Hermes Wiki
CertExams/SAA-C03/Questions/Questions10

Question 590

A company has experienced malicious traffic from some suspicious IP addresses. The security team discovered the requests are from different IP addresses under the same CIDR range.

What should a solutions architect recommend to the team?

  • ❌ A. Add a rule in the outbound table of the security group to deny the traffic from that CIDR range
  • ✅ B. Add a deny rule in the inbound table of the network ACL with a lower rule number than other rules
  • ❌ C. Add a rule in the inbound table of the security group to deny the traffic from that CIDR range
  • ❌ D. Add a deny rule in the outbound table of the network ACL with a lower rule number than other rules

Question 591

An application runs on a fleet of Amazon EC2 instances in an Amazon EC2 Auto Scaling group behind an Elastic Load Balancer. The operations team has determined that the application performs best when the CPU utilization of the EC2 instances is at or near 60%.

Which scaling configuration should a Solutions Architect use to optimize the applications performance?

  • ❌ A. Use a step scaling policy to dynamically scale the Auto Scaling group.
  • ✅ B. Use a target tracking policy to dynamically scale the Auto Scaling group.
  • ❌ C. Use a simple scaling policy to dynamically scale the Auto Scaling group.
  • ❌ D. Use a scheduled scaling policy to dynamically the Auto Scaling group.

Question 592

A Solutions Architect works for a company looking to centralize its Machine Learning Operations. Currently they have a large amount of existing cloud storage to store their operational data which is used for machine learning analysis. There is some data which exists within an Amazon RDS MySQL database, and they need a solution which can easily retrieve data from the database.

Which service can be used to build a centralized data repository to be used for Machine Learning purposes?

  • ✅ A. AWS Lake Formation
  • ❌ B. Amazon Quantum Ledger Database (QLDB)
  • ❌ C. Amazon Neptune
  • ❌ D. Amazon S3

Question 593

A company has created a disaster recovery solution for an application that runs behind an Application Load Balancer (ALB). The DR solution consists of a second copy of the application running behind a second ALB in another Region. The Solutions Architect requires a method of automatically updating the DNS record to point to the ALB in the second Region.

What action should the Solutions Architect take?

  • ❌ A. Enable an ALB health check.
  • ✅ B. Enable an Amazon Route 53 health check.
  • ❌ C. Configure an alarm on a CloudTrail trail.
  • ❌ D. Use Amazon EventBridge to cluster the ALBs.

Question 594

A shared services VPC is being setup for use by several AWS accounts. An application needs to be securely shared from the shared services VPC. The solution should not allow consumers to connect to other instances in the VPC.

How can this be setup with the least administrative effort? (Select TWO)

  • ❌ A. Configure security groups to restrict access
  • ✅ B. Create a Network Load Balancer (NLB)
  • ❌ C. Setup VPC peering between each AWS VPC
  • ✅ D. Use AWS PrivateLink to expose the application as an endpoint service
  • ❌ E. Use AWS ClassicLink to expose the application as an endpoint service

Question 595

A company hosts statistical data in an Amazon S3 bucket that users around the world download from their website using a URL that resolves to a domain name. The company needs to provide low latency access to users and plans to use Amazon Route 53 for hosting DNS records.

Which solution meets these requirements?

  • ✅ A. Create a web distribution on Amazon CloudFront pointing to an Amazon S3 origin. Create an ALIAS record in the Amazon Route 53 hosted zone that points to the CloudFront distribution, resolving to the application's URL domain name.
  • ❌ B. Create an A record in Route 53, use a Route 53 traffic policy for the web application, and configure a geolocation rule. Configure health checks to check the health of the endpoint and route DNS queries to other endpoints if an endpoint is unhealthy.
  • ❌ C. Create a web distribution on Amazon CloudFront pointing to an Amazon S3 origin. Create a CNAME record in a Route 53 hosted zone that points to the CloudFront distribution, resolving to the application's URL domain name.
  • ❌ D. Create an A record in Route 53, use a Route 53 traffic policy for the web application, and configure a geoproximity rule. Configure health checks to check the health of the endpoint and route DNS queries to other endpoints if an endpoint is unhealthy.

Question 596

A company is migrating its legacy customer support applications from an on-premises data center to AWS. Each application runs on a dedicated virtual machine and relies on proprietary software that cannot be modified. The applications must remain highly available and continue to operate in the event of a single Availability Zone failure. The company wants to minimize changes to its architecture and operational overhead.

Which solution will meet these requirements?

  • ❌ A. Use AWS Elastic Disaster Recovery (AWS DRS) to replicate the on-premises virtual machines to AWS. Launch the virtual machines in an Auto Scaling group configured to span multiple Availability Zones.
  • ❌ B. Use AWS Backup to configure hourly backups of each EC2 instance. Store backups in Amazon S3 Glacier. In case of failure, restore the latest backup to a new EC2 instance in another Availability Zone.
  • ✅ C. Create an Amazon Machine Image (AMI) for each application. Launch two EC2 instances for each application in different Availability Zones. Use an Application Load Balancer to distribute traffic evenly between the instances.
  • ❌ D. Refactor the applications into microservices and deploy them on Amazon ECS with Fargate. Use a Network Load Balancer to route traffic to the Fargate tasks.

Question 597

A company wants to use Amazon Elastic Container Service (Amazon ECS) to run its containerized application in a hybrid environment. The company needs to ensure that the application can scale across both on-premises and AWS environments. It also requires a load balancer to handle HTTP traffic for the new containers that will run in the AWS Cloud.

Which combination of actions will meet these requirements? (Select TWO)

  • ✅ A. Set up an Application Load Balancer for cloud ECS services.
  • ✅ B. Set up an ECS cluster that uses the AWS Fargate launch type for the cloud application containers. Use an Amazon ECS Anywhere external launch type for the on-premises application containers.
  • ❌ C. Set up an ECS cluster that uses the AWS Fargate launch type. Use Fargate for the cloud application containers and the on-premises application containers.
  • ❌ D. Set up a Network Load Balancer for cloud ECS services.
  • ❌ E. Set up an ECS cluster that uses the Amazon EC2 launch type for the cloud application containers. Use Amazon ECS Anywhere with an AWS Fargate launch type for the on-premises application containers.

Question 598

A company runs its critical payment processing application on an Amazon Aurora MySQL cluster in the ap-southeast-1 Region. As part of its disaster recovery (DR) strategy, the company has selected the ap-northeast-1 Region for failover capabilities.

The company requires a recovery point objective (RPO) of less than 5 minutes and a recovery time objective (RTO) of no more than 15 minutes. The company also wants to minimize operational overhead and ensure failover happens with minimal downtime and configuration.

Which solution will meet these requirements with the MOST operational efficiency?

