Hermes Wiki

Question 460

A company has two accounts for perform testing and each account has a single VPC: VPC-TEST1 and VPC-TEST2. The operations team require a method of securely copying files between Amazon EC2 instances in these VPCs. The connectivity should not have any single points of failure or bandwidth constraints.

Which solution should a Solutions Architect recommend?

❌ A. Attach a Direct Connect gateway to VPC-TEST1 and VPC-TEST2 and enable routing.
✅ B. Create a VPC peering connection between VPC-TEST1 and VPC-TEST2.
❌ C. Attach a virtual private gateway to VPC-TEST1 and VPC-TEST2 and enable routing.
❌ D. Create a VPC gateway endpoint for each EC2 instance and update route tables.

Question 461

Amazon EC2 instances in an Auto Scaling group. The application stores temporary training data on attached Amazon Elastic Block Store (Amazon EBS) volumes. The company seeks recommendations to optimize costs for the EC2 instances, the Auto Scaling group, and the EBS volumes with minimal manual intervention.

Which solution will meet these requirements with the MOST operational efficiency?

❌ A. Use AWS Cost and Usage Reports to export data to Amazon Athena. Query the data to identify inefficiencies in the EC2 instances, the Auto Scaling group, and the EBS volumes.
❌ B. Use AWS Compute Optimizer for recommendations on EC2 instances and Auto Scaling groups. Use Amazon Data Lifecycle Manager to evaluate cost optimizations for the EBS volumes.
✅ C. Configure AWS Compute Optimizer to provide cost optimization recommendations for the EC2 instances, the Auto Scaling group, and the EBS volumes.
❌ D. Set up Amazon CloudWatch billing alerts and manually analyze metrics to identify cost-saving opportunities for the EC2 instances, the Auto Scaling group, and the EBS volumes.

Question 462

A persistent database must be migrated from an on-premises server to an Amazon EC2 instances. The database requires 64,000 IOPS and, if possible, should be stored on a single Amazon EBS volume.

Which solution should a Solutions Architect recommend?

✅ A. Create a Nitro-based Amazon EC2 instance with an Amazon EBS Provisioned IOPS SSD (i01) volume attached. Provision 64,000 IOPS for the volume.
❌ B. Create an Amazon EC2 instance with four Amazon EBS General Purpose SSD (gp2) volumes attached. Max out the IOPS on each volume and use a RAID 0 stripe set.
❌ C. Use an instance from the I3 I/O optimized family and leverage instance store storage to achieve the IOPS requirement.
❌ D. Create an Amazon EC2 instance with two Amazon EBS Provisioned IOPS SSD (i01) volumes attached. Provision 32,000 IOPS per volume and create a logical volume using the OS that aggregates the capacity.

Question 463

A company runs containerized applications for many application workloads in an on-premise data center. The company is planning to deploy containers to AWS and the chief architect has mandated that the same configuration and administrative tools must be used across all containerized environments. The company also wishes to remain cloud agnostic to safeguard against the impact of future changes in cloud strategy.

How can a Solutions Architect design a managed solution that will align with open-source software?

❌ A. Launch the containers on Amazon Elastic Container Service (ECS) with Amazon EC2 instance worker nodes.
❌ B. Launch the containers on a fleet of Amazon EC2 instances in a cluster placement group.
✅ C. Launch the containers on Amazon Elastic Kubernetes Service (EKS) and EKS worker nodes.
❌ D. Launch the containers on Amazon Elastic Container Service (ECS) with AWS Fargate instances.

Question 464

A company operates a multi-tier application with its backend services deployed on Amazon EC2 instances in a VPC. The backend services must communicate securely with APIs of a third-party SaaS provider that is also hosted on AWS. The company wants to ensure that this communication occurs privately and minimizes exposure to the public internet.

Which solution will meet these requirements?

❌ A. Set up an AWS Direct Connect connection between the VPC and the third-party SaaS provider to establish private communication.
✅ B. Configure AWS PrivateLink to create a private connection between the VPC and the third-party SaaS provider's APIs.
❌ C. Use an AWS VPN connection to establish a secure tunnel between the VPC and the third-party SaaS provider's infrastructure.
❌ D. Deploy a NAT gateway in the VPC to enable secure outbound communication with the third-party SaaS provider.

Question 465

A fintech company is modernizing its payments processing system to adopt a serverless microservices architecture. The company wants to decouple its services and implement an event-driven architecture to support a publish/subscribe (pub/sub) model. The system needs to notify multiple downstream services when payment events occur, ensuring scalability and low operational overhead.

Which solution will meet these requirements MOST cost-effectively?

❌ A. Use Amazon MQ as a message broker to enable publish/subscribe communication between the payment microservices and the downstream services.
❌ B. Use Amazon Kinesis Data Firehose to deliver payment events to multiple S3 buckets. Configure downstream services to poll the buckets for event processing.
✅ C. Configure an Amazon SNS topic to receive payment events from an AWS Lambda function. Set up multiple subscribers, such as Lambda functions, to process the events.
❌ D. Configure an Amazon EventBridge rule to capture payment events and route them to multiple AWS Lambda functions that handle downstream processing.

Question 466

A company uses an Amazon RDS for MySQL instance for its operational database. To handle the increased read-only traffic during a recent peak period, the company added a read replica. During the peak period, the CPU usage on the read replica reached 60%, and the primary instance also had 60% CPU usage. After the peak period ended, the read replica's CPU usage decreased to 25%, while the primary instance consistently remains at 60%. The company wants to optimize costs while ensuring enough capacity for future growth.

Which solution will meet these requirements?

✅ A. Resize the read replica to a smaller instance size and keep the primary instance unchanged.
❌ B. Delete the read replica and keep the primary instance unchanged.
❌ C. Upgrade the read replica to a larger instance size and downgrade the primary instance to a smaller instance size.
❌ D. Delete the read replica and upgrade the primary instance to a larger instance size.

Question 467

A Solutions Architect has deployed an application on several Amazon EC2 instances across three private subnets. The application must be made accessible to internet-based clients with the least amount of administrative effort.

How can the Solutions Architect make the application available on the internet?

✅ A. Create an Application Load Balancer and associate three public subnets from the same Availability Zones as the private instances. Add the private instances to the ALB.
❌ B. Create an Application Load Balancer and associate three private subnets from the same Availability Zones as the private instances. Add the private instances to the ALB.
❌ C. Create an Amazon Machine Image (AMI) of the instances in the private subnet and launch new instances from the AMI in public subnets. Create an Application Load Balancer and add the public instances to the ALB.
❌ D. Create a NAT gateway in a public subnet. Add a route to the NAT gateway to the route tables of the three private subnets.

Question 468

A web application allows users to upload photos and add graphical elements to them. The application offers two tiers of service: free and paid. Photos uploaded by paid users should be processed before those submitted using the free tier. The photos are uploaded to an Amazon S3 bucket which uses an event notification to send the job information to Amazon SQS.

How should a Solutions Architect configure the Amazon SQS deployment to meet these requirements?

