Hermes Wiki
CertExams/SAA-C03/Questions/Questions12

Question 720

A company runs an internal browser-based application. The application runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. The Auto Scaling group scales up to 20 instances during work hours, but scales down to 2 instances overnight. Staff are complaining that the application is very slow when the day begins, although it runs well by midmorning

How should the scaling be changed to address the staff complaints and keep costs to a minimum?

  • ❌ A. Implement a step scaling action triggered at a lower CPU threshold, and decrease the cooldown period
  • ❌ B. Implement a scheduled action that sets the desired capacity to 20 shortly before the office opens
  • ❌ C. Implement a scheduled action that sets the minimum and maximum capacity to 20 shortly before the office opens
  • ✅ D. Implement a target tracking action triggered at a lower CPU threshold, and decrease the cooldown period

Question 721

A Solutions Architect is designing an application for processing and extracting data from log files. The log files are generated by an application and the number and frequency of updates varies. The files are up to 1 GB in size and processing will take around 40 seconds for each file.

Which solution is the most cost-effective?

  • ❌ A. Write the log files to an Amazon EC2 instance with an attached EBS volume. After processing, save the files to an Amazon S3 bucket
  • ❌ B. Write the log files to an Amazon SQS queue. Use AWS Lambda to process the files from the queue and save to an Amazon S3 bucket
  • ✅ C. Write the log files to an Amazon S3 bucket. Create an event notification to invoke an AWS Lambda function that will process the files
  • ❌ D. Write the log files to an Amazon S3 bucket. Create an event notification to invoke an Amazon ECS task to process the files and save to an Amazon S3 bucket

Question 722

A software firm is developing a microservices-based application to be deployed on Amazon ECS. This application needs to interact with a resilient, shared filesystem capable of restoring data to a different AWS Region with a Recovery Point Objective (RPO) of 2 hours.

The filesystem is also expected to provide a mount target in each Availability Zone (AZ) within a Region. The solutions architect intends to employ AWS Backup to oversee the cross-Region data replication.

Which option will meet these requirements?

  • ❌ A. Amazon FSx for OpenZFS.
  • ❌ B. Amazon FSx for NetApp ONTAP with a Multi-AZ deployment.
  • ✅ C. Amazon Elastic File System (Amazon EFS) with the Standard storage class.
  • ❌ D. Amazon FSx for Windows File Server with a Multi-AZ deployment.

Question 723

A company's web application is using multiple Amazon EC2 Linux instances and storing data on Amazon EBS volumes. The company is looking for a solution to increase the resiliency of the application in case of a failure.

What should a solutions architect do to meet these requirements?

  • ✅ A. Create an Application Load Balancer with Auto Scaling groups across multiple Availability Zones. Store data on Amazon EFS and mount a target on each instance
  • ❌ B. Create an Application Load Balancer with Auto Scaling groups across multiple Availability Zones. Mount an instance store on each EC2 instance
  • ❌ C. Launch the application on EC2 instances in each Availability Zone. Attach EBS volumes to each EC2 instance
  • ❌ D. Create an Application Load Balancer with Auto Scaling groups across multiple Availability Zones. Store data using Amazon S3 One Zone-Infrequent Access (S3 One Zone-A)

Question 724

A company runs an API on a Linux server in their on-premises data center. The company are planning to migrate the API to the AWS cloud. The company require a highly available, scalable and cost-effective solution. What should a Solutions Architect recommend?

  • ❌ A. Migrate the API to Amazon API Gateway and migrate the backend to Amazon EC2
  • ✅ B. Migrate the API to Amazon API Gateway and use AWS Lambda as the backend
  • ❌ C. Migrate the API to Amazon CloudFront and use AWS Lambda as the origin
  • ❌ D. Migrate the API server to Amazon EC2 instances in an Auto Scaling group and attach an Application Load Balancer

Question 725

A global financial services company is currently operating a three-tier web application to handle their main customer facing website. This application uses several Amazon EC2 instances behind an Application Load Balancer and connects directly to a DynamoDB table.

Due to recent customer complaints of slow loading times, their Solutions Architect has been asked to implement changes to solve this problem, without rearchitecting the core application components.

Which combination of actions should the solutions architect take to accomplish this? (Select TWO)

  • ✅ A. Set up an Amazon DynamoDB Accelerator (DAX) cluster in front of the DynamoDB table.
  • ❌ B. Migrate the web application to be hosted on a containerized solution using AWS Fargate.
  • ✅ C. Create a CloudFront distribution and place it in front of the Application Load Balancer.
  • ❌ D. Migrate the entire application stack to AWS Elastic Beanstalk with both web server and worker environments.
  • ❌ E. Migrate the DynamoDB database to Amazon Aurora with a multi-AZ deployment model.

Question 726

A three-tier web application is composed of a front end hosted on an Amazon EC2 instance in public subnet, application middleware hosted on EC2 in a private subnet and a database hosted on an Amazon RDS MySQL database in a private subnet. The database layer should be restricted to only allow incoming connections from the application.

Which of the following options makes sure that database can only be accessed by the application layer?

  • ❌ A. Create a new route table that excludes the route to the public subnets' CIDR blocks. Associate the route table with the database subnets.
  • ✅ B. Create a security group that allows inbound traffic from the security group that is assigned to instances in the private subnets. Attach the security group to the DB instances.
  • ❌ C. Create a security group that denies inbound traffic from the security group that is assigned to instances in the public subnets. Attach the security group to the DB instances.
  • ❌ D. Create a new peering connection between the public subnets and the private subnets. Create a different peering connection between the private subnets and the database subnets.

Question 727

A telemarketing company has developed customer call center functionality on AWS. The company plans to enhance the current application by enabling support for multiple speaker recognition and transcript generation. They also want to query the transcript files to analyze business patterns.

Which solution will meet these requirements?

  • ❌ A. Use Amazon Rekognition for multiple speaker recognition. Store the transcript files in Amazon S3. Use Amazon Textract for transcript file analysis.
  • ✅ B. Use Amazon Transcribe for multiple speaker recognition. Use Amazon Athena for transcript file analysis.
  • ❌ C. Use Amazon Translate for multiple speaker recognition. Store the transcript files in Amazon Redshift. Use SQL queries for transcript file analysis.
  • ❌ D. Use Amazon Rekognition for multiple speaker recognition. Store the transcript files in Amazon S3. Use machine learning models for transcript file analysis.

Question 728

A large company is currently using multiple AWS accounts as part of its cloud deployment model, and these accounts are currently structured using AWS Organizations. A Solutions Architect has been tasked with limiting access to an Amazon S3 bucket to only users of accounts that are enrolled with AWS Organizations. The Solutions Architect wants to avoid listing the many dozens of account IDs in the Bucket policy, as there are many accounts the frequent changes.

Which strategy meets these requirements with the LEAST amount of effort?

