Hermes Wiki

Question 785

A Solutions Architect needs a solution for hosting a website that will be used by a development team. The website contents will consist of HTML, CSS, client-side JavaScript, and images.

Which solution is MOST cost-effective?

✅ A. Create an Amazon S3 bucket and host the website there.
❌ B. Launch an Amazon EC2 instance and host the website there.
❌ C. Create an Application Load Balancer with an AWS Lambda target.
❌ D. Use a Docker container to host the website on AWS Fargate.

Question 786

A company is developing a web-based application that will be used for real-time chat functionality. The application should use WebSocket APIs to maintain a persistent connection with the client. The backend services of the application, hosted in containers within private subnets of a VPC, need to be accessed securely.

Which solution will meet these requirements?

✅ A. Develop a WebSocket API using Amazon API Gateway. Host the application in Amazon Elastic Kubernetes Service (EKS) in a private subnet. Establish a private VPC link for the API Gateway to securely access the Amazon EKS cluster.
❌ B. Develop a REST API using Amazon API Gateway. Host the application in Amazon Elastic Kubernetes Service (EKS) in a private subnet. Establish a private VPC link for the API Gateway to securely access the Amazon EKS cluster.
❌ C. Develop a WebSocket API using Amazon API Gateway. Host the application in Amazon Elastic Kubernetes Service (EKS) in a private subnet. Create a security group that allows API Gateway to access the Amazon EKS cluster.
❌ D. Develop a REST API using Amazon API Gateway. Host the application in Amazon Elastic Kubernetes Service (EKS) in a private subnet. Create a security group that allows API Gateway to access the Amazon EKS cluster.

Question 787

An application uses a MySQL database running on an Amazon EC2 instance. The application generates high I/O and constant writes to a single table on the database. Which Amazon EBS volume type will provide the MOST consistent performance and low latency?

❌ A. Cold HDD (sc1)
❌ B. General Purpose SSD (gp2)
✅ C. Provisioned IOPS SSD (io1)
❌ D. Throughput Optimized HDD (st1)

Question 788

An application generates unique files that are returned to customers after they submit requests to the application. The application uses an Amazon CloudFront distribution for sending the files to customers. The company wishes to reduce data transfer costs without modifying the application.

How can this be accomplished?

❌ A. Enable Amazon S3 Transfer Acceleration to reduce the transfer times.
❌ B. Enable caching on the CloudFront distribution to store generated files at the edge.
✅ C. Use Lambda@Edge to compress the files as they are sent to users.
❌ D. Use AWS Global Accelerator to reduce application latency for customers.

Question 789

A multinational organization has a distributed application that runs on Amazon EC2 instances, which are behind an Application Load Balancer in an Auto Scaling group. The application utilizes a MySQL database hosted on Amazon Aurora. The database cluster spans across multiple Availability Zones in a single region.

The organization plans to launch its services in a new geographical area and wants to ensure maximum availability with minimal service interruption.

Which strategy should the organization adopt?

❌ A. Expand the existing Auto Scaling group into the new Region. Utilize Amazon Aurora Global Database to extend the database across the primary and new regions. Implement Amazon Route 53 health checks with a failover routing policy directed towards the new region.
❌ B. Replicate the application layer in the new region. Implement an Aurora MySQL Read Replica in the new region using Route 53 health checks and a failover routing policy. In case of primary failure, promote the Read Replica to primary.
✅ C. Establish the application layer in the new region. Use Amazon Aurora Global Database for deploying the database in the primary and new regions. Apply Amazon Route 53 health checks with a failover routing policy to the new region. Promote the secondary to primary as needed.
❌ D. Create a similar application layer in the new region. Establish a new Aurora MySQL database in this region. Use AWS Database Migration Service (AWS DMS) for ongoing replication from the primary database to the new region. Implement Amazon Route 53 health checks with a failover routing policy to the new region.

Question 790

An international software firm provides its clients with custom solutions and tools designed for efficient data collection and analysis on AWS. The firm intends to centrally manage and distribute a standard set of solutions and tools for its clients' self-service needs.

Which solution would best satisfy these requirements?

✅ A. Create AWS Service Catalog portfolios for the clients.
❌ B. Create AWS Systems Manager documents for the clients.
❌ C. Create AWS CloudFormation stacks for the clients.
❌ D. Create AWS Config rules for the clients.

Question 791

An e-commerce company operates a serverless web application that must interact with numerous Amazon DynamoDB tables to fulfill user requests. It is critical that the application's performance remains consistent and unaffected while interacting with these tables.

Which method provides the MOST operationally efficient way to fulfill these requirements?

✅ A. AWS AppSync with multiple data sources and resolvers.
❌ B. Amazon S3 with Lambda triggers.
❌ C. AWS Glue with a DynamoDB connector.
❌ D. AWS Lambda with Step Functions.

Question 792

An on-premises server runs a MySQL database and will be migrated to the AWS Cloud. The company require a managed solution that supports high availability and automatic failover in the event of the outage of an Availability Zone (AZ).

Which solution is the BEST fit for these requirements?

