Hermes Wiki

Question 655

An application has been deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). A Solutions Architect must improve the security posture of the application and minimize the impact of a DDoS attack on resources.

Which of the following solutions is MOST effective?

✅ A. Configure an AWS WAF ACL with rate-based rules. Enable the WAF ACL on the Application Load Balancer.
❌ B. Enable access logs on the Application Load Balancer and configure Amazon CloudWatch to monitor the access logs and trigger a Lambda function when potential attacks are identified. Configure the Lambda function to modify the ALBs security group and block the attack.
❌ C. Enable VPC Flow Logs and store them in Amazon S3. Use Amazon Athena to parse the logs and identify and block potential DDoS attacks.
❌ D. Create a custom AWS Lambda function that monitors for suspicious traffic and modifies a network ACL when a potential DDoS attack is identified.

Question 656

A web application runs in public and private subnets. The application architecture consists of a web tier and database tier running on Amazon EC2 instances. Both tiers run in a single Availability Zone (AZ).

Which combination of steps should a solutions architect take to provide high availability for this architecture? (Select TWO)

❌ A. Add the existing web application instances to an Auto Scaling group behind an Application Load Balancer (ALB)
✅ B. Create an Amazon EC2 Auto Scaling group and Application Load Balancer (ALB) spanning multiple AZs
❌ C. Create new public and private subnets in a new AZ. Create a database using Amazon EC2 in one AZ
✅ D. Create new public and private subnets in the same VPC, each in a new AZ. Migrate the database to an Amazon RDS multi-AZ deployment
❌ E. Create new public and private subnets in the same AZ for high availability

Question 657

An application in a private subnet needs to query data in an Amazon DynamoDB table. Use of the DynamoDB public endpoints must be avoided. What is the most EFFICIENT and secure method of enabling access to the table?

❌ A. Create a software VPN between DynamoDB and the application in the private subnet
✅ B. Create a gateway VPC endpoint and add an entry to the route table
❌ C. Create an interface VPC endpoint in the VPC with an Elastic Network Interface (ENI)
❌ D. Create a private Amazon DynamoDB endpoint and connect to it using an AWS VPN

Question 658

A company requires a solution to allow customers to customize images that are stored in an online catalog. The image customization parameters will be sent in requests to Amazon API Gateway. The customized image will then be generated on-demand and can be accessed online.

The solutions architect requires a highly available solution. Which solution will be MOST cost-effective?

❌ A. Use Amazon EC2 instances to manipulate the original images into the requested customization. Store the original images in Amazon S3 and the manipulated images in Amazon DynamoDB. Configure an Amazon CloudFront distribution with the S3 bucket as the origin
❌ B. Use Amazon EC2 instances to manipulate the original images into the requested customization. Store the original and manipulated images in Amazon S3. Configure an Elastic Load Balancer in front of the EC2 instances
❌ C. Use AWS Lambda to manipulate the original images to the requested customization. Store the original images in Amazon S3 and the manipulated images in Amazon DynamoDB. Configure an Elastic Load Balancer in front of the Amazon EC2 instances
✅ D. Use AWS Lambda to manipulate the original images to the requested customization. Store the original and manipulated images in Amazon S3. Configure an Amazon CloudFront distribution with the S3 bucket as the origin

Question 659

A Solutions Architect is designing an application that consists of AWS Lambda and Amazon RDS Aurora MySQL. The Lambda function must use database credentials to authenticate to MySQL and security policy mandates that these credentials must not be stored in the function code.

How can the Solutions Architect securely store the database credentials and make them available to the function?

❌ A. Store the credentials in AWS Key Management Service and use environment variables in the function code pointing to KMS
❌ B. Create an IAM policy and store the credentials in the policy. Attach the policy to the Lambda function execution role
✅ C. Store the credentials in Systems Manager Parameter Store and update the function code and execution role
❌ D. Use the AWSAuthenticationPlugin and associate an IAM user account in the MySQL database

Question 660

A company is testing a new web application that runs on Amazon EC2 instances. A Solutions Architect is performing load testing and must be able to analyze the performance of the web application with a granularity of 1 minute.

What should the Solutions Architect do to meet this requirement?

❌ A. Create an AWS Lambda function to fetch EC2 logs from Amazon CloudWatch Logs. Use Amazon CloudWatch metrics to perform the analysis.
❌ B. Create an AWS CloudTrail trail and log data events. Use Amazon Athena to query the CloudTrail logs.
❌ C. Send Amazon CloudWatch logs to Amazon S3. Use Amazon Athena to perform the analysis.
✅ D. Enable detailed monitoring on all EC2 instances. Use Amazon CloudWatch metrics to perform the analysis.

Question 661

A Solutions Architect is migrating a distributed application from their on-premises environment into AWS. This application consists of an Apache Cassandra NoSQL database, with a containerized SUSE Linux compute layer with an additional storage layer made up of multiple Microsoft SQL Server databases. Once in the cloud the company wants to have as little operational overhead as possible, with no schema conversion during the migration and the company wants to host the architecture in a highly available and durable way.

Which of the following groups of services will provide the solutions architect with the best solution ?