❌ A. Use one SQS standard queue. Use batching for the paid photos and short polling for the free photos.
❌ B. Use one SQS FIFO queue. Assign a higher priority to the paid photos so they are processed first.
✅ C. Use a separate SQS Standard queue for each tier. Configure Amazon EC2 instances to prioritize polling for the paid queue over the free queue.
❌ D. Use a separate SQS FIFO queue for each tier. Set the free queue to use short polling and the paid queue to use long polling.

Question 469

An insurance company has a web application that serves users in the United Kingdom and Australia. The application includes a database tier using a MySQL database hosted in eu-west-2. The web tier runs from eu-west-2 and ap-southeast-2. Amazon Route 53 geoproximity routing is used to direct users to the closest web tier. It has been noted that Australian users receive slow response times to queries.

Which changes should be made to the database tier to improve performance?

❌ A. Migrate the database to Amazon RDS for MySQL. Configure Multi-AZ in the Australian Region
❌ B. Deploy MySQL instances in each Region. Deploy an Application Load Balancer in front of MySQL to reduce the load on the primary instance
✅ C. Migrate the database to an Amazon Aurora global database in MySQL compatibility mode. Configure read replicas in ap-southeast-2
❌ D. Migrate the database to Amazon DynamoDB. Use DynamoDB global tables to enable replication to additional Regions

Question 470

The database tier of a web application is running on a Windows server on-premises. The database is a Microsoft SQL Server database. The application owner would like to migrate the database to an Amazon RDS instance.

How can the migration be executed with minimal administrative effort and downtime?

❌ A. Use the AWS Database Migration Service (DMS) to directly migrate the database to RDS. Use the Schema Conversion Tool (SCT) to enable conversion from Microsoft SQL Server to Amazon RDS
✅ B. Use the AWS Database Migration Service (DMS) to directly migrate the database to RDS
❌ C. Use the AWS Server Migration Service (SMS) to migrate the server to Amazon EC2.Use AWS Database Migration Service (DMS) to migrate the database to RDS
❌ D. Use AWS DataSync to migrate the data from the database to Amazon S3. Use AWS Database Migration Service (DMS) to migrate the database to RDS

Question 471

A company runs an application that uses an Amazon RDS PostgreSQL database. The database is currently not encrypted. A Solutions Architect has been instructed that due to new compliance requirements all existing and new data in the database must be encrypted. The database experiences high volumes of changes and no data can be lost.

How can the Solutions Architect enable encryption for the database without incurring any data loss?

❌ A. Create a snapshot of the existing RDS DB instance. Create an encrypted copy of the snapshot. Create a new RDS DB instance from the encrypted snapshot. Configure the application to use the new DB endpoint.
❌ B. Update the RDS DB to Multi-AZ mode and enable encryption for the standby replica. Perform a failover to the standby instance and then delete the unencrypted RDS DB instance.
✅ C. Create a snapshot of the existing RDS DB instance. Create an encrypted copy of the snapshot. Create a new RDS DB instance from the encrypted snapshot and update the application. Use AWS DMS to synchronize data between the source and destination RDS DBs.
❌ D. Create an RDS read replica and specify an encryption key. Promote the encrypted read replica to primary. Update the application to point to the new RDS DB endpoint.

Question 472

A financial services company has a web application with an application tier running in the U.S and Europe. The database tier consists of a MySQL database running on Amazon EC2 in us-west-1. Users are directed to the closest application tier using Route 53 latency-based routing. The users in Europe have reported poor performance when running queries.

Which changes should a Solutions Architect make to the database tier to improve performance?

❌ A. Migrate the database to Amazon RedShift. Use AWS DMS to synchronize data. Configure applications to use the RedShift data warehouse for queries.
❌ B. Migrate the database to Amazon RDS for MySQL. Configure Multi-AZ in one of the European Regions.
❌ C. Create an Amazon RDS Read Replica in one of the European regions. Configure the application tier in Europe to use the read replica for queries.
✅ D. Migrate the database to an Amazon Aurora global database in MySQL compatibility mode. Configure the application tier in Europe to use the local reader endpoint.

Question 473

A genomics research organization is building an application to analyze large datasets. Raw genomic data is stored in an Amazon S3 bucket, processed by multiple Amazon EC2 instances, and the results are stored in a separate S3 bucket. The application frequently transfers large amounts of data between the EC2 instances during analysis. The organization wants to reduce overall data transfer costs while maintaining efficient data processing.

What should the solutions architect do to achieve this?

❌ A. Configure an Auto Scaling group to launch the EC2 instances in multiple Regions to distribute the processing workload.
❌ B. Use Amazon S3 Transfer Acceleration to optimize the transfer of data between the EC2 instances and the S3 buckets.
❌ C. Use Amazon Elastic Fabric Adapter (EFA) to enable high-speed data transfer between EC2 instances, reducing transfer costs.
✅ D. Deploy all the EC2 instances in the same Availability Zone to eliminate cross-AZ data transfer charges.

Question 474

A surveying team is using a fleet of drones to collect images of construction sites. The surveying team's laptops lack the inbuilt storage and compute capacity to transfer the images and process the data. While the team has Amazon EC2 instances for processing and Amazon S3 buckets for storage, network connectivity is intermittent and unreliable. The images need to be processed to evaluate the progress of each construction site.

What should a solutions architect recommend?

✅ A. Process and store the images using AWS Snowball Edge devices.
❌ B. Cache the images locally on a hardware appliance pre-installed with AWS Storage Gateway to process the images when connectivity is restored.
❌ C. Configure Amazon Kinesis Data Firehose to create multiple delivery streams aimed separately at the S3 buckets for storage and the EC2 instances for processing the images.
❌ D. During intermittent connectivity to EC2 instances, upload images to Amazon SQS.

Question 475

A company requires that all AWS IAM user accounts have specific complexity requirements and minimum password length.

How should a Solutions Architect accomplish this?

✅ A. Set a password policy for the entire AWS account.
❌ B. Set a password policy for each IAM user in the AWS account.
❌ C. Create an IAM policy that enforces the requirements and apply it to all users.
❌ D. Use an AWS Config rule to enforce the requirements when creating user accounts.

Question 476

A company runs a critical data analysis job every Friday evening. The job processes large datasets and requires at least 2 hours to complete without interruptions. The job is stateful and needs reliable compute resources. The company wants to minimize operational overhead while ensuring the job runs as scheduled.

Which solution will meet these requirements?

❌ A. Configure the job to run in an AWS Lambda function with reserved concurrency. Use Amazon EventBridge to invoke the function on a schedule.
❌ B. Use an Amazon EMR cluster with Spot Instances to process the job. Use Amazon EMR Step Functions to schedule the job execution.
✅ C. Configure the job as a containerized task and run it on AWS Fargate using Amazon ECS. Schedule the task using Amazon EventBridge Scheduler.
❌ D. Deploy the job on a dedicated Amazon EC2 On-Demand instance. Use a cron job to schedule the analysis.

