Question 1066

A business analyst needs to clean and normalize a messy CSV dataset stored in Amazon S3 for use in a machine learning model. The analyst has no coding experience and requires a visual interface to build a reusable 'recipe' of transformations. Which service is the most appropriate for this requirement?

• ❌ A. Amazon Athena Not quite — this is a serverless query service that requires SQL knowledge to analyze data and lacks a point-and-click visual cleaning interface.
• ✅ B. AWS Glue DataBrew Right answer — this service is specifically designed as a code-free, visual data preparation tool for business analysts and data scientists to clean and normalize data.
• ❌ C. AWS Glue Studio While it provides a visual interface for ETL, it is primarily aimed at data engineers and generates Python or Scala code behind the scenes.
• ❌ D. Amazon SageMaker Notebooks Notebooks require data scientists to write Python or R code for data transformation, which does not meet the code-free requirement.

Question 1067

A media company wants to prevent users from accessing their private S3-hosted images directly via S3 URLs, requiring all traffic to pass through an Amazon CloudFront distribution. Which security configuration is required?

• ✅ A. Configure Origin Access Control (OAC) and update the S3 bucket policy That's right! — OAC allows CloudFront to authenticate with S3, and the bucket policy restricts access so only the distribution can fetch the objects.
• ❌ B. Reference the CloudFront Security Group in the S3 bucket's Security Group rules S3 is a regional service and does not use Security Groups, which are VPC-level constructs tied to Elastic Network Interfaces.
• ❌ C. Use Route 53 Alias records pointing to the S3 bucket Alias records manage DNS routing but do not provide access control or enforce that traffic must come from a specific CDN distribution.
• ❌ D. Enable S3 Block Public Access on the bucket While it prevents public access, it doesn't selectively allow CloudFront traffic unless paired with a specific access identity like OAC.

Question 1068

An application requires 40,000 random IOPS for processing temporary scratch data that is discarded after each session. Which storage option is the most cost-effective?

• ❌ A. Amazon Elastic File System (EFS) EFS is a shared file system not optimized for single-instance, high-random-IOPS scratch workloads and would be far more expensive.
• ❌ B. Provisioned IOPS SSD (io2) EBS volumes While io2 can meet the IOPS requirement, it incurs a significant premium cost for network-attached durability that this workload does not require.
• ✅ C. EC2 Instance Store Right answer — instance store offers high IOPS at no extra charge beyond the instance's hourly rate, making it ideal for temporary data that does not need to persist.
• ❌ D. General Purpose SSD (gp3) EBS volumes Not quite — to reach 40,000 IOPS on gp3, you would have to pay for additional provisioned throughput, which is less cost-effective than using included local storage.

Question 1069

To protect a backend database from being overwhelmed during traffic spikes, an architect needs to limit the maximum number of concurrent executions for a specific AWS Lambda function. Which feature should be used?

• ❌ A. Provisioned Concurrency Provisioned Concurrency is used to keep functions warm to eliminate cold starts, not to cap maximum throughput.
• ❌ B. API Gateway Throttling While it can protect the API, it does not directly control the concurrency limit of the Lambda function itself across all potential event sources.
• ❌ C. SQS Visibility Timeout Not quite — this controls how long a message is hidden from other consumers but does not limit the total number of Lambda instances running simultaneously.
• ✅ D. Reserved Concurrency Right answer — Reserved Concurrency sets a guaranteed maximum limit of concurrent executions for a function, effectively throttling it to protect downstream resources.

Question 1070

A company needs to expose an internal service to other VPCs in different AWS accounts. The solution must ensure traffic does not traverse the public internet and must provide a fixed IP address for allowlisting. Which load balancer is required?

• ❌ A. Application Load Balancer ALBs do not support static IP addresses and cannot be used as the target for a VPC Endpoint Service (PrivateLink).
• ❌ B. Gateway Load Balancer GLBs are intended for transparently inserting security appliances into a traffic path, not for exposing services via PrivateLink.
• ❌ C. Classic Load Balancer CLB is a legacy service that does not support modern features like PrivateLink or static IP addresses.
• ✅ D. Network Load Balancer That's right! — an NLB is required to use AWS PrivateLink for cross-account connectivity and is the only ELB type that provides a static IP address per AZ.

Question 1071

A web application's static content is hosted in S3. The company wants to improve global performance and ensure that users can only access the content via a specific domain. They also need to accelerate dynamic API calls. Which service combination is best?