✅ A. Run the NoSQL database on Amazon Keyspaces, and the compute layer on Amazon ECS on Fargate. Use Amazon RDS for Microsoft SQL Server to host the second storage layer.
❌ B. Run the NoSQL database on DynamoDB, and the compute layer on Amazon ECS on Fargate. Use Amazon RDS for Microsoft SQL Server to host the second storage layer.
❌ C. Run the NoSQL database on DynamoDB, and the compute layer on Amazon ECS on EC2. Use Amazon RDS for Microsoft SQL Server to host the second storage layer.
❌ D. Run the NoSQL database on Amazon Keyspaces, and the compute layer on Amazon ECS on Fargate. Use Amazon Aurora to host the second storage layer.

Question 662

A Solutions Architect for a large banking company is configuring access control within the organization for an Amazon S3 bucket containing thousands of financial records. There are 20 different teams which need to have access to this bucket, however they all need different permissions. These 20 teams correspond to 20 accounts within the banking company who are currently using AWS Organizations.

What is the simplest way to achieve this, whilst adhering to the principle of least privilege?

✅ A. Use S3 Access points to administer different access policies to each team, and control access points using Service Control Policies within AWS Organizations.
❌ B. Create the S3 Bucket in an individual account. Configure an IAM Role for each user to enable cross account access for the S3 Bucket with a permissions policy to only access the appropriate items within the bucket.
❌ C. Create a new AWS Organizations. Assign each team to a different Organizational Unit and apply to appropriate permissions granting access to the appropriate resources in the bucket.
❌ D. Copy the items from the bucket to create separate versions of each Separate the items in the bucket into new buckets. Administer Bucket policies to allow each account to access the appropriate bucket.

Question 663

To increase performance and redundancy for an application a company has decided to run multiple implementations in different AWS Regions behind network load balancers. The company currently advertise the application using two public IP addresses from separate /24 address ranges and would prefer not to change these. Users should be directed to the closest available application endpoint.

Which actions should a solutions architect take? (Select TWO)

❌ A. Create an Amazon Route 53 geolocation based routing policy
❌ B. Create PTR records to map existing public IP addresses to an Alias
✅ C. Create an AWS Global Accelerator and attach endpoints in each AWS Region
❌ D. Assign new static anycast IP addresses and modify any existing pointers
✅ E. Migrate both public IP addresses to the AWS Global Accelerator

Question 664

A computer scientist working for a university is looking to build a machine learning application which will use telemetry data to predict weather for a given area at a given time. This application would benefit from using managed services and will need to find a solution which uses third party data within the application.

Which of the following combinations of services will deliver the best solution?

❌ A. Use Amazon SageMaker to build the machine learning part of the application and use AWS DataSync to gain access to the third-party telemetry data.
✅ B. Use Amazon SageMaker to build the machine learning part of the application and use AWS Data Exchange to gain access to the third-party telemetry data.
❌ C. Use a TensorFlow AMI from the AWS Marketplace to build the machine learning part of the application and use AWS DataSync to gain access to the third-party telemetry data.
❌ D. Use a TensorFlow AMI from the AWS Marketplace to build the machine learning part of the application and use AWS Data Exchange to gain access to the third-party telemetry data.

Question 665

An application is running on Amazon EC2 behind an Elastic Load Balancer (ELB). Content is being published using Amazon CloudFront and you need to restrict the ability for users to circumvent CloudFront and access the content directly through the ELB.

How can you configure this solution?

❌ A. Create an Origin Access Identity (OAI) and associate it with the distribution
❌ B. Use signed URLs or signed cookies to limit access to the content
❌ C. Use a Network ACL to restrict access to the ELB
✅ D. Create a VPC Security Group for the ELB and use AWS Lambda to automatically update the CloudFront internal service IP addresses when they change

Question 666

Over 500 TB of data must be analyzed using standard SQL business intelligence tools. The dataset consists of a combination of structured data and unstructured data. The unstructured data is small and stored on Amazon S3. Which AWS services are most suitable for performing analytics on the data?

✅ A. Amazon Redshift with Amazon Redshift Spectrum
❌ B. Amazon RDS MariaDB with Amazon Athena
❌ C. Amazon DynamoDB with Amazon DynamoDB Accelerator (DAX)
❌ D. Amazon ElastiCache for Redis with cluster mode enabled

Question 667

A company delivers content to subscribers distributed globally from an application running on AWS. The application uses a fleet of Amazon EC2 instance in a private subnet behind an Application Load Balancer (ALB). Due to an update in copyright restrictions, it is necessary to block access for specific countries.

What is the EASIEST method to meet this requirement?

❌ A. Modify the ALB security group to deny incoming traffic from blocked countries
❌ B. Use a network ACL to block the IP address ranges associated with the specific countries
❌ C. Modify the security group for EC2 instances to deny incoming traffic from blocked countries
✅ D. Use Amazon CloudFront to serve the application and deny access to blocked countries

Question 668

A company runs a large batch processing job at the end of every quarter. The processing job runs for 5 days and uses 15 Amazon EC2 instances. The processing must run uninterrupted for 5 hours per day. The company is investigating ways to reduce the cost of the batch processing job.

