Hermes Wiki

Question 850

A company requires that inbound traffic to its web servers on port 443 be allowed, while all other inbound traffic must be blocked. The solution must also ensure that return traffic for established connections is permitted without additional configuration. Which tool is best suited for this?

❌ A. Route Table
❌ B. Network Access Control Lists (NACLs)
❌ C. Internet Gateways
✅ D. Security Groups

Question 851

An application requires an API key for a third-party service. The security team mandates that the key must be rotated every 30 days. Which AWS service provides this rotation capability with the least operational overhead?

❌ A. AWS Systems manager Parameter Store
✅ B. AWS Secrets Manager
❌ C. Amazon S3 with Object Lock
❌ D. AWS Key Management Service

Question 852

A solutions architect needs to apply encryption to an existing Amazon RDS MySQL database that was initially created without encryption. What is the most effective way to achieve this?

✅ A. Take a snapshot, copy the snapshot with encryption enabled, and restore a new instance from that snapshot.
❌ B. Use AWS DMS to migrate data to a new encrypted RDS instance in real-time.
❌ C. Configure an RDS Read Replica with encryption enabled and promote it to the primary instance.
❌ D. Enable encryption on the RDS instance settings directly in the AWS Management Console.

Question 853

In an Amazon ECS environment using the Fargate launch type, which IAM role should be configured to allow the application code inside the container to access an Amazon S3 bucket?

✅ A. Task Role
❌ B. Task Execution Role
❌ C. EC2 Instance Profile
❌ D. Service Linked Role

Question 854

A developer wants to ensure they can experiment with attaching various IAM policies to roles but must be prevented from ever granting themselves the AdministratorAccess policy. What is the most appropriate security control to enforce this?

❌ A. IAM Access Analyzer
❌ B. Service Control Policy (SCP)
✅ C. IAM Permissions Boundary
❌ D. Resource-based Policy

Question 855

A company stores logs in Amazon S3 and uses AWS KMS for encryption. To reduce the costs associated with the high volume of KMS API calls when uploading and accessing objects, which feature should they enable?

❌ A. SSE-S3 Encryption
❌ B. KMS Automatic Key Rotation
✅ C. S3 Bucket Key
❌ D. S3 Intelligent-Tiering

Question 856

A solutions architect needs to restrict access to a public Amazon API Gateway REST API so that only requests from a specific office IP range (203.0.113.0/24) are permitted. What is the most secure and operationally efficient way to implement this?

✅ A. Configure an API Gateway Resource Policy with an IP address condition.
❌ B. Implement logic in the backend Lambda function to check the source IP and return an error.
❌ C. Use a Network ACL on the VPC subnets where the API is deployed.
❌ D. Add a Security Group to the API Gateway that allows only the office IP range.

Question 857

A company wants to ensure that a specific Amazon S3 bucket containing confidential project data can only be accessed by users whose accounts belong to the same AWS Organization. Which bucket policy condition should be used?

❌ A. aws:SourceOrgID
❌ B. aws:PrincipalAccount
✅ C. aws:PrincipalOrgID
❌ D. aws:PrincipalArn

Question 858

To apply the principle of least privilege between a web tier and a database tier in a VPC, what should the database security group use as the 'Source' in its inbound rule for port 3306?

✅ A. The Security Group ID of the web tier.
❌ B. The CIDR block of the web tier's subnet.
❌ C. The VPC CIDR block.
❌ D. The Public IP addresses of the web servers.

Question 859

A company wants to replicate encrypted S3 objects from us−east−1 to us−west−2. They require that the same encryption key be used in both regions for seamless access. Which KMS feature facilitates this?

❌ A. KMS Custom Key Stores
❌ B. KMS Key Grants
❌ C. KMS Key Policies
✅ D. KMS Multi-Region Keys

Question 860

A security team receives an alert that an EC2 instance is communicating with a known command-and-control server associated with cryptocurrency mining. Which AWS service was most likely used to detect this behavior?

❌ A. AWS Config
❌ B. Amazon Inspector
❌ C. Amazon Macie
✅ D. Amazon GuardDuty

Question 861

An application in a private subnet needs to download security patches from the internet. The architect must ensure that the instances remain unreachable from the public internet. Which component should be placed in the public subnet to allow this?