❌ A. Use the AWS Database Migration Service (DMS) to directly migrate the database to an Amazon EC2 MySQL Multi-AZ deployment
❌ B. Create a snapshot of the MySQL database server and use AWS DataSync to migrate the data Amazon S3. Launch a new Amazon RDS MySQL Multi-AZ deployment from the snapshot
❌ C. Use the AWS Database Migration Service (DMS) to directly migrate the database to Amazon RDS MySQL. Use the Schema Conversion Tool (SCT) to enable conversion from MySQL to Amazon RDS
✅ D. Use the AWS Database Migration Service (DMS) to directly migrate the database to an Amazon RDS MySQL Multi-AZ deployment

Question 793

A company is deploying an analytics application on AWS Fargate. The application requires connected storage that offers concurrent access to files and high performance.

Which storage option should the solutions architect recommend?

✅ A. Create an Amazon EFS file share and establish an IAM role that allows Fargate to communicate with Amazon EFS.
❌ B. Create an Amazon S3 bucket for the application and establish an IAM role for Fargate to communicate with Amazon S3.
❌ C. Create an Amazon FSx for Lustre file share and establish an IAM role that allows Fargate to communicate with FSx for Lustre.
❌ D. Create an Amazon EBS volume for the application and establish an IAM role that allows Fargate to communicate with Amazon EBS.

Question 794

A solutions architect is optimizing a website for real-time streaming and on-demand videos. The website’s users are located around the world and the solutions architect needs to optimize the performance for both the real-time and on-demand streaming.

Which service should the solutions architect choose?

❌ A. Amazon S3 Transfer Acceleration
❌ B. AWS Global Accelerator
✅ C. Amazon CloudFront
❌ D. Amazon Route 53

Question 795

A company runs a streaming media service and the content is stored on Amazon S3. The media catalog server pulls updated content from S3 and can issue over 1 million read operations per second for short periods. Latency must be kept under 5ms for these updates. Which solution will provide the BEST performance for the media catalog updates?

❌ A. Update the application code to use an Amazon DynamoDB Accelerator cluster
❌ B. Implement an Instance store volume on the media catalog server
✅ C. Update the application code to use an Amazon ElastiCache for Redis cluster
❌ D. Implement Amazon CloudFront and cache the content at Edge Locations

Question 796

A software development company is deploying a microservices-based application on Amazon Elastic Kubernetes Service (Amazon EKS). The application's traffic fluctuates significantly throughout the day and the company wants to ensure that the EKS cluster scales up and down according to these traffic patterns.

Which combination of steps would satisfy these requirements with MINIMAL operational overhead? (Select TWO)

❌ A. Integrate Amazon SQS and connect it to Amazon EKS for workload management.
✅ B. Utilize the Kubernetes Metrics Server to enable horizontal pod autoscaling based on resource utilization.
✅ C. Employ the Kubernetes Cluster Autoscaler for dynamically managing the quantity of nodes in the EKS cluster.
❌ D. Implement the Kubernetes Vertical Pod Autoscaler to adjust the CPU and memory allocation for the pods.
❌ E. Leverage AWS X-Ray to track and analyze the application's network activity.

Question 797

The Solutions Architect in charge of a critical application must ensure the Amazon EC2 instances are able to be launched in another AWS Region in the event of a disaster.

What steps should the Solutions Architect take? (Select TWO)

❌ A. Copy the snapshots using Amazon S3 cross-region replication
❌ B. Enable cross-region snapshots for the Amazon EC2 instances
❌ C. Launch instances in the second Region using the S3 API
✅ D. Create AMIs of the instances and copy them to another Region
✅ E. Launch instances in the second Region from the AMIs

Question 798

An application runs on EC2 instances in a private subnet behind an Application Load Balancer in a public subnet. The application is highly available and distributed across multiple AZs. The EC2 instances must make API calls to an internet-based service. How can the Solutions Architect enable highly available internet connectivity?

❌ A. Create a NAT instance in the private subnet of each AZ. Update the route tables for each private subnet to direct internet-bound traffic to the NAT instance
❌ B. Configure an internet gateway. Add a route to the gateway to each private subnet route table
✅ C. Create a NAT gateway in the public subnet of each AZ. Update the route tables for each private subnet to direct internet-bound traffic to the NAT gateway
❌ D. Create a NAT gateway and attach it to the VPC. Add a route to the gateway to each private subnet route table

Question 799

A healthcare company is migrating its patient record system to AWS. The company receives thousands of encrypted patient data files every day through FTP. An on-premises server processes the data files twice a day. However, the processing job takes hours to finish.

The company wants the AWS solution to process incoming data files as soon as they arrive with minimal changes to the FTP clients that send the files. The solution must delete the incoming data files after the files have been processed successfully. Processing for each file needs to take around 10 minutes.

Which solution will meet these requirements in the MOST operationally efficient way?

❌ A. Use an Amazon EC2 instance that runs an SFTP server to store incoming files in Amazon S3 Standard. Configure a job queue in AWS Batch. Use Amazon EventBridge rules to invoke the job to process the files twice a day. Delete the files after the job has processed the files.
❌ B. Use AWS Transfer Family to create an SFTP server to store incoming files in Amazon S3 Standard. Use Amazon EC2 instances managed by an Auto Scaling group to process the files. Set an S3 event notification to trigger an AWS Lambda function that launches the EC2 instances when the files arrive. Delete the files after they are processed.
✅ C. Use AWS Transfer Family to create an SFTP server to store incoming files in Amazon S3 Standard. Create an AWS Lambda function to process the files and to delete the files after they are processed. Use an S3 event notification to invoke the Lambda function when the files arrive.
❌ D. Use AWS Transfer Family to create an SFTP server to store incoming files in Amazon S3 Glacier. Configure an Amazon EC2 instance to process the files. Use Amazon EventBridge rules to invoke the EC2 instance to process the files twice a day from S3 Glacier. Delete the objects after the job has processed the objects.