Which pricing model should the company choose?

❌ A. Dedicated Instances
✅ B. On-Demand Instances
❌ C. Reserved Instances
❌ D. Spot Instances

Question 669

Storage capacity has become an issue for a company that runs application servers on-premises. The servers are connected to a combination of block storage and NFS storage solutions. The company requires a solution that supports local caching without re-architecting its existing applications.

Which combination of changes can the company make to meet these requirements? (Select TWO)

❌ A. Use Amazon Elastic File System (EFS) volumes to replace the block storage.
✅ B. Use an AWS Storage Gateway volume gateway to replace the block storage.
✅ C. Use an AWS Storage Gateway file gateway to replace the NFS storage.
❌ D. Use AWS Direct Connect and mount an Amazon FSx for Windows File Server using iSCSI.
❌ E. Use the mount command on servers to mount Amazon S3 buckets using NFS.

Question 670

An automotive company plans to implement IoT sensors in manufacturing equipment that will send data to AWS in real time. The solution must receive events in an ordered manner from each asset and ensure that the data is saved for future processing.

Which solution would be MOST efficient?

❌ A. Use Amazon Kinesis Data Streams for real-time events with a shard for each equipment asset. Use Amazon Kinesis Data Firehose to save data to Amazon EBS.
✅ B. Use Amazon Kinesis Data Streams for real-time events with a partition for each equipment asset. Use Amazon Kinesis Data Firehose to save data to Amazon S3.
❌ C. Use an Amazon SQS FIFO queue for real-time events with one queue for each equipment asset. Trigger an AWS Lambda function for the SQS queue to save data to Amazon EFS.
❌ D. Use an Amazon SQS standard queue for real-time events with one queue for each equipment asset. Trigger an AWS Lambda function from the SQS queue to save data to Amazon S3.

Question 671

A company has divested a single business unit and needs to move the AWS account owned by the business unit to another AWS Organization. How can this be achieved?

❌ A. Create a new account in the destination AWS Organization and share the original resources using AWS Resource Access Manager
✅ B. Migrate the account using the AWS Organizations console
❌ C. Migrate the account using AWS CloudFormation
❌ D. Create a new account in the destination AWS Organization and migrate resources

Question 672

A highly elastic application consists of three tiers. The application tier runs in an Auto Scaling group and processes data and writes it to an Amazon RDS MySQL database. The Solutions Architect wants to restrict access to the database tier to only accept traffic from the instances in the application tier. However, instances in the application tier are being constantly launched and terminated.

How can the Solutions Architect configure secure access to the database tier?

✅ A. Configure the database security group to allow traffic only from the application security group
❌ B. Configure a Network ACL on the database subnet to allow all traffic from the application subnet
❌ C. Configure the database security group to allow traffic only from port 3306
❌ D. Configure a Network ACL on the database subnet to deny all traffic to ports other than 3306

Question 673

A company's application is running on Amazon EC2 instances in a single Region. In the event of a disaster, a solutions architect needs to ensure that the resources can also be deployed to a second Region.

Which combination of actions should the solutions architect take to accomplish this? (Select TWO)

✅ A. Launch a new EC2 instance from an Amazon Machine Image (AMI) in the second Region
❌ B. Launch a new EC2 instance in the second Region and copy a volume from Amazon S3 to the new instance
✅ C. Copy an Amazon Machine Image (AMI) of an EC2 instance and specify the second Region for the destination
❌ D. Detach a volume on an EC2 instance and copy it to an Amazon S3 bucket in the second Region
❌ E. Copy an Amazon Elastic Block Store (Amazon EBS) volume from Amazon S3 and launch an EC2 instance in the second Region using that EBS volume

Question 674

A company runs a web application that serves weather updates. The application runs on a fleet of Amazon EC2 instances in a Multi-AZ Auto scaling group behind an Application Load Balancer (ALB). The instances store data in an Amazon Aurora database. A solutions architect needs to make the application more resilient to sporadic increases in request rates.

Which architecture should the solutions architect implement? (Select TWO)

❌ A. Add an AWS Global Accelerator endpoint
✅ B. Add Amazon Aurora Replicas
❌ C. Add and AWS WAF in front of the ALB
❌ D. Add an AWS Transit Gateway to the Availability Zones
✅ E. Add an Amazon CloudFront distribution in front of the ALB

Question 675

A retail organization sends coupons out twice a week and this results in a predictable surge in sales traffic. The application runs on Amazon EC2 instances behind an Elastic Load Balancer. The organization is looking for ways lower costs while ensuring they meet the demands of their customers.

How can they achieve this goal?

❌ A. Use a mixture of spot instances and on demand instances
✅ B. Use capacity reservations with savings plans
❌ C. Increase the instance size of the existing EC2 instances
❌ D. Purchase Amazon EC2 dedicated hosts

Question 676

An IoT sensor is being rolled out to thousands of a company’s existing customers. The sensors will stream high volumes of data each second to a central location. A solution must be designed to ingest and store the data for analytics. The solution must provide near-real time performance and millisecond responsiveness.

Which solution should a Solutions Architect recommend?