  • ❌ A. Create a new Aurora MySQL cluster in ap-northeast-1 and use AWS Database Migration Service (AWS DMS) to replicate data between clusters.
  • ❌ B. Create an Aurora read replica in ap-northeast-1 to replicate data from the primary Aurora cluster. Promote the read replica manually in the event of a failover.
  • ❌ C. Use Amazon S3 Cross-Region Replication to replicate database backups from ap-southeast-1 to ap-northeast-1. Restore the backups to a new Aurora cluster during failover.
  • ✅ D. Convert the Aurora cluster to an Aurora global database. Configure cross-Region replication and managed failover.

Question 599

A research organization is planning to migrate its simulation analysis platform to AWS. The platform stores simulation results and logs on an on-premises NFS server. The platform's codebase is legacy and cannot be modified to use any protocol other than NFS to store and retrieve data. The organization needs a storage solution on AWS that supports NFS and is highly available and scalable.

Which storage solution should a solutions architect recommend for use after the migration?

  • ❌ A. Use Amazon FSx for Windows File Server to create a shared file system for data storage and access through the SMB protocol.
  • ✅ B. Use Amazon Elastic File System (Amazon EFS) to provide an NFS-compatible shared file system that integrates with AWS services.
  • ❌ C. Use AWS Storage Gateway File Gateway to provide an NFS interface backed by Amazon S3 for storing and retrieving data.
  • ❌ D. Use Amazon Elastic Block Store (Amazon EBS) volumes attached to each EC2 instance for storage. Use NFS software on the EC2 instances to create a shared file system.

Question 600

A Solutions Architect must design a solution to allow many Amazon EC2 instances across multiple subnets to access a shared data store. The data must be accessed by all instances simultaneously and access should use the NFS protocol. The solution must also be highly scalable and easy to implement.

Which solution best meets these requirements?

  • ❌ A. Create an Amazon S3 bucket and configure a Network ACL. Grant the EC2 instances permission to access the bucket using the NFS protocol.
  • ❌ B. Create an Amazon EBS volume and create a resource-based policy that grants an AWS IAM role access to the data. Attach the role to the EC2 instances.
  • ❌ C. Configure an additional EC2 instance as a file server. Create a role in AWS IAM that grants permissions to the file share and attach the role to the EC2 instances.
  • ✅ D. Create an Amazon EFS file system. Configure a mount target in each Availability Zone. Attach each instance to the appropriate mount target.

Question 601

An application runs on Amazon EC2 Linux instances. The application generates log files which are written using standard API calls. A storage solution is required that can be used to store the files indefinitely and must allow concurrent access to all files.

Which storage service meets these requirements and is the MOST cost-effective?

  • ❌ A. Amazon EFS
  • ❌ B. Amazon EBS
  • ✅ C. Amazon S3
  • ❌ D. Amazon EC2 instance store

Question 602

An application consists of a web tier in a public subnet and a MySQL cluster hosted on Amazon EC2 instances in a private subnet. The MySQL instances must retrieve product data from a third-party provider over the internet. A Solutions Architect must determine a strategy to enable this access with maximum security and minimum operational overhead.

What should the Solutions Architect do to meet these requirements?

  • ✅ A. Deploy a NAT gateway in the public subnet. Modify the route table in the private subnet to direct all internet traffic to the NAT gateway.
  • ❌ B. Deploy a NAT instance in the private subnet. Direct all internet traffic to the NAT instance.
  • ❌ C. Create a virtual private gateway and attach it to the VPC. Modify the private subnet route table to direct internet traffic to the virtual private gateway.
  • ❌ D. Create an internet gateway and attach it to the VPC. Modify the private subnet route table to direct internet traffic to the internet gateway.

Question 603

A company has on-premises file servers that include both Windows SMB and Linux NFS protocols. The company plans to migrate to AWS and consolidate these file servers into a managed cloud solution. The chosen solution must support both NFS and SMB access, provide protocol sharing, and offer redundancy at the Availability Zone level.

Which solution will meet these requirements?

  • ✅ A. Use Amazon FSx for NetApp ONTAP to consolidate storage and enable multi-protocol access for both SMB and NFS.
  • ❌ B. Create two Amazon EC2 instances with locally attached storage: one instance for SMB access and the other instance for NFS access.
  • ❌ C. Use Amazon S3 for storage and deploy an Amazon S3 File Gateway for on-premises access to both SMB and NFS clients.
  • ❌ D. Deploy Amazon FSx for Windows File Server for SMB access and Amazon FSx for OpenZFS for NFS access.

Question 604

A company needs to implement a new data retention policy for regulatory compliance. As part of this policy, sensitive documents that are stored in an Amazon S3 bucket must be protected from deletion or modification for a fixed period of time.

Which solution will meet these requirements?

  • ❌ A. Use AWS Backup to create immutable backups of the S3 objects and enforce a retention policy.
  • ✅ B. Enable S3 Object Lock on the required objects and set compliance mode.
  • ❌ C. Activate S3 Object Lock in compliance mode on the bucket. Configure a WORM (Write Once, Read Many) policy.
  • ❌ D. Create an Amazon S3 bucket with versioning enabled. Use a lifecycle rule to automatically delete older versions after the retention period.

Question 605

A media company is building a video content distribution platform on AWS. The platform uses an REST API hosted on Amazon API Gateway to serve metadata about the videos, such as titles and descriptions. The metadata is confidential and must be accessible only from a specific set of trusted IP addresses belonging to the company’s office network.

Which solution will meet these requirements?

  • ❌ A. Set up API Gateway with a private integration and restrict access to the trusted IP addresses using a VPC endpoint policy.
  • ❌ B. Deploy the API Gateway in a private subnet and configure a network ACL to permit traffic only from the trusted IP addresses.
  • ✅ C. Configure an API Gateway resource policy that denies access to any IP address that is not explicitly allowed.
  • ❌ D. Modify the API Gateway security group to allow inbound requests only from the trusted IP addresses.

Question 606

A Solutions Architect is designing a solution for an application that requires very low latency between the client and the backend. The application uses the UDP protocol, and the backend is hosted on Amazon EC2 instances. The solution must be highly available across multiple Regions and users around the world should be directed to the most appropriate Region based on performance.

How can the Solutions Architect meet these requirements?

  • ❌ A. Deploy an Application Load Balancer in front of the EC2 instances in each Region. Use AWS WAF to direct traffic to the most optimal Regional endpoint.
  • ❌ B. Deploy an Amazon CloudFront distribution with a custom origin pointing to Amazon EC2 instances in multiple Regions.
  • ✅ C. Deploy a Network Load Balancer in front of the EC2 instances in each Region. Use AWS Global Accelerator to route traffic to the most optimal Regional endpoint.
  • ❌ D. Deploy Amazon EC2 instances in multiple Regions. Create a multivalue answer routing record in Amazon Route 53 that includes all EC2 endpoints.

Question 607

A company recently performed a lift and shift migration of its on-premises Oracle database workload to run on an Amazon EC2 memory-optimized Linux instance. The EC2 Linux instance uses a 1 TB Provisioned IOPS SSD (io1) EBS volume with 64,000 IOPS. The database storage performance after the migration is slower than the performance of the on-premises database.