Question 477

A company offers an online product brochure that is delivered from a static website running on Amazon S3. The company’s customers are mainly in the United States, Canada, and Mexico. The company is looking to cost-effectively reduce the latency for users in these regions.

What is the most cost-effective solution to these requirements?

❌ A. Create an Amazon CloudFront distribution that uses origins in U.S, Canada and Mexico.
✅ B. Create an Amazon CloudFront distribution and set the price class to use only U.S, Canada and Mexico.
❌ C. Create an Amazon CloudFront distribution and set the price class to use all Edge Locations for best performance.
❌ D. Create an Amazon CloudFront distribution and use Lambda@Edge to run the website's data processing closer to the users.

Question 478

A research organization wants to set up an Amazon EMR cluster for multiple departments to run their big data analytics jobs. The organization needs to ensure that each department’s workloads can access only the specific AWS services required for their analysis. Additionally, the organization wants to block access to Instance Metadata Service Version 2 (IMDSv2) on the EMR cluster's underlying EC2 instances.

Which solution will meet these requirements?

❌ A. Assign unique EC2 IAM instance profiles to each team’s workloads. Configure the instance profiles with the specific permissions needed for each department.
❌ B. Configure VPC interface endpoints for each AWS service that the departments require. Route traffic from the big data workloads through these VPC endpoints.
❌ C. Create an EMR security configuration that disables access to the Instance Metadata Service. Use this security configuration with application-specific IAM roles to submit the workloads.
✅ D. Use EMR runtime roles to enforce granular permissions for each department's workloads. Configure the EMR cluster to use these roles when submitting jobs.

Question 479

A retail company operates a multi-tier application that includes a web server layer running on Amazon EC2 instances and a database layer hosted on Amazon RDS. The company is preparing for an annual sales event and anticipates a significant surge in traffic to its application. The operations team wants to monitor the performance of the EC2 instances and database, analyzing metrics with a granularity of 1 minute to ensure quick detection of bottlenecks during the event.

What should the solutions architect do to meet this requirement?

❌ A. Configure Amazon CloudWatch Logs Insights to aggregate application logs for both the EC2 instances and Amazon RDS. Use Amazon QuickSight for detailed visualization.
✅ B. Enable detailed monitoring on all EC2 instances and use Amazon CloudWatch metrics for analysis.
❌ C. Use AWS Systems Manager to collect logs from the EC2 instances and Amazon RDS. Store the logs in Amazon S3 and use Amazon Athena to query performance data.
❌ D. Configure an Amazon CloudWatch Events rule to trigger an AWS Lambda function that collects custom metrics from the EC2 instances and Amazon RDS. Use Amazon CloudWatch dashboards to display the metrics.

Question 480

A global logistics company hosts its shipment tracking system in the eu-west-1 Region. The system runs on Amazon EC2 instances, and customers access the shipment tracking API to retrieve real-time updates about their packages. Customers from Asia and South America report slower API response times compared to customers in Europe.

The company wants to improve API response times for international customers in a cost-effective manner.

Which solution will meet these requirements MOST cost-effectively?

❌ A. Establish an AWS Direct Connect connection with a public virtual interface (VIF) from each international customer's data center to the eu-west-1 Region. Route API requests over the Direct Connect connection to the shipment tracking system.
❌ B. Deploy Amazon CloudFront in front of the API. Configure the API response to be cached and use the CachingOptimized managed policy to improve efficiency and reduce latency for frequently requested data.
✅ C. Use AWS Global Accelerator to route traffic through the closest AWS edge location to customers. Configure endpoint groups for the shipment tracking API to distribute traffic globally and reduce response times.
❌ D. Deploy EC2 instances hosting the API in Asia and South America. Use an Application Load Balancer to distribute traffic across all Regions based on the geolocation of customer requests.

Question 481

An Amazon S3 bucket in the us-east-1 Region hosts the static website content of a company. The content is made available through an Amazon CloudFront origin pointing to that bucket. A second copy of the bucket is created in the ap-southeast-1 Region using cross-region replication. The chief solutions architect wants a solution that provides greater availability for the website.

Which combination of actions should a solutions architect take to increase availability? (Select TWO)

✅ A. Using us-east-1 bucket as the primary bucket and ap-southeast-1 bucket as the secondary bucket, create a CloudFront origin group.
❌ B. Set up failover routing in Amazon Route 53.
❌ C. Point Amazon Route 53 to the replica bucket by creating a record.
✅ D. Add an origin for ap-southeast-1 to CloudFront.
❌ E. Create an origin for CloudFront for both buckets.

Question 482

A genetics research firm processes DNA sequencing data for multiple clients. The raw data is stored in relational databases provided by each client. The company must extract the data, apply unique transformation algorithms for each client, and store the processed results in Amazon S3.

Due to the sensitivity of the data, the company must encrypt it both during processing and at rest in Amazon S3. Each client must have their own encryption keys to meet compliance requirements. The company also wants to minimize operational overhead while implementing this solution.

Which solution will meet these requirements with the LEAST operational effort?

❌ A. Deploy an Amazon EMR cluster for each client with a client-specific Hadoop configuration. Use client-side encryption (CSE) to encrypt data with customer-managed root keys during transformations and upload the results to S3.
❌ B. Use AWS Glue to create a single ETL pipeline for all clients. Configure the pipeline to tag each client’s data and use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt data based on client-specific keys before storing it in Amazon S3.
❌ C. Deploy a centralized Amazon EMR cluster to process data for all clients. Encrypt the data in transit using TLS certificates for each client and store the data in Amazon S3 using server-side encryption with Amazon S3 managed keys (SSE-S3).
✅ D. Use AWS Glue to create individual ETL jobs for each client. Attach a security configuration that uses client-specific AWS KMS keys for server-side encryption (SSE-KMS) during processing and storage in S3.

Question 483

A company runs an application in a private subnet within a VPC. The application is integrated with Amazon Cognito using a user pool for user authentication. The company wants to enable users to securely upload and store their documents in an Amazon S3 bucket.

What combination of steps should the company take to securely integrate the application with Amazon S3? (Select TWO)

✅ A. Configure an Amazon Cognito identity pool to provide temporary credentials for Amazon S3 when users authenticate through the user pool.
❌ B. Add a bucket policy to deny requests that do not include valid Amazon Cognito credentials.
✅ C. Enable Amazon S3 VPC endpoints in the VPC to ensure private connectivity between the application and the S3 bucket.
❌ D. Configure the application to generate Amazon S3 access tokens directly from the Cognito user pool.
❌ E. Assign IAM roles directly to the S3 bucket to allow user-level access.

Question 484

A company has deployed a new website on Amazon EC2 instances behind an Application Load Balancer (ALB). Amazon Route 53 is used for the DNS service. The company has asked a Solutions Architect to create a backup website with support contact details that users will be directed to automatically if the primary website is down.

How should the Solutions Architect deploy this solution cost-effectively?

