gateway
within the VPC that is connected to the Direct Connect connection.
Create a new SMB file share.
Write nightly database exports to the new SMB file share on the volume
gateway, and automate copies of this data to an S3 bucket.
View question →
-
Q58. Q208. An education company Is running a web application used by
college students around the world. The application runs in an Amazon
Elastic Container Service (Amazon ECS) cluster in an Auto Scaling group
behind an Application Load Balancer (ALB). A system administrator
detects a weekly spike In the number of failed login attempts which
overwhelm the application's authentication service. All the tailed
login attempts originate from about 500 different IP addresses that
change each week. A solutions architect must prevent the tailed login
attempts from overwhelming the authentication service. Which solution
meets these requirements with the MOST operational efficiency?
- A. Use AWS Firewall Manager to create a security group and security
group policy to deny access from the IP addresses.
- B. Create an AWS WAF web ACL with a rate-based rule and set the rule
action to Block Connect the web ACL to the ALB.
- C. Use AWS Firewall Manager To create a security group and security
group policy to allow access only to specific CIDR ranges.
- D. Create an AWS WAF web ACL with an IP set match rule, and set the rule
action to Block Connect the web ACL to the ALB.
View question →
-
Q59. Q209. A company has a data late in Amazon S3 that needs to be
accessed by hundreds of applications across many AWS accounts.
The company's information security policy states that the S3 bucket
must not be accessed over the public internet and that each application
should have the minimum permissions necessary to function. To meet these
requirements, a solution architect plans to use an S3 access point that
is restricted to specific VPCs for each application.
Which combination of steps should the solutions architect take to
implement this solution? (Choose Two)
- A. Create an S3 access point for each application in the AWS account
that owns the S3 bucket.
Configure each access point to be accessible only from the
application's VPC.
Update the bucket policy to require access from an access point.
- B. Create an interface endpoint for Amazon S3 in each application's VPC
Configure the endpoint policy to allow access to an S3 access point.
Create a VPC gateway attachment for the S3 endpoint.
- C. Create a gateway endpoint for Amazon S3 in each application's VPC.
Configure the endpoint policy to allow access to an S3 access point.
Specify the route table that is used to access the access point.
- D. Create an S3 access point for each application in each AWS account
and attach the access points in the S3 bucket.
Configure each access point to accessible only from the application's
VPC update the bucket policy to require access from an access point
- E. Create a gateway endpoint for Amazon S3 in the data lake's VPC.
Attach an endpoint policy to allow access to the S3 bucket. Specify the
route able that is used to access the bucket.
View question →
-
Q60. Q210. A company is running an application in the AWS Cloud. The
application consists of microservices that run on a fleet of Amazon EC2
instances in multiple Availability Zones behind an Application Load
Balancer. The company recently added a new RESTAPI that was implemented
in Amazon API Gateway. Some of the older microservices that nun on EC2
instances need to call this new API. The company does not want the API
to be accessible from the public internet and does not want proprietary
data to traverse the public internet.
What should a solutions architect do to meet these requirements?
- A. Create an AWS Site-to-Site VPN connection between the VPC and the API
Gateway Use API Gateway to generate a unique API key for each
microservice. Configure the API methods to require the key.
- B. Create an interface VPC endpoint for API Gateway, and set an endpoint
policy to only allow access to the specific API Add a resource policy to
API Gateway to only allow access from the VPC endpoint Change the API
Gateway endpoint type to private.
- C. Modify the API Gateway to use IAM authentication. Update the IAM
policy for the IAM role that is assigned to the EC2 instances to allow
access to the API Gateway. Move the API Gateway into a new VPC Deploy a
transit gateway and connect the VPCs
- D. Create an accelerator in AWS Global Accelerator, and connect the
accelerator to the API Gateway.
Update the route table for all VPC subnets with a route to the created
Global Accelerator endpoint IP address. Add an API key for each service
to use for authentication.