✅ A. NAT Gateway
❌ B. Virtual Private Gateway
❌ C. Internet Gateway
❌ D. VPC Endpoint

Question 862

A solutions architect needs to choose an encryption method for S3 objects that requires no manual key rotation by the customer but still allows the company to audit every time an encryption key is used. Which option is best?

❌ A. SSE-S3
✅ B. SSE-KMS
❌ C. Client-Side Encryption
❌ D. SSE-C

Question 863

An application is hosted on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The security group on the EC2 instances should be configured to follow the principle of least privilege. What should the source of the inbound rule be for the application port?

✅ A. The Security Group ID of the Application Load Balancer.
❌ B. The CIDR block of the public subnet.
❌ C. The IP address of the Internet Gateway.
❌ D. A source of 0.0.0.0/0 on the application port.

Question 864

A solutions architect needs to identify all S3 buckets that contain unencrypted Personally Identifiable Information (PII), such as credit card numbers. Which service should be used to automate this discovery?

❌ A. Amazon GuardDuty
❌ B. AWS Config
✅ C. Amazon Macie
❌ D. Amazon Inspector

Question 865

A solutions architect is configuring a site-to-site VPN to connect an on-premises data center to a VPC. Which component is the VPN concentrator on the Amazon side of the connection?

✅ A. Virtual Private Gateway (VGW)
❌ B. Internet Gateway
❌ C. Transit Gateway
❌ D. Customer Gateway

Question 866

A global company requires a relational database solution that can survive a regional outage with a Recovery Point Objective (RPO) of approximately 1 second and a Recovery Time Objective (RTO) of less than 1 minute. Which solution is most appropriate?

❌ A. Amazon RDS Cross-Region Read Replicas
❌ B. Amazon RDS Multi-AZ Deployment
❌ C. DynamoDB Global Tables
✅ D. Amazon Aurora Global Database

Question 867

A global company requires a non-relational (NoSQL) database solution that can survive a regional outage with a Recovery Point Objective (RPO) of approximately 1 second and a Recovery Time Objective (RTO) of less than 1 minute. Which solution is most appropriate?

❌ A. Amazon Aurora Global Database
❌ B. Amazon RDS Multi-AZ Deployment
✅ C. DynamoDB Global Tables
❌ D. Amazon ElastiCache Global Datastore

Question 868

To optimize costs for private instances accessing Amazon S3 frequently, which component should a Solutions Architect add to the VPC route table?

❌ A. S3 Interface Endpoint
✅ B. S3 Gateway Endpoint
❌ C. NAT Gateway
❌ D. Transit Gateway

Question 869

A developer is building a text-to-speech application and needs to ensure that specific product abbreviations are pronounced correctly by the service. Which feature of Amazon Polly should be utilized?

❌ A. StartSpeechSynthesisTask
❌ B. Standard Voices
✅ C. Custom Lexicons
❌ D. Speech Synthesis Markup Language

Question 870

Which AWS networking service improves application performance for global users by routing traffic over the AWS global network backbone and supports both TCP and UDP protocols?

❌ A. Amazon Route 53
❌ B. AWS Direct Connect
✅ C. AWS Global Accelerator
❌ D. Amazon CloudFront

Question 871

Security Groups in AWS VPC are described as 'stateful'. What is the practical implication of this characteristic when configuring inbound and outbound rules?

❌ A. You must explicitly define outbound rules to allow return traffic.
❌ B. The security group can only be applied to a single instance at a time.
✅ C. Return traffic for an allowed connection is automatically permitted.
❌ D. Rules are evaluated in numeric order and the first match is applied.

Question 872

An Amazon ElastiCache implementation requires that the cache data is never stale and that read latency is minimized, even if it increases the cost of write operations. Which caching strategy should be used?

❌ A. Lazy Loading (Cache-aside)
❌ B. DAX (DynamoDB Accelerator)
❌ C. TTL (Time to Live)
✅ D. Write-Through

Question 873

A gaming application uses a custom UDP-based protocol to communicate with a fleet of servers globally. Which service will best improve performance and provide fast failover by routing traffic through the AWS global network?

❌ A. Amazon Route 53 with Latency Routing
✅ B. AWS Global Accelerator
❌ C. Amazon CloudFront
❌ D. Application Load Balancer (ALB)

Question 874

In an Amazon ECS environment using Fargate, which IAM role is responsible for allowing the ECS agent to pull container images from Amazon ECR and send logs to CloudWatch?