Question 800

A company runs an application on premises that stores a large quantity of semi-structured data using key-value pairs. The application code will be migrated to AWS Lambda and a highly scalable solution is required for storing the data.

Which datastore will be the best fit for these requirements?

❌ A. Amazon EFS
❌ B. Amazon EBS
✅ C. Amazon DynamoDB
❌ D. Amazon RDS MySQL

Question 801

A financial services company is migrating its sensitive customer data and applications to AWS. They want to ensure that the data is securely stored and managed while reducing the overall maintenance and operational overhead associated with managing databases.

Which solution will meet these requirements?

✅ A. Migrate the data and applications to Amazon RDS instances. Enable encryption at rest using AWS Key Management Service (AWS KMS).
❌ B. Migrate the data to Amazon RDS instances. Enable Amazon GuardDuty for data protection and threat detection.
❌ C. Migrate the applications and data to Amazon EC2 instances. Utilize the AWS Key Management Service (AWS KMS) customer managed keys for encryption.
❌ D. Store the data in Amazon S3. Utilize Amazon Macie for ongoing data security and threat detection.

Question 802

A company needs to ensure that they can failover between AWS Regions in the event of a disaster seamlessly with minimal downtime and data loss. The applications will run in an active-active configuration.

Which DR strategy should a Solutions Architect recommend?

❌ A. Pilot light
✅ B. Multi-site
❌ C. Warm standby
❌ D. Backup and restore

Question 803

A solutions architect is designing a high performance computing (HPC) application using Amazon EC2 Linux instances. All EC2 instances need to communicate to each other with low latency and high throughput network performance.

Which EC2 solution BEST meets these requirements?

❌ A. Launch the EC2 instances in an Auto Scaling group spanning multiple Availability Zones
❌ B. Launch the EC2 instances in a spread placement group in one Availability Zone
✅ C. Launch the EC2 instances in a cluster placement group in one Availability Zone
❌ D. Launch the EC2 instances in an Auto Scaling group in two Regions. Place a Network Load Balancer in front of the instances

Question 804

A corporation has a web-based multiplayer gaming service that operates using both TCP and UDP protocols. Amazon Route 53 is currently employed to direct application traffic to a set of Network Load Balancers (NLBs) in various AWS Regions. To prepare for an increase in user activity, the company must enhance application performance and reduce latency.

Which approach will best meet these requirements?

❌ A. Substitute the NLBs with Application Load Balancers (ALBs) and set Route 53 to utilize latency-based routing.
❌ B. Insert an Amazon API Gateway endpoint behind the NLBs, enable API caching, and customize method caching across different stages.
✅ C. Implement AWS Global Accelerator ahead of the NLBs and align the Global Accelerator endpoint to use the appropriate listener ports.
❌ D. Incorporate Amazon CloudFront in front of the NLBs and extend the duration of the Cache-Control max-age directive.

Question 805

Three AWS accounts are owned by the same company but in different regions. Account Z has two AWS Direct Connect connections to two separate company offices. Accounts A and B require the ability to route across account Z’s Direct Connect connections to each company office. A Solutions Architect has created an AWS Direct Connect gateway in account Z.

How can the required connectivity be configured?

❌ A. Create a VPC Endpoint to the Direct Connect gateway in account A and B
❌ B. Associate the Direct Connect gateway to a transit gateway in each region
✅ C. Associate the Direct Connect gateway to a virtual private gateway in account A and B
❌ D. Create a PrivateLink connection in Account Z and ENIs in accounts A and B

Question 806

An application allows users to upload and download files. Files older than 2 years will be accessed less frequently. A solutions architect needs to ensure that the application can scale to any number of files while maintaining high availability and durability.

Which scalable solutions should the solutions architect recommend?

❌ A. Store the files on Amazon Elastic File System (EFS) with a lifecycle policy that moves objects older than 2 years to EFS Infrequent Access (EFS IA)
❌ B. Store the files in Amazon Elastic Block Store (EBS) volumes. Schedule snapshots of the volumes. Use the snapshots to archive data older than 2 years
✅ C. Store the files on Amazon S3 with a lifecycle policy that moves objects older than 2 years to S3 Standard Infrequent Access (S3 Standard-IA)
❌ D. Store the files in Amazon Elastic Block Store (EBS) volumes. Create a lifecycle policy to move files older than 2 years to Amazon S3 Glacier

Question 807

A company needs to store data from an application. Data in the application changes frequently. All levels of stored data must be audited under a new regulation which the company adheres to.

Application storage capacity is running out on the company's on-premises infrastructure. To comply with the new regulation, a solutions architect must offload some data securely to AWS to relieve the on-premises capacity issues.

Which solution will meet these requirements?

✅ A. Use AWS Storage Gateway to move the existing data to Amazon S3. Use AWS CloudTrail to log management events.
❌ B. Move the existing data to Amazon S3 with AWS Snowcone. Using AWS CloudTrail, you can log management events.
❌ C. Move existing data to Amazon S3 using AWS DataSync. Log data events using AWS CloudTrail.
❌ D. The existing data can be transferred to Amazon S3 with the help of Amazon S3 Transfer Acceleration. Log data events using AWS CloudTrail.