View question →
-
Q61. Q211. A company has a new application that needs to run on five
Amazon EC2 instances in a single AWS Region. The application requires
high-throughput, low-latency network connections between all of the EC2
instances where the application will run. There is no requirement for
the application to be fault tolerant.
Which solution will meet these requirements?
- A. Launch five new EC2 instances into a cluster placement group Ensure
that the EC2 instance type supports enhanced networking.
- B. Launch five new EC2 instances into an Auto Scaling group in the same
Availability Zone. Attach an extra elastic network interface to each EC2
instance
- C. Launch five new EC2 instances into a partition placement group.
Ensure that the EC2 instance type supports enhanced networking.
- D. Launch five new EC2 instances into a spread placement group Attach an
extra elastic network interface to each EC2 instance.
View question →
-
Q62. Q212. A company recently started hosting new application workloads in
the AWS Cloud. The company is using Amazon EC2 instances,Amazon Elastic
File System (Amazon EFS) file systems, and Amazon RDS DB instances.
To meet regulatory and business requirements, the company must make the
following changes for data backups:
-Backups must be retained based on custom daily, weekly, and monthly
requirements. -Backups must be replicated to at least one other AWS
Region immediately after capture. -The backup solution must provide a
single source of backup status across the AWS environment. -The backup
solution must send immediate notifications upon failure of any resource
backup. Which combination of steps will meet these requirements with the
LEAST amount of operational overhead? (Select THREE)
- A. Create an AWS Backup plan with a backup rule for each of the
retention requirements.
- B. Configure an AWS Backup plan to copy backups to another Region
- C. Create an AWS Lambda function to replicate backups to another Region
and send notification if a failure occurs.
- D. Add an Amazon Simple Notification Service (Amazon SNS) topic to the
backup plan to send a notification for finished jobs that have any
status except BACKUP_JOB COMPLETED
- E. Create an Amazon Data Lifecycle Manager (Amazon DLM) snapshot
lifecycle policy for each of the retention requirements.
- F. Set up RDS snapshots on each database.
View question →
-
Q63. Q213. A company has an application that runs on Amazon EC2instances
in an Amazon EC2 Auto Scaling group. The company uses AWS CodePipeline
to deploy the application. The instances that run in the Auto Scaling
group are constantly changing because of scaling events.
When the company deploys new application code versions, the company
installs the AWS CodeDeploy agent on any new target EC2 instances and
associates the instances with the CodeDeploy deployment group. The
application is set to go live within the next 24 hours. What should a
solutions architect recommend to automate the application deployment
process with the LEAST amount of operational overhead?
- A. Configure Amazon EventBridge (Amazon CloudWatch Events) to invoke an
AWS Lambda function when anew EC2 instance is launched into the Auto
Scaling group. Code the Lambda function to associate the EC2 instances
with the CodeDeploy deployment group.
- B. Write a script to suspend Amazon EC2 Auto Scaling operations before
the deployment of new code When the deployment is complete. create a new
AMI and configure the Auto Scaling group's launch template to use the
new AMI for new launches. Resume Amazon EC2 Auto Scaling operations.
- C. Create a new AWS CodeBuild project that creates a new AMI that
contains the new code. Configure CodeBuild to update the Auto Scaling
group's launch template to the new AMl. Run an Amazon EC2 Auto Scaling
instance refresh operation.
- D. Create a new AMI that has the CodeDeploy agent installed Configure
the Auto Scaling group's launch template to use the new AM1 Associate
the CodeDeploy deployment group with the Auto Scaling group instead of
the EC2 instances.
View question →
-
Q64. Q214. A company has developed a hybrid solution between its data
center and AWS. The company uses Amazon VPC and Amazon EC2 instances
that send application logs to Amazon CloudWatch. The EC2 instances read
data from multiple relational databases that are
hosted on premises.
The company wants to monitor which EC2 instances are connected to the
databases in near-real time. The company already has a monitoring
solution that uses Splunk on premises. A solutions architect needs to
determine how to send networking traffic to Splunk.