❌ A. Ingest the data into an Amazon Kinesis Data Stream. Process the data with an AWS Lambda function and then store the data in Amazon RedShift.
❌ B. Ingest the data into an Amazon SQS queue. Process the data using an AWS Lambda function and then store the data in Amazon RedShift.
❌ C. Ingest the data into an Amazon SQS queue. Process the data using an AWS Lambda function and then store the data in Amazon DynamoDB.
✅ D. Ingest the data into an Amazon Kinesis Data Stream. Process the data with an AWS Lambda function and then store the data in Amazon DynamoDB.

Question 677

A Solutions Architect is designing an application that will run on an Amazon EC2 instance. The application must asynchronously invoke an AWS Lambda function to analyze thousands of .CSV files. The services should be decoupled.

Which service can be used to decouple the compute services?

✅ A. Amazon SNS
❌ B. Amazon Kinesis
❌ C. Amazon OpsWorks
❌ D. Amazon SWF

Question 678

A team are planning to run analytics jobs on log files each day and require a storage solution. The size and number of logs is unknown and data will persist for 24 hours only.

What is the MOST cost-effective solution?

✅ A. Amazon S3 Standard
❌ B. Amazon S3 Intelligent-Tiering
❌ C. Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)
❌ D. Amazon S3 Glacier Deep Archive

Question 679

An Amazon RDS Read Replica is being deployed in a separate region. The master database is not encrypted but all data in the new region must be encrypted. How can this be achieved?

❌ A. Enable encryption using Key Management Service (KMS) when creating the cross-region Read Replica
❌ B. Enabled encryption on the master DB instance, then create an encrypted cross-region Read Replica
✅ C. Encrypt a snapshot from the master DB instance, create a new encrypted master DB instance, and then create an encrypted cross-region Read Replica
❌ D. Encrypt a snapshot from the master DB instance, create an encrypted cross-region Read Replica from the snapshot

Question 680

A company has acquired another business and needs to migrate their 50TB of data into AWS within 1 month. They also require a secure, reliable and private connection to the AWS cloud.

How are these requirements best accomplished?

✅ A. Migrate data using AWS Snowball. Provision an AWS VPN initially and order a Direct Connect link
❌ B. Launch a Virtual Private Gateway (VPG) and migrate the data over the AWS VPN
❌ C. Provision an AWS VPN CloudHub connection and migrate the data over redundant links
❌ D. Provision an AWS Direct Connect connection and migrate the data over the link

Question 681

A Solutions Architect has placed an Amazon CloudFront distribution in front of their web server, which is serving up a highly accessed website, serving content globally. The Solutions Architect needs to dynamically route the user to a new URL depending on where the user is accessing from, through running a particular script. This dynamic routing will happen on every request, and as a result requires the code to run at extremely low latency, and low cost.

What solution will best achieve this goal?

❌ A. Use Route 53 Geo Proximity Routing to route users’ traffic to your resources based on their geographic location.
✅ B. At the Edge Location, run your code with CloudFront Functions.
❌ C. Redirect traffic by running your code within a Lambda function using Lambda@Edge.
❌ D. Use Path Based Routing to route each user to the appropriate webpage behind an Application Load Balancer.

Question 682

As part of a company’s shift to the AWS cloud, they need to gain an insight into their total on-premises footprint. They have discovered that they are currently struggling with managing their software licenses. They would like to maintain a hybrid cloud setup, with some of their licenses stored in the cloud with some stored on-premises.

What actions should be taken to ensure they are managing the licenses appropriately going forward?

❌ A. Use the AWS Key Management Service to treat the license key safely and store it securely
❌ B. Use Amazon S3 with governance lock to manage the storage of the licenses
✅ C. Use AWS License Manager to manage the software licenses
❌ D. Use AWS Secrets Manager to store the licenses as secrets to ensure they are stored securely

Question 683

A company is deploying an Amazon ElastiCache for Redis cluster. To enhance security a password should be required to access the database. What should the solutions architect use?

❌ A. VPC Security Group
❌ B. AWS Directory Service
❌ C. AWS IAM Policy
✅ D. Redis AUTH command

Question 684

A solutions architect needs to backup some application log files from an online ecommerce store to Amazon S3. It is unknown how often the logs will be accessed or which logs will be accessed the most. The solutions architect must keep costs as low as possible by using the appropriate S3 storage class.

Which S3 storage class should be implemented to meet these requirements?

✅ A. S3 Intelligent-Tiering
❌ B. S3 One Zone-Infrequent Access (S3 One Zone-IA)
❌ C. S3 Glacier
❌ D. S3 Standard-Infrequent Access (S3 Standard-IA)

Question 685

An application that runs a computational fluid dynamics workload uses a tightly-coupled HPC architecture that uses the MPI protocol and runs across many nodes. A service-managed deployment is required to minimize operational overhead.

Which deployment option is MOST suitable for provisioning and managing the resources required for this use case?