✅ A. Task Execution Role
❌ B. AWSServiceRoleForECS
❌ C. Task Role
❌ D. IAM User Role

Question 875

A company is receiving high AWS bills due to underutilized EC2 instances. Which AWS service provides machine-learning-based recommendations to 'right-size' these instances for cost optimization?

✅ A. AWS Compute Optimizer
❌ B. AWS Budgets
❌ C. AWS Trusted Advisor
❌ D. AWS Cost Explorer

Question 876

An enterprise is migrating a legacy system that requires a shared file system accessible by both Windows (SMB) and Linux (NFS) instances simultaneously, while maintaining data consistency across Availability Zones. Which Amazon FSx flavor meets this multi-protocol requirement?

❌ A. Amazon FSx for Windows File Server
❌ B. Amazon FSx for OpenZFS
❌ C. Amazon FSx for Lustre
✅ D. Amazon FSx for NetApp ONTAP

Question 877

A company wants its Amazon VPC resources to be able to resolve private DNS records for services located in its on-premises data center. Which component of Route 53 Resolver is necessary to facilitate this AWS-to-on-premises query flow?

❌ A. Inbound Endpoint
❌ B. VPC Peering
❌ C. Private Hosted Zone
✅ D. Outbound Endpoint

Question 878

A data processing workflow involves multiple steps, including image recognition and database updates. One specific step may take up to 30 minutes to complete. Which service should be used to orchestrate this long-running process?

❌ A. AWS Lambda
❌ B. Amazon SQS
❌ C. Amazon EventBridge
✅ D. AWS Step Functions

Question 879

A data science team uses an EC2 instance to load a massive in-memory dataset, which takes 20 minutes to initialize. They want to stop the instance overnight to save costs but avoid the 20-minute reload time the next morning. Which feature should they use?

❌ A. EBS Snapshot
❌ B. EC2 Instance Store
✅ C. EC2 Hibernation
❌ D. EC2 Auto Scaling

Question 880

A company needs to share a centralized Transit Gateway and several private subnets across 50 different AWS accounts within their Organization to simplify networking. Which service enables this cross-account resource sharing?

❌ A. AWS Control Tower
❌ B. AWS Organizations
❌ C. AWS PrivateLink
✅ D. AWS Resource Access Manager (RAM)

Question 881

A logistics company needs to automate the extraction of specific data fields from thousands of scanned paper invoices, preserving the table structure of the documents. Which AI service is designed for this task?

❌ A. Amazon Transcribe
❌ B. Amazon Rekognition
✅ C. Amazon Textract
❌ D. Amazon Comprehend

Question 882

A company has 500 TB of data on a local NAS that must be migrated to Amazon S3. The internet connection is highly unstable and limited to 10 Mbps. Which migration tool is most appropriate?

✅ A. AWS Snowball Edge
❌ B. AWS DataSync
❌ C. AWS Transfer Family
❌ D. AWS Application Migration Service (MGN)

Question 883

A corporation has three separate remote offices that all need to communicate with a central VPC and with each other through a secure, encrypted connection over the internet. Which architecture provides the simplest hub-and-spoke connectivity for this requirement?

❌ A. AWS PrivateLink
❌ B. AWS Direct Connect
❌ C. VPC Peering
✅ D. AWS VPN CloudHub

Question 884

A solutions architect needs to implement a routing policy in Amazon Route 53 that allows them to adjust the size of the geographic area from which traffic is routed to a specific resource by using a 'bias' value. Which routing policy should be used?

❌ A. Multivalue answer routing
❌ B. Latency based routing
❌ C. Geolocation routing
✅ D. Geoproximity routing

Question 885

A data engineer needs to ingest real-time streaming data and deliver it to an Amazon S3 bucket for long-term storage with the least amount of operational effort. The data must be converted from JSON to Apache Parquet during ingestion. Which service is most appropriate?

❌ A. AWS Glue ETL
❌ B. Amazon Managed Streaming for Apache Kafka (MSK)
❌ C. Amazon Kinesis Data Streams
✅ D. Amazon Data Firehose

Question 886

A company is running an HPC workload on Linux that requires a shared file system with sub-millisecond latency and the ability to scale to hundreds of gigabytes per second of throughput. The storage must be able to lazily load data from an Amazon S3 bucket. Which service fits this profile?