How should the solutions architect meet these requirements?
- A. Enable VPC flows logs, and send them to CloudWatch. Create an AWS
Lambda function to periodically export the CloudWatch logs to an Amazon
S3 bucket by using the pre-defined export function.
Generate ACCESS_KEY and SECRET_KEY AWS credentials. Configure Splunk
to pull the logs from the S3 bucket by using those credentials.
- B. Create an Amazon Kinesis Data Firehose delivery stream with Splunk as
the destination. Configure a pre-processing AWS Lambda function with a
Kinesis Data Firehose stream processor that extracts individual log
events from records sent by CloudWatch Logs subscription filters. Enable
VPC flows logs, and send them to CloudWatch. Create a CloudWatch Logs
subscription that sends log events to the Kinesis Data Firehose delivery
stream
- C. Ask the company to log every request that is made to the databases
along with the EC2instance IP address. Export the CloudWatch logs to an
Amazon S3 bucket. Use Amazon Athena to query the logs grouped by
database name.Export Athena results to another S3 bucket. Invoke an AWS
Lambda function to automatically send any new file that is put in the S3
bucket to Splunk.
- D. Send the CloudWatch logs to an Amazon Kinesis data stream with Amazon
Kinesis Data Analytics for SQL Applications.
Configure a 1-minute sliding window to collect the events. Create a SQL
query that uses the anomaly detection template to monitor any networking
traffic anomalies in near-real time. Send the result to an Amazon
Kinesis Data Firehose delivery stream with Splunk as the destination.
View question →
-
Q65. Q215. A company is developing a new on-demand video application that
is based on microservices. The application will have 5 million users at
launch and will have 30 million users after 6 months. The company has
deployed the application on Amazon Elastic Container Service (Amazon
ECS) on AWS Fargate The company developed the application by using ECS
services that use the HTTPS protocol. A solutions architect needs to
implement updates to the application by using blue/green deployments.
The solution must distribute traffic to each ECS service through a load
balancer. The application must automatically adjust the number of tasks
in response to an Amazon CloudWatch alarm.
Which solution will meet these requirements?
- A. Configure the ECS services to use the blue/green deployment type and
a Network Load Balancer.
Request increases to the service quota for tasks per service to meet the
demand.
- B. Configure the ECS services to use the blue/green deployment type and
a Network Load Balancer.
Implement an Auto Scaling group for each ECS service by using the
Cluster Autoscaler.
- C. Configure the ECS services to use the blue/green deployment type and
an Application Load Balancer.
Implement an Auto Scaling group for each ECS service by using the
Cluster Autoscaler.
- D. Configure the ECS services to use the blue/green deployment type and
an Application Load Balancer.
Implement Service Auto Scaling for each ECS service.
View question →
-
Q66. Q216. A company needs to establish a connection from its on-premises
data center to AWS. The company needs to connect all of its VPCS that
are located in different AWS Regions with transitive routing
capabilities between VPC networks. The company also must reduce network
outbound traffic costs, increase bandwidth throughput, and provide a
consistent network experience for end users.
Which solution will meet these requirements?
- A. Create an AWS Site-to-Site VPN connection between the on-premises
data center and a new central VPC. Create VPC peering connections that
initiate from the central VPC to all other VPCS.
- B. Create an AWS Direct Connect connection between the on-premises data
center and AWS. Provision a transit VIF, and connect it to a Direct
Connect gateway. Connect the Direct Connect gateway to all the other
VPCS by using a transit gateway in each Region.
- C. Create an AWS Site-to-Site VPN connection between the on-premises
data center and a new central VPC. Use a transit gateway with dynamic
routing. Connect the transit gateway to all other VPCS.
- D. Create an AWS Direct Connect connection between the on-premises data
center and AWS. Establish an AWS Site-to-Site VPN connection between all
VPCS in each Region. Create VPC peering connections that initiate from
the central VPC to all other VPCS.