Question 808

A telecommunication company has an API that allows users to manage their mobile plans and services. The API experiences significant traffic spikes during specific times such as end of the month and special offer periods. The company needs to ensure low latency response time consistently to ensure a good user experience. The solution should also minimize operational overhead.

Which solution would meet these requirements MOST efficiently?

❌ A. Use Amazon API Gateway with AWS Fargate tasks to handle the API requests.
❌ B. Implement the API using AWS Elastic Beanstalk with auto-scaling groups.
✅ C. Use Amazon API Gateway along with AWS Lambda functions with provisioned concurrency.
❌ D. Implement the API on an Amazon EC2 instance behind an Application Load Balancer with manual scaling.

Question 809

A company is creating a solution that must offer disaster recovery across multiple AWS Regions. The solution requires relational a database that can support a Recovery Point Objective (RPO) of 1 second and a Recovery Time Objective (RTO) of 1 minute.

Which AWS solution can achieve this?

❌ A. Amazon RDS for with Multi-AZ enabled.
❌ B. Amazon RDS for with a cross-Region replica.
✅ C. Amazon Aurora Global Database.
❌ D. Amazon DynamoDB global tables.

Question 810

An application makes calls to a REST API running on Amazon EC2 instances behind an Application Load Balancer (ALB). Most API calls complete quickly. However, a single endpoint is making API calls that require much longer to complete and this is introducing overall latency into the system. What steps can a Solutions Architect take to minimize the effects of the long-running API calls?

❌ A. Increase the ALB idle timeout to allow the long-running requests to complete
❌ B. Change the ALB to a Network Load Balancer (NLB) and use SSL/TLS termination
❌ C. Change the EC2 instance to one with enhanced networking to reduce latency
✅ D. Create an Amazon SQS queue and decouple the long-running API calls

Question 811

A Solutions Architect needs to capture information about the traffic that reaches an Amazon Elastic Load Balancer. The information should include the source, destination, and protocol.

What is the most secure and reliable method for gathering this data?

❌ A. Enable Amazon CloudTrail logging and configure packet capturing
❌ B. Create a VPC flow log for the subnets in which the ELB is running
❌ C. Use Amazon CloudWatch Logs to review detailed logging information
✅ D. Create a VPC flow log for each network interface associated with the ELB

Question 812

A production application runs on an Amazon RDS MySQL DB instance. A solutions architect is building a new reporting tool that will access the same data. The reporting tool must be highly available and not impact the performance of the production application.

How can this be achieved?

✅ A. Create a Multi-AZ RDS Read Replica of the production RDS DB instance
❌ B. Create a cross-region Multi-AZ deployment and create a read replica in the second region
❌ C. Create a Single-AZ RDS Read Replica of the production RDS DB instance. Create a second Single-AZ RDS Read Replica from the replica
❌ D. Use Amazon Data Lifecycle Manager to automatically create and manage snapshots

Question 813

A web application in a three-tier architecture runs on a fleet of Amazon EC2 instances. Performance issues have been reported and investigations point to insufficient swap space. The operations team requires monitoring to determine if this is correct.

What should a solutions architect recommend?

❌ A. Use EC2 metadata to collect information, then publish it to Amazon CloudWatch custom metrics. Monitor SwapUsage metrics in CloudWatch
❌ B. Enable detailed monitoring in the EC2 console. Create an Amazon CloudWatch SwapUtilization custom metric. Monitor SwapUtilization metrics in CloudWatch
✅ C. Install an Amazon CloudWatch agent on the instances. Run an appropriate script on a set schedule. Monitor SwapUtilization metrics in CloudWatch
❌ D. Configure an Amazon CloudWatch SwapUsage metric dimension. Monitor the SwapUsage dimension in the EC2 metrics in CloudWatch

Question 814

A tool needs to analyze data stored in an Amazon S3 bucket. Processing the data takes a few seconds and results are then written to another S3 bucket. Less than 256 MB of memory is needed to run the process. What would be the MOST cost-effective compute solutions for this use case?

✅ A. AWS Lambda functions
❌ B. Amazon EC2 spot instances
❌ C. AWS Fargate tasks
❌ D. Amazon Elastic Beanstalk

Question 815

A company is looking for ways to incorporate its current AWS usage expenditure into its operational expense tracking dashboard. A solutions architect has been tasked with proposing a method that enables the company to fetch its current year's cost data and project the costs for the forthcoming 12 months programmatically.

Which approach would fulfill these needs with the MINIMUM operational burden?

✅ A. Leverage the AWS Cost Explorer API to retrieve usage cost-related data, using pagination for larger data sets.
❌ B. Set up AWS Budgets actions to transmit usage cost data to the corporation via FTP.
❌ C. Generate AWS Budgets reports on usage cost data and dispatch the data to the corporation through SMTP.
❌ D. Make use of downloadable AWS Cost Explorer report files in the .csv format to access usage cost-related data.

Question 816

A company has some statistical data stored in an Amazon RDS database. The company want to allow users to access this information using an API. A solutions architect must create a solution that allows sporadic access to the data, ranging from no requests to large bursts of traffic.

Which solution should the solutions architect suggest?

❌ A. Set up an Amazon API Gateway and use Amazon ECS
✅ B. Set up an Amazon API Gateway and use AWS Lambda functions
❌ C. Set up an Amazon API Gateway and use Amazon EC2 with Auto Scaling
❌ D. Set up an Amazon API Gateway and use AWS Elastic Beanstalk

Question 817

A Solutions Architect is designing an application that will run on Amazon EC2 instances. The application will use Amazon S3 for storing image files and an Amazon DynamoDB table for storing customer information. The security team require that traffic between the EC2 instances and AWS services must not traverse the public internet.