Which solution will improve storage performance?

  • ❌ A. Increase the size of the Provisioned IOPS SSD (io1) EBS volume to 2 TB.
  • ❌ B. Change the EC2 Linux instance to a storage-optimized instance type. Do not change the Provisioned IOPS SSD (io1) EBS volume.
  • ❌ C. Increase the Provisioned IOPS SSD (io1) EBS volume to more than 64,000 IOPS.
  • ✅ D. Add more Provisioned IOPS SSD (io1) EBS volumes. Use OS commands to create a Logical Volume Management (LVM) stripe.

Question 608

A retail company runs an on-premises application that uses Java Spring Boot on Windows servers. The application is resource-intensive and handles customer-facing operations. The company wants to modernize the application by migrating it to a containerized environment running on AWS. The new solution must automatically scale based on Amazon CloudWatch metrics and minimize operational overhead for managing infrastructure.

Which solution will meet these requirements with the LEAST operational overhead?

  • ❌ A. Use AWS App2Container to containerize the application. Deploy the containerized application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate by using an AWS CloudFormation template.
  • ❌ B. Use AWS App Runner to containerize the application. Deploy the containerized application to Amazon Elastic Kubernetes Service (Amazon EKS) on Amazon EC2 instances.
  • ❌ C. Use AWS App2Container to containerize the application. Deploy the containerized application to Amazon Elastic Container Service (Amazon ECS) on Amazon EC2 instances by using an AWS CloudFormation template.
  • ✅ D. Use AWS App Runner to containerize the application. Use App Runner to automatically deploy and manage the application without using ECS or EC2.

Question 609

A company requires a high-performance file system that can be mounted on Amazon EC2 Windows instances and Amazon EC2 Linux instances. Applications running on the EC2 instances perform separate processing of the same files and the solution must provide a file system that can be mounted by all instances simultaneously.

Which solution meets these requirements?

  • ❌ A. Use Amazon FSx for Windows File Server for the Windows instances. Use Amazon FSx for Lustre for the Linux instances. Link both Amazon FSx file systems to the same Amazon S3 bucket.
  • ❌ B. Use Amazon Elastic File System (Amazon EFS) with General Purpose performance mode for the Windows instances and the Linux instances.
  • ❌ C. Use Amazon FSx for Windows File Server for the Windows instances. Use Amazon Elastic File System (Amazon EFS) with Max I/O performance mode for the Linux instances.
  • ✅ D. Use Amazon FSx for Windows File Server for the Windows instances and the Linux instances.

Question 610

A high-performance file system is required for a financial modelling application. The data set will be stored on Amazon S3 and the storage solution must have seamless integration so objects can be accessed as files.

Which storage solution should be used?

  • ❌ A. Amazon Elastic Block Store (EBS)
  • ✅ B. Amazon FSx for Lustre
  • ❌ C. Amazon FSx for Windows File Server
  • ❌ D. Amazon Elastic File System (EFS)

Question 611

A company has created an application that stores sales performance data in an Amazon DynamoDB table. A web application is being created to display the data. A Solutions Architect must design the web application using managed services that require minimal operational maintenance.

Which architectures meet these requirements? (Select TWO)

  • ❌ A. An Elastic Load Balancer forwards requests to a target group of Amazon EC2 instances. The EC2 instances run an application that reads data from the DynamoDB table.
  • ✅ B. An Amazon API Gateway REST API invokes an AWS Lambda function. The Lambda function reads data from the DynamoDB table.
  • ❌ C. An Elastic Load Balancer forwards requests to a target group with the DynamoDB table configured as the target.
  • ✅ D. An Amazon API Gateway REST API directly accesses the sales performance data in the DynamoDB table.
  • ❌ E. An Amazon Route 53 hosted zone routes requests to an AWS Lambda endpoint to invoke a Lambda function that reads data from the DynamoDB table.

Question 612

A company requires a fully managed replacement for an on-premises storage service. The company’s employees often work remotely from various locations. The solution should also be easily accessible to systems connected to the on-premises environment.

Which solution meets these requirements?

  • ❌ A. Use AWS DataSync to synchronize data between the on-premises service and Amazon S3.
  • ❌ B. Use AWS Storage Gateway to create a volume gateway to store and transfer files to Amazon S3.
  • ❌ C. Use AWS Transfer Acceleration to replicate files to Amazon S3 and enable public access.
  • ✅ D. Use Amazon FSx to create an SMB file share. Connect remote clients to the file share over a client VPN.

Question 613

A media streaming company stores user activity logs in an Amazon S3 bucket. The logs are accessed frequently for real-time analytics and reporting. The company enforces strict encryption requirements for data stored in S3 and currently uses AWS Key Management Service (AWS KMS) for encryption.

The company wants to reduce costs related to encrypting objects in the S3 bucket while maintaining compliance with its encryption requirements and minimizing the number of AWS KMS calls.

Which solution will meet these requirements?

  • ❌ A. Use server-side encryption with Amazon S3 managed keys (SSE-S3) to eliminate AWS KMS usage.
  • ✅ B. Enable S3 Bucket Key for server-side encryption with AWS KMS keys (SSE-KMS) on the objects to reduce the cost of KMS requests.
  • ❌ C. Use client-side encryption with AWS KMS customer-managed keys to encrypt the data before uploading it to S3.
  • ❌ D. Use server-side encryption with customer-provided encryption keys (SSE-C) and store the keys in AWS Secrets Manager.

Question 614

A company needs to migrate a large quantity of data from an on-premises environment to Amazon S3. The company is connected via an AWS Direct Connect (DX) connection. The company requires a fully managed solution that will keep the data private and automate and accelerate the replication of the data to AWS storage services.

Which solution should a Solutions Architect recommend?

  • ❌ A. Deploy an AWS DataSync agent for the on-premises environment. Configure a task to replicate the data and connect it to a public endpoint.
  • ❌ B. Deploy an AWS Storage Gateway volume gateway in stored volume mode and take point-in-time copies of the volumes using AWS Backup.
  • ✅ C. Deploy an AWS DataSync agent for the on-premises environment. Configure a task to replicate the data and connect it to a VPC endpoint.
  • ❌ D. Deploy an AWS Storage Gateway file gateway with a local cache and store the primary data set in Amazon S3.

Question 615

A Financial Services company currently stores data in Amazon S3. Each bucket contains items which have different access patterns. The Chief Financial officer of the organization wants to reduce costs, as they have noticed a sharp increase in their S3 bill. The Chief Financial Officer wants to reduce the S3 spend as quickly as possible.

What is the quickest way to reduce the S3 spend with the LEAST operational overhead?