  • ✅ A. Use the global key of AWS Organizations within a bucket policy using the aws:PrincipalOrgID key to allow access only to accounts which are part of the Organization.
  • ❌ B. Use AWS Config and AWS Lambda functions to make remediations to the bucket policy as and when new accounts are created and tagged as not being part of AWS Organizations. Update the S3 bucket policy accordingly.
  • ❌ C. Add all the non-organizational accounts to an Organizational Unit (OU) and attached a Service Control Policy (SCP) which denies access to the specific Amazon S3 bucket.
  • ❌ D. Use Attribute Based Access Control by referencing Tags of accounts which are either enrolled as part of AWS Organizations, or not.

Question 729

An application is running in a private subnet of an Amazon VPC and must have outbound internet access for downloading updates. The Solutions Architect does not want the application exposed to inbound connection attempts. Which steps should be taken?

  • ❌ A. Create a NAT gateway but do not attach an internet gateway to the VPC
  • ❌ B. Attach an internet gateway to the VPC but do not create a NAT gateway
  • ❌ C. Attach an internet gateway to the private subnet and create a NAT gateway
  • ✅ D. Create a NAT gateway and attach an internet gateway to the VPC

Question 730

An application has been migrated from on-premises to an Amazon EC2 instance. The migration has failed to an unknown dependency that the application must communicate with an on-premises server using private IP addresses.

Which action should a solutions architect take to quickly provision the necessary connectivity?

  • ✅ A. Configure a Virtual Private Gateway
  • ❌ B. Create an Amazon CloudFront distribution
  • ❌ C. Create an AWS Transit Gateway
  • ❌ D. Setup an AWS Direct Connect connection

Question 731

The database layer of an on-premises web application is being migrated to AWS. The database uses a multi-threaded, in-memory caching layer to improve performance for repeated queries. Which service would be the most suitable replacement for the database cache?

  • ❌ A. Amazon DynamoDB DAX
  • ❌ B. Amazon RDS MySQL
  • ❌ C. Amazon ElastiCache Redis
  • ✅ D. Amazon ElastiCache Memcached

Question 732

A company has several AWS accounts each with multiple Amazon VPCs. The company must establish routing between all private subnets. The architecture should be simple and allow transitive routing to occur.

How should the network connectivity be configured?

  • ❌ A. Create a transitive VPC peering connection between each Amazon VPC and configure route tables
  • ❌ B. Create an AWS Managed VPN between each Amazon VPC and configure route tables
  • ❌ C. Create a hub-and-spoke topology with AWS App Mesh and use AWS Resource Access Manager to share route tables
  • ✅ D. Create an AWS Transit Gateway and share it with each account using AWS Resource Access Manager

Question 733

A game development company is planning to build a cloud-based game platform on AWS. The player activity patterns are unpredictable and could remain idle for extended periods. Only players who have purchased the game should have the ability to log in and play.

Which combination of steps will meet these requirements MOST cost-effectively? (Select THREE)

  • ✅ A. Use AWS Cognito User Pools to handle user authentication.
  • ✅ B. Leverage AWS Amplify to serve the frontend game interface with HTML, CSS, and JS. Use the integrated Amazon CloudFront configuration for distribution.
  • ❌ C. Set up an Amazon Elastic Container Service (Amazon ECS) service behind an Application Load Balancer to fetch player information from Amazon RDS. Establish an Amazon API Gateway endpoint to handle RESTful API calls, directing them to the ECS service.
  • ❌ D. Use AWS Cognito Identity Pools to handle user authentication.
  • ✅ E. Implement an AWS Lambda function to fetch player information from Amazon DynamoDB. Establish an Amazon API Gateway endpoint to handle RESTful API calls, directing them to the Lambda function.
  • ❌ F. Use Amazon S3 static web hosting with HTML, CSS, and JS. Use Amazon CloudFront to distribute the frontend game interface.

Question 734

A media company has grown significantly in the past few months and the management team are concerned about compliance, governance, auditing, and security. The management team requires that configuration changes are tracked a history of API calls is recorded.

What should a solutions architect do to meet these requirements?

  • ❌ A. Use AWS CloudTrail to track configuration changes and AWS Config to record API calls.
  • ✅ B. Use AWS Config to track configuration changes and AWS CloudTrail to record API calls.
  • ❌ C. Use AWS CloudTrail to track configuration changes and Amazon CloudWatch to record API calls.
  • ❌ D. Use AWS Config to track configuration changes and Amazon CloudWatch to record API calls.

Question 735

A multinational podcast company uses Amazon CloudFront for distributing its digital content. The company wants to gradually introduce content across various regions. It also needs to ensure that listeners who are outside the regions to which the content is currently released, cannot access the content.

Which solution will meet these requirements?

  • ✅ A. Implement geographical restrictions on CloudFront content using a deny list and create a custom error message.
  • ❌ B. Create a new URL for the restricted content and establish an expiration date-based access policy for signed URLs.
  • ❌ C. Encrypt the company's distributed content data and establish a custom error message.
  • ❌ D. Establish a new URL for the restricted content, control access with signed URLs and cookies, and set up a custom error message.

Question 736

A media company is running a production workload on thousands of EC2 instances which run a custom solution powered by third-party software. This software is subjected to regular updates and patches by the third-party organization.

How can a solutions architect patch all the instances quickly to remediate a security exposure?

  • ✅ A. Configure AWS Systems Manager Patch Manager to apply the patch to all EC2 instances.
  • ❌ B. Schedule an AWS Systems Manager maintenance window to apply the patch to all EC2 instances.
  • ❌ C. Create an AWS Lambda function to apply the patch to all EC2 instances.
  • ❌ D. Use AWS Systems Manager Run Command to run a custom command that applies the patch to all EC2 instances.

Question 737

A media company is designing a disaster recovery (DR) solution for a business-critical application. The recovery time objective (RTO) should be 4 hours or less. The application is running on Amazon EC2 instances using the fewest possible AWS resources during normal operations.

Which of the following is recommended to implement the DR solution across regions cost-effectively?

  • ❌ A. Launch EC2 instances in a secondary AWS Region. Keep the EC2 instances in the secondary Region active at all times.
  • ✅ B. Create Amazon Machine Images (AMIs) to back up the EC2 instances. Copy the AMIs to a secondary AWS Region. Automate infrastructure deployment in the secondary Region by using AWS CloudFormation.
  • ❌ C. Launch EC2 instances in a secondary Availability Zone. Keep the EC2 instances in the secondary Availability Zone active at all times.
  • ❌ D. Create Amazon Machine Images (AMI) to back up the EC2 instances. Copy the AMIs to a secondary AWS Region. Automate infrastructure deployment in the secondary Region by using AWS Lambda and custom scripts.

Question 738

An application that is being installed on an Amazon EC2 instance requires a persistent block storage volume. The data must be encrypted at rest and regular volume-level backups must be automated.

Which solution options should be used?