✅ A. Use AWS Batch to deploy a multi-node parallel job
❌ B. Use AWS CloudFormation to deploy a Cluster Placement Group on EC2
❌ C. Use Amazon EC2 Auto Scaling to deploy instances in multiple subnets
❌ D. Use AWS Elastic Beanstalk to provision and manage the EC2 instances

Question 686

The Chief Financial Officer of a large corporation is looking for an AWS native tool which will help reduce their cloud spend. After receiving a budget alarm, the company has decided that they need to reduce their spend across their different areas of compute and need insights into their spend to decide where they can reduce cost.

What is the easiest way to achieve this goal?

❌ A. AWS Trusted Advisor
❌ B. Cost and Usage Reports
✅ C. AWS Compute Optimizer
❌ D. AWS Cost Explorer

Question 687

An application running on an Amazon ECS container instance using the EC2 launch type needs permissions to write data to Amazon DynamoDB.

How can you assign these permissions only to the specific ECS task that is running the application?

❌ A. Use a security group to allow outbound connections to DynamoDB and assign it to the container instance
❌ B. Create an IAM policy with permissions to DynamoDB and attach it to the container instance
❌ C. Modify the AmazonECSTaskExecutionRolePolicy policy to add permissions for DynamoDB
✅ D. Create an IAM policy with permissions to DynamoDB and assign It to a task using the taskRoleArn parameter

Question 688

A new application will run across multiple Amazon ECS tasks. Front-end application logic will process data and then pass that data to a back-end ECS task to perform further processing and write the data to a datastore. The Architect would like to reduce-interdependencies so failures do no impact other components.

Which solution should the Architect use?

✅ A. Create an Amazon SQS queue and configure the front-end to add messages to the queue and the back-end to poll the queue for messages
❌ B. Create an Amazon Kinesis Firehose delivery stream and configure the front-end to add data to the stream and the back-end to read data from the stream
❌ C. Create an Amazon SQS queue that pushes messages to the back-end. Configure the front-end to add messages to the queue
❌ D. Create an Amazon Kinesis Firehose delivery stream that delivers data to an Amazon S3 bucket, configure the front-end to write data to the stream and the back-end to read data from Amazon S3

Question 689

A company has uploaded some highly critical data to an Amazon S3 bucket. Management are concerned about data availability and require that steps are taken to protect the data from accidental deletion. The data should still be accessible, and a user should be able to delete the data intentionally.

Which combination of steps should a solutions architect take to accomplish this? (Select TWO)

❌ A. Enable default encryption on the S3 bucket.
✅ B. Enable MFA Delete on the S3 bucket.
✅ C. Enable versioning on the S3 bucket.
❌ D. Create a lifecycle policy for the objects in the S3 bucket.
❌ E. Create a bucket policy on the S3 bucket.

Question 690

A solutions architect is designing the infrastructure to run an application on Amazon EC2 instances. The application requires high availability and must dynamically scale based on demand to be cost efficient.

What should the solutions architect do to meet these requirements?

❌ A. Configure an Application Load Balancer in front of an Auto Scaling group to deploy instances to multiple Regions
❌ B. Configure an Amazon API Gateway API in front of an Auto Scaling group to deploy instances to multiple Availability Zones
✅ C. Configure an Application Load Balancer in front of an Auto Scaling group to deploy instances to multiple Availability Zones
❌ D. Configure an Amazon CloudFront distribution in front of an Auto Scaling group to deploy instances to multiple Regions

Question 691

A company is migrating a decoupled application to AWS. The application uses a message broker based on the MQTT protocol. The application will be migrated to Amazon EC2 instances and the solution for the message broker must not require rewriting application code.

Which AWS service can be used for the migrated message broker?

❌ A. AWS Step Functions
❌ B. Amazon SQS
✅ C. Amazon MQ
❌ D. Amazon SNS

Question 692

A website is running on Amazon EC2 instances and access is restricted to a limited set of IP ranges. A solutions architect is planning to migrate static content from the website to an Amazon S3 bucket configured as an origin for an Amazon CloudFront distribution. Access to the static content must be restricted to the same set of IP addresses.

Which combination of steps will meet these requirements? (Select TWO)

❌ A. Create an AWS WAF web ACL that includes the same IP restrictions that exist in the EC2 security group. Associate this new web ACL with the Amazon S3 bucket.
❌ B. Create an origin access identity (OAI) and associate it with the distribution. Generate presigned URLs that limit access to the OAI.
✅ C. Create an origin access identity (OAI) and associate it with the distribution. Change the permissions in the bucket policy so that only the OAI can read the objects.
✅ D. Create an AWS WAF web ACL that includes the same IP restrictions that exist in the EC2 security group. Associate this new web ACL with the CloudFront distribution.
❌ E. Attach the existing security group that contains the IP restrictions to the Amazon CloudFront distribution.

Question 693

A solutions architect is creating a document submission application for a school. The application will use an Amazon S3 bucket for storage. The solution must prevent accidental deletion of the documents and ensure that all versions of the documents are available. Users must be able to upload and modify the documents.

Which combination of actions should be taken to meet these requirements? (Select TWO)

❌ A. Encrypt the bucket using AWS SSE-S3
✅ B. Enable MFA Delete on the bucket
❌ C. Set read-only permissions on the bucket
✅ D. Enable versioning on the bucket
❌ E. Attach an IAM policy to the bucket

Question 694

Every time an item in an Amazon DynamoDB table is modified a record must be retained for compliance reasons. What is the most efficient solution to recording this information?