  • ❌ A. Automate the move of your S3 objects to the best storage class with AWS Trusted Advisor.
  • ✅ B. Transition the objects to the appropriate storage class by using an S3 Lifecycle configuration.
  • ❌ C. Create a Lambda function to scan your S3 buckets, check which objects are stored in the appropriate buckets, and move them there.
  • ❌ D. Place all objects in S3 Glacier Instant Retrieval.

Question 616

A company is deploying a solution for sharing media files around the world using Amazon CloudFront with an Amazon S3 origin configured as a static website. The company requires that all traffic for the website must be inspected by AWS WAF.

Which solution meets these requirements?

  • ✅ A. Deploy CloudFront with an S3 origin and configure an origin access identity (OAI) to restrict access to the S3 bucket. Enable AWS WAF on the CloudFront distribution.
  • ❌ B. Use an Amazon Route 53 Alias record to forward traffic for the website to AWS WAF. Configure AWS WAF to inspect traffic and attach the CloudFront distribution.
  • ❌ C. Create a Network ACL that limits access to the S3 bucket to the CloudFront IP addresses. Attach a WebACL to the CloudFront distribution.
  • ❌ D. Create an S3 bucket policy with a condition that only allows requests that originate from AWS WAF.

Question 617

A video editing company processes high-resolution footage for its clients. Each video file is several terabytes in size and needs to undergo intensive editing, such as applying filters and color grading, before delivery. Processing each video takes up to 25 minutes.

The company needs a solution that can scale to handle increased demand during peak periods while remaining cost-effective. The processed videos must be accessible for a minimum of 90 days.

Which solution will meet these requirements?

  • ❌ A. Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate to run containerized video editing tasks. Store metadata in Amazon DynamoDB and processed video files in Amazon S3 Standard-IA for reduced costs.
  • ✅ B. Use AWS Batch to orchestrate video editing jobs on Spot Instances. Store metadata in Amazon ElastiCache for Redis and processed video files in Amazon S3 Intelligent-Tiering.
  • ❌ C. Use an on-premises video processing server connected to AWS Storage Gateway to store and retrieve video files from Amazon S3. Use Amazon RDS for metadata and configure Storage Gateway for caching frequently accessed data.
  • ❌ D. Deploy Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). Use Amazon Simple Queue Service (Amazon SQS) to queue incoming video processing jobs. Store metadata in Amazon RDS, and store processed videos in Amazon S3 Glacier Flexible Retrieval for long-term storage.

Question 618

A company has a Production VPC and a Pre-Production VPC. The Production VPC uses VPNs through a customer gateway to connect to a single device in an on-premises data center. The Pre-Production VPC uses a virtual private gateway attached to two AWS Direct Connect (DX) connections. Both VPCs are connected using a single VPC peering connection.

How can a Solutions Architect improve this architecture to remove any single point of failure?

  • ❌ A. Add a second virtual private gateway and attach it to the Production VPC.
  • ✅ B. Add additional VPNs to the Production VPC from a second customer gateway device.
  • ❌ C. Add an additional VPC peering connection between the two VPCs.
  • ❌ D. Add a set of VPNs between the Production and Pre-Production VPCs.

Question 619

An Architect needs to find a way to automatically and repeatably create many member accounts within an AWS Organization. The accounts also need to be moved into an OU and have VPCs and subnets created.

What is the best way to achieve this?

  • ✅ A. Use CloudFormation with scripts
  • ❌ B. Use the AWS Management Console
  • ❌ C. Use the AWS CLI
  • ❌ D. Use the AWS Organizations API

Question 620

A financial services company manages its web application on Amazon EC2 instances. The EC2 instances are registered in an IP address-type target group behind an Application Load Balancer (ALB). The company uses AWS Systems Manager for patching and routine maintenance of the instances.

To meet security compliance requirements, the company must ensure that EC2 instances are temporarily removed from service during patching to prevent serving traffic. During a recent patching attempt, the company experienced application errors and traffic disruptions.

Which combination of solutions will resolve these issues? (Select TWO)

  • ✅ A. Use the Systems Manager Maintenance Windows feature to schedule patching and automatically deregister instances from the ALB during updates.
  • ❌ B. Use Systems Manager State Manager to schedule patching jobs and ensure instances are deregistered and re-registered with the ALB after patching is complete.
  • ❌ C. Change the target type of the target group from IP address type to instance type and re-register the instances.
  • ✅ D. Implement the AWSEC2-PatchLoadBalancerInstance Systems Manager Automation document to manage the patching process for EC2 instances behind the ALB.
  • ❌ E. Configure ALB health checks to automatically remove unhealthy instances during patching. Use Systems Manager Run Command to apply the patches manually.

Question 621

A company has deployed an API in a VPC behind an internal Network Load Balancer (NLB). An application that consumes the API as a client is deployed in a second account in private subnets.

Which architectural configurations will allow the API to be consumed without using the public Internet? (Select TWO)

  • ✅ A. Configure a VPC peering connection between the two VPCs. Access the API using the private address
  • ❌ B. Configure an AWS Direct Connect connection between the two VPCs. Access the API using the private address
  • ❌ C. Configure an AWS Resource Access Manager connection between the two accounts. Access the API using the private address
  • ✅ D. Configure a PrivateLink connection for the API into the client VPC. Access the API using the PrivateLink address
  • ❌ E. Configure a ClassicLink connection for the API into the client VPC. Access the API using the ClassicLink address

Question 622

A Solutions Architect has been tasked with migrating 30 TB of data from an on-premises data center within 20 days. The company has an internet connection that is limited to 25 Mbps and the data transfer cannot use more than 50% of the connection speed.

What should a Solutions Architect do to meet these requirements?

  • ✅ A. Use AWS Snowball.
  • ❌ B. Use AWS DataSync.
  • ❌ C. Use a site-to-site VPN.
  • ❌ D. Use AWS Storage Gateway.

Question 623

A streaming service company runs its video recommendation engine on an Amazon EC2 Auto Scaling group behind an Application Load Balancer (ALB) in a single AWS Region. The service generates personalized recommendations based on user activity and serves dynamic content to millions of users worldwide.

The company needs a cost-optimized solution to improve performance and scalability while ensuring that users across the globe experience low latency when accessing personalized recommendations.

Which solution will meet these requirements?

  • ❌ A. Migrate the recommendation engine to Amazon S3 and enable static website hosting. Use an Amazon CloudFront distribution to cache the content globally.
  • ❌ B. Deploy additional EC2 instances and ALBs in multiple Regions. Use Amazon Route 53 latency-based routing to direct users to the Region with the lowest latency.
  • ❌ C. Configure AWS Global Accelerator to route traffic to the existing ALB and EC2 instances in the Region closest to each user.
  • ✅ D. Set up an Amazon CloudFront distribution and configure the existing ALB as the origin. Use dynamic cache settings to reduce latency for global users.

Question 624

A company’s staff connect from home office locations to administer applications using bastion hosts in a single AWS Region. The company requires a resilient bastion host architecture that requires minimal ongoing operational overhead.