  • ❌ A. Use an encrypted Amazon EC2 instance store and copy the data to another EC2 instance using a cron job and a batch script
  • ✅ B. Use an encrypted Amazon EBS volume and use Data Lifecycle Manager to automate snapshots
  • ❌ C. Use server-side encryption on an Amazon S3 bucket and use Cross-Region-Replication to backup on a schedule
  • ❌ D. Use an encrypted Amazon EFS filesystem and use an Amazon CloudWatch Events rule to start a backup copy of data using AWS Lambda

Question 739

A company uses several Windows Servers as the operating system of choice for all their application servers hosted in their data center. The company wants to move some file servers into the cloud, and keep some in their data center, mounted to the same File System. The company also wants to maintain extremely low latency access to their on-premises data center, across a private network. The company has an AWS Direct Connect connection set up into the us-east-1 Region.

What should a solutions architect do to meet these requirements?

  • ❌ A. Migrate all the data to Amazon DynamoDB Local. Ensure all users have the appropriate IAM permissions to access the relevant files.
  • ✅ B. Install an SMB client on to the on-premises servers and mount an Amazon FSx file system to the servers. Mount the same file system to the EC2 instances within the Amazon VPC. Use the existing Direct Connect connection to connect the on-premises data center to the Amazon VPC.
  • ❌ C. Install an NFS client on to the on-premises servers and mount an Amazon EFS file system to the servers. Mount the same file system to the EC2 instances within the Amazon VPC. Use the existing Direct Connect connection to connect the on-premises data center to the Amazon VPC.
  • ❌ D. Use Amazon S3 on Outposts and mount the S3 File Gateway on to the on-premises servers.

Question 740

A music streaming company needs to incorporate a third-party song feed. The song feed sends a webhook to notify an external service when new songs are ready for consumption. A developer has written an AWS Lambda function to retrieve songs when the company receives a webhook callback. The developer must expose the Lambda function for the third party to invoke.

Which solution will meet these requirements with the LEAST operational complexity?

  • ❌ A. Create an Amazon Simple Queue Service (Amazon SQS) queue. Connect the queue to the Lambda function. Provide the ARN of the SQS queue to the third party for the webhook.
  • ✅ B. Generate an API Gateway endpoint for the Lambda function. Provide the API Gateway endpoint to the third party for the webhook.
  • ❌ C. Deploy a Network Load Balancer (NLB) to distribute requests to the Lambda function. Provide the NLB URL to the third party for the webhook.
  • ❌ D. Create an Amazon Simple Notification Service (Amazon SNS) topic. Link the topic to the Lambda function. Provide the SNS topic ARN to the third party for the webhook.

Question 741

A traffic law enforcement company is building a solution that has thousands of edge devices that collectively generate 1 TB of status alerts each day. These devices provide vehicle information and number plate data whenever alerts detecting red light jumps are detected. Each entry is around 2Kb in size. A solutions architect needs to implement a solution to ingest and store the alerts for future analysis.

The company wants a highly available solution. However, the company needs to minimize costs and does not want to manage additional infrastructure. Additionally, the company wants to keep 14 days of data available for immediate analysis and archive any data older than 14 days.

What is the MOST operationally efficient solution that meets these requirements?

  • ❌ A. Create an Amazon Simple Queue Service (Amazon SQS) standard queue to ingest the alerts and set the message retention period to 14 days. Configure consumers to poll the SQS queue, check the age of the message, and analyze the message data as needed. If the message is 14 days old, the consumer should copy the message to an Amazon S3 bucket and delete the message from the SQS queue.
  • ❌ B. Create an Amazon Kinesis Data Firehose delivery stream to ingest the alerts. Configure the kinesis Data Firehose stream to deliver the alerts to an Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster. Set up the Amazon Open Search Service (Amazon Elasticsearch Service) cluster to take manual snapshots every day and delete data from the cluster that is older than 14 days.
  • ✅ C. Create an Amazon Kinesis Data Firehose delivery stream to ingest the alerts. Configure the Kinesis Data Firehose stream to deliver the alerts to an Amazon S3 bucket. Set up an S3 Lifecycle configuration to transition data to Amazon S3 Glacier after 14 days.
  • ❌ D. Launch Amazon EC2 instances across two Availability Zones and place them behind an Elastic Load Balancer to ingest the alerts. Create a script on the EC2 instances that will store the alerts in an Amazon S3 bucket. Set up an S3 Lifecycle configuration to transition data to Amazon S3 Glacier after 14 days.

Question 742

An online game platform company is launching a new game feature that involves a significant update to their existing API hosted on Amazon API Gateway. The company wants to minimize the impact on their existing users, and they need a deployment strategy that allows them to gradually roll out the changes while monitoring for any potential issues.

What should the company do to achieve this?

  • ❌ A. Update the existing API directly in API Gateway with the new feature and immediately direct all traffic to the updated API.
  • ❌ B. Create a completely new API for the new game feature and redirect half of the user traffic to the new API while maintaining the other half on the existing API.
  • ✅ C. Use an API Gateway canary release deployment. Initially direct a small percentage of user traffic to the new API version. After API verification, promote the canary stage to the production stage.
  • ❌ D. Create a new version of the API and use Route 53 to gradually shift DNS queries from the existing API endpoint to the new API endpoint.

Question 743

A company wants to improve its ability to clone large amounts of production data into a test environment in the same AWS Region. The data is stored in Amazon EC2 instances on Amazon Elastic Block Store (Amazon EBS) volumes. Modifications to the cloned data must not affect the production environment. The software that accesses this data requires consistently high I/O performance.

A solutions architect needs to minimize the time that is required to clone the production data into the test environment.

Which solution will meet these requirements?

  • ❌ A. Take EBS snapshots of the production EBS volumes. Create and initialize new EBS volumes. Attach the new EBS volumes to EC2 instances in the test environment before restoring the volumes from the production EBS snapshots.
  • ✅ B. Take EBS snapshots of the production EBS volumes. Turn on the EBS fast snapshot restore feature on the EBS snapshots. Restore the snapshots into new EBS volumes. Attach the new EBS volumes to EC2 instances in the test environment.
  • ❌ C. Take EBS snapshots of the production EBS volumes. Restore the snapshots onto EC2 instance store volumes in the test environment.
  • ❌ D. Configure the production EBS volumes to use the EBS Multi-Attach feature. Take EBS snapshots of the production EBS volumes. Attach the production EBS volumes to the EC2 instances in the test environment.

Question 744

A Solutions Architect manages multiple Amazon RDS MySQL databases. To improve security, the Solutions Architect wants to enable secure user access with short-lived credentials. How can these requirements be met?

  • ❌ A. Configure the application to use the AUTH command to send a unique password
  • ❌ B. Configure the MySQL databases to use AWS KMS data encryption keys
  • ❌ C. Configure the MySQL databases to use the AWS Security Token Service (STS)
  • ✅ D. Create the MySQL user accounts to use the AWSAuthenticationPlugin with IAM

Question 745

An international logistics company has web applications running on AWS in the us-west-2 Region and database servers in the eu-central-1 Region. The applications running in a VPC in us-west-2 need to communicate securely with the databases running in a VPC in eu-central-1.

Which network design will meet these requirements?