❌ A. Amazon FSx for Windows File Server
❌ B. Amazon EBS with Multi-Attach
✅ C. Amazon FSx for Lustre
❌ D. Amazon EFS with Max I/O mode

Question 887

An analytics company needs a code-free, visual interface to allow business analysts to clean and prepare data sets from their S3 data lake for machine learning. Which AWS service is specifically designed for this 'data prep' use case?

❌ A. Amazon Athena
✅ B. AWS Glue DataBrew
❌ C. AWS Glue Studio
❌ D. Amazon SageMaker Notebooks

Question 888

A company wants to prevent users from accessing their S3-hosted images directly via S3 URLs, mandating that all traffic must go through an Amazon CloudFront distribution. Which feature should be used to secure the S3 origin?

❌ A. Route 53 Alias records
✅ B. Origin Access Control (OAC)
❌ C. S3 Block Public Access
❌ D. Security Group Referencing

Question 889

A company asks a solutions architect to implement a pilot light disaster recovery (DR) strategy for an existing on-premises application. The application is self contained and does not need to access any databases.

Which solution will implement a pilot light DR strategy?

❌ A. Back up the on-premises application, configuration, and data to an Amazon S3 bucket. When the on-premises application fails, rebuild the on-premises hosting environment and restore the application from the information that is stored in the S3 bucket.
❌ B. Back up the on-premises application, configuration, and data to an Amazon S3 bucket. When the on-premises application fails, build a new hosting environment on AWS and restore the application from the information that is stored in the S3 bucket.
✅ C. Recreate the application hosting environment on AWS by using Amazon EC2 instances and stop the EC2 instances. When the on-premises application fails, start the stopped EC2 instances and direct 100% of application traffic to the EC2 instances that are running in the AWS Cloud.
❌ D. Recreate the application hosting environment on AWS by using Amazon EC2 instances. Direct 10% of application traffic to the EC2 instances that are running in the AWS Cloud. When the on-premises application fails, direct 100% of application traffic to the EC2 instances that are running in the AWS Cloud.

Question 890

A company is transitioning its Amazon EC2 based MariaDB database to Amazon RDS. The company has already identified a database instance type that will meet the company's CPU and memory requirements. The database currently provides 40 GiB of storage capacity and 1,000 IOPS.

Which storage configuration for the Amazon RDS for MariaDB instance is MOST cost-effective?

❌ A. Provision 350 GiB of magnetic storage for the RDS instance.
❌ B. Provision 50 GiB of Provisioned IOPS storage with 1,000 IOPS for the RDS instance.
❌ C. Provision 334 GiB of General Purpose SSD storage (gp2) for the RDS instance.
✅ D. Provision 50 GiB of General Purpose SSD (gp3) storage for the RDS instance.

Question 891

A solutions architect needs to connect workloads in an on-premises data center with multiple Amazon VPCs. The VPCs must be centrally connected through an AWS Transit Gateway. The VPCs should have a connection of at least 1 GB to the data center with an active failover configuration. Currently only one AWS Direct Connect link is being used to establish the connection.

What is the MOST cost-effective way to connect the workloads?

❌ A. Configure AWS Site-to-Site VPN connections as active connections. Set the existing Direct Connect dedicated link as a failover connection.
❌ B. Use the existing Direct Connect dedicated link as the active connection. Add AWS Client VPN connections as failover connections.
❌ C. Use the existing Direct Connect dedicated link as the active connection. Add a second Direct Connect dedicated link as a failover connection.
✅ D. Use the existing Direct Connect dedicated link as the active connection. Add AWS Site-to-Site VPN connections as failover connections.

Question 892

A company needs to maintain data records for a minimum of 5 years. The data is rarely accessed after it is stored. The data must be accessible within 2 hours.

Which solution will meet these requirements MOST cost-effectively?

❌ A. Store the data in an Amazon Elastic Block Store (Amazon EBS) volume. Create snapshots. Store the snapshots in an Amazon S3 bucket.
❌ B. Store the data in an Amazon Elastic File System (Amazon EFS) file system. Access the data by using AWS Direct Connect.
✅ C. Store the data in an Amazon S3 bucket. Use an S3 Lifecycle policy to move the data to S3 Glacier Instant Retrieval.
❌ D. Store the data in an Amazon S3 bucket. Use an S3 Lifecycle policy to move the data to S3 Standard-Infrequent Access (S3 Standard-IA).