❌ A. Deploy the backup website on EC2 and ALB in another Region and use Route 53 health checks for failover routing.
❌ B. Configure a static website using Amazon S3 and create a Route 53 weighted routing policy.
✅ C. Configure a static website using Amazon S3 and create a Route 53 failover routing policy.
❌ D. Create the backup website on EC2 and ALB in another Region and create an AWS Global Accelerator endpoint.

Question 485

A Microsoft Windows file server farm uses Distributed File System Replication (DFSR) to synchronize data in an on-premises environment. The infrastructure is being migrated to the AWS Cloud.

Which service should the solutions architect use to replace the file server farm?

✅ A. Amazon FSx
❌ B. Amazon EFS
❌ C. AWS Storage Gateway
❌ D. Amazon EBS

Question 486

A video production company is planning to move some of its workloads to the AWS Cloud. The company will require around 5 TB of storage for video processing with the maximum possible I/O performance. They also require over 400 TB of extremely durable storage for storing video files and 800 TB of storage for long-term archival.

Which combinations of services should a Solutions Architect use to meet these requirements?

❌ A. Amazon EC2 instance store for maximum performance, Amazon EFS for durable data storage, and Amazon S3 for archival storage.
❌ B. Amazon EBS for maximum performance, Amazon EFS for durable data storage, and Amazon S3 Glacier for archival storage.
❌ C. Amazon EBS for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage.
✅ D. Amazon EC2 instance store for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage.

Question 487

There are two applications in a company: a sender application that sends messages containing payloads, and a processing application that receives messages containing payloads. The company wants to implement an AWS service to handle messages between these two different applications. The sender application sends on average 1,000 messages each hour and the messages depending on the type sometimes take up to 2 days to be processed. If the messages fail to process, they must be retained so that they do not impact the processing of any remaining messages.

Which solution meets these requirements and is the MOST operationally efficient?

❌ A. Subscribe the processing application to an Amazon Simple Notification Service (Amazon SNS) topic to receive notifications. Write to the SNS topic using the sender application.
❌ B. Receive the messages from the sender application using an Amazon Kinesis data stream. Utilize the Kinesis Client Library (KCL) to integrate the processing application.
❌ C. Set up a Redis database on Amazon EC2. Configure the instance to be used by both applications. The messages should be stored, processed, and deleted, respectively.
✅ D. Provide an Amazon Simple Queue Service (Amazon SQS) queue for the sender and processor applications. Set up a dead-letter queue to collect failed messages.

Question 488

A company is working with a strategic partner that has an application that must be able to send messages to one of the company’s Amazon SQS queues. The partner company has its own AWS account.

How can a Solutions Architect provide least privilege access to the partner?

❌ A. Update the permission policy on the SQS queue to grant all permissions to the partner’s AWS account.
❌ B. Create a cross-account role with access to all SQS queues and use the partner's AWS account in the trust document for the role.
❌ C. Create a user account and grant the sqs:SendMessage permission for Amazon SQS. Share the credentials with the partner company.
✅ D. Update the permission policy on the SQS queue to grant the sqs:SendMessage permission to the partner’s AWS account.

Question 489

A new application is to be published in multiple regions around the world. The Architect needs to ensure only 2 IP addresses need to be whitelisted. The solution should intelligently route traffic for lowest latency and provide fast regional failover.

How can this be achieved?

✅ A. Launch EC2 instances into multiple regions behind an NLB and use AWS Global Accelerator
❌ B. Launch EC2 instances into multiple regions behind an ALB and use Amazon CloudFront with a pair of static IP addresses
❌ C. Launch EC2 instances into multiple regions behind an NLB with a static IP address
❌ D. Launch EC2 instances into multiple regions behind an ALB and use a Route 53 failover routing policy

Question 490

A financial services company operates multiple internal services across various AWS accounts. The company uses AWS Organizations to manage these accounts and needs a centralized security appliance in a networking account to inspect all inter-service communication between AWS accounts. The solution must ensure secure and efficient routing of traffic through the security appliance.

Which solution will meet these requirements?

❌ A. Deploy an Application Load Balancer (ALB) in the networking account to route traffic to the security appliance. Configure the service accounts to send traffic to the ALB by using a private link.
❌ B. Deploy a Network Load Balancer (NLB) in the networking account to route traffic to the security appliance. Configure the service accounts to send traffic to the NLB by using a VPC peering connection.
❌ C. Deploy interface VPC endpoints in the networking account for each service in the service accounts. Configure the security appliance to inspect traffic sent through the endpoints.
✅ D. Deploy a Gateway Load Balancer (GWLB) in the networking account to route traffic to the security appliance. Configure the service accounts to send traffic to the GWLB by using a Gateway Load Balancer endpoint in each service account.

Question 491

A scientific research institute stores experimental datasets in AWS. Some datasets are accessed daily for analysis, while others remain unused for weeks or months. The datasets are large and must be highly durable, but the institute wants to reduce costs without compromising availability for frequently accessed data.

The institute needs a cost-effective storage solution that adapts to these varying access patterns and ensures the highest durability.

Which storage solution meets these requirements?

❌ A. Use Amazon EFS with lifecycle policies to move infrequently accessed files to lower-cost storage tiers.
✅ B. Use Amazon S3 Intelligent-Tiering to automatically adjust storage costs based on the frequency of data access while maintaining high durability.
❌ C. Use Amazon S3 Glacier Instant Retrieval for all datasets to achieve high durability with low-cost storage for infrequent access.
❌ D. Use Amazon FSx for Lustre integrated with Amazon S3 to offload unused datasets and retrieve them as needed for analysis.

Question 492

An application is being created that will use Amazon EC2 instances to generate and store data. Another set of EC2 instances will then analyze and modify the data. Storage requirements will be significant and will continue to grow over time. The application architects require a storage solution.

Which actions would meet these needs?

❌ A. Store the data in Amazon S3 Glacier. Update the vault policy to allow access to the application instances
❌ B. Store the data in an Amazon EBS volume. Mount the EBS volume on the application instances
❌ C. Store the data in AWS Storage Gateway. Setup AWS Direct Connect between the Gateway appliance and the EC2 instances
✅ D. Store the data in an Amazon EFS filesystem. Mount the file system on the application instances

Question 493

A company has developed a non-production application that is composed of multiple microservices for each of the company's business units. A single development team maintains all the microservices. The current architecture uses a static web frontend and a Java-based backend that contains the application logic. The architecture also uses a MySQL database that the company hosts on an Amazon EC2 instance. The company needs to ensure that the application is secure, scalable, and globally available while minimizing operational overhead.

Which solution will meet these requirements?