How can a Solutions Architect best meet these requirements?

  • ❌ A. Create a Network Load Balancer backed by an Auto Scaling group with instances in multiple AWS Regions.
  • ✅ B. Create a Network Load Balancer backed by an Auto Scaling group with instances in multiple Availability Zones.
  • ❌ C. Create a Network Load Balancer backed by Reserved Instances in a cluster placement group.
  • ❌ D. Create a Network Load Balancer backed by the existing servers in different Availability Zones.

Question 625

A web app allows users to upload images for viewing online. The compute layer that processes the images is behind an Auto Scaling group. The processing layer should be decoupled from the front end and the ASG needs to dynamically adjust based on the number of images being uploaded.

How can this be achieved?

  • ✅ A. Create an Amazon SQS queue and custom CloudWatch metric to measure the number of messages in the queue. Configure the ASG to scale based on the number of messages in the queue
  • ❌ B. Create a scheduled policy that scales the ASG at times of expected peak load
  • ❌ C. Create a target tracking policy that keeps the ASG at 70% CPU utilization
  • ❌ D. Create an Amazon SNS Topic to generate a notification each time a message is uploaded. Have the ASG scale based on the number of SNS messages

Question 626

A company runs a business-critical application in the us-east-1 Region. The application uses an Amazon Aurora MySQL database cluster which is 2 TB in size. A Solutions Architect needs to determine a disaster recovery strategy for failover to the us-west-2 Region. The strategy must provide a recovery time objective (RTO) of 10 minutes and a recovery point objective (RPO) of 5 minutes.

Which strategy will meet these requirements?

  • ❌ A. Create a multi-Region Aurora MySQL DB cluster in us-east-1 and us-west-2. Use an Amazon Route 53 health check to monitor us-east-1 and fail over to us-west-2 upon failure.
  • ✅ B. Recreate the database as an Aurora global database with the primary DB cluster in us-east-1 and a secondary DB cluster in us-west-2. Use an Amazon EventBridge rule that invokes an AWS Lambda function to promote the DB cluster in us-west-2 when failure is detected.
  • ❌ C. Create a cross-Region Aurora MySQL read replica in us-west-2 Region. Configure an Amazon EventBridge rule that invokes an AWS Lambda function that promotes the read replica in us-west-2 when failure is detected.
  • ❌ D. Recreate the database as an Aurora multi master cluster across the us-east-1 and us-west-2 Regions with multiple writers to allow read/write capabilities from all database instances.

Question 627

A research organization runs its photo analysis application on AWS. The application processes images uploaded by field scientists and stores them temporarily on an Amazon EC2 instance's locally attached Amazon Elastic Block Store (Amazon EBS) volume. Every evening, the processed images are uploaded to an Amazon S3 bucket for long-term storage.

The solutions architect has discovered that the images are being uploaded to S3 through the public internet. The organization wants to ensure that the upload traffic to Amazon S3 remains private and does not use the public internet.

Which solution will meet these requirements?

  • ✅ A. Create a gateway VPC endpoint for the S3 bucket. Update the VPC's route table to route all S3 traffic through the gateway endpoint.
  • ❌ B. Deploy a NAT gateway in the VPC. Configure the EC2 instance's security group to allow outbound traffic to the NAT gateway, which will route traffic to the S3 bucket.
  • ❌ C. Use an Amazon S3 access point for the EC2 instance. Configure the photo analysis application to upload files to the bucket through the access point.
  • ❌ D. Configure a VPC peering connection between the VPC containing the EC2 instance and Amazon S3. Update the route table to use the peering connection for traffic to S3.

Question 628

A Solutions Architect created the following policy and associated to an AWS IAM group containing several administrative users:

{

   "Version": "2012-10-17",

    "Statement": [

    {

            "Effect": "Allow",

            "Action": "ec2:TerminateInstances",

            "Resource": "*",

            "Condition": {

                     "IpAddress": {

                          "aws:SourceIp": "10.1.2.0/24"

                   }

             }

    },

   {

                    "Effect": "Deny",

                    "Action": "ec2:*",

                     "Resource": "*",

                     "Condition": {

                           "StringNotEquals": {

                                       "ec2:Region": "us-east-1"

                            }

                      }

                 }

           ]

   }

What is the effect of this policy?

  • ❌ A. Administrators cannot terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.1.2.28.
  • ❌ B. Administrators can terminate an EC2 instance in any AWS Region except us-east-1.
  • ✅ C. Administrators can terminate an EC2 instance in the us-east-1 Region when the user's source IP is 10.1.2.28.
  • ❌ D. Administrators can terminate an EC2 instance with the IP address 10.1.2.5 in the us-east-1 Region.

Question 629

A security team wants to limit access to specific services or actions in all of the team's AWS accounts. All accounts belong to a large organization in AWS Organizations. The solution must be scalable and there must be a single point where permissions can be maintained.

What should a solutions architect do to accomplish this?

  • ✅ A. Create a service control policy in the root organizational unit to deny access to the services or actions
  • ❌ B. Create an ACL to provide access to the services or actions
  • ❌ C. Create cross-account roles in each account to deny access to the services or actions
  • ❌ D. Create a security group to allow accounts and attach it to user groups

Question 630

A company has deployed an application that consists of several microservices running on Amazon EC2 instances behind an Amazon API Gateway API. A Solutions Architect is concerned that the microservices are not designed to elastically scale when large increases in demand occur.

Which solution addresses this concern?

  • ❌ A. Use Amazon CloudWatch alarms to notify operations staff when the microservices are suffering high CPU utilization.
  • ❌ B. Spread the microservices across multiple Availability Zones and configure Amazon Data Lifecycle Manager to take regular snapshots.
  • ❌ C. Use an Elastic Load Balancer to distribute the traffic between the microservices. Configure Amazon CloudWatch metrics to monitor traffic to the microservices.
  • ✅ D. Create an Amazon SQS queue to store incoming requests. Configure the microservices to retrieve the requests from the queue for processing.

Question 631

A healthcare startup is building a cloud-based patient management system on AWS. The system processes sensitive health data and uses Amazon RDS for the database, Amazon S3 for storing medical reports, and AWS Lambda for processing event-driven workflows triggered by S3 Event Notifications.

The startup uses AWS IAM Identity Center to manage user authentication. The development, testing, and operations teams need secure access to RDS and S3 while ensuring compliance with healthcare regulations that mandate least privilege access and centralized access control.

Which solution meets these requirements with the LEAST operational overhead?