❌ A. Enable DynamoDB Global Tables. Enable DynamoDB streams on the multi-region table and save the output directly to an Amazon S3 bucket
❌ B. Enable Amazon CloudTrail. Configure an Amazon EC2 instance to monitor activity in the CloudTrail log files and record changed items in another DynamoDB table
✅ C. Enable DynamoDB Streams. Configure an AWS Lambda function to poll the stream and record the modified item data to an Amazon S3 bucket
❌ D. Enable Amazon CloudWatch Logs. Configure an AWS Lambda function to monitor the log files and record deleted item data to an Amazon S3 bucket

Question 695

A solutions architect is designing an application on AWS. The compute layer will run in parallel across EC2 instances. The compute layer should scale based on the number of jobs to be processed. The compute layer is stateless. The solutions architect must ensure that the application is loosely coupled and the job items are durably stored.

Which design should the solutions architect use?

❌ A. Create an Amazon SNS topic to send the jobs that need to be processed. Create an Amazon EC2 Auto Scaling group for the compute application. Set the scaling policy for the Auto Scaling group to add and remove nodes based on CPU usage
❌ B. Create an Amazon SQS queue to hold the jobs that need to be processed. Create an Amazon EC2 Auto Scaling group for the compute application. Set the scaling policy for the Auto Scaling group to add and remove nodes based on network usage
❌ C. Create an Amazon SNS topic to send the jobs that need to be processed. Create an Amazon EC2 Auto Scaling group for the compute application. Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of messages published to the SNS topic
✅ D. Create an Amazon SQS queue to hold the jobs that needs to be processed. Create an Amazon EC2 Auto Scaling group for the compute application. Set the scaling policy for the Auto Scaling group to add and remove nodes based on the number of items in the SQS queue

Question 696

A company plans to make an Amazon EC2 Linux instance unavailable outside of business hours to save costs. The instance is backed by an Amazon EBS volume. There is a requirement that the contents of the instance’s memory must be preserved when it is made unavailable.

How can a solutions architect meet these requirements?

❌ A. Stop the instance outside business hours. Start the instance again when required.
✅ B. Hibernate the instance outside business hours. Start the instance again when required.
❌ C. Use Auto Scaling to scale down the instance outside of business hours. Scale up the instance when required.
❌ D. Terminate the instance outside business hours. Recover the instance again when required.

Question 697

Three Amazon VPCs are used by a company in the same region. The company has two AWS Direct Connect connections to two separate company offices and wishes to share these with all three VPCs. A Solutions Architect has created an AWS Direct Connect gateway. How can the required connectivity be configured?

❌ A. Associate the Direct Connect gateway to a virtual private gateway in each VPC
✅ B. Associate the Direct Connect gateway to a transit gateway
❌ C. Create a VPC peering connection between the VPCs and route entries for the Direct Connect Gateway
❌ D. Create a transit virtual interface between the Direct Connect gateway and each VPC

Question 698

An Amazon RDS PostgreSQL database is configured as Multi-AZ. A solutions architect needs to scale read performance and the solution must be configured for high availability. What is the most cost-effective solution?

❌ A. Deploy a read replica using Amazon ElastiCache
❌ B. Deploy a read replica in the same AZ as the master DB instance
✅ C. Create a read replica as a Multi-AZ DB instance
❌ D. Deploy a read replica in a different AZ to the master DB instance

Question 699

A company runs several NFS file servers in an on-premises data center. The NFS servers must run periodic backups to Amazon S3 using automatic synchronization for small volumes of data.

Which solution meets these requirements and is MOST cost-effective?

❌ A. Set up an AWS Direct Connect connection between the on-premises data center and AWS and copy the data to Amazon S3.
❌ B. Set up AWS Glue to extract the data from the NFS shares and load it into Amazon S3.
✅ C. Set up an AWS DataSync agent on the on-premises servers and sync the data to Amazon S3.
❌ D. Set up an SFTP sync using AWS Transfer for SFTP to sync data from on premises to Amazon S3.

Question 700

A website runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) which serves as an origin for an Amazon CloudFront distribution. An AWS WAF is being used to protect against SQL injection attacks. A review of security logs revealed an external malicious IP that needs to be blocked from accessing the website.

What should a solutions architect do to protect the application?

✅ A. Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address
❌ B. Modify the network ACL for the EC2 instances in the target groups behind the ALB to deny the malicious IP address
❌ C. Modify the network ACL on the CloudFront distribution to add a deny rule for the malicious IP address
❌ D. Modify the security groups for the EC2 instances in the target groups behind the ALB to deny the malicious IP address

Question 701

A company hosts a multiplayer game on AWS. The application uses Amazon EC2 instances in a single Availability Zone and users connect over Layer 4. Solutions Architect has been tasked with making the architecture highly available and also more cost-effective.