❌ A. Use Amazon CloudFront and AWS Amplify to host the static web frontend. Refactor the backend to AWS Lambda functions triggered by an EventBridge bus. Migrate the database to an Amazon EC2 Reserved Instance with backups configured on Amazon S3.
✅ B. Use Amazon CloudFront and Amazon S3 to host the static web frontend. Refactor the backend to use AWS Lambda functions that are invoked by Amazon API Gateway. Migrate the database to Amazon Aurora Serverless for auto-scaling.
❌ C. Use AWS Amplify to host the static web frontend. Refactor the backend microservices to Amazon Elastic Kubernetes Service (Amazon EKS) with auto-scaling. Migrate the database to Amazon RDS for MySQL with a read replica for high availability.
❌ D. Use Amazon CloudFront and Amazon S3 to host the static web frontend. Refactor the backend microservices to run on Amazon ECS on AWS Fargate. Migrate the database to Amazon DynamoDB for auto-scaling and cost optimization.

Question 494

A retail company with many stores and warehouses is implementing IoT sensors to gather monitoring data from devices in each location. The data will be sent to AWS in real time. A solutions architect must provide a solution for ensuring events are received in order for each device and ensure that data is saved for future processing.

Which solution would be MOST efficient?

❌ A. Use an Amazon SQS FIFO queue for real-time events with one queue for each device. Trigger an AWS Lambda function for the SQS queue to save data to Amazon EFS
❌ B. Use an Amazon SQS standard queue for real-time events with one queue for each device. Trigger an AWS Lambda function from the SQS queue to save data to Amazon S3
❌ C. Use Amazon Kinesis Data Streams for real-time events with a shard for each device. Use Amazon Kinesis Data Firehose to save data to Amazon EBS
✅ D. Use Amazon Kinesis Data Streams for real-time events with a partition key for each device. Use Amazon Kinesis Data Firehose to save data to Amazon S3

Question 495

A company is launching a new internal platform for managing multiple independent projects. Each project will require its own dedicated AWS account for isolation. The company needs a solution that automates account creation, applies mandatory security guardrails, and centrally manages shared networking resources such as VPNs and subnets for the accounts. The solution must minimize manual effort and ensure compliance with security standards.

Which solution will meet these requirements with the LEAST operational overhead?

❌ A. Use AWS Organizations to create project accounts manually. Deploy a VPC in a centralized networking account. Use AWS RAM to share subnets. Manually configure security policies in each account.
✅ B. Use AWS Control Tower to automate account provisioning. Create a dedicated networking account with a centralized VPC. Use AWS Resource Access Manager (AWS RAM) to share subnets with project accounts. Enforce security guardrails by using AWS Control Tower guardrails.
❌ C. Use AWS Organizations to create accounts for each project. Deploy a shared VPC in a centralized account. Configure AWS Firewall Manager to enforce security controls. Manually configure routing for project account traffic through the shared VPC.
❌ D. Use AWS Control Tower to set up accounts with pre-configured VPCs in each project account. Connect these VPCs to a central networking account through a transit gateway. Enforce security controls with AWS Config.

Question 496

A startup is prototyping a movie streaming platform on AWS. The platform consists of an Application Load Balancer, an Auto Scaling group of Amazon EC2 instances to host the frontend, and an Amazon RDS for PostgreSQL DB instance running in a Single-AZ configuration.

Users report slow response times when browsing the catalog of available movies. The movie catalog is a set of tables in the database that is updated infrequently. A solutions architect finds that the database's CPU utilization spikes significantly during catalog queries.

What should the solutions architect recommend to improve the performance of the platform during catalog searches?

✅ A. Implement an Amazon ElastiCache for Redis cluster to cache catalog queries. Configure the application to use lazy loading to populate the cache.
❌ B. Use Amazon Aurora Serverless for the movie catalog database. Configure Aurora’s built-in caching to handle frequent queries efficiently.
❌ C. Migrate the movie catalog to Amazon DynamoDB and use the DynamoDB Accelerator (DAX) service to cache queries for the catalog.
❌ D. Enable read replicas for the RDS instance. Configure the frontend application to distribute catalog queries across the read replicas.

Question 497

A company runs an application in a factory that has a small rack of physical compute resources. The application stores data on a network attached storage (NAS) device using the NFS protocol. The company requires a daily offsite backup of the application data.

Which solution can a Solutions Architect recommend to meet this requirement?

❌ A. Use an AWS Storage Gateway volume gateway with stored volumes on premises to replicate the data to Amazon S3.
❌ B. Use an AWS Storage Gateway volume gateway with cached volumes on premises to replicate the data to Amazon S3.
✅ C. Use an AWS Storage Gateway file gateway hardware appliance on premises to replicate the data to Amazon S3.
❌ D. Create an IPSec VPN to AWS and configure the application to mount the Amazon EFS file system. Run a copy job to backup the data to EFS.

Question 498

A company runs an application on six web application servers in an Amazon EC2 Auto Scaling group in a single Availability Zone. The application is fronted by an Application Load Balancer (ALB). A Solutions Architect needs to modify the infrastructure to be highly available without making any modifications to the application.

Which architecture should the Solutions Architect choose to enable high availability?

❌ A. Create a launch template that can be used to quickly create more instances in another Region.
✅ B. Modify the Auto Scaling group to use two instances across each of three Availability Zones.
❌ C. Create an Auto Scaling group to launch three instances across each of two Regions.
❌ D. Create an Amazon CloudFront distribution with a custom origin across multiple Regions.

Question 499

A company is launching a new photo processing service that uses machine learning (ML) models to analyze and tag images. The service consists of independent microservices for different types of image processing tasks. Each ML model loads approximately 500 MB of data from Amazon S3 into memory at startup. Users will submit images through a RESTful API, which can handle individual or batch requests. Traffic patterns are unpredictable, with peaks during marketing campaigns and minimal usage during off-hours. The company needs a scalable and cost-effective solution to manage this workload.

Which solution will meet these requirements?

❌ A. Send the API requests to an Amazon EventBridge bus. Deploy the ML models as AWS Lambda functions that EventBridge invokes. Use auto scaling to increase memory and concurrency based on the size of the event payloads.
❌ B. Route the API requests to a Network Load Balancer (NLB). Deploy the ML models as Amazon Elastic Kubernetes Service (Amazon EKS) pods. Configure auto scaling based on CPU usage for EKS nodes
❌ C. Route the API requests to an Application Load Balancer (ALB). Deploy the ML models as AWS Lambda functions. Use provisioned concurrency to ensure Lambda functions remain warm for high-performance batch processing.
✅ D. Send the API requests to an Amazon Simple Queue Service (Amazon SQS) queue. Deploy the ML models as Amazon Elastic Container Service (Amazon ECS) services that read messages from the queue. Use auto scaling for ECS to adjust capacity based on queue length.

Question 500

A company is deploying a fleet of Amazon EC2 instances running Linux across multiple Availability Zones within an AWS Region. The application requires a data storage solution that can be accessed by all of the EC2 instances simultaneously. The solution must be highly scalable and easy to implement. The storage must be mounted using the NFS protocol.

Which solution meets these requirements?

❌ A. Create an Amazon S3 bucket and create an S3 gateway endpoint to allow access to the file system using the NFS protocol.
✅ B. Create an Amazon EFS file system with mount targets in each Availability Zone. Configure the application instances to mount the file system.
❌ C. Create an Amazon EBS volume and use EBS Multi-Attach to mount the volume to all EC2 instances across each Availability Zone.
❌ D. Create an Amazon RDS database and store the data in a BLOB format. Point the application instances to the RDS endpoint.

