Free AWS SAP-C02 Practice Questions & Answers 2026 Part4

Question #1

A company is using multiple AWS accounts. The DNS records are stored in a private hosted zone for Amazon Route 53 in Account A. The company’s applications and databases are running in Account B.A solutions architect will deploy a two-tier application in a new VPC. To simplify the configuration, the db.example.com CNAME record set for the Amazon RDS endpoint was created in a private hosted zone for Amazon Route 53.During deployment, the application failed to start. Troubleshooting revealed that db.example.com is not resolvable on the Amazon EC2 instance. The solutions architect confirmed that the record set was created correctly in Route 53.Which combination of steps should the solutions architect take to resolve this issue? (Choose two.)

A. Deploy the database on a separate EC2 instance in the new VPC

B. Use SSH to connect to the application tier EC2 instance

C. Create an authorization to associate the private hosted zone in Account A with the new VPC in Account B

D. Create a private hosted zone for the example com domain in Account B

E. Associate a new VPC in Account B with a hosted zone in Account A

View answer

Correct Answer: CE

Question #2

A company is running a web application in the AWS Cloud. The application consists of dynamic content that is created on a set of Amazon EC2 instances. The EC2 instances run in an Auto Scaling group that is configured as a target group for an Application Load Balancer (ALB).The company is using an Amazon CloudFront distribution to distribute the application globally. The CloudFront distribution uses the ALB as an origin. The company uses Amazon Route 53 for DNS and has created an A record of www.example.com for the CloudFront distribution.A solutions architect must configure the application so that itis highly available and fault tolerant.Which solution meets these requirements?

A. Provision a full, secondary application deployment in a different AWS Region

B. Provision an ALB, an Auto Scaling group, and EC2 instances in a different AWS Region

C. Provision an Auto Scaling group and EC2 instances in a different AWS Region

D. Provision a full, secondary application deployment in a different AWS Region

View answer

Correct Answer: B

Question #3

A company’s factory and automation applications are running in a single VPC. More than 20 applications run on a combination of Amazon EC2, Amazon Elastic Container Service (Amazon ECS), and Amazon RDS.The company has software engineers spread across three teams. One of the three teams owns each application, and each time is responsible for the cost and performance of all of its applications. Team resources have tags that represent their application and team. The teams use IAM access for daily activities.The company needs to determine which costs on the monthly AWS bill are attributable to each application or team. The company also must be able to create reports to compare costs from the last 12 months and to help forecast costs for the next 12 months. A solutions architect must recommend an AWS Billing and Cost Management solution that provides these cost reports.Which combination of actions will meet these requirements? (Choose three.)

A. Activate the user-define cost allocation tags that represent the application and the team

B. Activate the AWS generated cost allocation tags that represent the application and the team

C. Create a cost category for each application in Billing and Cost Management

D. Activate IAM access to Billing and Cost Management

E. Create a cost budget

F. Enable Cost Explorer

View answer

Correct Answer: ACF

Question #4

A company has an application that runs on Amazon EC2 instances. A solutions architect is designing VPC infrastructure in an AWS Region where the application needs to access an Amazon Aurora DB Cluster. The EC2 instances are all associated with the same security group. The DB cluster is associated with its own security group.The solutions architect needs to add rules to the security groups to provide the application with least privilege access to the DB Cluster.Which combination of steps will meet these requirements? (Choose two.)

A. Add an inbound rule to the EC2 instances' security group

B. Add an outbound rule to the EC2 instances' security group

C. Add an inbound rule to the DB cluster's security group

D. Add an outbound rule to the DB cluster's security group

E. Add an outbound rule to the DB cluster's security group

View answer

Correct Answer: BC

Question #5

A company wants to migrate its workloads from on premises to AWS. The workloads run on Linux and Windows. The company has a large on-premises infrastructure that consists of physical machines and VMs that host numerous applications.The company must capture details about the system configuration, system performance, running processes, and network connections of its on-premises workloads. The company also must divide the on-premises applications into groups for AWS migrations. The company needs recommendations for Amazon EC2 instance types so that the company can run its workloads on AWS in the most cost-effective manner.Which combination of steps should a solutions architect take to meet these requirements? (Choose three.)

A. Assess the existing applications by installing AWS Application Discovery Agent on the physical machines and VMs

B. Assess the existing applications by installing AWS Systems Manager Agent on the physical machines and VMs

C. Group servers into applications for migration by using AWS Systems Manager Application Manager

D. Group servers into applications for migration by using AWS Migration Hub

E. Generate recommended instance types and associated costs by using AWS Migration Hub

F. Import data about server sizes into AWS Trusted Advisor

View answer

Correct Answer: ADE

Question #6

A company is running an application in the AWS Cloud. The application collects and stores a large amount of unstructured data in an Amazon S3 bucket. The S3 bucket contains several terabytes of data and uses the S3 Standard storage class. The data increases in size by several gigabytes every day.The company needs to query and analyze the data. The company does not access data that is more than 1 year old. However, the company must retain all the data indefinitely for compliance reasons.Which solution will meet these requirements MOST cost-effectively?