Question 893

A company uses one AWS account to run production workloads. The company has a separate AWS account for its security team. During periodic audits, the security team needs to view specific account settings and resource configurations in the AWS account that runs production workloads. A solutions architect must provide the required access to the security team by designing a solution that follows AWS security best practices.

Which solution will meet these requirements?

❌ A. Create an IAM role in the security account. Attach a permissions policy that provides the permissions required by the security team. Add the security team account to the trust policy. Advise the security team to assume the new role.
❌ B. Create a new IAM user in the production account. Assign administrative privileges to the user. Allow the security team to use this account to log in to the systems that need to be accessed.
✅ C. Create an IAM role in the production account. Attach a permissions policy that provides the permissions required by the security team. Add the security team account to the trust policy. Advise the security team to assume the new role.
❌ D. Create an IAM user for each security team member in the production account. Attach a permissions policy that provides the permissions required by the security team to a new IAM group. Assign the security team members to the group.

Question 894

A media company is designing a new application for graphic rendering. The application requires up to 400 GB of storage for temporary data that is discarded after the frames are rendered. The application requires approximately 40,000 random IOPS to perform the rendering.

What is the MOST cost-effective storage option for this rendering application?

❌ A. A burstable Amazon EC2 instance with a Throughput Optimized HDD (st1) Amazon Elastic Block Store (Amazon EBS) volume
❌ B. A burstable Amazon EC2 instance with Amazon S3 storage over a VPC endpoint
❌ C. A storage optimized Amazon EC2 instance with a Provisioned IOPS SSD (io1 or io2) Amazon Elastic Block Store (Amazon EBS) volume
✅ D. A storage optimized Amazon EC2 instance with instance store storage

Question 895

A company is deploying a new application that will consist of an application layer and an online transaction processing (OLTP) relational database. The application must be available at all times. However, the application will have unpredictable traffic patterns. The company wants to pay the minimum for compute costs during these idle periods.

Which solution will meet these requirements MOST cost effectively?

❌ A. Deploy the application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. Use Amazon RDS for MySQL for the database.
❌ B. Deploy the application and a MySQL database to Amazon EC2 instances by using AWS CloudFormation. Delete the instances at the beginning of the idle periods.
❌ C. Run the application on Amazon EC2 instances by using a burstable instance type. Use Amazon Redshift for the database.
✅ D. Run the application in containers with Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. Use Amazon Aurora Serverless for the database.

Question 896

An ecommerce company is experiencing sophisticated layer 3 DDoS volumetric attacks against its main website. The website runs on Amazon EC2 and uses Amazon CloudFront for global content delivery. A solutions architect must implement an AWS managed solution to protect the website from the DDoS attacks. The solution must automatically detect and mitigate the attacks to minimize application downtime and latency.

Which solution will meet these requirements with the LEAST operational overhead?

✅ A. Subscribe to AWS Shield Advanced. Add the CloudFront distribution as a protected resource.
❌ B. Add a new DDoS protection managed rule group to the web ACL to protect EC2 instances in AWS WAF.
❌ C. Use AWS Application Migration Service to migrate the website from Amazon EC2 to Amazon S3 to handle the additional load.
❌ D. Create a DNS firewall block rule in Amazon Route 53 Resolver DNS Firewall. Add the rule to a DNS firewall rule group and associate the rule group to the VPC of EC2 instances.

Question 897

A company has strict data protection requirements. A solutions architect must configure security for a VPC to ensure that backend Amazon RDS DB instances cannot be accessed from the internet. The solutions architect must ensure that the DB instances are accessible from the application tier over a specified port only.

Which actions should the solutions architect take to meet these requirements? (Select TWO)

❌ A. Attach an elastic network interface with a private IPv4 address to each DB instance.
❌ B. Configure an AWS Direct Connect connection on the database port between the application tier and the backend.
✅ C. Specify a DB subnet group that contains only private subnets for the DB instances.
✅ D. Add an inbound rule to the database security group that allows requests from the security group of the application tier over the database port. Remove other inbound rules.
❌ E. Configure AWS Shield with the VPC. Update the route tables for the subnets that the DB instances use.

Question 898

A company runs its website on Amazon EC2 instances behind an Application Load Balancer that is configured as the origin for an Amazon CloudFront distribution. The company wants to protect against cross-site scripting and SQL injection attacks.

Which approach should a solutions architect recommend to meet these requirements?