• ✅ A. Amazon CloudFront and Route 53 Right answer — CloudFront caches static content and accelerates dynamic traffic, while Route 53 manages the custom domain name for global routing.
• ❌ B. Amazon S3 and AWS Direct Connect Direct Connect provides a private link from on-premises to AWS but does not improve the performance for general internet users globally.
• ❌ C. AWS Global Accelerator and S3 Transfer Acceleration Not quite — Global Accelerator improves connectivity but does not provide content caching, which is critical for static website performance.
• ❌ D. Elastic Load Balancing and Amazon ElastiCache While these improve performance for VPC-based applications, they do not provide a global edge network for static content delivery.

Question 1072

A company wants to automate the deployment of their infrastructure across 50 different AWS accounts to ensure consistency. The solution must automatically deploy a standard security baseline to any new account added to the organization. Which tool should they use?

• ❌ A. AWS Control Tower While Control Tower sets up the environment, StackSets is the underlying mechanism for rolling out specific infrastructure resources consistently.
• ✅ B. AWS CloudFormation StackSets Right answer — StackSets allow you to deploy CloudFormation stacks across multiple accounts and Regions, with automatic deployment to new accounts in an Organization.
• ❌ C. AWS Systems Manager Systems Manager is an operational hub for managing existing resources but is not the primary tool for multi-account infrastructure-as-code deployment.
• ❌ D. AWS Service Catalog Not quite — Service Catalog provides a self-service portal for users to launch approved resources but does not automatically push a baseline to all accounts.

Question 1073

A high-performance gaming application requires a load balancer that can handle millions of requests per second with ultra-low latency and supports static IP addresses for client allowlisting. Which load balancer should be used?

• ✅ A. Network Load Balancer Right answer — NLB operates at Layer 4 and is designed for extreme performance, low latency, and provides a static IP address per Availability Zone.
• ❌ B. Application Load Balancer ALB operates at Layer 7 and focuses on content-based routing; it does not support static IP addresses and has higher latency than NLB.
• ❌ C. Gateway Load Balancer Not quite — GLB is used to insert third-party virtual appliances into a traffic path, not for balancing high-throughput application traffic.
• ❌ D. Classic Load Balancer CLB is a legacy product that lacks the performance capabilities and static IP support of the newer Network Load Balancer.

Question 1074

A data engineering team needs to perform complex transformations on a live stream of data before it is stored in a data lake. Which architecture pattern utilizes AWS Glue effectively for this requirement?

• ❌ A. AWS Glue Studio generating Python code for scheduled batch processing of S3 logs. Not quite — this is a batch pattern that runs on a schedule against data already at rest in S3, not on a live stream.
• ❌ B. AWS Glue DataBrew integrated with Amazon Kinesis Data Firehose. DataBrew is a visual, batch-oriented data preparation tool and does not integrate directly with Firehose for real-time transformation.
• ✅ C. AWS Glue Streaming ETL jobs consuming from Amazon Kinesis Data Streams. Right answer — Glue Streaming ETL jobs are purpose-built to continuously consume and apply complex transformations to data from Kinesis Data Streams before it lands in the data lake.
• ❌ D. Amazon Data Firehose using the AWS Glue Data Catalog for format conversion. Firehose with the Glue Data Catalog handles simple format conversion (e.g., to Parquet) during delivery, not complex custom transformations.

Question 1075

A multi-tier application uses an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. To follow the principle of least privilege, how should the EC2 security group be configured for inbound traffic?

• ✅ A. Allow inbound traffic with the source set to the security group ID of the ALB. That's right! — referencing the ALB's security group ensures only traffic routed through the load balancer is permitted, regardless of the instances' dynamic IPs.
• ❌ B. Allow inbound traffic from the CIDR block of the public subnets where the ALB resides. This is too broad as it allows any resource in those subnets to bypass the ALB and communicate directly with the instances.
• ❌ C. Allow inbound traffic from 0.0.0.0/0 on the application port. This exposes the instances directly to the internet, violating the principle of least privilege and bypassing the ALB's security benefits.
• ❌ D. Allow inbound traffic from the IP address of the Internet Gateway (IGW). An IGW is a routing target and does not have a source IP address that can be used in security group rules.

Question 1076

To handle a sudden spike in traffic for a web application, which Amazon EC2 Auto Scaling policy is best suited to maintain a specific average CPU utilization of 50%?