View question →
-
Q67. Q217. A large education company recently introduced Amazon WorkSpaces
to provide access to internal applications across multiple universities.
The company is storing user profiles on an Amazon FSX for Windows File
Server file system. The file system is configured with a DNS alias and
is connected to a self- managed Active Directory. As more users begin to
use the WorkSpaces, login time increases to unacceptable levels An
investigation reveals a degradation in performance of the file system.
The company created the file system on HDD storage with a throughput of
16 MBps A solutions architect must improve the performance of the file
system during a defined maintenance window. What should the solutions
architect do to meet these requirements with the LEAST administrative
effort?
- A. Use AWS Backup to create a point-in-time backup of the file system.
Restore the backup to a new FSX for Windows File Server file system.
Select SSD as the storage type Select 32 MBps as the throughput
capacity. When the backup and
restore process is completed adjust the DNS alias accordingly. Delete
the original file system
- B. Disconnect users from the file system. In the Amazon FSX console,
update the throughput capacity to 32 MBps. Update the storage type to
SSD. Reconnect users to the file system
- C. Deploy an AWS DataSync agent onto a new Amazon EC2instance. Create a
task Configure the existing file system as
the source location Configure a new FSx for Windows File Server file
system with SSD storage and 32 MBps of
throughput as the target location. Schedule the task When the task is
completed, adjust the DNS alias accordingly
Delete the original file system
- D. Enable shadow copies on the existing file system by using a Windows
PowerShell command. Schedule the shadow copy job to create a
point-in-time backup of the file system. Choose to restore previous
versions. Create a new FSx for
Windows File Server file system with SSD storage and 32 MBps of
throughput. When the copy job is completed, adjust
the DNS alias Delete the original file system
View question →
-
Q68. Q218. A company has an application that is deployed on Amazon EC2
instances behind an Application Load Balancer (ALB). The instances are
part of an Auto Scaling group. The application has unpredictable
workloads and frequently scales out and in. The company's development
team wants to analyze application logs to find ways to improve the
application's performance. However, the logs are no longer available
after instances scale in
Which solution will give the development team the ability to view the
application logs after a scale-in event?
- A. Enable access logs for the ALB. Store the logs in an Amazon S3 bucket
- B. Configure the EC2 instances to publish logs to Amazon CloudWatch Logs
by using the unified CloudWatch agent
- C. Modify the Auto Scaling group to use a step scaling policy
- D. Instrument the application with AWS X-Ray tracing
View question →
-
Q69. Q219. A company is migrating a legacy application from an on-premises
data center to AWS. The application uses MongoDB as a key-value
database.According to the company's technical guidelines, all Amazon
EC2instances must be hosted in a private subnet without an internet
connection. In addition, all connectivity between applications and
databases must be encrypted. The database must be able to scale based on
demand.
Which solution will meet these requirements?
- A. Create new Amazon DocumentDB (with MongoDB compatibility) tables for
the application with Provisioned lOPS volumes Use the instance endpoint
to connect to Amazon DocumentDB
- B. Create new Amazon DynamoDB tables for the application with on-demand
capacity. Use a gateway VPC endpoint for DynamoDB to connect to the
DynamoDB tables
- C. Create new Amazon DynamoDB tables for the application with on-demand
capacity. Use an interface VPC endpoint for DynamoDB to connect to the
DynamoDB tables
- D. Create new Amazon DocumentDB (with MongoDB compatibility) tables for
the application with Provisioned IOPS volumes. Use the cluster endpoint
to connect to Amazon DocumentDB
View question →
-
Q70. Q220. A company has five development teams that have each created
five AWS accounts to develop and host applications. To track spending,
the development teams log in to each account every month, record the
current cost from the AWS Billing and Cost Management console, and
provide the information to the company's finance team.