How can the Solutions Architect meet the security team’s requirements?

✅ A. Create gateway VPC endpoints for Amazon S3 and DynamoDB.
❌ B. Create a NAT gateway in a public subnet and configure route tables.
❌ C. Create interface VPC endpoints for Amazon S3 and DynamoDB.
❌ D. Create a virtual private gateway and configure VPC route tables.

Question 818

A company has refactored a legacy application to run as two microservices using Amazon ECS. The application processes data in two parts and the second part of the process takes longer than the first.

How can a solutions architect integrate the microservices and allow them to scale independently?

❌ A. Implement code in microservice 1 to send data to an Amazon S3 bucket. Use S3 event notifications to invoke microservice 2
❌ B. Implement code in microservice 1 to send data to Amazon Kinesis Data Firehose. Implement code in microservice 2 to read from Kinesis Data Firehose
✅ C. Implement code in microservice 1 to send data to an Amazon SQS queue. Implement code in microservice 2 to process messages from the queue
❌ D. Implement code in microservice 1 to publish data to an Amazon SNS topic. Implement code in microservice 2 to subscribe to this topic

Question 819

An application runs on Amazon EC2 instances backed by Amazon EBS volumes and an Amazon RDS database. The application is highly sensitive and security compliance requirements mandate that all personally identifiable information (PII) be encrypted at rest.

Which solution should a Solutions Architect choose to this requirement?

❌ A. Deploy AWS CloudHSM, generate encryption keys, and use the customer master key (CMK) to encrypt database volumes.
❌ B. Configure SSL/TLS encryption using AWS KMS customer master keys (CMKs) to encrypt database volumes.
❌ C. Enable encryption on Amazon RDS during creation. Use Amazon Macie to identify sensitive data.
✅ D. Configure Amazon EBS encryption and Amazon RDS encryption with AWS KMS keys to encrypt instance and database volumes.

Question 820

A solutions architect has created a new AWS account and must secure AWS account root user access.

Which combination of actions will accomplish this? (Select TWO)

✅ A. Ensure the root user uses a strong password
✅ B. Enable multi-factor authentication to the root user
❌ C. Store root user access keys in an encrypted Amazon S3 bucket
❌ D. Delete the root user account
❌ E. Add the root user to a group containing administrative permissions

Question 821

An e-commerce web application needs a highly scalable key-value database. Which AWS database service should be used?

✅ A. Amazon DynamoDB
❌ B. Amazon RDS
❌ C. Amazon RedShift
❌ D. Amazon ElastiCache

Question 822

A company is planning to migrate a large quantity of important data to Amazon S3. The data will be uploaded to a versioning enabled bucket in the us-west-1 Region. The solution needs to include replication of the data to another Region for disaster recovery purposes.

How should a solutions architect configure the replication?

❌ A. Create an additional S3 bucket in another Region and configure cross-Region replication
✅ B. Create an additional S3 bucket with versioning in another Region and configure cross-Region replication
❌ C. Create an additional S3 bucket in another Region and configure cross-origin resource sharing (CORS)
❌ D. Create an additional S3 bucket with versioning in another Region and configure cross-origin resource sharing (CORS)

Question 823

A company has several AWS accounts that are used by developers for development, testing and pre-production environments. The company has received large bills for Amazon EC2 instances that are underutilized. A Solutions Architect has been tasked with restricting the ability to launch large EC2 instances in all accounts.

How can the Solutions Architect meet this requirement with the LEAST operational overhead?

❌ A. Create a service-linked role for Amazon EC2 and attach a policy the denies the launch of large EC2 instances.
❌ B. Create a resource-based policy that denies the launch of large EC2 instances and attach it to Amazon EC2 in each account.
❌ C. Create an IAM role in each account that denies the launch of large EC2 instances. Grant the developers IAM group access to the role.
✅ D. Create an organization in AWS Organizations that includes all accounts and create a service control policy (SCP) that denies the launch of large EC2 instances.

Question 824

A web application is running on a fleet of Amazon EC2 instances using an Auto Scaling Group. It is desired that the CPU usage in the fleet is kept at 40%.

How should scaling be configured?

✅ A. Use a target tracking policy that keeps the average aggregate CPU utilization at 40%
❌ B. Use a step scaling policy that uses the PercentChangeInCapacity value to adjust the group size as required
❌ C. Use a custom CloudWatch alarm to monitor CPU usage and notify the ASG using Amazon SNS
❌ D. Use a simple scaling policy that launches instances when the average CPU hits 40%

Question 825

Health related data in Amazon S3 needs to be frequently accessed for up to 90 days. After that time the data must be retained for compliance reasons for seven years and is rarely accessed.

Which storage classes should be used?

✅ A. Store data in STANDARD for 90 days then transition the data to DEEP_ARCHIVE
❌ B. Store data in STANDARD for 90 days then transition to REDUCED_REDUNDANCY
❌ C. Store data in STANDARD for 90 days then expire the data
❌ D. Store data in INTELLIGENT_TIERING for 90 days then transition to STANDARD_IA

Question 826

A legacy application is being migrated into AWS. The application has a large amount of data that is rarely accessed. When files are accessed they are retrieved sequentially. The application will be migrated onto an Amazon EC2 instance.