  • ✅ A. Use AWS IAM Identity Center integrated with the startup's existing Active Directory. Create permission sets with fine-grained permissions for RDS and S3. Assign team members to appropriate groups in Active Directory, which map to Identity Center permission sets.
  • ❌ B. Use AWS Organizations to create separate accounts for development, testing, and operations teams. Apply Service Control Policies (SCPs) to restrict access at the account level. Use cross-account IAM roles to grant granular permissions for RDS and S3 based on team needs.
  • ❌ C. Configure an Amazon Cognito user pool to authenticate team members. Use a custom Lambda function to generate temporary credentials for RDS and S3 access. Implement role-based access controls within the Lambda function to enforce least privilege.
  • ❌ D. Create separate IAM users for all team members. Assign each user predefined managed policies with RDS and S3 permissions. Use IAM Access Analyzer to review permissions periodically to ensure compliance with least privilege principles.

Question 632

A gaming company recently launched a multiplayer gaming platform for its users. The platform runs on multiple Amazon EC2 instances across two Availability Zones. Players use TCP to communicate with the platform in real time. The platform must be highly available and automatically scale as the number of players increases, while remaining cost-effective.

Which combination of steps will meet these requirements MOST cost-effectively? (Select TWO)

  • ✅ A. Add a Network Load Balancer in front of the EC2 instances to manage TCP traffic.
  • ✅ B. Configure an Auto Scaling group to add or remove EC2 instances based on player traffic.
  • ❌ C. Configure Amazon Route 53 to implement latency-based routing across multiple EC2 instances.
  • ❌ D. Use an Application Load Balancer to distribute TCP traffic to the EC2 instances.
  • ❌ E. Deploy an Amazon ECS cluster to replace the EC2 instances and handle player traffic.

Question 633

An application is deployed on multiple AWS regions and accessed from around the world. The application exposes static public IP addresses. Some users are experiencing poor performance when accessing the application over the Internet.

What should a solutions architect recommend to reduce internet latency?

  • ❌ A. Set up an Amazon Route 53 geoproximity routing policy to route traffic
  • ✅ B. Set up AWS Global Accelerator and add endpoints
  • ❌ C. Set up AWS Direct Connect locations in multiple Regions
  • ❌ D. Set up an Amazon CloudFront distribution to access an application

Question 634

A financial services company needs to set up an Amazon RDS Multi-AZ database to store customer transaction records. The database will serve as the backend for an on-premises financial analysis application. The company requires the on-premises application to connect directly to the RDS database when employees are working from the office.

The company must ensure the connection is established securely and efficiently.

Which solution provides the required connectivity MOST securely?

  • ❌ A. Create a VPC with two public subnets. Deploy the RDS database in the public subnets. Use AWS Client VPN to establish secure connectivity between employees’ desktops and the database.
  • ❌ B. Create a VPC with two private subnets. Deploy the RDS database in the private subnets. Configure RDS security groups to allow the on-premises office IP ranges to access the database directly over the internet.
  • ✅ C. Create a VPC with two private subnets. Deploy the RDS database in the private subnets. Establish connectivity between the on-premises office and AWS using AWS Site-to-Site VPN with a customer gateway.
  • ❌ D. Create a VPC with two public subnets. Deploy the RDS database in the public subnets. Configure an AWS Direct Connect connection between the on-premises office and the VPC for low-latency access.

Question 635

An organization is extending a secure development environment into AWS. They have already secured the VPC including removing the Internet Gateway and setting up a Direct Connect connection. What else needs to be done to add encryption?

  • ✅ A. Setup a Virtual Private Gateway (VPG)
  • ❌ B. Setup the Border Gateway Protocol (BGP) with encryption
  • ❌ C. Configure an AWS Direct Connect Gateway
  • ❌ D. Enable IPSec encryption on the Direct Connect connection

Question 636

A financial services company runs a credit evaluation system in a private subnet behind an Application Load Balancer (ALB) in a VPC. The VPC includes a NAT gateway and an internet gateway. The system analyzes customer credit data and uploads the results to Amazon S3 for reporting.

The company has strict regulatory requirements stating that all data traffic must remain within AWS’s private network and must not traverse the public internet. Additionally, the company wants to implement a cost-effective solution while ensuring compliance.

Which solution will meet these requirements MOST cost-effectively?

  • ✅ A. Configure an S3 gateway endpoint. Update the route table of the private subnet to direct S3 traffic through the endpoint.
  • ❌ B. Configure an S3 interface endpoint. Attach a security group to the endpoint that allows the application to send traffic to Amazon S3 securely.
  • ❌ C. Create a VPN connection between the VPC and Amazon S3 to ensure secure communication without public internet traffic.
  • ❌ D. Enable S3 Transfer Acceleration for faster uploads and downloads while restricting access to trusted IP addresses.

Question 637

A company operates a production environment on Amazon EC2 instances. The instances are required to run continuously from Tuesday to Sunday without interruptions. On Mondays, the instances are needed for only 8 hours, and they also cannot tolerate interruptions. The company wants to implement a cost-effective solution to optimize EC2 usage while meeting these requirements.

Which solution will provide the MOST cost-effective results?

  • ❌ A. Purchase Standard Reserved Instances for the EC2 instances that operate continuously from Tuesday to Sunday. Use Convertible Reserved Instances for the EC2 instances that run for 8 hours on Mondays.
  • ✅ B. Purchase Standard Reserved Instances for the EC2 instances that operate continuously from Tuesday to Sunday. Use Scheduled Reserved Instances for the EC2 instances that run for 8 hours on Mondays.
  • ❌ C. Purchase Convertible Reserved Instances for the EC2 instances that operate continuously from Tuesday to Sunday. Use Spot Instances for the EC2 instances that run for 8 hours on Mondays.
  • ❌ D. Use Spot Instances for the EC2 instances that run for 8 hours on Mondays. Purchase Standard Reserved Instances for the EC2 instances that operate continuously from Tuesday to Sunday.

Question 638

A gaming company collects real-time data and stores it in an on-premises database system. The company are migrating to AWS and need better performance for the database. A solutions architect has been asked to recommend an in-memory database that supports data replication.

Which database should a solutions architect recommend?

  • ✅ A. Amazon ElastiCache for Redis
  • ❌ B. Amazon RDS for PostgreSQL
  • ❌ C. Amazon ElastiCache for Memcached
  • ❌ D. Amazon RDS for MySQL

Question 639

An online store uses an Amazon Aurora database. The database is deployed as a Multi-AZ deployment. Recently, metrics have shown that database read requests are high and causing performance issues which result in latency for write requests.

What should the solutions architect do to separate the read requests from the write requests?

  • ❌ A. Create a read replica and modify the application to use the appropriate endpoint
  • ❌ B. Create a second Amazon Aurora database and link it to the primary database as a read replica
  • ✅ C. Update the application to read from the Aurora Replica
  • ❌ D. Enable read through caching on the Amazon Aurora database

Question 640

A research institute uses an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to run machine learning workloads. The institute must ensure that Kubernetes service accounts within the EKS cluster have secure, fine-grained access to specific AWS resources for model training and data processing. The solution must use IAM roles for service accounts (IRSA) to meet these requirements.