How can the solutions architect best meet these requirements? (Select TWO)

❌ A. Configure an Application Load Balancer in front of the EC2 instances
✅ B. Configure a Network Load Balancer in front of the EC2 instances
✅ C. Configure an Auto Scaling group to add or remove instances in multiple Availability Zones automatically
❌ D. Increase the number of instances and use smaller EC2 instance types
❌ E. Configure an Auto Scaling group to add or remove instances in the Availability Zone automatically

Question 702

A Solutions Architect is rearchitecting an application with decoupling. The application will send batches of up to 1000 messages per second that must be received in the correct order by the consumers.

Which action should the Solutions Architect take?

❌ A. Create an AWS Step Functions state machine
✅ B. Create an Amazon SQS FIFO queue
❌ C. Create an Amazon SNS topic
❌ D. Create an Amazon SQS Standard queue

Question 703

A legacy tightly-coupled High Performance Computing (HPC) application will be migrated to AWS. Which network adapter type should be used?

❌ A. Elastic Network Interface (ENI)
✅ B. Elastic Fabric Adapter (EFA)
❌ C. Elastic IP Address
❌ D. Elastic Network Adapter (ENA)

Question 704

A large MongoDB database running on-premises must be migrated to Amazon DynamoDB within the next few weeks. The database is too large to migrate over the company’s limited internet bandwidth so an alternative solution must be used. What should a Solutions Architect recommend?

❌ A. Use the AWS Database Migration Service (DMS) to extract and load the data to an AWS Snowball Edge device. Complete the migration to Amazon DynamoDB using AWS DMS in the AWS Cloud
❌ B. Enable compression on the MongoDB database and use the AWS Database Migration Service (DMS) to directly migrate the database to Amazon DynamoDB
✅ C. Use the Schema Conversion Tool (SCT) to extract and load the data to an AWS Snowball Edge device. Use the AWS Database Migration Service (DMS) to migrate the data to Amazon DynamoDB
❌ D. Setup an AWS Direct Connect and migrate the database to Amazon DynamoDB using the AWS Database Migration Service (DMS)

Question 705

A Solutions Architect has been tasked with building an application which stores images to be used for a website. The website will be accessed by thousands of customers. The images within the application need to be able to be transformed and processed as they are being retrieved. The solutions architect would prefer to use managed services to achieve this, and the solution should be highly available and scalable, and be able to serve users from around the world with low latency.

Which scenario represents the easiest solution for this task?

❌ A. Store the images in a DynamoDB table, with DynamoDB Global Tables enabled. Provision a Lambda function to process the data on demand as it leaves the table.
✅ B. Store the images in Amazon S3, behind a CloudFront distribution. Use S3 Object Lambda to transform and process the images whenever a GET request is initiated on an object.
❌ C. Store the images in Amazon S3, behind a CloudFront distribution. Use S3 Event Notifications to connect to a Lambda function to process and transform the images when a GET request is initiated on an object.
❌ D. Store the images in a DynamoDB table, with DynamoDB Accelerator enabled. Use Amazon EventBridge to pass the data into an event bus as it is retrieved from DynamoDB and use AWS Lambda to process the data.

Question 706

An organization want to share regular updates about their charitable work using static webpages. The pages are expected to generate a large amount of views from around the world. The files are stored in an Amazon S3 bucket. A solutions architect has been asked to design an efficient and effective solution.

Which action should the solutions architect take to accomplish this?

❌ A. Use cross-Region replication to all Regions
❌ B. Generate presigned URLs for the files
✅ C. Use Amazon CloudFront with the S3 bucket as its origin
❌ D. Use the geoproximity feature of Amazon Route 53

Question 707

Amazon EC2 instances in a development environment run between 9am and 5pm Monday-Friday. Production instances run 24/7. Which pricing models should be used to optimize cost and ensure capacity is available? (Select TWO)

✅ A. Use Reserved instances for the production environment
✅ B. On-demand capacity reservations for the development environment
❌ C. Use On-Demand instances for the production environment
❌ D. Use Reserved instances for the development environment
❌ E. Use Spot instances for the development environment

Question 708

An application is being monitored using Amazon GuardDuty. A Solutions Architect needs to be notified by email of medium to high severity events. How can this be achieved?

❌ A. Configure an Amazon CloudTrail alarm the triggers based on GuardDuty API activity
❌ B. Create an Amazon CloudWatch Logs rule that triggers an AWS Lambda function
❌ C. Configure an Amazon CloudWatch alarm that triggers based on a GuardDuty metric
✅ D. Create an Amazon CloudWatch events rule that triggers an Amazon SNS topic

Question 709

A Solutions Architect needs to select a low-cost, short-term option for adding resilience to an AWS Direct Connect connection. What is the MOST cost-effective solution to provide a backup for the Direct Connect connection?

❌ A. Configure an IPSec VPN connection over the Direct Connect link
❌ B. Implement a second AWS Direct Connection
❌ C. Configure AWS Transit Gateway with an IPSec VPN backup
✅ D. Implement an IPSec VPN connection and use the same BGP prefix

Question 710

A solutions architect is designing a new service that will use an Amazon API Gateway API on the frontend. The service will need to persist data in a backend database using key-value requests. Initially, the data requirements will be around 1 GB and future growth is unknown. Requests can range from 0 to over 800 requests per second.