❌ A. Define an AWS Shield Advanced policy in AWS Firewall Manager to block cross-site scripting and SQL injection attacks.
✅ B. Set up AWS WAF on the CloudFront distribution. Use conditions and rules that block cross-site scripting and SQL injection attacks.
❌ C. Enable AWS Shield Advanced. List the CloudFront distribution as a protected resource.
❌ D. Deploy AWS Firewall Manager on the EC2 instances. Create conditions and rules that block cross-site scripting and SQL injection attacks.

Question 899

A company uses Amazon DocumentDB (with MongoDB compatibility) for its database. The company wants to use AWS Identity and Access Management (IAM) to manage database access. The company wants to streamline the authentication processes.

Which solution will meet these requirements?

❌ A. Configure IAM users and policies to handle both AWS level actions and direct database authentication for Amazon DocumentDB.
✅ B. Use IAM policies to control AWS level actions that relate to Amazon DocumentDB. Use a database username and password to connect to the Amazon DocumentDB database.
❌ C. Use IAM roles to authenticate directly to Amazon DocumentDB without requiring a database username and password.
❌ D. Implement an IAM policy that automatically updates passwords in Amazon DocumentDB to eliminate the need for traditional authentication.

Question 900

A web application runs on two Amazon EC2 instances behind a Network Load Balancer. The EC2 instances are in a single Availability Zone.

What should a solutions architect do to make this architecture more highly available?

✅ A. Place the EC2 instances in an Auto Scaling group that extends across multiple Availability Zones. Designate the Auto Scaling group as the target of the Network Load Balancer.
❌ B. Create a new VPC with two new EC2 instances in the same Availability Zone as the original EC2 instances. Create a VPC peering connection between the two VPCs.
❌ C. Replace the Network Load Balancer with a Gateway Load Balancer that is configured with the EC2 instances in an Auto Scaling group.
❌ D. Configure Amazon Route 53 to perform health checks on the EC2 instances behind the Network Load Balancer. Add a failover routing policy.

Question 901

A company uses Amazon RDS instances to process customer information. A solutions architect must create a weekly export of data to create sample data for the development environment. When the data is retrieved, all customer names and personal identifiers should be either removed or replaced with random data. The company wants to reduce the amount of custom code that is developed to manage the solution in the long term.

Which solution will meet these requirements with the LEAST operational overhead?

❌ A. Export the data to Amazon S3. Use Amazon Athena to create a job that uses regular expressions to search for and replace personal identifiers. Export the clean data to Amazon S3 for use in the development environment.
✅ B. Create an AWS Glue DataBrew project and connect the project to Amazon RDS. Use existing recipes to replace the sensitive data. Export the clean data to Amazon S3 for use in the development environment.
❌ C. Select Amazon S3 as the source of the data. Use Amazon Textract to analyze exported RDS data for personal identifiers, remove the discovered data, and replace the discovered data with random data. Export the clean data to Amazon S3 for use in the development environment.
❌ D. Create an Amazon Macie job to discover sensitive data from RDS exports by using built-in data identifiers. Use the Macie job to mask the discovered data. Export the clean data to Amazon S3 for use in the development environment.

Question 902

A company has two applications. The applications are each deployed on an Amazon EC2 instance. Each EC2 instances is in its own VPC. Both VPCs are placed in the same AWS Region and are peered to one another. The applications share files through an Amazon S3 bucket. Each application connects privately to the S3 bucket by using VPC interface endpoints. The company wants to use only fully managed services. The company wants to change the file sharing to implement the same permission model using an NFSv4 protocol for the file system.

Which solution will meet these requirements?

❌ A. Add an Amazon S3 File Gateway in front of the S3 bucket. Attach the gateway to both EC2 instances.
❌ B. Configure a new Amazon Elastic Block Store (Amazon EBS) volume in one of the two VPCs. Attach the volume to both EC2 instances.
❌ C. Deploy an Amazon FSx for Windows File Server file system. Mount the file system to both EC2 instances.
✅ D. Create an Amazon Elastic File System (Amazon EFS) file system. Mount the file system to both EC2 instances.

Question 903

A reporting application runs on Amazon EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple Availability Zones. For complex reports, the application can take up to 15 minutes to respond to a request. A solutions architect is concerned that users will receive HTTP 5xx errors if a report request is in progress during a scale-in event.