Which combination of solutions will meet these requirements? (Select TWO)

  • ✅ A. Configure a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider associated with the EKS cluster.
  • ❌ B. Create an IAM policy that defines the necessary permissions for AWS resources. Attach the policy directly to the IAM role of the EKS worker nodes.
  • ❌ C. Modify the EKS cluster's worker node IAM role to include permissions for Kubernetes service accounts. Ensure all service accounts map to a single IAM role.
  • ❌ D. Implement pod security policies in the EKS cluster to restrict pods from accessing unauthorized AWS resources.
  • ✅ E. Define an IAM role that includes the required permissions. Annotate the Kubernetes service accounts with the Amazon Resource Name (ARN) of the IAM role.

Question 641

A company has created a duplicate of its environment in another AWS Region. The application is running in warm standby mode. There is an Application Load Balancer (ALB) in front of the application. Currently, failover is manual and requires updating a DNS alias record to point to the secondary ALB.

How can a solutions architect automate the failover process?

  • ✅ A. Enable an Amazon Route 53 health check
  • ❌ B. Create a latency based routing policy on Amazon Route 53
  • ❌ C. Create a CNAME record on Amazon Route 53 pointing to the ALB endpoint
  • ❌ D. Enable an ALB health check

Question 642

A security officer requires that access to company financial reports is logged. The reports are stored in an Amazon S3 bucket. Additionally, any modifications to the log files must be detected.

Which actions should a solutions architect take?

  • ❌ A. Use S3 server access logging on the bucket that houses the reports with the read and write management events and log file validation options enabled
  • ❌ B. Use AWS CloudTrail to create a new trail. Configure the trail to log read and write management events on the S3 bucket that houses the reports. Log these events to a new bucket, and enable log file validation
  • ❌ C. Use S3 server access logging on the bucket that houses the reports with the read and write data events and the log file validation options enabled
  • ✅ D. Use AWS CloudTrail to create a new trail. Configure the trail to log read and write data events on the S3 bucket that houses the reports. Log these events to a new bucket, and enable log file validation

Question 643

A company runs a containerized application on an Amazon Elastic Kubernetes Service (EKS) using a microservices architecture. The company requires a solution to collect, aggregate, and summarize metrics and logs. The solution should provide a centralized dashboard for viewing information including CPU and memory utilization for EKS namespaces, services, and pods.

Which solution meets these requirements?

  • ❌ A. Configure AWS X-Ray to enable tracing for the EKS microservices. Query the trace data using Amazon Elasticsearch.
  • ✅ B. Configure Amazon CloudWatch Container Insights in the existing EKS cluster. View the metrics and logs in the CloudWatch console.
  • ❌ C. Migrate the containers to Amazon ECS and enable Amazon CloudWatch Container Insights. View the metrics and logs in the CloudWatch console.
  • ❌ D. Run the Amazon CloudWatch agent in the existing EKS cluster. View the metrics and logs in the CloudWatch console.

Question 644

A company is deploying an application that produces data that must be processed in the order it is received. The company requires a solution for decoupling the event data from the processing layer. The solution must minimize operational overhead.

How can a Solutions Architect meet these requirements?

  • ❌ A. Create an Amazon SNS topic to decouple the application. Configure an AWS Lambda function as a subscriber.
  • ❌ B. Create an Amazon SQS standard queue to decouple the application. Set up an AWS Lambda function to process messages from the queue independently.
  • ❌ C. Create an Amazon SNS topic to decouple the application. Configure an Amazon SQS queue as a subscriber.
  • ✅ D. Create an Amazon SQS FIFO queue to decouple the application. Configure an AWS Lambda function to process messages from the queue.

Question 645

An online education company is launching a new e-learning platform on AWS. The platform will run on Amazon EC2 instances deployed across multiple Availability Zones in multiple AWS Regions. Students worldwide will access the platform through the internet to stream educational content. The company wants to ensure that each student is directed to the EC2 instances in the Region that is geographically closest to their location. The solution must provide high availability and efficient traffic routing.

Which solution will meet these requirements?

  • ❌ A. Use Amazon Route 53 geolocation routing policy to direct students to the closest Region. Use an internet-facing Application Load Balancer to distribute traffic across the EC2 instances within each Region.
  • ❌ B. Use Amazon Route 53 geoproximity routing policy to route students to the geographically closest Region. Configure an internet-facing Network Load Balancer to distribute traffic across the EC2 instances within each Availability Zone.
  • ❌ C. Use Amazon Route 53 weighted routing policy to balance traffic across Regions. Use an internet-facing Application Load Balancer to distribute traffic across the EC2 instances within each Availability Zone.
  • ✅ D. Use Amazon Route 53 latency routing policy to direct students to the Region with the lowest network latency. Use an internet-facing Application Load Balancer to distribute traffic across the EC2 instances within each Region.

Question 646

An application has multiple components for receiving requests that must be processed and subsequently processing the requests. The company requires a solution for decoupling the application components. The application receives around 10,000 requests per day and requests can take up to 2 days to process. Requests that fail to process must be retained.

Which solution meets these requirements most efficiently?

  • ❌ A. Use an Amazon Kinesis data stream to decouple application components and integrate the processing component with the Kinesis Client Library (KCL).
  • ❌ B. Decouple the application components with an Amazon SQS Topic. Configure the receiving component to subscribe to the SNS Topic.
  • ✅ C. Decouple the application components with an Amazon SQS queue. Configure a dead-letter queue to collect the requests that failed to process.
  • ❌ D. Create an Amazon DynamoDB table and enable DynamoDB streams. Configure the processing component to process requests from the stream.

Question 647

A solutions architect is designing a microservices architecture. AWS Lambda will store data in an Amazon DynamoDB table named Orders. The solutions architect needs to apply an IAM policy to the Lambda function’s execution role to allow it to put, update, and delete items in the Orders table. No other actions should be allowed.

Which of the following code snippets should be included in the IAM policy to fulfill this requirement whilst providing the LEAST privileged access?

  • ❌ A.

      "Sid": "PutUpdateDeleteOnOrders",
  "Effect": "Deny",
  "Action": "dynamodb:* ",
  "Resource": "arn:aws:dynamodb:us-east-1:227392126428:table/Orders"

  • ❌ B.

      "Sid": "PutUpdateDeleteOnOrders",
  "Effect": "Allow",
  "Action": "dynamodb:\* ",
  "Resource": "arn:aws:dynamodb:us-east-1:227392126428:table/Orders"

  • ✅ C.

      "Sid": "PutUpdateDeleteOnOrders",
  "Effect": "Allow",
  "Action": [
  "dynamodb:PutItem",
  "dynamodb:UpdateItem",
  "dynamodb:DeleteItem"
  ],
  "Resource": "arn:aws:dynamodb:us-east-1:227392126428:table/Orders"

  • ❌ D.