Which combination of AWS services would meet these requirements? (Select TWO)

✅ A. Amazon DynamoDB
❌ B. Amazon EC2 Auto Scaling
✅ C. AWS Lambda
❌ D. AWS Fargate
❌ E. Amazon RDS

Question 711

A financial institution with many departments wants to migrate to the AWS Cloud from their data center. Each department should have their own established AWS accounts with preconfigured, Limited access to authorized services, based on each team's needs, by the principle of least privilege.

What actions should be taken to ensure compliance with these security requirements?

❌ A. Use AWS CloudFormation to create new member accounts and networking and use IAM roles to allow access to approved AWS services.
✅ B. Deploy a Landing Zone within AWS Control Tower. Allow department administrators to use the Landing Zone to create new member accounts and networking. Grant the department's AWS power user permissions on the created accounts.
❌ C. Deploy a Landing Zone within AWS Organizations. Allow department administrators to use the Landing Zone to create new member accounts and networking. Grant the department's AWS power user permissions on the created accounts.
❌ D. Configure AWS Organizations with SCPs and create new member accounts. Use AWS CloudFormation templates to configure the member account networking.

Question 712

A company hosts an application on Amazon EC2 instances behind Application Load Balancers in several AWS Regions. Distribution rights for the content require that users in different geographies must be served content from specific regions.

Which configuration meets these requirements?

✅ A. Create Amazon Route 53 records with a geolocation routing policy.
❌ B. Configure Application Load Balancers with multi-Region routing.
❌ C. Create Amazon Route 53 records with a geoproximity routing policy.
❌ D. Configure Amazon CloudFront with multiple origins and AWS WAF.

Question 713

A telecommunications company is looking to expand its 5G coverage nationwide, and as a result needs to provision and build their own private cellular network with the help of AWS.

Which solution does AWS provide to help with this?

❌ A. AWS Outposts
❌ B. AWS CloudHSM
✅ C. AWS Private 5G
❌ D. AWS Wavelength

Question 714

A Solutions Architect has been tasked with re-deploying an application running on AWS to enable high availability. The application processes messages that are received in an ActiveMQ queue running on a single Amazon EC2 instance. Messages are then processed by a consumer application running on Amazon EC2. After processing the messages the consumer application writes results to a MySQL database running on Amazon EC2.

Which architecture offers the highest availability and low operational complexity?

✅ A. Deploy Amazon MQ with active/standby brokers configured across two Availability Zones. Create an Auto Scaling group for the consumer EC2 instances across two Availability Zones. Use an Amazon RDS MySQL database with Multi-AZ enabled.
❌ B. Deploy Amazon MQ with active/standby brokers configured across two Availability Zones. Launch an additional consumer EC2 instance in another Availability Zone. Use Amazon RDS for MySQL with Multi-AZ enabled.
❌ C. Deploy a second Active MQ server to another Availability Zone. Launch an additional consumer EC2 instance in another Availability Zone. Use MySQL database replication to another Availability Zone.
❌ D. Deploy Amazon MQ with active/standby brokers configured across two Availability Zones. Launch an additional consumer EC2 instance in another Availability Zone. Use MySQL database replication to another Availability Zone.

Question 715

An application running on Amazon EC2 needs to asynchronously invoke an AWS Lambda function to perform data processing. The services should be decoupled.

Which service can be used to decouple the compute services?

❌ A. AWS Step Functions
❌ B. Amazon MQ
❌ C. AWS Config
✅ D. Amazon SNS

Question 716

An organization has a large amount of data on Windows (SMB) file shares in their on-premises data center. The organization would like to move data into Amazon S3. They would like to automate the migration of data over their AWS Direct Connect link.

Which AWS service can assist them?

✅ A. AWS DataSync
❌ B. AWS Database Migration Service (DMS)
❌ C. AWS Snowball
❌ D. AWS CloudFormation

Question 717

A HR application stores employment records on Amazon S3. Regulations mandate the records are retained for seven years. Once created the records are accessed infrequently for the first three months and then must be available within 10 minutes if required thereafter.

Which lifecycle action meets the requirements whilst MINIMIZING cost?

❌ A. Store the data in S3 Standard for 3 months, then transition to S3 Glacier
✅ B. Store the data in S3 Standard-IA for 3 months, then transition to S3 Glacier
❌ C. Store the data in S3 Intelligent Tiering for 3 months, then transition to S3 Standard-IA
❌ D. Store the data in S3 Standard for 3 months, then transition to S3 Standard-IA

Question 718

A company are finalizing their disaster recovery plan. A limited set of core services will be replicated to the DR site ready to seamlessly take over the in the event of a disaster. All other services will be switched off.

Which DR strategy is the company using?

❌ A. Warm standby
❌ B. Multi-site
❌ C. Backup and restore
✅ D. Pilot light

Question 719

A Solutions Architect is tasked with designing a fully Serverless, Microservices based web application which requires the use of a GraphQL API to provide a single entry point to the application.

Which AWS managed service could the Solutions Architect use?

✅ A. AWS AppSync
❌ B. API Gateway
❌ C. Amazon Athena
❌ D. AWS Lambda