  • ✅ A. Configure a VPC peering connection between the us-west-2 VPC and the eu-central-1 VPC. Update the subnet route tables accordingly. Create an inbound rule in the eu-central-1 database security group that allows traffic from the us-west-2 application server IP addresses.
  • ❌ B. Establish a VPC peering connection between the us-west-2 VPC and the eu-central-1 VPC. Modify the subnet route tables accordingly. Create an inbound rule in the eu-central-1 database security group that references the security group ID of the application servers in us-west-2.
  • ❌ C. Establish a transit gateway with a peering attachment between the us-west-2 VPC and the eu-central-1 VPC. After the transit gateways are properly peered and routing is configured, create an inbound rule in the eu-central-1 database security group that references the security group ID of the application servers in us-west-2.
  • ❌ D. Create a VPC peering connection between the us-west-2 VPC and the eu-central-1 VPC. Add the appropriate routes to the subnet route tables. Create an inbound rule in the us-west-2 application security group that allows traffic from the eu-central-1 database server IP addresses.

Question 746

A law firm has recently productionized a three-tier web application that is deployed on AWS. The web servers are deployed in a public subnet in a VPC. The application servers and database servers are deployed in private subnets in the same VPC. The company has deployed a third-party virtual firewall appliance from the AWS Marketplace in an inspection VPC. The appliance is configured with an IP interface that can accept IP packets.

A solutions architect needs to integrate the web application with the appliance to inspect all traffic to the application before the traffic reaches the web server.

Which solution will meet these requirements with the LEAST operational overhead?

  • ❌ A. Deploy a transit gateway in the inspection VPC. Configure route tables to route the incoming packets through the transit gateway.
  • ❌ B. Create an Application Load Balancer in the public subnet of the application's VPC to route the traffic to the appliance for packet inspection.
  • ❌ C. Create a Network Load Balancer in the public subnet of the application's VPC to route the traffic to the appliance for packet inspection.
  • ✅ D. Deploy a Gateway Load Balancer in the inspection VPC. Create a Gateway Load Balancer endpoint to receive the incoming packets and forward the packets to the appliance.

Question 747

A finance organization wants to deploy end of day processing applications to a fleet of Amazon EC2 instances with a focus on reducing cost. These applications are stateless and can be re-triggered in case of failure. The company needs a solution that minimizes cost and operational overhead.

What should a solutions architect do to meet these requirements?

  • ✅ A. Use Spot Instances in an Amazon Elastic Kubernetes Service (Amazon EKS) managed node group.
  • ❌ B. Use On-Demand Instances in an Amazon Elastic Kubernetes Service (Amazon EKS) managed node group.
  • ❌ C. Use Spot Instances in an Amazon EC2 Auto Scaling group to run the application containers.
  • ❌ D. Use On-Demand Instances in an Amazon EC2 Auto Scaling group to run the application containers.

Question 748

As a security measure, a finance-based organization want to introduce additional security measures for an existing application deployed in AWS. The application is serverless and has an Amazon API Gateway in front which is deployed in the us-east-1 Region and the eu-west-1 Region. The company requires the accounts to be secured against SQL injection and cross-site scripting attacks.

Which solution will meet these requirements with the LEAST amount of administrative effort?

  • ❌ A. Set up AWS WAF in both Regions. Associate Regional web ACLs with an API stage
  • ✅ B. Set up AWS Firewall Manager in both Regions. Centrally configure AWS WAF rules.
  • ❌ C. Set up AWS Shield in both Regions. Associate Regional web ACLs with an API stage.
  • ❌ D. Set up AWS Shield in one of the Regions. Associate Regional web ACLs with an API stage.

Question 749

A travel agency operates a web service in an AWS Region. The service is accessed by customers via a REST API on Amazon API Gateway. The agency uses Amazon Route 53 for DNS and wants to provide individual and secure URLs for each travel agent using the service.

Which combination of steps will meet these requirements with the LEAST operational complexity? (Select THREE)

  • ❌ A. Establish separate API endpoints in API Gateway for each travel agent.
  • ✅ B. Establish a custom domain name in API Gateway for the REST API. Import the corresponding certificate from AWS Certificate Manager (ACM).
  • ❌ C. Request a wildcard certificate that corresponds to the custom domain name in AWS Certificate Manager (ACM), within a different Region.
  • ✅ D. Register the desired domain with a domain registrar. Set up a wildcard custom domain in a Route 53 hosted zone and create a record in the zone that points to the API Gateway endpoint.
  • ✅ E. Request a wildcard certificate that matches the custom domain name in AWS Certificate Manager (ACM) in the same Region.
  • ❌ F. Create separate hosted zones in Route 53 for each travel agent as needed. Set up zone records that point to the API Gateway endpoint.

Question 750

A company is deploying a new web application that will run on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones. The application requires a shared storage solution that offers strong consistency as the content will be regularly updated.

Which solution requires the LEAST amount of effort?

  • ❌ A. Create an Amazon S3 bucket to store the web content and use Amazon CloudFront to deliver the content
  • ❌ B. Create a volume gateway using AWS Storage Gateway to host the data and mount it to the Auto Scaling group
  • ✅ C. Create an Amazon Elastic File System (Amazon EFS) file system and mount it on the individual Amazon EC2 instances
  • ❌ D. Create a shared Amazon Block Store (Amazon EBS) volume and mount it on the individual Amazon EC2 instances

Question 751

An application uses Amazon EC2 instances and an Amazon RDS MySQL database. The database is not currently encrypted. A solutions architect needs to apply encryption to the database for all new and existing data.

How should this be accomplished?

  • ❌ A. Enable encryption for the database using the API. Take a full snapshot of the database. Delete old snapshots
  • ✅ B. Take a snapshot of the RDS instance. Create an encrypted copy of the snapshot. Restore the RDS instance from the encrypted snapshot
  • ❌ C. Create an RDS read replica with encryption at rest enabled. Promote the read replica to master and switch the application over to the new master. Delete the old RDS instance
  • ❌ D. Create an Amazon ElastiCache cluster and encrypt data using the cache nodes

Question 752

A company observed an increase in Amazon EC2 costs in its most recent bill. The billing team noticed unwanted vertical scaling of instance types for a couple of EC2 instances. A solutions architect needs to create a graph comparing the last 2 months of EC2 costs and perform an in-depth analysis to identify the root cause of the vertical scaling.

How should the solutions architect generate the information with the LEAST operational overhead?

  • ❌ A. Use graphs from the AWS Billing and Cost Management dashboard to compare EC2 costs based on instance types for the last 2 months.
  • ❌ B. Use AWS Budgets to create a budget report and compare EC2 costs based on instance types.
  • ❌ C. Use AWS Cost and Usage Reports to create a report and send it to an Amazon S3 bucket. Use Amazon QuickSight with Amazon S3 as a source to generate an interactive graph based on instance types.
  • ✅ D. Use Cost Explorer's granular filtering feature to perform an in-depth analysis of EC2 costs based on instance types.

Question 753

A web application has recently been launched on AWS. The architecture includes two tier with a web layer and a database layer. It has been identified that the web server layer may be vulnerable to cross-site scripting (XSS) attacks.

What should a solutions architect do to remediate the vulnerability?