What is the LEAST expensive EBS volume type for this use case?

❌ A. General Purpose SSD (gp2)
✅ B. Cold HDD (sc1)
❌ C. Provisioned IOPS SSD (io1)
❌ D. Throughput Optimized HDD (st1)

Question 827

A company operates multiple AWS accounts under AWS Organizations. To better manage the costs, the company wants to allocate different budgets for each of these accounts. The company also wants to prevent additional resource provisioning in an AWS account if it reaches its allocated budget before the end of the budget period.

Which combination of solutions will meet these requirements? (Select THREE)

❌ A. Use AWS Budgets in the AWS Management Console to set up budgets and specify the cost threshold for each AWS account.
✅ B. Use AWS Budgets to establish different budgets for each AWS account. Configure the budgets in the Billing and Cost Management console.
❌ C. Create an IAM user with adequate permissions to allow AWS Budgets to enforce budget actions.
❌ D. Set up an alert in AWS Budgets to notify the company when a particular account meets its budget threshold. Enable real-time monitoring for immediate notification.
✅ E. Configure alerts in AWS Budgets to notify the company when an account is about to reach its budget threshold. Then use a budget action that links to the IAM role to prevent additional resource provisioning.
✅ F. Set up an IAM role with the necessary permissions that allow AWS Budgets to execute budget actions.

Question 828

There are badge readers located at every entrance of an organization’s warehouses. A message is sent over HTTPS when badges are scanned to indicate who tried to access the entrance.

A solutions architect must design a system to process these messages. A highly available solution is required. The solution must store results in a durable data store for later analysis.

Which system architecture should the solutions architect recommend?

✅ A. Set up an HTTPS endpoint in Amazon API Gateway. To process the messages and save the results to Amazon DynamoDB, configure an API Gateway endpoint to invoke an AWS Lambda function.
❌ B. Set up an Amazon S3 gateway endpoint in your VPC. Connect the facility network to the VPC via a Site-to-Site VPN connection so that sensor data can be written directly to an S3 bucket.
❌ C. Direct incoming messages from the sensor to an AWS Lambda function using Amazon Route 53. Create a Lambda function that processes messages and saves results to Amazon DynamoDB.
❌ D. Create an Amazon EC2 instance to serve as the HTTPS endpoint and to process messages. An Amazon S3 bucket should be configured for the EC2 instance to save the results.

Question 829

A company copies 250 TB of data from a recent land survey onto multiple AWS Snowball Edge Storage Optimized devices. The company has a high-performance computing (HPC) cluster that is hosted within AWS to look for items of archaeological interest. A solutions architect must provide the cluster with consistent low latency and high-throughput access to the data which is hosted on the Snowball Edge Storage Optimized devices. The company is sending the devices back to AWS.

Which solution will meet these requirements?

❌ A. Create an Amazon FSx for Lustre file system and import the data directly into the FSx for Lustre file system and access the FSx for Lustre file system from the HPC cluster instances.
✅ B. Set up an Amazon S3 bucket. Configure an Amazon FSx for Lustre file system and integrate it with the S3 bucket after importing the data then access the FSx for Lustre file system from the HPC cluster instances.
❌ C. Create a bucket in Amazon S3 and import the data into the S3 bucket. Set up an AWS Storage Gateway file gateway to use the S3 bucket and access the file gateway from the HPC cluster instances.
❌ D. Set up an Amazon Elastic File System (Amazon EFS) file system and an Amazon S3 bucket. Upload the data to the S3 bucket. Using the EFS file system, copy the data from the S3 bucket and access the EFS file system from the HPC cluster instances.

Question 830

A data analytics company is building a high-performance application that requires concurrent writes to a shared block storage volume from multiple Amazon EC2 instances.

The EC2 instances are Nitro-based and reside within the same Availability Zone. The company needs a storage solution that supports simultaneous connections to facilitate data resilience and high availability.

Which solution will meet these requirements?

✅ A. Use Provisioned IOPS SSD (io2) EBS volumes with Amazon EBS Multi-Attach.
❌ B. Use General Purpose SSD (gp2) EBS volumes with Amazon EBS Multi-Attach.
❌ C. Use Amazon S3 with S3 Transfer Acceleration to enhance speed.
❌ D. Use Amazon EFS with NFSv4.1 protocol across multiple EC2 instances.

Question 831

A media company hosts several terabytes of multimedia content across multiple AWS accounts. The company uses AWS Lake Formation to manage its data lake. The company's marketing team needs to securely access and analyze selective data from various accounts for targeted advertisement campaigns.

Which solution will meet these requirements with the LEAST operational overhead?

❌ A. Use the Lake Formation permissions Grant command in each account where the data is stored to permit the required marketing team users to access the data.
❌ B. Replicate the required data to a shared account. Create an IAM access role in that account. Grant access by defining a permission policy that includes users from the marketing team accounts as trusted entities.
✅ C. Utilize Lake Formation tag-based access control to authorize and grant cross-account permissions for the required data to the marketing team accounts.
❌ D. Use AWS DataSync to synchronize the necessary data to the marketing team accounts.

Question 832

A cloud architect is assessing the resilience of a web application deployed on AWS. It was observed that the application experienced a downtime of about 3 minutes when a scheduled failover was performed on the application's Amazon RDS MySQL database as part of a scaling operation.

The organization wants to mitigate such downtime in future scaling exercises while minimizing operational overhead.