Question 501

A media processing company is migrating its on-premises application to the AWS Cloud. The application processes high volumes of videos and generates large output files during the workflow.

The company requires a scalable solution to handle an increasing number of video processing jobs. The solution should minimize manual intervention, simplify job orchestration, and eliminate the need to manage infrastructure. Operational overhead must be kept to a minimum.

Which solution will fulfill these requirements with the LEAST operational overhead?

✅ A. Use AWS Batch to run video processing jobs. Use AWS Step Functions to manage the workflow. Store the processed files in Amazon S3.
❌ B. Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate to process the videos. Use Amazon Simple Queue Service (Amazon SQS) for workflow orchestration and store the processed files in Amazon S3.
❌ C. Use a fleet of Amazon EC2 Spot Instances to process the videos. Use AWS Step Functions for workflow management and store the processed files in Amazon Elastic File System (Amazon EFS).
❌ D. Use AWS Lambda and Amazon EC2 On-Demand Instances for video processing. Store the processed files in Amazon FSx for Lustre.

Question 502

A financial services company runs a trading application on a Kubernetes cluster hosted in its on-premises data center. Due to a recent surge in trading activity, the on-premises infrastructure can no longer support the increased load. The company plans to migrate the trading application to the AWS Cloud using an Amazon Elastic Kubernetes Service (Amazon EKS) cluster.

The company wants to minimize the operational overhead by avoiding management of the underlying compute infrastructure for the new AWS architecture.

Which solution will meet these requirements with the LEAST operational overhead?

✅ A. Use AWS Fargate to provide the compute capacity for the EKS cluster. Create a Fargate profile and deploy the application using the profile.
❌ B. Use Amazon EC2 Spot Instances with managed node groups to provide cost-effective compute capacity for the EKS cluster. Deploy the application using the Spot nodes.
❌ C. Use self-managed EC2 instances to provide the compute capacity for the EKS cluster. Deploy the application to the cluster using these instances.
❌ D. Use managed node groups to provide the compute capacity for the EKS cluster. Deploy the application to the cluster using the managed nodes.

Question 503

A solutions architect is creating a system that will run analytics on financial data for several hours a night 5 days a week. The analysis is expected to run for the same duration and cannot be interrupted once it is started. The system will be required for a minimum of 1 year.

What should the solutions architect configure to ensure the EC2 instances are available when they are needed?

❌ A. On-Demand Instances
❌ B. Regional Reserved Instances
✅ C. On-Demand Capacity Reservations
❌ D. Savings Plans

Question 504

An eCommerce application consists of three tiers. The web tier includes EC2 instances behind an Application Load balancer, the middle tier uses EC2 instances and an Amazon SQS queue to process orders, and the database tier consists of an Auto Scaling DynamoDB table. During busy periods customers have complained about delays in the processing of orders. A Solutions Architect has been tasked with reducing processing times.

Which action will be MOST effective in accomplishing this requirement?

❌ A. Add an Amazon CloudFront distribution with a custom origin to cache the responses for the web tier.
❌ B. Replace the Amazon SQS queue with Amazon Kinesis Data Firehose.
❌ C. Use Amazon DynamoDB Accelerator (DAX) in front of the DynamoDB backend tier.
✅ D. Use Amazon EC2 Auto Scaling to scale out the middle tier instances based on the SQS queue depth.

Question 505

A company uses an Amazon RDS MySQL database instance to store customer order data. The security team have requested that SSL/TLS encryption in transit must be used for encrypting connections to the database from application servers. The data in the database is currently encrypted at rest using an AWS KMS key.

How can a Solutions Architect enable encryption in transit?

❌ A. Add a self-signed certificate to the RDS DB instance. Use the certificates in all connections to the RDS DB instance.
✅ B. Download the AWS-provided root certificates. Use the certificates when connecting to the RDS DB instance.
❌ C. Take a snapshot of the RDS instance. Restore the snapshot to a new instance with encryption in transit enabled.
❌ D. Enable encryption in transit using the RDS Management console and obtain a key using AWS KMS.

Question 506

A developer created an application that uses Amazon EC2 and an Amazon RDS MySQL database instance. The developer stored the database user name and password in a configuration file on the root EBS volume of the EC2 application instance. A Solutions Architect has been asked to design a more secure solution.

What should the Solutions Architect do to achieve this requirement?

❌ A. Attach an additional volume to the EC2 instance with encryption enabled. Move the configuration file to the encrypted volume.
❌ B. Install an Amazon-trusted root certificate on the application instance and use SSL/TLS encrypted connections to the database.
✅ C. Create an IAM role with permission to access the database. Attach this IAM role to the EC2 instance.
❌ D. Move the configuration file to an Amazon S3 bucket. Create an IAM role with permission to the bucket and attach it to the EC2 instance.

Question 507

A company is investigating methods to reduce the expenses associated with on-premises backup infrastructure. The Solutions Architect wants to reduce costs by eliminating the use of physical backup tapes. It is a requirement that existing backup applications and workflows should continue to function.

What should the Solutions Architect recommend?

❌ A. Connect the backup applications to an AWS Storage Gateway using the iSCSI protocol.
❌ B. Create an Amazon EFS file system and connect the backup applications using the iSCSI protocol.
❌ C. Create an Amazon EFS file system and connect the backup applications using the NFS protocol.
✅ D. Connect the backup applications to an AWS Storage Gateway using an iSCSI-virtual tape library (VTL).

Question 508

An AWS Organization has an OU with multiple member accounts in it. The company needs to restrict the ability to launch only specific Amazon EC2 instance types. How can this policy be applied across the accounts with the least effort?

❌ A. Create an IAM policy to deny launching all but the specific instance types
❌ B. Create an SCP with an allow rule that allows launching the specific instance types
✅ C. Create an SCP with a deny rule that denies all but the specific instance types
❌ D. Use AWS Resource Access Manager to control which launch types can be used

Question 509

A company runs a dynamic website that is hosted on an on-premises server in the United States. The company is expanding to Europe and is investigating how they can optimize the performance of the website for European users. The website’s backed must remain in the United States. The company requires a solution that can be implemented within a few days.

What should a Solutions Architect recommend?

❌ A. Migrate the website to Amazon S3. Use cross-Region replication between Regions and a latency-based Route 53 policy.
❌ B. Use Amazon CloudFront with Lambda@Edge to direct traffic to an on-premises origin.
❌ C. Launch an Amazon EC2 instance in an AWS Region in the United States and migrate the website to it.
✅ D. Use Amazon CloudFront with a custom origin pointing to the on-premises servers.

Question 510

A healthcare company is migrating its on-premises Oracle database to an Amazon RDS for Oracle database. The database must meet compliance requirements to retain backups for 120 days. Additionally, the company must have the ability to restore the database to any point in time within the past 10 days. The solution must minimize operational overhead and ensure compliance with these requirements.