  • ❌ A. Create a Classic Load Balancer. Put the web layer behind the load balancer and enable AWS WAF
  • ❌ B. Create a Network Load Balancer. Put the web layer behind the load balancer and enable AWS WAF
  • ✅ C. Create an Application Load Balancer. Put the web layer behind the load balancer and enable AWS WAF
  • ❌ D. Create an Application Load Balancer. Put the web layer behind the load balancer and use AWS Shield Standard

Question 754

An e-commerce company has developed a new application which has been successfully deployed on AWS. For an upcoming sale, the company is expecting a huge rise in traffic and while testing for the event they have encountered performance issues in the application when many requests are sent to the application.

The current application stack is Amazon Aurora PostgreSQL database with an AWS Lambda compute layer fronted by API Gateway. A solutions architect must recommend improvements scalability whilst minimizing the configuration effort.

Which solution will meet these requirements?

  • ❌ A. Refactor the Lambda function code to Apache Tomcat code that runs on Amazon EC2 instances. Connect the database by using native Java Database Connectivity (JDBC) drivers.
  • ✅ B. Set up two Lambda functions. Configure one function to receive the information. Configure the other function to load the information into the database. Integrate the Lambda functions by using an Amazon Simple Queue Service (Amazon SQS) queue.
  • ❌ C. Change the platform from Aurora to Amazon DynamoDB. Provision a DynamoDB Accelerator (DAX) cluster. Use the DAX client SDK to point the existing DynamoDB API calls at the DAX cluster.
  • ❌ D. Set up two Lambda functions. Configure one function to receive the information. Configure the other function to load the information into the database. Integrate the Lambda functions by using Amazon Simple Notification Service (Amazon SNS).

Question 755

An application analyzes images of people that are uploaded to an Amazon S3 bucket. The application determines demographic data which is then saved to a .CSV file in another S3 bucket. The data must be encrypted at rest and then queried using SQL. The solution should be fully serverless.

Which actions should a Solutions Architect take to encrypt and query the data?

  • ❌ A. Use Amazon S3 server-side encryption and Amazon QuickSight to query the data
  • ❌ B. Use Amazon S3 server-side encryption and use Amazon RedShift Spectrum to query the data
  • ❌ C. Use AWS KMS encryption keys for the S3 bucket and use Amazon Managed Service for Apache Flink to query the data.
  • ✅ D. Use AWS KMS encryption keys for the S3 bucket and use Amazon Athena to query the data

Question 756

A financial services company has a large, multi-Region footprint on AWS. A recent security audit highlighted some issues that must be addressed. The company must track all configuration changes affecting AWS resources and have detailed records of who has accessed the AWS environment. The data should include information such as which user has logged in and which API calls they made

What actions should a Solutions Architect take to meet these requirements?

  • ✅ A. Use AWS Config to track configuration changes and AWS CloudTrail to record API calls and track access patterns in the AWS Cloud.
  • ❌ B. Use AWS Config to track configuration changes and Amazon EventBridge to record API calls and track access patterns in the AWS Cloud.
  • ❌ C. Use Amazon CloudWatch to track configuration changes and AWS Config to record API calls and track access patterns in the AWS Cloud.
  • ❌ D. Use Amazon Macie to track configuration changes and Amazon CloudTrail to record API calls and track access patterns in the AWS Cloud.

Question 757

A multinational enterprise plans to transition from numerous independent AWS accounts to a structured, multi-account AWS setup. The enterprise anticipates creating multiple AWS accounts to cater to various departments. The enterprise seeks to authenticate access to these AWS accounts using a centralized corporate directory service.

What combination of steps should a solutions architect suggest to meet these needs? (Select TWO)

  • ✅ A. Deploy AWS Directory Service and integrate it with the corporate directory service. Set up AWS Identity Center for authentication across accounts.
  • ❌ B. Install and configure AWS Control Tower for centralized account management. Incorporate AWS Identity Center to manage identity.
  • ✅ C. Create a new AWS Organizations entity with all features enabled. Create the new AWS accounts within the organization.
  • ❌ D. Establish an AWS Transit Gateway for centralized network management, linking AWS accounts.
  • ❌ E. Set up an Amazon Cognito identity pool and configure AWS Identity Center to accept Amazon Cognito authentication.

Question 758

A company stores its application logs in an Amazon CloudWatch Logs log group. A new policy requires the company to store all application logs in Amazon OpenSearch Service (Amazon Elasticsearch Service) in near-real time.

Which solution will meet this requirement with the LEAST operational overhead?

  • ❌ A. Create an Amazon Kinesis Data Firehose delivery stream. Configure the log group as the delivery stream's source. Configure Amazon OpenSearch Service (Amazon Elasticsearch Service) as the delivery stream's destination.
  • ❌ B. Create an AWS Lambda function. Use the log group to invoke the function to write the logs to Amazon OpenSearch Service (Amazon Elasticsearch Service).
  • ❌ C. Install and configure Amazon Kinesis Agent on each application server to deliver the logs to Amazon Kinesis Data Streams. Configure Kinesis Data Streams to deliver the logs to Amazon OpenSearch Service (Amazon Elasticsearch Service).
  • ✅ D. Configure a CloudWatch Logs subscription to stream the logs to Amazon OpenSearch Service (Amazon Elasticsearch Service).

Question 759

An online education platform uses Amazon CloudFront to distribute learning resources globally. The company wants to ensure that only enrolled students have access to the course materials. These materials are stored in an Amazon S3 bucket. In addition, the company occasionally provides exclusive resources to certain students for research and project work.

Which solution will meet these requirements?

  • ❌ A. Implement CloudFront Field-Level Encryption to block access to non-enrolled students.
  • ❌ B. Utilize Amazon S3 object-level encryption for course materials.
  • ✅ C. Implement CloudFront signed cookies for authenticated students.
  • ❌ D. Create and provide S3 pre-signed URLs to authenticated students.

Question 760

A company migrated a two-tier application from its on-premises data center to AWS Cloud. A Multi-AZ Amazon RDS for Oracle deployment is used for the data tier, along with 12 TB of General Purpose SSD Amazon EBS storage. With an average document size of 6 MB, the application processes, and stores documents as binary large objects (blobs) in the database.

Over time, the database size has grown, which has reduced performance and increased storage costs. A highly available and resilient solution is needed to improve database performance.

Which solution will meet these requirements MOST cost-effectively?

  • ✅ A. Set up an Amazon S3 bucket. The application should be updated to use S3 buckets to store documents. Store the object metadata in the existing database.
  • ❌ B. Create a table in Amazon DynamoDB and update the application to use DynamoDB. Migrate Oracle data to DynamoDB using AWS Database Migration Service (AWS DMS).
  • ❌ C. Increase the RDS DB instance size. Increase the storage capacity to 24 TiB. Change the storage type to Provisioned IOPS.
  • ❌ D. Reduce the size of the RDS DB instance. Increase the storage capacity to 24 TiB. Magnetic storage should be selected.