• ❌ A. Step Scaling. Step scaling adjusts capacity based on the size of an alarm breach but does not automatically manage the math required to hit a specific target value.
• ❌ B. Scheduled Scaling. Scheduled scaling is based on time rather than live metrics, making it unsuitable for unpredictable traffic spikes.
• ❌ C. Simple Scaling. Simple scaling is legacy and requires manual management of alarms and cooldowns, which is less efficient for maintaining a target metric.
• ✅ D. Target Tracking Scaling. That's right! — target tracking allows you to define a metric value, and Auto Scaling automatically adjusts the fleet to maintain that target.

Question 1077

A solutions architect needs to decouple a monolith into microservices. When an order is placed, it must be processed independently by the inventory, billing, and shipping services. Which architecture pattern ensures no messages are lost if a service is temporarily down?

• ❌ A. A single Amazon SQS FIFO queue with Message Group IDs. A single queue cannot be consumed by multiple independent services without them competing for the same messages, which breaks the requirements.
• ❌ B. Amazon SNS with multiple HTTP endpoints. SNS is push-based; if an HTTP endpoint is down during the push, the message can be lost without a durable buffer like SQS.
• ❌ C. AWS Step Functions coordinating Lambda tasks. Step Functions is for workflow orchestration; while it can manage retries, it does not provide the same asynchronous decoupling as pub/sub messaging.
• ✅ D. Amazon SNS topic with multiple Amazon SQS queues as subscribers. That's right! — this 'Fan-out' pattern allows one event to be broadcast to multiple durable queues, where each service can poll at its own pace.

Question 1078

To reduce costs for a steady-state workload that runs 24/7 on EC2, but where the specific instance family may change as the application evolves, which purchasing option offers the best balance of discount and flexibility?

• ❌ A. On-Demand Instances. On-demand is the most expensive option and provides no discount for the steady-state nature of the workload.
• ❌ B. Standard Reserved Instances. Standard RIs offer high discounts but lock the user into a specific instance family for the duration of the term.
• ❌ C. Spot Instances. Not quite — Spot instances offer the highest discount but can be reclaimed by AWS, making them unsuitable for steady-state production workloads.
• ✅ D. Compute Savings Plans. Right answer — Savings Plans provide significant discounts for a commit to a dollar-per-hour spend and automatically apply regardless of instance family or region.

Question 1079

An enterprise wants to ensure that all newly created S3 buckets are private and have encryption enabled. They need a service that can automatically detect and alert on non-compliant buckets. Which service is appropriate?

• ❌ A. AWS Trusted Advisor. Trusted Advisor provides best practice recommendations but does not offer the same continuous, rule-based configuration auditing as Config.
• ❌ B. AWS CloudTrail. CloudTrail records API activity for auditing but does not evaluate resource configurations against desired policies.
• ✅ C. AWS Config. Right answer — AWS Config continuously monitors and evaluates resource configurations against rules you define, such as 's3-bucket-server-side-encryption-enabled'.
• ❌ D. Amazon GuardDuty. Not quite — GuardDuty is a threat detection service for malicious activity, not a configuration compliance tool.

Question 1080

To provide high-bandwidth, consistent network performance between an on-premises data center and AWS, while also ensuring the highest possible resiliency, which architecture is recommended?

• ✅ A. Direct Connect connections at multiple Direct Connect locations. Right answer — establishing connections at different physical locations provides redundancy against both hardware failure and location-wide outages.
• ❌ B. A single AWS Direct Connect connection with a backup Site-to-Site VPN. Not quite — while cost-effective, a single Direct Connect link is a single point of failure and does not provide the 'highest' resiliency.
• ❌ C. An AWS Transit Gateway connecting multiple VPCs to a single Customer Gateway. The Transit Gateway simplifies networking but the single Customer Gateway remains a physical single point of failure.
• ❌ D. Two Direct Connect connections at the same Direct Connect location. This setup is vulnerable to location-wide outages; high resiliency requires geographic diversity.

Question 1081

A company needs to expose a service to thousands of customer VPCs in different AWS accounts without using VPC Peering or exposing the traffic to the internet. Which service should be used?

• ❌ A. AWS Client VPN. Client VPN is for remote user access to a VPC, not for service-to-service connectivity across accounts.
• ❌ B. AWS Transit Gateway. Not quite — Transit Gateway is for interconnecting your own VPCs and networks; it is not the primary tool for exposing a specific service to external accounts privately.
• ❌ C. Direct Connect Gateway. This is used for hybrid connectivity between on-premises and AWS, not for inter-VPC service sharing.
• ✅ D. AWS PrivateLink. Right answer — PrivateLink allows you to create a VPC Endpoint Service that others can connect to via Interface VPC Endpoints, keeping traffic on the AWS backbone.