What should the solutions architect do to ensure that user requests will be completed before instances are terminated?

❌ A. Enable sticky sessions (session affinity) for the target group of the instances.
✅ B. Increase the deregistration delay timeout for the target group of the instances to greater than 900 seconds.
❌ C. Increase the cooldown period for the Auto Scaling group to a greater amount of time than the time required for the longest running responses.
❌ D. Increase the instance size in the Application Load Balancer target group.

Question 904

A solutions architect is designing a web application architecture with an Amazon API Gateway endpoint to expose a REST API. The solutions architect uses AWS Lambda to process the service and Amazon DynamoDB for the database. The solutions architect wants to improve the latency of the application because users report slow data load times. The application does not require consistent reads.

Which solution will meet these requirements with the LEAST operational overhead?

❌ A. Deploy an Amazon ElastiCache (Redis OSS) cache in front of DynamoDB.
❌ B. Migrate the data from DynamoDB to Amazon DocumentDB (with MongoDB compatibility).
❌ C. Deploy a standalone Amazon ElastiCache (Memcached) cache.
✅ D. Enable DynamoDB Accelerator (DAX) on the table.

Question 905

A company has an application that runs on a large general purpose Amazon EC2 instance type that is part of an EC2 Auto Scaling group. The company wants to reduce future costs associated with this application. After the company reviews metrics and logs in Amazon CloudWatch, the company notices that this application runs randomly a couple of times a day to retrieve and manage data. According to CloudWatch, the maximum runtime for each request is 10 minutes, the memory use is 4 GB, and the instances are always in the running state.

Which solution will reduce costs the MOST?

❌ A. Deploy the application on a large burstable EC2 instance.
❌ B. Use AWS Instance Scheduler to start and stop the instances based on the runtimes in the logs.
❌ C. Containerize the application by using Amazon Elastic Kubernetes Service (Amazon EKS). Host the container on EC2 instances.
✅ D. Refactor the application code to run as an AWS Lambda function.

Question 906

A company hosts several Windows file servers that run various production applications on Amazon EC2. The company also uses Amazon WorkSpaces. A solutions architect must create a storage strategy. The storage strategy should redundantly store personal files and shared directories for users and file servers that store data on AWS. The solutions architect wants to integrate the solution with the company's existing Active Directory.

Which solution will meet these requirements?

✅ A. Create multiple network file shares by using Amazon FSx for Windows File Server. Manage the shares by using the existing Active Directory users and groups. Mount the shares by using built-in utilities.
❌ B. Deploy an Amazon S3 File Gateway. Manage permissions to each file share by using the existing Active Directory.
❌ C. Deploy additional Amazon Elastic Block Store (Amazon EBS) volumes to each of the EC2 servers. Enable Windows Distributed File System (DFS). Create file shares with DFS and share the file shares to WorkSpaces by using the existing Active Directory permissions.
❌ D. Create a network mount with multiple access points by using Amazon Elastic File System (Amazon EFS). Enforce permissions by using AWS IAM Identity Center policies and roles that are federated with the existing Active Directory. Mount the shares by using Microsoft Services for NFS.

Question 907

A solutions architect must interconnect 10 Amazon VPCs through a centralized and scalable solution. Five of the VPCs must have full connectivity to all 10 of the VPCs. Five of the VPCs must connect to only a subset of the VPCs. Additionally, all VPCs must perform deep packet inspection of the network traffic to and from the internet and between the VPCs.

Which solution will meet these requirements with the LEAST operational overhead?

❌ A. Use AWS Transit Gateway to interconnect the VPCs. Use AWS WAF for deep packet inspection of the network traffic.
❌ B. Use VPC peering to interconnect the VPCs. Use AWS WAF for deep packet inspection of the network traffic.
✅ C. Use AWS Transit Gateway to interconnect the VPCs. Use AWS Network Firewall for deep packet inspection of the network traffic.
❌ D. Use VPC peering to interconnect the VPCs. Use AWS Network Firewall for deep packet inspection of the network traffic.

Question 908

A company is developing a video processing application. The application receives video upload requests, processes the videos, and stores the final videos. Each video requires up to 30 minutes to be processed. The application must be able to handle varying loads throughout the day.

A solutions architect needs to design a scalable architecture that can automatically adjust to fluctuating demand. The company wants to use containerized applications. The company wants to avoid managing the underlying infrastructure.