A. Use S3 Select to query the data

B. Use Amazon Redshift Spectrum to query the data

C. Use an AWS Glue Data Catalog and Amazon Athena to query the data

D. Use Amazon Redshift Spectrum to query the data

View answer

Correct Answer: C

Question #7

A company consists or two separate business units. Each business unit has its own AWS account within a single organization in AWS Organizations. The business units regularly share sensitive documents with each other. To facilitate sharing, the company created an Amazon S3 bucket in each account and configured low-way replication between the S3 buckets. The S3 buckets have millions of objects.Recently, a security audit identified that neither S3 bucket has encryption at rest enabled. Company policy requires that all documents must be stored with encryption at rest. The company wants to implement server-side encryption with Amazon S3 managed encryption keys (SSE-S3).What is the MOST operationally efficient solution that meets these requirements?

A. Turn on SSE-S3 on both S3 buckets

B. Create an AWS Key Management Service (AWS KMS) key in each account

C. Turn on SSE-S3 on both S3 buckets

D. Create an AWS Key Management Service, (AWS KMS) key in each account

View answer

Correct Answer: A

Question #8

A company is running a two-tier web-based application in an on-premises data center. The application layer consists of a single server running a stateful application. The application connects to a PostgreSQL database running on a separate server. The application’s user base is expected to grow significantly, so the company is migrating the application and database to AWS. The solution will use Amazon Aurora PostgreSQL, Amazon EC2 Auto Scaling, and Elastic Load Balancing.Which solution will provide a consistent user experience that will allow the application and database tiers to scale?

A. Enable Aurora Auto Scaling for Aurora Replicas

B. Enable Aurora Auto Scaling for Aurora writers

C. Enable Aurora Auto Scaling for Aurora Replicas

D. Enable Aurora Scaling for Aurora writers

View answer

Correct Answer: C

Question #9

A company runs an IoT platform on AWS. IoT sensors in various locations send data to the company’s Node.js API servers on Amazon EC2 instances running behind an Application Load Balancer. The data is stored in an Amazon RDS MySQL DB instance that uses a 4 TB General Purpose SSD volume.The number of sensors the company has deployed in the field has increased over time, and is expected to grow significantly. The API servers are consistently overloaded and RDS metrics show high write latency.Which of the following steps together will resolve the issues permanently and enable growth as new sensors are provisioned, while keeping this platform cost-efficient? (Choose two.)

A. Resize the MySQL General Purpose SSD storage to 6 TB to improve the volume’s IOPS

B. Re-architect the database tier to use Amazon Aurora instead of an RDS MySQL DB instance and add read replicas

C. Leverage Amazon Kinesis Data Streams and AWS Lambda to ingest and process the raw data

D. Use AWS X-Ray to analyze and debug application issues and add more API servers to match the load

E. Re-architect the database tier to use Amazon DynamoDB instead of an RDS MySQL DB instance

View answer

Correct Answer: CE

Question #10

A company recently completed the migration from an on-premises data center to the AWS Cloud by using a replatforming strategy. One of the migrated servers is running a legacy Simple Mail Transfer Protocol (SMTP) service that a critical application relies upon. The application sends outbound email messages to the company’s customers. The legacy SMTP server does not support TLS encryption and uses TCP port 25. The application can use SMTP only.The company decides to use Amazon Simple Email Service (Amazon SES) and to decommission the legacy SMTP server. The company has created and validated the SES domain. The company has lifted the SES limits.What should the company do to modify the application to send email messages from Amazon SES?

A. Configure the application to connect to Amazon SES by using TLS Wrapper

B. Configure the application to connect to Amazon SES by using STARTTLS

C. Configure the application to use the SES API to send email messages

D. Configure the application to use AWS SDKs to send email messages

View answer

Correct Answer: B

Question #11

A company runs an application on AWS. The company curates data from several different sources. The company uses proprietary algorithms to perform data transformations and aggregations. After the company performs E TL processes, the company stores the results in Amazon Redshift tables. The company sells this data to other companies. The company downloads the data as files from the Amazon Redshift tables and transmits the files to several data customers by using FTP. The number of data customers has grown significantly. Management of the data customers has become difficult.

A. Use AWS Data Exchange for APIs to share data with customers

B. In the AWS account of the company that produces the data, create an AWS Data Exchange datashare by connecting AWS Data Exchange to the Redshift cluster

C. Download the data from the Amazon Redshift tables to an Amazon S3 bucket periodically

D. Publish the Amazon Redshift data to an Open Data on AWS Data Exchange

View answer

Correct Answer: B

Question #12

A company wants to change its internal cloud billing strategy for each of its business units. Currently, the cloud governance team shares reports for overall cloud spending with the head of each business unit. The company uses AWS Organizations to manage the separate AWS accounts for each business unit. The existing tagging standard in Organizations includes the application, environment, and owner. The cloud governance team wants a centralized solution so each business unit receives monthly reports on its cloud spending. The solution should also send notifications for any cloud spending that exceeds a set threshold.Which solution is the MOST cost-effective way to meet these requirements?