The company has strict compliance requirements and needs to ensure that
resources are created only in AWS Regions in the United States. However,
some resources have been created in other Regions. A solutions architect
needs to implement a solution that gives the finance team the ability to
track and consolidate expenditures for all the accounts. The solution
also must ensure that the company can create resources only in Regions
in the United States.
Which combination of steps will meet these requirements in the MOST
operation all efficient way? (Select THREE)
- A. Create a new account to serve as a management account Create an
Amazon S3 bucket for the finance team. Use AWS Cost and Usage Reports to
create monthly reports and to store the data in the finance team's S3
bucket.
- B. Create a new account to serve as a management account. Deploy an
organization in AWS Organizations with all features enabled. Invite all
the existing accounts to the organization. Ensure that each account
accepts the invitation.
- C. Create an OU that includes all the development teams. Create an SCP
that allows the creation of resources only in Regions that are in the
United States Apply the SCP to the OU
- D. Create an OU that includes all the development teams. Create an SCP
that denies the creation of resources in Regions that are outside the
United States. Apply the SCP to the OU.
- E. Create an IAM role in the management account. Attach a policy that
includes permissions to view the Billing and Cost Management console.
Allow the finance team users to assume the role. Use AWS Cost Explorer
and the Billing and Cost Management console to analyze cost.
- F. Create an IAM role in each AWS account. Attach a policy that includes
permissions to view the Billing and Cost Management console. Allow the
finance team users to assume the role.
View question →
-
Q71. Q221. A company is rearchitecting its applications to run on AWS. The
company's infrastructure includes multiple Amazon EC2 instances. The
company's development team needs different levels of access. The
company wants to implement a policy that requires all Windows EC2
instances to be joined to an Active Directory domain on AWS. The company
also wants to implement enhanced security processes such as multi-factor
authentication (MFA). The company wants to use managed AWS services
wherever possible.
Which solution will meet these requirements?
- A. Create an AWS Directory Service for Microsoft Active Directory
implementation. Launch an Amazon WorkSpace. Connec to and use the
WorkSpace for domain security configuration tasks.
- B. Create an AWS Directory Servicelor Microsoft Active Directory
implementation. Launch an EC2instance.
Connect to and use the EC2 instance for domain security configuration
tasks.
- C. Create an AWS Directory Service Simple AD implementation. Launch an
EC2 instance. Connect to and use the EC2instance for domain security
configuration tasks.
- D. Create an AWS Directory Service Simple AD implementation. Launch an
Amazon WorkSpace. Connect to and use the WorkSpace for domain security
configuration tasks.
View question →
-
Q72. Q222. A company has migrated a legacy application to the AWS Cloud.
The application runs on three Amazon EC2 instances that are spread
across three Availability Zones. One EC2instance is in each Availability
Zone. The EC2 instances are running in three private subnets of the VPC
and are set up as targets for an Application Load Balancer (ALB) that is
associated with three public subnets. The application needs to
communicate with on-premises systems. Only traffic from IP addresses in
the company's IP address range are allowed to access the on-premises
systems. The company's security team is bringing only one IP address
from its internal IP address range to the cloud. The company has added
this IP address to the allow list for the company firewall. The company
also has created an Elastic IP address for this IP address.
A solutions architect needs to create a solution that gives the
application the ability to communicate with the on-premises systems. The
solution also must be able to mitigate failures automatically.
Which solution will meet these requirements?
- A. Deploy three NAT gateways, one in each public subnet. Assign the
Elastic IP address to the NAT gateways.Turn on health checks for the NAT
gateways. If a NAT gateway fails a health check, recreate the NAT
gateway and assign the Elastic IP address to the new NAT gateway.
- B. Replace the ALB with a Network Load Balancer (NLB). Assign the
Elastic IP address to the NLB. Turn on health checks for the NLB. In the
case of a failed health check, redeploy the NLB in different subnets.