Which solution will be the MOST effective in achieving this?

❌ A. Establish a secondary RDS MySQL cluster within the same AWS Region. During any future failover, modify the application to connect to the secondary cluster's writer endpoint.
❌ B. Implement an Amazon ElastiCache for Redis cluster to manage the load during the failover.
❌ C. Implement more RDS MySQL read replicas in the cluster to manage the load during the failover.
✅ D. Configure an Amazon RDS Proxy for the database and modify the application to connect to the proxy endpoint.

Question 833

A company is planning to use Amazon S3 to store documents uploaded by its customers. The images must be encrypted at rest in Amazon S3. The company does not want to spend time managing and rotating the keys, but it does want to control who can access those keys.

What should a solutions architect use to accomplish this?

✅ A. Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)
❌ B. Server-Side Encryption with Customer-Provided Keys (SSE-C)
❌ C. Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)
❌ D. Server-Side Encryption with keys stored in an S3 bucket

Question 834

A company operates a critical Python-based application that analyzes incoming real-time data. The application runs every 15 minutes and takes approximately 2 minutes to complete a run. It requires 1.5 GB of memory and uses the CPU intensively during its operation. The company wants to minimize the costs associated with running this application.

Which solution will meet these requirements?

❌ A. Use AWS App2Container (A2C) to containerize the application. Deploy the container on an Amazon EC2 instance, configure an Amazon CloudWatch alarm to stop the instance when the application is not running.
❌ B. Use AWS App2Container (A2C) to containerize the application. Run the application as an Amazon Elastic Container Service (Amazon ECS) task on AWS Fargate with 1 virtual CPU (vCPU) and 1.5 GB of memory.
✅ C. Implement the application as an AWS Lambda function configured with 1.5 GB of memory. Use Amazon EventBridge to schedule the function to run every 15 minutes.
❌ D. Deploy the application on an Amazon EC2 instance and manually start and stop the instance in alignment with the schedule of the application run.

Question 835

The database layer of an on-premises web application is being migrated to AWS. The database currently uses an in-memory cache. A Solutions Architect must deliver a solution that supports high availability and replication for the caching layer.

Which service should the Solutions Architect recommend?

❌ A. Amazon RDS Multi-AZ
✅ B. Amazon ElastiCache Redis
❌ C. Amazon DynamoDB
❌ D. Amazon ElastiCache Memcached

Question 836

A company operates a production web application that uses an Amazon RDS MySQL database. The database has automated, non-encrypted daily backups. To increase the security of the data, it has been recommended that encryption should be enabled for backups. Unencrypted backups will be destroyed after the first encrypted backup has been completed.

What should be done to enable encryption for future backups?

✅ A. Create a snapshot of the database. Copy it to an encrypted snapshot. Restore the database from the encrypted snapshot
❌ B. Enable an encrypted read replica on RDS for MySQL. Promote the encrypted read replica to primary. Remove the original database instance
❌ C. Modify the backup section of the database configuration to toggle the Enable encryption check box
❌ D. Enable default encryption for the Amazon S3 bucket where backups are stored

Question 837

A company runs a financial application using an Amazon EC2 Auto Scaling group behind an Application Load Balancer (ALB). When running month-end reports on a specific day and time each month the application becomes unacceptably slow. Amazon CloudWatch metrics show the CPU utilization hitting 100%.

What should a solutions architect recommend to ensure the application is able to handle the workload and avoid downtime?

❌ A. Configure Amazon ElastiCache to remove some of the workload from the EC2 instances
✅ B. Configure an EC2 Auto Scaling scheduled scaling policy based on the monthly schedule
❌ C. Configure an Amazon CloudFront distribution in front of the ALB
❌ D. Configure an EC2 Auto Scaling simple scaling policy based on CPU utilization

Question 838

A company has launched a multi-tier application architecture. The web tier and database tier run on Amazon EC2 instances in private subnets within the same Availability Zone.

Which combination of steps should a Solutions Architect take to add high availability to this architecture? (Select TWO)

❌ A. Create new public subnets in the same AZ for high availability and move the web tier to the public subnets
✅ B. Create new private subnets in the same VPC but in a different AZ. Migrate the database to an Amazon RDS multi-AZ deployment
❌ C. Create new private subnets in the same VPC but in a different AZ. Create a database using Amazon EC2 in one AZ
✅ D. Create an Amazon EC2 Auto Scaling group and Application Load Balancer (ALB) spanning multiple AZs
❌ E. Add the existing web application instances to an Auto Scaling group behind an Application Load Balancer (ALB)

Question 839

An application uses an Amazon RDS database and Amazon EC2 instances in a web tier. The web tier instances must not be directly accessible from the internet to improve security.

How can a Solutions Architect meet these requirements?

✅ A. Launch the EC2 instances in a private subnet and create an Application Load Balancer in a public subnet
❌ B. Launch the EC2 instances in a private subnet with a NAT gateway and update the route table
❌ C. Launch the EC2 instances in a public subnet and create an Application Load Balancer in a public subnet
❌ D. Launch the EC2 instances in a public subnet and use AWS WAF to protect the instances from internet-based attacks

Question 840

A new application will be launched on an Amazon EC2 instance with an Elastic Block Store (EBS) volume. A solutions architect needs to determine the most cost-effective storage option. The application will have infrequent usage, with peaks of traffic for a couple of hours in the morning and evening. Disk I/O is variable with peaks of up to 3,000 IOPS.