      "Sid": "PutUpdateDeleteOnOrders",
  "Effect": "Allow",
  "Action": [
  "dynamodb:PutItem",
  "dynamodb:UpdateItem",
  "dynamodb:DeleteItem"
  ],
  "Resource": "arn:aws:dynamodb:us-east-1:227392126428:table/*"

Question 648

A government agency is moving its document management system to AWS. The application will store classified documents in Amazon S3. The agency must encrypt the documents before storing them in S3 to ensure compliance with strict data security regulations.

Which solution will meet these requirements?

  • ❌ A. Encrypt the documents by using server-side encryption with AWS KMS keys (SSE-KMS) configured with custom key policies for access control.
  • ✅ B. Encrypt the documents by using client-side encryption with customer managed keys and upload the encrypted files to S3.
  • ❌ C. Encrypt the documents by using client-side encryption with Amazon S3 managed keys and upload the encrypted files to S3.
  • ❌ D. Encrypt the documents by using server-side encryption with customer-provided keys (SSE-C).

Question 649

A scientific research organization runs an on-premises simulation application that processes large datasets. The organization has migrated all simulation data to Amazon S3 to reduce costs. The simulation application requires low-latency storage access for seamless performance during processing tasks.

The organization needs to design a storage solution that minimizes costs while maintaining the performance requirements of the application.

Which storage solution will meet these requirements in the MOST cost-effective way?

  • ❌ A. Use AWS DataSync to copy frequently accessed data from Amazon S3 to an on-premises storage system. Configure the application to use the local storage for low-latency access.
  • ❌ B. Deploy a high-speed internet connection and configure the on-premises application to access the data directly from Amazon S3 using the S3 API for storage operations.
  • ✅ C. Use Amazon S3 File Gateway to provide low-latency storage for the on-premises application. The File Gateway will cache frequently accessed data locally.
  • ❌ D. Copy the data from Amazon S3 to Amazon FSx for Lustre. Use an Amazon FSx File Gateway to provide low-latency access for the on-premises application.

Question 650

A logistics company needs to replicate ongoing data changes from an on-premises Microsoft SQL Server database to Amazon RDS for SQL Server. The volume of data to replicate varies throughout the day due to periodic spikes in activity. The company plans to use AWS Database Migration Service (AWS DMS) for this task. The solution must dynamically allocate capacity based on workload demand while keeping operational overhead low.

Which solution will meet these requirements?

  • ❌ A. Deploy AWS DMS in an Amazon Elastic Kubernetes Service (Amazon EKS) cluster and use an autoscaler to adjust compute capacity during data spikes.
  • ✅ B. Configure AWS DMS Serverless to create a replication task that scales its capacity automatically based on workload demand.
  • ❌ C. Use Amazon EC2 Spot Instances to host the AWS DMS replication instance and manually scale up or down based on replication needs.
  • ❌ D. Create an AWS DMS replication instance with provisioned capacity in a Multi-AZ deployment to improve availability and fault tolerance.

Question 651

A company manages several applications that run in different AWS accounts within an AWS Organizations setup. The company has outsourced the management of certain applications to external contractors. The contractors require secure access to the AWS Management Console and operating system access to Amazon Linux-based Amazon EC2 instances in private subnets for troubleshooting. The company must ensure all activities are logged and minimize the risk of unauthorized access.

Which solution will meet these requirements MOST securely?

  • ✅ A. Deploy AWS Systems Manager Agent (SSM Agent) to all instances. Assign an instance profile to the instances with the required Systems Manager policies. Grant contractors access to the AWS Management Console by configuring permission sets in AWS IAM Identity Center. Use Systems Manager Session Manager for secure instance access without requiring open network ports.
  • ❌ B. Use AWS Systems Manager Agent (SSM Agent) with an attached instance profile to manage EC2 access. Provide contractors with temporary local IAM user credentials in each AWS account for console access. Require contractors to use Systems Manager Session Manager for instance access.
  • ❌ C. Set up AWS VPN or Direct Connect to create a private network connection to the contractors’ office. Allow access to the AWS Management Console by creating IAM user credentials in each AWS account. Use security groups to allow SSH access from the contractors' office to the private EC2 instances.
  • ❌ D. Configure a bastion host in a public subnet. Restrict SSH access to the bastion host by using security groups to allow connections only from the contractors' IP address ranges. Provide contractors with IAM user credentials for Management Console access and SSH key pairs for accessing private instances via the bastion host.

Question 652

An application runs on-premises and produces data that must be stored in a locally accessible file system that servers can mount using the NFS protocol. The data must be subsequently analyzed by Amazon EC2 instances in the AWS Cloud.

How can these requirements be met?

  • ✅ A. Use an AWS Storage Gateway file gateway to provide a locally accessible file system that replicates data to the cloud, then analyze the data in the AWS Cloud.
  • ❌ B. Use an AWS Storage Gateway volume gateway in stored mode to regularly take snapshots of the local data, then copy the data to AWS.
  • ❌ C. Use an AWS Storage Gateway volume gateway in cached mode to back up all the local storage in the AWS Cloud, then perform analytics on this data in the cloud.
  • ❌ D. Use an AWS Storage Gateway tape gateway to take a backup of the local data and store it on AWS, then perform analytics on this data in the AWS Cloud.

Question 653

A Solutions Architect working for a large financial institution is building an application to manage their customers financial information and their sensitive personal information. The Solutions Architect requires that the storage layer can store immutable data out of the box, with the ability to encrypt the data at rest and requires that the storage layer provides ACID properties. They also want to use a containerized solution to manage the compute layer.

Which solution will meet these requirements with the LEAST amount of operational overhead?

  • ❌ A. Create a cluster of ECS instances on AWS Fargate within an Auto Scaling Group behind an Application Load Balancer. To manage the storage layer, use Amazon S3.
  • ✅ B. Set up an ECS cluster behind an Application Load Balancer on AWS Fargate. Use Amazon Quantum Ledger Database (QLDB) to manage the storage layer.
  • ❌ C. Configure an ECS cluster on EC2 behind an Application Load Balancer within an Auto Scaling Group. Store data using Amazon DynamoDB.
  • ❌ D. Create an Auto Scaling Group with EC2 instances behind an Application Load Balancer. To manage the storage layer, use Amazon S3.

Question 654

An educational content provider has accumulated several terabytes of learning resources in an Amazon S3 bucket located in a specific AWS Region. A partner organization, based in a different AWS Region, has been granted access to the S3 bucket to retrieve the resources for integration into its own platform. The content provider wants to minimize its data transfer costs when the partner organization accesses the S3 bucket.

Which solution will meet these requirements?

  • ✅ A. Enable the Requester Pays feature on the content provider’s S3 bucket.
  • ❌ B. Use S3 Transfer Acceleration to allow the partner organization to retrieve data from the bucket.
  • ❌ C. Set up S3 Cross-Region Replication (CRR) to copy the learning resources to the partner organization’s S3 bucket.
  • ❌ D. Configure the bucket to use S3 Standard-IA storage to reduce access costs for the partner organization.
Hermes Wiki