Question 1082

A data scientist needs to build a custom machine learning model using their own historical business data. Which AWS service provides the end-to-end platform for this task?

• ✅ A. Amazon SageMaker AI. That's right! — SageMaker is the comprehensive platform designed for building, training, and deploying custom machine learning models at scale.
• ❌ B. Amazon Comprehend. Comprehend is a pre-trained NLP service for text analysis and is not a general platform for custom model training.
• ❌ C. Amazon Rekognition. Rekognition is a pre-trained AI service for computer vision; it does not allow for building custom models from arbitrary historical data.
• ❌ D. AWS Glue DataBrew. DataBrew is for cleaning data before ML training, but it is not the platform used to perform the actual model training and deployment.

Question 1083

Which Amazon S3 feature should be used to allow a mobile application to upload a user's profile picture directly to a private bucket for a limited time, without using AWS credentials on the device?

• ❌ A. Cross-Region Replication (CRR). CRR is for duplicating data across regions for resilience, not for managing user-level access permissions.
• ✅ B. Presigned URLs. Right answer — presigned URLs grant temporary permission to perform specific actions (like PUT or GET) on an object using the permissions of the URL creator.
• ❌ C. Origin Access Control (OAC). Not quite — OAC is used to restrict access to an S3 origin so it can only be reached through CloudFront, not for direct user uploads.
• ❌ D. S3 Bucket Policies. Bucket policies provide access to principals but do not provide a time-limited mechanism for anonymous or federated users to upload directly.

Question 1084

To monitor an EC2 instance for suspicious activity like communicating with a known cryptocurrency mining pool, which service provides automated threat detection?

• ❌ A. AWS Shield. Not quite — Shield is a preventative service for DDoS protection, not a detective tool for compromised workload behavior.
• ❌ B. AWS Config. AWS Config tracks configuration changes for compliance but does not monitor network traffic or API patterns for security threats.
• ✅ C. Amazon GuardDuty. Right answer — GuardDuty is a detective threat detection service that analyzes logs to find unauthorized behavior such as crypto-mining or compromised keys.
• ❌ D. Amazon Inspector. Inspector scans for software vulnerabilities and network exposure but does not perform real-time threat detection for malicious activity like Bitcoin mining.

Question 1085

An enterprise requires a shared file system for a Windows-based application that integrates with their on-premises Active Directory. Which FSx flavor should be used?

• ✅ A. Amazon FSx for Windows File Server. That's right! — this service is built on Windows Server and provides native support for SMB, NTFS, and Active Directory integration.
• ❌ B. Amazon FSx for NetApp ONTAP. While it supports SMB, FSx for Windows is the native choice for Windows-only workloads needing full NTFS and AD integration features.
• ❌ C. Amazon FSx for OpenZFS. OpenZFS uses the NFS protocol and is targeted at Linux workloads rather than Windows applications.
• ❌ D. Amazon FSx for Lustre. Lustre is designed for high-performance computing on Linux and does not natively support Active Directory or the SMB protocol.

Question 1086

To provide high-speed NFS storage for an HPC workload on AWS that needs to process data from an Amazon S3 bucket, which FSx flavor is most appropriate?

• ❌ A. Amazon FSx for OpenZFS. Not quite — OpenZFS is a high-performance NFS server but does not have the native, seamless integration with S3 for massive parallel processing like Lustre.
• ❌ B. Amazon FSx for NetApp ONTAP. While multi-protocol, it is generally positioned for enterprise migrations rather than extreme HPC performance with S3 linking.
• ✅ C. Amazon FSx for Lustre. Right answer — Lustre is built for high-performance computing and can be linked directly to an S3 bucket to process objects as files.
• ❌ D. Amazon FSx for Windows File Server. Windows File Server uses the SMB protocol and is not suitable for HPC workloads that typically require NFS or Lustre.

Question 1087

An application is returning 'stale data' after an update. The developer wants to ensure that a read from DynamoDB always reflects the result of the most recent write. Which consistency model should they use?

• ❌ A. DynamoDB Accelerator (DAX). Not quite — DAX is a cache that can actually increase the chance of reading stale data if not managed correctly, as it focuses on performance over consistency.
• ❌ B. Global Tables. Global tables provide multi-region replication but use an eventual consistency model for cross-region synchronization.
• ❌ C. Eventually Consistent Reads. This is the default and cheapest model, but it may return stale data for a brief window after a write.
• ✅ D. Strongly Consistent Reads. Right answer — strongly consistent reads guarantee that the data returned reflects all successful writes that occurred prior to the read.