Which solution should the solutions architect recommend?

✅ A. Amazon EBS General Purpose SSD (gp2)
❌ B. Amazon EBS Provisioned IOPS SSD (io1)
❌ C. Amazon EBS Cold HDD (sc1)
❌ D. Amazon EBS Throughput Optimized HDD (st1)

Question 841

A company is in the process of improving its security posture and wants to analyze and rectify a high volume of failed login attempts and unauthorized activities being logged in AWS CloudTrail.

What is the most efficient solution to help the company identify these security events with the LEAST amount of operational effort?

❌ A. Implement Amazon Elasticsearch Service with Kibana to visualize the CloudTrail logs and manually search for these events.
❌ B. Utilize AWS Data Pipeline to regularly extract CloudTrail logs and use a custom script to identify the required security events.
✅ C. Use Amazon Athena to directly query CloudTrail logs for failed logins and unauthorized activities.
❌ D. Leverage AWS Lambda to trigger on CloudTrail log updates and use a custom script to scan for failed logins and unauthorized actions.

Question 842

A High Performance Computing (HPC) application needs storage that can provide 135,000 IOPS. The storage layer is replicated across all instances in a cluster.

What is the optimal storage solution that provides the required performance and is cost-effective?

❌ A. Use Amazon S3 with byte-range fetch
❌ B. Use Amazon EBS Provisioned IOPS volume with 135,000 IOPS
✅ C. Use Amazon Instance Store
❌ D. Use Amazon EC2 Enhanced Networking with an EBS HDD Throughput Optimized volume

Question 843

A digital media company uses an Amazon RDS MySQL instance for its content management system. Recently, the company has observed that their RDS instance is nearing its storage capacity due to the constant influx of new data. The company wants to ensure there's always sufficient storage without any operational interruption or manual intervention.

Which solution should the company use to address this situation with the LEAST operational overhead?

❌ A. Implement a lifecycle policy to delete older data from the MySQL instance.
❌ B. Migrate the database to a larger Amazon RDS MySQL instance.
✅ C. Enable automatic storage scaling for the MySQL instance.
❌ D. Utilize Amazon ElastiCache to offload some read traffic and reduce database load.

Question 844

An application runs on Amazon EC2 instances in a private subnet. The EC2 instances process data that is stored in an Amazon S3 bucket. The data is highly confidential and a private and secure connection is required between the EC2 instances and the S3 bucket.

Which solution meets these requirements?

❌ A. Configure encryption for the S3 bucket using an AWS KMS key.
❌ B. Configure a custom SSL/TLS certificate on the S3 bucket.
❌ C. Set up an IAM policy to grant read-write access to the S3 bucket.
✅ D. Set up S3 bucket policies to allow access from a VPC endpoint.

Question 845

A Solutions Architect has created an AWS Organization with several AWS accounts. Security policy requires that use of specific API actions are limited across all accounts. The Solutions Architect requires a method of centrally controlling these actions.

What is the SIMPLEST method of achieving the requirements?

❌ A. Create an IAM policy in the root account and attach it to users and groups in each account
❌ B. Create cross-account roles in each account to limit access to the services and actions that are allowed
✅ C. Create a service control policy in the root organizational unit to deny access to the services or actions
❌ D. Create a Network ACL that limits access to the services or actions and attach it to all relevant subnets

Question 846

A systems administrator of a company wants to detect and remediate the compromise of services such as Amazon EC2 instances and Amazon S3 buckets.

Which AWS service can the administrator use to protect the company against attacks?

❌ A. Amazon Inspector
✅ B. Amazon GuardDuty
❌ C. Amazon Cognito
❌ D. Amazon Macie

Question 847

An application runs on Amazon EC2 instances across multiple Availability Zones. The instances run in an Amazon EC2 Auto Scaling group behind an Application Load Balancer. The application performs best when the CPU utilization of the EC2 instances is at or near 40%.

What should a solutions architect do to maintain the desired performance across all instances in the group?

✅ A. Use a target tracking policy to dynamically scale the Auto Scaling group
❌ B. Use scheduled scaling actions to scale up and scale down the Auto Scaling group
❌ C. Use an AWS Lambda function to update the desired Auto Scaling group capacity
❌ D. Use a simple scaling policy to dynamically scale the Auto Scaling group

Question 848

A financial institution wants to use machine learning (ML) algorithms to detect potential fraudulent transactions. They need to create ML models based on their vast financial transaction data and integrate these models into their business intelligence system for real-time decision-making. The solution should require minimal operational overhead.

Which solution will best meet these requirements?

❌ A. Use a pre-built ML Amazon Machine Image (AMI) from the AWS Marketplace to build and train models and use AWS Athena for data visualization.
❌ B. Use AWS Glue to perform ETL jobs on the transaction data and use Amazon Forecast for predictive analytics.
❌ C. Use Amazon Comprehend for analyzing the transaction data and Amazon Elasticsearch for visualization.
✅ D. Use Amazon SageMaker to build, train, and deploy ML models, and use Amazon QuickSight for data visualization.

Question 849

An application requires a MySQL database which will only be used several times a week for short periods. The database needs to provide automatic instantiation and scaling. Which database service is most suitable?

❌ A. Amazon RDS MySQL
✅ B. Amazon Aurora Serverless
❌ C. Amazon EC2 instance with MySQL database installed
❌ D. Amazon Aurora