Which solution will meet these requirements with the LEAST operational overhead?

❌ A. Use AWS Backup to create a backup plan for Amazon RDS with a 120-day retention period. Enable point-in-time recovery by combining AWS Backup and RDS automated backups.
✅ B. Configure Amazon RDS automated backups. Set the retention period to 35 days and enable point-in-time recovery for the past 10 days. Use AWS Backup to retain additional backups for 120 days.
❌ C. Set up Amazon S3 Lifecycle policies to retain database exports for 120 days. Use AWS Database Migration Service (AWS DMS) to export the database to Amazon S3 every 24 hours.
❌ D. Create an Amazon RDS manual snapshot every week. Use an AWS Lambda function to delete snapshots that are older than 120 days.

Question 511

A financial services company stores transaction records in an Amazon S3 bucket. The company runs its analytics application on a cluster of on-premises servers. The application needs temporary, secure access to the S3 bucket to analyze the data files.

The company uses AWS IAM Identity Center to manage identities and ensure adherence to the principle of least privilege. The solution must avoid long-term credential storage and provide a secure method for the application to access the S3 bucket.

Which solution will meet these requirements?

✅ A. Use IAM Roles Anywhere to issue temporary credentials to the application. Set up a trust relationship with IAM Identity Center and configure the application to assume the role using these credentials.
❌ B. Use AWS Systems Manager to store an access key and secret key for an IAM user with access to the S3 bucket. Configure the application to retrieve the credentials from Systems Manager Parameter Store when needed.
❌ C. Deploy AWS Storage Gateway File Gateway to the on-premises environment. Configure the application to access the S3 bucket through the gateway by using NFS or SMB.
❌ D. Create an S3 bucket policy to allow access from the public IP address range of the company’s on-premises servers. Configure the application to access the S3 bucket directly.

Question 512

An eCommerce company runs an application on Amazon EC2 instances in public and private subnets. The web application runs in a public subnet and the database runs in a private subnet. Both the public and private subnets are in a single Availability Zone.

Which combination of steps should a solutions architect take to provide high availability for this architecture? (Select TWO)

❌ A. Create new public and private subnets in a different AZ. Create a database using Amazon EC2 in one AZ.
❌ B. Create new public and private subnets in the same AZ but in a different Amazon VPC.
✅ C. Create an EC2 Auto Scaling group and Application Load Balancer that spans across multiple AZs.
❌ D. Create an EC2 Auto Scaling group in the public subnet and use an Application Load Balancer.
✅ E. Create new public and private subnets in a different AZ. Migrate the database to an Amazon RDS multi-AZ deployment.

Question 513

A healthcare organization operates multiple applications on virtual machines (VMs) in its on-premises data center. Due to increasing demand for its services, the data center can no longer scale quickly enough to meet business needs. The organization has decided to migrate its non-critical workloads to AWS using a lift-and-shift strategy to expedite the process.

Which combination of steps will meet these requirements? (Select THREE)

❌ A. Install the AWS Systems Manager Agent on the VMs to streamline operational management during migration.
✅ B. Complete the initial data replication from the VMs to AWS. Launch test instances to perform acceptance tests for the workloads.
✅ C. Use AWS Application Migration Service to replicate the VMs to AWS. Install the AWS Replication Agent on each VM.
❌ D. Use AWS Server Migration Service (AWS SMS) to automate the migration of VMs to Amazon EC2 instances.
❌ E. Use AWS App Runner to containerize the workloads before migrating them to AWS.
✅ F. Stop all operations on the VMs. Perform a cutover by launching the migrated instances in AWS.

Question 514

A company provides a REST-based interface to an application that allows a partner company to send data in near-real time. The application then processes the data that is received and stores it for later analysis. The application runs on Amazon EC2 instances.

The partner company has received many 503 Service Unavailable Errors when sending data to the application and the compute capacity reaches its limits and is unable to process requests when spikes in data volume occur.

Which design should a Solutions Architect implement to improve scalability?

❌ A. Use Amazon SQS to ingest the data. Configure the EC2 instances to process messages from the SQS queue.
❌ B. Use Amazon SNS to ingest the data and trigger AWS Lambda functions to process the data in near-real time.
❌ C. Use Amazon API Gateway in front of the existing application. Create a usage plan with a quota limit for the partner company.
✅ D. Use Amazon Kinesis Data Streams to ingest the data. Process the data using AWS Lambda functions.

Question 515

A company runs an application on an Amazon EC2 instance the requires 250 GB of storage space. The application is not used often and has small spikes in usage on weekday mornings and afternoons. The disk I/O can vary with peaks hitting a maximum of 3,000 IOPS. A Solutions Architect must recommend the most cost-effective storage solution that delivers the performance required.

Which configuration should the Solutions Architect recommend?

❌ A. Amazon EBS Provisioned IOPS SSD (i01)
❌ B. Amazon EBS Cold HDD (sc1)
❌ C. Amazon EBS Throughput Optimized HDD (st1)
✅ D. Amazon EBS General Purpose SSD (gp2)

Question 516

A global manufacturing company uses AWS Outposts servers to manage IoT workloads in its factories across multiple continents. The company regularly updates factory IoT software, consisting of 50 files, from a central Amazon S3 bucket in the us-east-1 Region. Factories report significant delays when downloading and applying the updates, causing downtime. The company needs to minimize the latency for distributing software updates globally while reducing operational overhead.

Which solution will meet this requirement with the LEAST operational overhead?

✅ A. Create an Amazon S3 bucket in the us-east-1 Region. Set up an Amazon CloudFront distribution with the S3 bucket as the origin. Use signed URLs to download the software updates.
❌ B. Create an Amazon S3 bucket in the us-east-1 Region. Configure Amazon S3 Transfer Acceleration for the bucket. Use the S3 Transfer Acceleration endpoint for faster downloads.
❌ C. Create Amazon S3 buckets in multiple Regions. Configure S3 Cross-Region Replication (CRR) between the buckets. Deploy updates from the nearest bucket to each factory location.
❌ D. Create an Amazon S3 bucket in the us-east-1 Region. Deploy AWS Outposts servers at the factories as S3 endpoints. Configure the servers to cache the updates locally.

Question 517

A healthcare organization is designing a secure web application in the AWS Cloud for managing patient records. The application must securely retrieve and store multiple patient credentials, including access keys and passwords. The organization wants to use an AWS-managed service to handle these credentials. The solution must minimize operational overhead while ensuring security.

Which solution will meet these requirements with the LEAST operational overhead?

❌ A. Store the patient credentials in AWS Systems Manager Parameter Store. Use the GetParametersByPath API to securely retrieve the credentials in the application at runtime.
❌ B. Store the patient credentials in an Amazon RDS database table. Encrypt the credentials by using AWS Key Management Service (AWS KMS). Configure the application to query the RDS database to retrieve the credentials.
✅ C. Store the patient credentials in AWS Secrets Manager. Use the GetSecretValue API to securely retrieve the credentials in the application at runtime.
❌ D. Store the patient credentials in an Amazon S3 bucket. Enable server-side encryption with AWS KMS keys (SSE-KMS). Use pre-signed URLs to retrieve the credentials securely.