Which solution will meet these requirements?

❌ A. Deploy an AWS Lambda function from a container image to process the videos. Use Amazon Simple Queue Service (Amazon SQS) as a queue for incoming requests. Enable provisioned concurrency.
✅ B. Implement Amazon ECS on AWS Fargate to run the containerized application. Use Amazon Simple Queue Service (Amazon SQS) as a queue for incoming requests. Configure auto scaling based on queue metrics.
❌ C. Implement Amazon ECS on Amazon EC2 instances to run the containerized application. Use Amazon Simple Queue Service (Amazon SQS) as a queue for incoming requests. Configure auto scaling based on queue metrics.
❌ D. Deploy the containerized application on Amazon Elastic Kubernetes Service (Amazon EKS) managed node groups. Use Amazon Simple Notification Service (Amazon SNS) to distribute incoming requests to the containers.

Question 909

An application requires an active-active multi-region database setup to provide near-zero RPO and RTO for a global user base. Which service should be utilized?

❌ A. Amazon RDS Multi AZ
✅ B. Amazon DynamoDB Global Tables
❌ C. Amazon Redshift with Cross Region Snapshots
❌ D. Amazon Aurora Global Database

Question 910

A legacy application stores its state in the memory of the web server. When scaling horizontally, users report that their shopping carts frequently appear empty. What is the best short-term architectural fix?

❌ A. Replace the Application Load Balancer (ALB) with a Network Load Balancer (NLB)
❌ B. Increase the size of the EC2 instances (Vertical scaling)
✅ C. Enable Sticky Sessions on the Application Load Balancer
❌ D. Migrate the session state to an Amazon RDS Database

Question 911

A developer is configuring an Amazon ECS task to store and retrieve data from a DynamoDB table. Which IAM role should the developer use to grant the application code the necessary permissions to call the DynamoDB API?

❌ A. Service Linked Role
❌ B. Instance Profile Role
✅ C. Task Role
❌ D. Task Execution Role

Question 912

A company is required by law to manage its encryption keys on dedicated, single-tenant hardware that meets FIPS 140-2 Level 3 standards. Which AWS service should be used?

✅ A. AWS CloudHSM
❌ B. AWS Secrets Manager
❌ C. AWS KMS With Customer Managed Keys
❌ D. AWS Shield Advanced

Question 913

A solutions architect needs to ensure that an Amazon S3 bucket used for a static website origin can only be accessed through Amazon CloudFront. Which feature should be implemented on the CloudFront distribution?

✅ A. Origin Access Control (OAC)
❌ B. VPC Gateway Endpoint
❌ C. Route53 Alias Records
❌ D. S3 Block Public Access

Question 914

When configuring a Network ACL (NACL), how are the rules evaluated when a packet arrives at the subnet boundary?

❌ A. Only inbound rules are evaluated; outbound rules are checked for return traffic.
❌ B. All rules are evaluated simultaneously, and Deny takes precedence.
✅ C. Rules are evaluated in numeric order, and the first match determines the outcome.
❌ D. Rules are evaluated based on the protocol type, with TCP rules checked before UDP.

Question 915

A company wants to provide its employees with single sign-on (SSO) access to multiple AWS accounts using their existing corporate Active Directory credentials. What is the most appropriate AWS service for this use case?

✅ A. IAM Identity Center
❌ B. Amazon Cognito User Pool
❌ C. AWS Directory Service for Microsoft Active Directory
❌ D. IAM Roles for Federation

Question 916

An enterprise wants to allow its on-premises DNS servers to resolve domain names for resources located in a Private Hosted Zone on Route 53. Which component is required to facilitate this inbound DNS traffic?

❌ A. VPC Peering
❌ B. Transit Gateway
✅ C. Route 53 Inbound Endpoint
❌ D. Route 53 Outbound Endpoint

Question 917

A SaaS provider needs to share a private service with hundreds of customer VPCs in different accounts. The provider wants to ensure that the traffic remains on the AWS backbone and avoids the complexities of VPC peering. Which solution is best?

❌ A. VPC Peering
❌ B. Transit Gateway
❌ C. AWS Client VPN
✅ D. AWS PrivateLink (VPC Endpoint Service)

Question 918

Which element is mandatory in a resource-based policy but absent in an identity-based policy?

❌ A. Effect
❌ B. Action
✅ C. Principal
❌ D. Resource