Question 761

An e-commerce company operates a containerized microservices application on a fleet of Amazon EC2 instances. As part of their infrastructure improvement efforts, the company plans to migrate the application to Amazon Elastic Kubernetes Service (Amazon EKS) for enhanced scalability and management.

As part of the security protocol, the company has configured the Amazon EKS control plane with endpoint private access enabled and public access disabled. The data plane resides within private subnets. However, the company faces an issue where nodes fail to join the cluster.

What can be done to allow the nodes to join the EKS cluster?

  • ❌ A. Establish VPC peering connection for nodes to access the control plane.
  • ✅ B. Set up VPC endpoints for Amazon EKS and ECR to enable nodes to communicate with the control plane.
  • ❌ C. Modify the associated IAM role to include permissions to the AmazonEKSClusterPolicy.
  • ❌ D. Move nodes to public subnet and configure security group rules for the EC2 nodes.

Question 762

A law firm has recently moved an on-premises multi-tier web application to AWS. Currently, the web application is based on a containerized solution and is running inside Linux based EC2 instances which connect to a PostgreSQL database hosted on separate but dedicated EC2 instances. The company wishes to optimize operational efficiency and performance.

Which combination of actions should the solutions architect take? (Select TWO)

  • ❌ A. Set up an Amazon CloudFront distribution for the web application content.
  • ❌ B. Migrate the web application to the same Amazon EC2 instances as the database.
  • ❌ C. Set up Amazon ElastiCache between the web application and the PostgreSQL database.
  • ✅ D. Migrate the PostgreSQL database to Amazon Aurora.
  • ✅ E. Migrate the web application to be hosted on AWS Fargate with Amazon Elastic Container Service (Amazon ECS).

Question 763

A financial services company is currently using 500 Amazon EC2 instances to run batch-processing workloads to analyze financial information on a periodic basis. The organization needs to install a third-party tool on all these instances as quickly and as efficiently as possible and will have to carry out similar tasks on an ongoing basis going forward. The solution also needs to scale for the addition of future EC2 instances.

What should a solutions architect do to meet these requirements in the easiest way possible?

  • ✅ A. Use AWS Systems Manager Run Command to run a custom command that installs the tool on all the EC2 instances.
  • ❌ B. Use AWS Systems Manager Maintenance Windows to install the tool on all the EC2 instances within a set period of time.
  • ❌ C. Use AWS Systems Manager Patch Manager to install the tool on all the EC2 instances within a single patch.
  • ❌ D. Create an AWS Lambda Function which will make configuration changes to all the EC2 instances. Validate the tool has been installed using another Lambda function.

Question 764

A financial firm is aiming to leverage AWS Cloud for augmenting its on-premises disaster recovery (DR) architecture. The firm's main application, running on PostgreSQL, is housed on a virtual machine (VM) on-premises. The DR solution needs to align with the application's recovery point objective (RPO) of less than a minute and a recovery time objective (RTO) of within two hours, all while keeping costs to a minimum.

Which solution will meet these requirements?

  • ❌ A. Configure an active-active multi-site setup between the on-premises server and AWS using PostgreSQL with a third-party high availability solution.
  • ❌ B. Use AWS Elastic Disaster Recovery with continuous replication to act as a pilot light solution on AWS.
  • ❌ C. Utilize third-party backup software to perform daily backups and store a secondary set of backups in Amazon S3.
  • ✅ D. Set up a warm standby Amazon RDS for PostgreSQL database on AWS. Configure AWS Database Migration Service (AWS DMS) to use change data capture (CDC).

Question 765

A software development company is creating a microservices-based application using Amazon Elastic Kubernetes Service (Amazon EKS). The company needs to ensure that sensitive configuration data like database credentials and API keys stored in Kubernetes ConfigMaps and Secrets are encrypted at rest.

Which solution will meet these requirements?

  • ❌ A. Create the Amazon EKS cluster with default options. Use the Amazon Elastic File System (Amazon EFS) Container Storage Interface (CSI) driver as an add-on.
  • ❌ B. Use Amazon S3 to store all sensitive data. Enable server-side encryption with a new AWS Key Management Service (AWS KMS) key.
  • ❌ C. Implement AWS Secrets Manager to manage, rotate, and store all sensitive data. Integrate it with the Amazon EKS cluster.
  • ✅ D. Create a new AWS Key Management Service (AWS KMS) key. Enable Amazon EKS KMS secrets encryption on the Amazon EKS cluster.

Question 766

A finance organization has bootstrapped a golden image for their in-house application and the resultant AMI is to be shared across various AWS accounts as a base image. This image is to be used across many applications. The company needs to design an application that captures AWS API calls and sends alerts whenever the Amazon EC2 CreateImage API operation is called within the company's account.

Which solution will meet these requirements with the LEAST operational overhead?

  • ❌ A. Configure an Amazon SQS FIFO queue as a target for AWS CloudTrail logs. Create an AWS Lambda function to send an alert to an Amazon SNS topic when a CreateImage API call is detected.
  • ✅ B. Create an Amazon EventBridge rule for the CreateImage API call. Configure the target as an Amazon SNS topic to send an alert when a Createlmage API call is detected.
  • ❌ C. Create an AWS Lambda function to query AWS CloudTrail logs and to send an alert when a CreateImage API call is detected.
  • ❌ D. Configure AWS CloudTrail with an Amazon SNS notification that occurs when updated logs are sent to Amazon S3. Use Amazon Athena to create a new table and to query on CreateImage when an API call is detected

Question 767

A solutions architect in a large finance organization must restrict access for a specific S3 bucket to only users in accounts within the organization in AWS Organizations. This is due to the confidentiality of project reports data.

Which solution meets these requirements with the LEAST amount of operational overhead?

  • ✅ A. Add the aws:PrincipalOrgID global condition key with a reference to the organization ID to the S3 bucket policy.
  • ❌ B. Create an organizational unit (OU) for each department. Add the aws:PrincipalOrgPaths global condition key to the S3 bucket policy.
  • ❌ C. Use AWS CloudTrail to monitor the CreateAccount, InviteAccountToOrganization, LeaveOrganization, and RemoveAccountFromOrganization events. Update the S3 bucket policy accordingly.
  • ❌ D. Tag each user that needs access to the S3 bucket. Add the aws:PrincipalTag global condition key to the S3 bucket policy.

Question 768

To trace a recent production incident a product manager needs to view logs in the Amazon CloudWatch logs. These logs are linked to events over the course of a week and may be needed in the future if incidents occur again. The product manager doesn’t have administrative access to the AWS account as it is managed by a third-party management company.

According to principal of least privilege, which option out of the below will fulfill the requirement to provide the necessary access for the product manager?

  • ✅ A. Share the dashboard from the CloudWatch console. Enter the client’s email address and complete the sharing steps. Provide a shareable link for the dashboard to the product manager.
  • ❌ B. Create an IAM user for the company's employees. Attach the ViewOnly Access AWS managed policy to the IAM user. Share the new login credentials with the product manager. Ask the product manager to navigate to the CloudWatch console and locate the dashboard by name in the Dashboards section.
  • ❌ C. Create an IAM user specifically for the product manager. Attach the CloudWatchReadOnlyAccess AWS managed policy to the user. Share the new login credentials with the product manager. Share the browser URL of the correct dashboard with the product manager.
  • ❌ D. Deploy a bastion server in a public subnet. When the product manager requires access to the dashboard, start the server and share the RDP credentials. On the bastion server, ensure that the browser is configured to open the dashboard URL with cached AWS credentials that have appropriate permissions to view the dashboard.