Question 1088

A company wants to receive an alert if their month-to-date EC2 costs are forecasted to exceed a certain budget. Which cost management tool is appropriate?

• ❌ A. Savings Plans. Savings Plans are a pricing model for discounts, not a tool for cost monitoring or alerting.
• ❌ B. AWS Cost and Usage Report (CUR). Not quite — the CUR provides granular raw data for analysis but does not function as an alerting tool.
• ✅ C. AWS Budgets. Right answer — AWS Budgets allows you to set custom budgets and receive alerts based on actual or forecasted cost and usage.
• ❌ D. AWS Cost Explorer. Cost Explorer is for visualizing and forecasting trends, but it does not have a native alerting mechanism for budget thresholds.

Question 1089

An application's performance is bottlenecked by the time it takes to resolve DNS names between a VPC and an on-premises data center. The on-premises servers need to resolve names in an AWS Private Hosted Zone. What should be configured?

• ✅ A. Route 53 Inbound Endpoint. Right answer — inbound endpoints allow external resolvers (like on-premises servers) to send queries into Route 53 to resolve internal AWS records.
• ❌ B. Route 53 Outbound Endpoint. Outbound endpoints are used when AWS resources need to resolve names hosted on-premises.
• ❌ C. Direct Connect Gateway. Not quite — this gateway handles the physical routing of traffic but does not manage the logic of DNS query forwarding.
• ❌ D. VPC Peering. VPC peering facilitates IP traffic routing between VPCs but does not provide a mechanism for DNS resolution from on-premises.

Question 1090

A legacy application requires a physical server dedicated to it for regulatory reasons and the ability to use existing per-core licenses. Which EC2 purchasing option is correct?

• ❌ A. Reserved Instances. Reserved instances are a billing commitment and do not guarantee physical isolation on a dedicated server.
• ❌ B. Savings Plans. Savings plans apply discounts to compute usage but do not provide dedicated physical hardware or socket visibility.
• ❌ C. Dedicated Instances. Not quite — dedicated instances run on hardware dedicated to the account but do not provide the socket/core visibility needed for per-core licensing.
• ✅ D. Dedicated Hosts. Right answer — dedicated hosts provide a physical server and visibility into underlying cores, supporting BYOL (Bring Your Own License) requirements.

Question 1091

Which AWS cost management tool provides the most granular, hourly line-item data that can be ingested into a data warehouse for chargeback reporting?

• ❌ A. AWS Budgets. Budgets are for tracking thresholds and alerting, not for providing detailed analytical data exports.
• ❌ B. Cost Allocation Tags. Tags are metadata used to label resources, but they must be viewed within the CUR or Cost Explorer to perform analysis.
• ❌ C. AWS Cost Explorer. Cost Explorer provides high-level visualizations and forecasts but lacks the extreme line-item granularity of the CUR.
• ✅ D. AWS Cost and Usage Report (CUR). That's right! — the CUR is the most detailed data set available, providing hourly granularity and metadata across the entire organization.

Question 1092

A developer needs to ensure that specific product abbreviations are pronounced correctly by a text-to-speech application. Which feature of Amazon Polly should be utilized?

• ❌ A. Speech Synthesis Markup Language (SSML). SSML can adjust pronunciation inline, but Lexicons are the correct way to apply global, consistent pronunciation rules for domain terms.
• ❌ B. Neural Text-to-Speech (NTTS) voices. Not quite — NTTS provides more human-like voices but does not inherently solve the problem of custom abbreviations without a lexicon.
• ✅ C. Custom Lexicons. Right answer — Lexicons allow you to define custom pronunciations for acronyms, abbreviations, or specialized terminology across the whole application.
• ❌ D. StartSpeechSynthesisTask. This is an asynchronous API operation used for converting long-form text, not a feature for controlling pronunciation.

Question 1093

An application requires an RPO of near-zero and an RTO of near-zero. Which disaster recovery strategy meets this requirement while acknowledging that cost is not a primary constraint?

• ❌ A. Warm Standby. Warm standby has a low RTO (minutes) but not 'near-zero' because some scaling or DNS-switching time is involved.
• ❌ B. Pilot Light. Pilot light has much higher RTO and RPO because compute must be provisioned and databases must be promoted.
• ✅ C. Multi-Site Active/Active. That's right! — by serving traffic from two regions simultaneously with continuous replication, this strategy achieves near-zero downtime and data loss.
• ❌ D. Backup and Restore with cross-region replication. This strategy is the slowest and has the highest data loss potential among the standard DR tiers.