Question 518

A company is migrating from an on-premises infrastructure to the AWS Cloud. One of the company's applications stores files on a Windows file server farm that uses Distributed File System Replication (DFSR) to keep data in sync. A solutions architect needs to replace the file server farm.

Which service should the solutions architect use?

✅ A. Amazon FSx
❌ B. Amazon EFS
❌ C. Amazon S3
❌ D. AWS Storage Gateway

Question 519

A company runs an application in an on-premises data center that collects environmental data from production machinery. The data consists of JSON files stored on network attached storage (NAS) and around 5 TB of data is collected each day. The company must upload this data to Amazon S3 where it can be processed by an analytics application. The data must be transferred securely.

Which solution offers the MOST reliable and time-efficient data transfer?

❌ A. Multiple AWS Snowcone devices.
✅ B. AWS DataSync over AWS Direct Connect.
❌ C. Amazon S3 Transfer Acceleration over the Internet.
❌ D. AWS Database Migration Service over the Internet.

Question 520

A company needs to connect its on-premises data center network to a new virtual private cloud (VPC). There is a symmetrical internet connection of 100 Mbps in the data center network. The data transfer rate for an on-premises application is multiple gigabytes per day. Processing will be done using an Amazon Kinesis Data Firehose stream.

What should a solutions architect recommend for maximum performance?

❌ A. Get an AWS Snowball Edge Storage Optimized device. Data must be copied to the device after several days and shipped to AWS for expedited transfer to Kinesis Data Firehose. Repeat as necessary.
❌ B. Establish a peering connection between the on-premises network and the VPC. Configure routing for the on-premises network to use the VPC peering connection.
✅ C. Kinesis Data Firehose can be connected to the VPC using AWS PrivateLink. Install a 1 Gbps AWS Direct Connect connection between the on-premises network and AWS. To send data from on-premises to Kinesis Data Firehose, use the PrivateLink endpoint.
❌ D. Establish an AWS Site-to-Site VPN connection between the on-premises network and the VPC. Set up BGP routing between the customer gateway and the virtual private gateway. Send data to Kinesis Data Firehose using a VPN connection.

Question 521

A logistics company is running a containerized application on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with Amazon EC2 instances as the worker nodes. The application includes a management dashboard that uses Amazon DynamoDB for real-time tracking data and a reporting service that stores large datasets in Amazon S3.

The company needs to ensure that the EKS Pods running the management dashboard can access only Amazon DynamoDB, and the EKS Pods running the reporting service can access only Amazon S3. The company uses AWS Identity and Access Management (IAM) for access control.

Which solution will meet these requirements?

✅ A. Create separate IAM roles with policies for Amazon S3 and DynamoDB access. Use Kubernetes service accounts with IAM Role for Service Accounts (IRSA) to assign the AmazonS3FullAccess policy to the reporting service Pods and the AmazonDynamoDBFullAccess policy to the management dashboard Pods.
❌ B. Create separate IAM policies for Amazon S3 and DynamoDB access. Attach both policies to the IAM role associated with the EC2 instance profile. Use Kubernetes namespaces to restrict access for the respective Pods to Amazon S3 or DynamoDB.
❌ C. Create IAM roles with permissions for Amazon S3 and DynamoDB access. Attach the Amazon S3 role to the reporting service Pods and the DynamoDB role to the management dashboard Pods using a shared service account.
❌ D. Configure role-based access control (RBAC) within Kubernetes to define which Pods can access Amazon S3 and DynamoDB. Use Kubernetes ConfigMaps to store the IAM credentials for each service.

Question 522

A financial institution is designing the architecture for a new data processing platform on AWS. The institution uses organizational units (OUs) in AWS Organizations to manage its accounts. To comply with regulatory requirements, all Amazon EC2 instances must include a compliance-level tag with values of compliant or noncompliant. IAM users must not be allowed to create EC2 instances without this tag or modify the tag after creation.

Which combination of steps will meet these requirements? (Select TWO)

✅ A. In AWS Organizations, create a service control policy (SCP) to deny the creation of EC2 instances if the compliance-level tag is not specified. Attach the SCP to the appropriate OU.
❌ B. Use AWS Lambda with an EventBridge rule to trigger a function whenever a new EC2 instance is created. Configure the function to terminate any instance that does not include the compliance-level tag with the correct values.
❌ C. Use AWS Config to check for compliance-level tags on EC2 instances. Configure AWS Config to remediate noncompliant resources by automatically adding the required tags to EC2 instances.
❌ D. Create an IAM policy that denies the deletion of tags on EC2 instances. Assign this policy to all IAM users who manage EC2 resources in the organization's accounts.
✅ E. In AWS Organizations, create a tag policy to enforce the use of the compliance-level tag with the required values. Attach the tag policy to the appropriate OU to ensure EC2 instances adhere to the tagging requirements.

Question 523

A logistics company processes real-time sensor data from delivery vehicles to optimize routes and track vehicle health. The current architecture includes an Auto Scaling group of Amazon EC2 instances for ingesting and storing sensor data, and a separate Auto Scaling group for analyzing and generating route optimizations based on this data.

The company has observed performance issues during peak delivery hours when the rate of data ingestion is significantly higher than the analysis and processing rate. The company wants to ensure that both systems can scale independently, and no data is lost during scaling events.

Which solution will meet these requirements?

❌ A. Use Amazon Kinesis Data Streams to buffer the sensor data. Configure Amazon Kinesis Data Analytics to process the data and adjust the number of EC2 instances in the analysis Auto Scaling group based on the volume of data being processed.
❌ B. Use two Amazon SQS queues: one for data ingestion and one for route analysis. Configure Amazon EventBridge rules to monitor queue length and scale each Auto Scaling group based on the backlog of messages in their respective queues.
❌ C. Replace the EC2-based Auto Scaling groups with AWS Lambda functions to process the incoming data and analysis tasks. Use Amazon DynamoDB to store the intermediate data and scale DynamoDB based on the traffic patterns.
✅ D. Use two Amazon Simple Queue Service (Amazon SQS) queues: one for data ingestion and one for route analysis. Configure the EC2 instances to poll their respective queues and scale the Auto Scaling groups based on the ApproximateNumberOfMessages metric in each queue.

Question 524

An Amazon VPC contains several Amazon EC2 instances. The instances need to make API calls to Amazon DynamoDB. A solutions architect needs to ensure that the API calls do not traverse the internet.

How can this be accomplished? (Select TWO)

❌ A. Create a VPC peering connection between the VPC and DynamoDB
✅ B. Create a gateway endpoint for DynamoDB
❌ C. Create a new DynamoDB table that uses the endpoint
❌ D. Create an ENI for the endpoint in each of the subnets of the VPC
✅ E. Create a route table entry for the endpoint