Question 769

IAM permissions-related Access Denied errors and Unauthorized errors need to be analyzed and troubleshooted by a company. AWS CloudTrail has been enabled at the company.

Which solution will meet these requirements with the LEAST effort?

  • ✅ A. Search CloudTrail logs with Amazon QuickSight. Create a dashboard to identify the errors.
  • ❌ B. Write custom scripts to query CloudTrail logs using AWS Glue.
  • ❌ C. Create a custom script and execute it against CloudTrail logs to find errors using AWS Batch.
  • ❌ D. Search CloudTrail logs with Amazon RedShift. Create a dashboard to identify the errors.

Question 770

A company has multiple Windows workloads which are .NET application servers and Microsoft SQL Server databases running on Amazon EC2 instances with Windows Server 2016. The company requires a shared file system which is highly available, durable and provides high levels of throughput and IOPS.

What is the best way to meet this requirement?

  • ❌ A. Migrate all the data to Amazon S3. Set up IAM authentication for users to access files.
  • ❌ B. Set up an Amazon S3 File Gateway, mount the S3 File Gateway on the existing EC2 instances.
  • ❌ C. Extend the file share environment to Amazon Elastic File System (Amazon EFS) with a Multi-AZ configuration. Migrate all the data to Amazon EFS.
  • ✅ D. Extend the file share environment to Amazon FSx for Windows File Server with a Multi-AZ configuration. Migrate all the data to FSx for Windows File Server.

Question 771

A global logistics company collects shipment tracking information, which updates every few seconds. The company wishes to perform real-time analysis on these data updates to monitor shipment progress and predict delays, after which they want the data to be ingested into their Amazon S3-based data lake. Which solution will fulfill these requirements with the MOST operational efficiency?

  • ❌ A. Use AWS Direct Connect for data ingestion and Amazon Athena for real-time analysis.
  • ❌ B. Use Amazon SQS for data ingestion and Amazon EMR for real-time analysis.
  • ❌ C. Use Amazon Kinesis Data Streams for data ingestion and AWS Lambda for real-time data analysis.
  • ✅ D. Use Amazon Kinesis Data Firehose for data ingestion and Amazon Managed Service for Apache Flink for real-time analysis.

Question 772

Data from 45 TB of data is used for reporting by a company. The company wants to move this data from on premises into the AWS cloud. A custom application in the company's data center runs a weekly data transformation job and the company plans to pause the application until the data transfer is complete and needs to begin the transfer process as soon as possible.

The data center bandwidth is saturated, and a solutions architect has been tasked to transfer the data and must configure the transformation job to continue to run in the AWS Cloud.

Which solution will meet these requirements with the LEAST operational overhead?

  • ❌ A. The data will be moved using an AWS Snowcone device. The transformation application should be deployed to the device.
  • ✅ B. Order an AWS Snowball Edge Storage Optimized device. Copy the data to the device. and create a custom transformation job by using AWS Glue.
  • ❌ C. The data can be moved using AWS DataSync. Using AWS Glue, create a custom transformation job.
  • ❌ D. Order an AWS Snowball Edge Storage Optimized device that includes Amazon EC2 compute. Transfer the data to the device. Launch a new EC2 instance to run the transformation application.

Question 773

An organization is planning their disaster recovery solution. They plan to run a scaled down version of a fully functional environment. In a DR situation the recovery time must be minimized.

Which DR strategy should a Solutions Architect recommend?

  • ❌ A. Multi-site
  • ❌ B. Backup and restore
  • ✅ C. Warm standby
  • ❌ D. Pilot light

Question 774

A healthcare company maintains patient records in Amazon S3. To comply with HIPAA regulations, the stored data must not contain any protected health information (PHI). The company recently found out that some objects in the S3 buckets contain PHI. The company needs to automate the detection of PHI in the S3 buckets and notify its compliance team when such data is detected.

Which solution will meet these requirements?

  • ✅ A. Use Amazon Macie. Create an Amazon EventBridge rule to filter the ‘SensitiveData:S3Object/Health’ event type from Macie findings and trigger an Amazon Simple Email Service (Amazon SES) notification to the compliance team.
  • ❌ B. Use Amazon Macie. Create an AWS Lambda function to filter the ‘SensitiveData:S3Object/Personal’ event type from Macie findings and trigger an Amazon Simple Notification Service (Amazon SNS) notification to the compliance team.
  • ❌ C. Use AWS Security Hub. Create an AWS Lambda function to filter the ‘Security Hub findings - High severity’ event type and trigger an Amazon Simple Email Service (Amazon SES) notification to the compliance team.
  • ❌ D. Use AWS Security Hub. Create an Amazon EventBridge rule to filter the ‘Security Hub findings - High severity’ event type and send an Amazon Simple Notification Service (Amazon SNS) notification to the compliance team.

Question 775

A data analytics company is hosting a data lake which consists of data in Amazon S3 and Amazon RDS for PostgreSQL. The company needs a reporting solution that provides data visualization for the latest dataset and includes all the data sources within the data lake. Only the company's management team should have full access to all the visualizations. The rest of the company should have only limited access.

Which solution will meet these requirements?

  • ❌ A. Create an analysis in Amazon QuickSight. Connect all the data sources and create new datasets. Publish dashboards to visualize the data. Share the dashboards with the appropriate IAM roles.
  • ✅ B. Create an analysis in Amazon QuickSight. Connect all the data sources and create new datasets. Publish dashboards to visualize the data. Share the dashboards with the appropriate users and groups.
  • ❌ C. Create an AWS Glue table and crawler for the data in Amazon S3. Use Amazon Athena Federated Query to access data within Amazon RDS for PostgreSQL. Generate reports by using Amazon Athena. Publish the reports to Amazon S3. Use S3 bucket policies to limit access to the reports.
  • ❌ D. Create an AWS Glue table and crawler for the data in Amazon S3. Create an AWS Glue extract, transform, and load (ETL) job to produce reports. Publish the reports to Amazon S3. Use S3 bucket policies to limit access to the reports.

Question 776

A company has an on-premises server that uses a MySQL database to process and store customer information. The company wants to migrate to an AWS database service to achieve higher availability and to improve application performance. Additionally, the company wants to offload reporting workloads from its primary database to ensure it remains performant.

Which solution will meet these requirements in the MOST operationally efficient way?