- C. Deploy a single NAT gateway in a public subnet.Assign the Elastic IP
address to the NAT gateway. Use Amazon CloudWatch with a custom metric
to monitor the NAT gateway. If the NAT gateway is unhealthy, invoke an
AWS Lambda function to create a new NAT gateway in a different subnet.
Assign the Elastic IP address to the new NAT gateway.
- D. Assign the Elastic IP address to the ALB. Create an Amazon Route
53simple record with the Elastic IP address as the value. Create a Route
53 health check. In the case of a failed health check, recreate the ALB
in different subnets.
View question →
-
Q73. Q223. A company has many separate AWS accounts and uses no central
billing or management. Each AWS account hosts services for different
departments in the company. The company has a Microsoft Azure Active
Directory that is deployed
A solutions architect needs to centralize billing and management of the
company's AWS accounts. The company wants to start using identity
federation instead of manual user management. The company also wants to
use temporary credentials instead of long-lived access keys Which
combination of steps will meet these requirements? (Select THREE)
- A. Create a new AWS account to serve as a management account. Deploy an
organization in AWS Organizations. Invite each existing AWS account to
join the organization. Ensure that each account accepts the invitation
- B. Configure each AWS account's email address to be aws+@example.com
so that account management email messages and invoices are sent to the
same place
- C. Deploy AWS Single Sign-On (AWS SSO) in the management account.
Connect AWS SSO to the Azure Active Directory. Configure AWS SSO for
automatic synchronization of users and groups
- D. Deploy an AWS Managed Microsoft AD directory in the management
account. Share the directory with all other accounts in the organization
by using AWS Resource Access Manager (AWS RAM)
- E. Create AWS Single Sign-On (AWS SSO) permission sets. Attach the
permission sets to the appropriate AwS SSO groups and AWS accounts
- F. Configure AWS Identity and Access Management (IAM) in each AWS
account to use AWS Managed Microsoft AD for authentication and
authorization
View question →
-
Q74. Q224. A company processes environmental data. The company has set up
sensors to provide a continuous stream of data from different areas in a
city. The data is available in JSON format.The company wants to use an AWS solution to send the data to a database
that does not require fixed schemas for storage. The data must be sent
in real time.Which solution will meet these requirements?
- A. Use Amazon Kinesis Data Firehose to send the data to Amazon Redshift.
- B. Use Amazon Kinesis Data Streams to send the data to Amazon DynamoDB.
- C. Use Amazon Managed Streaming for Apache Kafka (Amazon MSK) to send
the data to Amazon Aurora.
- D. Use Amazon Kinesis Data Firehose to send the data to Amazon Keyspaces
(for Apache Cassandra).
View question →
-
Q75. Q225. A company wants to run a custom network analysis software
package to inspect traffic as traffic leaves and enters a VPC. The
company has deployed the solution by using AWS CloudFormation on three
Amazon EC2 instances in an Auto Scaling group All network routing has
been established to direct traffic to the EC2 instances
Whenever the analysis software stops working., the Auto Scaling group
replaces an instance. The network routes are not updated when the
instance replacement occurs Which combination of steps will resolve this
issue? (Select THREE.)
- A. Create alarms based on EC2 status check metrics that will cause the
Auto Scaling group to replace the failed instance
- B. Update the CloudFormation template to install the Amazon CloudWatch
agent on the EC2 instances.
Configure the CloudWatch agent to send process metrics for the
application.
- C. Update the CloudFormation template to install AWS Systems Manager
Agent on the EC2 instances.
Configure Systems Manager Agent to send process metrics for the
application
- D. Create an alarm for the custom metric in Amazon CloudWatch for the
failure scenarios. Configure the alarm to publish a message to an Amazon
Simple Notification Service (Amazon SNS) topic
- E. Create an AWS Lambda function that responds to the Amazon Simple
Notification Service (Amazon SNS) message to take the instance out of
service Update the network routes to point to the replacement instance
- F. In the CloudFormation template, write a condition that updates the
network routes when a replacement instance is launched.
View question →