  • ❌ A. Use Amazon RDS with MySQL in a Single-AZ deployment. Create a read replica in the same availability zone as the primary DB instance. Direct the reporting functions to the read replica.
  • ❌ B. Use Amazon EC2 instances to deploy a self-managed MySQL database with a replication setup for reporting purposes. Place instances in multiple availability zones and manage backups and patching manually.
  • ❌ C. Use AWS Database Migration Service (AWS DMS) to create an Amazon Aurora DB cluster in multiple AWS Regions. Point the reporting functions toward a separate DB instance from the primary DB instance.
  • ✅ D. Use Amazon Aurora with MySQL compatibility. Direct the reporting functions to use one of the Aurora Replicas.

Question 777

A large quantity of data is stored on a NAS device on-premises and accessed using the SMB protocol. The company require a managed service for hosting the filesystem and a tool to automate the migration.

Which actions should a Solutions Architect take?

  • ✅ A. Migrate the data to Amazon FSx for Windows File Server using AWS DataSync
  • ❌ B. Migrate the data to Amazon FSx for Lustre using AWS DataSync
  • ❌ C. Migrate the data to Amazon S3 using and AWS Snowball Edge device
  • ❌ D. Migrate the data to Amazon EFS using the AWS Server Migration Service (SMS)

Question 778

An organization manages its own MySQL databases, which are hosted on Amazon EC2 instances. In response to changes in demand, replication and scaling are manually managed by the company. It is essential for the company to have a way to add and remove compute capacity as needed from the database tier. The solution also must offer improved performance, scaling, and durability with minimal effort from operations.

Which solution meets these requirements?

  • ❌ A. Consolidate the databases into a single MySQL database. Use larger EC2 instances for the larger database.
  • ✅ B. Migrate the databases to Amazon Aurora Serverless (Aurora MySQL).
  • ❌ C. For the database tier, create an EC2 Auto Scaling group. Create a new database environment and migrate the existing databases.
  • ❌ D. Migrate the databases to Amazon Aurora Serverless (Aurora PostgreSQL).

Question 779

A company is storing a large quantity of small files in an Amazon S3 bucket. An application running on an Amazon EC2 instance needs permissions to access and process the files in the S3 bucket.

Which action will MOST securely grant the EC2 instance access to the S3 bucket?

  • ✅ A. Create an IAM role with least privilege permissions and attach it to the EC2 instance profile.
  • ❌ B. Create a bucket ACL on the S3 bucket and configure the EC2 instance ID as a grantee.
  • ❌ C. Generate access keys and store the credentials on the EC2 instance for use in making API calls.
  • ❌ D. Create an IAM user for the application with specific permissions to the S3 bucket.

Question 780

A health tech company runs a multi-tier medical records application in the AWS Cloud, which operates across three Availability Zones. The application architecture includes an Application Load Balancer, a cluster of Amazon EC2 instances that handle user session states, and a PostgreSQL database running on an EC2 instance.

The company anticipates a sharp surge in application traffic due to a new partnership. The company needs to scale to accommodate future application capacity demands and ensure high availability across all three Availability Zones.

Which solution will meet these requirements?

  • ❌ A. Keep the PostgreSQL database on EC2 instance. Use Amazon ElastiCache for Redis to manage session data and cache reads. Migrate the application server to an Auto Scaling group across three Availability Zones.
  • ❌ B. Migrate the PostgreSQL database to Amazon Aurora with PostgreSQL compatibility with a single AZ deployment. Use Amazon ElastiCache for Memcached to manage session data and cache reads. Migrate the application server to an Auto Scaling group across three Availability Zones.
  • ✅ C. Migrate the PostgreSQL database to Amazon RDS for PostgreSQL with a Multi-AZ DB instance deployment. Use Amazon ElastiCache for Redis with a replication group to manage session data and cache reads. Migrate the application server to an Auto Scaling group across three Availability Zones.
  • ❌ D. Migrate the PostgreSQL database to Amazon DynamoDB. Use DynamoDB Accelerator (DAX) to cache reads. Store the session data in DynamoDB. Migrate the application server to an Auto Scaling group across three Availability Zones.

Question 781

A company have 500 TB of data in an on-premises file share that needs to be moved to Amazon S3 Glacier. The migration must not saturate the company’s low-bandwidth internet connection and the migration must be completed within a few weeks.

What is the MOST cost-effective solution?

  • ❌ A. Order 7 AWS Snowball appliances and select an S3 Glacier vault as the destination. Create a bucket policy to enforce a VPC endpoint
  • ✅ B. Order 7 AWS Snowball appliances and select an Amazon S3 bucket as the destination. Create a lifecycle policy to transition the S3 objects to Amazon S3 Glacier
  • ❌ C. Use AWS Global Accelerator to accelerate upload and optimize usage of the available bandwidth
  • ❌ D. Create an AWS Direct Connect connection and migrate the data straight into Amazon Glacier

Question 782

A Solutions Architect is designing a migration strategy for a company moving to the AWS Cloud. The company use a shared Microsoft filesystem that uses Distributed File System Namespaces (DFSN). What will be the MOST suitable migration strategy for the filesystem?

  • ✅ A. Use AWS DataSync to migrate to Amazon FSx for Windows File Server
  • ❌ B. Use the AWS Server Migration Service to migrate to an Amazon S3 bucket
  • ❌ C. Use the AWS Server Migration Service to migrate to Amazon FSx for Lustre
  • ❌ D. Use AWS DataSync to migrate to an Amazon EFS filesystem

Question 783

A digital marketing agency manages numerous client websites and apps on AWS. Each AWS resource is supposed to be tagged by the account for tracking and backup purposes. The agency wants to ensure that all AWS resources, including untagged ones, are backed up properly to minimize data loss risks.

Which solution will meet these requirements with the LEAST operational overhead?

  • ❌ A. Rely on each account owner to identify their untagged resources and then use AWS Backup for backing up.
  • ✅ B. Use AWS Config to identify all untagged resources and tag them programmatically. Then, use AWS Backup to automate the backup of all AWS resources based on tags.
  • ❌ C. Manually search for all untagged resources in each AWS service. Once identified, tag them appropriately and set up AWS Backup for each service separately.
  • ❌ D. Use AWS Lambda to periodically scan for untagged resources, add necessary tags, and then set up AWS Backup.

Question 784

A software development firm uses AWS to run their compute instances across multiple accounts. These instances are individually billed. The company recently purchased an EC2 Reserved Instance (RI) for an ongoing project. However, due to the completion of that project, a significant number of EC2 instances were decommissioned. The company now wishes to utilize the benefits of their unused Reserved Instance across their other AWS accounts.

Which combination of steps should the company follow to achieve this? (Select TWO)

  • ❌ A. Enable Reserved Instance sharing in the billing preferences section of the AWS Management Console for the management account.
  • ❌ B. From the AWS Organizations management account, utilize AWS Resource Access Manager (AWS RAM) to share the Reserved Instance with other accounts.
  • ✅ C. Enable Reserved Instance sharing in the billing preferences section of the AWS Management Console for the account that purchased the existing RI.
  • ✅ D. Establish an AWS Organization in the AWS account that purchased the RI and hosts the remaining active EC2 instances. Invite the other AWS accounts to join this organization from the management account.
  • ❌ E. Use AWS Organizations to establish a new payer account and invite the other accounts to join this organization.
Hermes Wiki