A. Configure AWS Budgets in each account and configure budget alerts that are grouped by application, environment, and owner

B. Configure AWS Budgets in the organization's management account and configure budget alerts that are grouped by application, environment, and owner

C. Configure AWS Budgets in each account and configure budget alerts that are grouped by application, environment, and owner

D. Enable AWS Cost and Usage Reports in the organization's management account and configure reports grouped by application, environment

View answer

Correct Answer: B

Question #13

A company needs to modernize an application and migrate the application to AWS. The application stores user profile data as text in a single table in an on-premises MySQL database.After the modernization, users will use the application to upload video files that are up to 4 GB in size. Other users must be able to download the video files from the application. The company needs a video storage solution that provides rapid scaling. The solution must not affect application performance.Which solution will meet these requirements?

A. igrate the database to Amazon Keyspaces by using AWS DMS with AWS SCT

B. igrate the database to Amazon Aurora PostgreSQL by using AWS DMS

C. igrate the database to Amazon DynamoDB by using AWS DMS with AWS SCT

D. igrate the database to Amazon DynamoDB by using AWS DMS with AWS SCT

View answer

Correct Answer: C

Question #14

A company consists or two separate business units. Each business unit has its own AWS account within a single organization in AWS Organizations. The business units regularly share sensitive documents with each other. To facilitate sharing, the company created an Amazon S3 bucket in each account and configured low-way replication between the S3 buckets. The S3 buckets have millions of objects.Recently, a security audit identified that neither S3 bucket has encryption at rest enabled. Company policy requires that all documents must be stored with encryption at rest. The company wants to implement server-side encryption with Amazon S3 managed encryption keys (SSE-S3).What is the MOST operationally efficient solution that meets these requirements?

A. Turn on SSE-S3 on both S3 buckets

B. Create an AWS Key Management Service (AWS KMS) key in each account

C. Turn on SSE-S3 on both S3 buckets

D. Create an AWS Key Management Service, (AWS KMS) key in each account

View answer

Correct Answer: A

Question #15

A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization.The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company’s on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts when changes are made to the allow list.The solutions architect must design a solution that distributes the common set of CIDR ranges across all accounts.Which solution meets these requirements with the LEAST amount of operational overhead?

A. Set up an Amazon Simple Notification Service (Amazon SNS) topic in the security team's AWS account

B. Create new customer-managed prefix lists in each AWS account within the organization

C. Create a new customer-managed prefix list in the security team’s AWS account

D. Create an IAM role in each account in the organization

View answer

Correct Answer: C

Question #16

A company that uses AWS Organizations allows developers to experiment on AWS. As part of the landing zone that the company has deployed, developers use their company email address to request an account. The company wants to ensure that developers are not launching costly services or running services unnecessarily. The company must give developers a fixed monthly budget to limit their AWS costs.Which combination of steps will meet these requirements? (Choose three.)

A. Create an SCP to set a fixed monthly account usage limit

B. Use AWS Budgets to create a fixed monthly budget for each developer’s account as part of the account creation process

C. Create an SCP to deny access to costly services and components

D. Create an IAM policy to deny access to costly services and components

E. Create an AWS Budgets alert action to terminate services when the budgeted amount is reached

F. Create an AWS Budgets alert action to send an Amazon Simple Notification Service (Amazon SNS) notification when the budgeted amount is reached

View answer

Correct Answer: BCF

Question #17

A company consists or two separate business units. Each business unit has its own AWS account within a single organization in AWS Organizations. The business units regularly share sensitive documents with each other. To facilitate sharing, the company created an Amazon S3 bucket in each account and configured low-way replication between the S3 buckets. The S3 buckets have millions of objects.Recently, a security audit identified that neither S3 bucket has encryption at rest enabled. Company policy requires that all documents must be stored with encryption at rest. The company wants to implement server-side encryption with Amazon S3 managed encryption keys (SSE-S3).What is the MOST operationally efficient solution that meets these requirements?

A. Turn on SSE-S3 on both S3 buckets

B. Create an AWS Key Management Service (AWS KMS) key in each account

C. Turn on SSE-S3 on both S3 buckets

D. Create an AWS Key Management Service, (AWS KMS) key in each account

View answer

Correct Answer: A

Question #18

A company is using multiple AWS accounts. The DNS records are stored in a private hosted zone for Amazon Route 53 in Account A. The company’s applications and databases are running in Account B.A solutions architect will deploy a two-tier application in a new VPC. To simplify the configuration, the db.example.com CNAME record set for the Amazon RDS endpoint was created in a private hosted zone for Amazon Route 53.During deployment, the application failed to start. Troubleshooting revealed that db.example.com is not resolvable on the Amazon EC2 instance. The solutions architect confirmed that the record set was created correctly in Route 53.Which combination of steps should the solutions architect take to resolve this issue? (Choose two.)

A. Deploy the database on a separate EC2 instance in the new VPC

B. Use SSH to connect to the application tier EC2 instance

C. Create an authorization to associate the private hosted zone in Account A with the new VPC in Account B

D. Create a private hosted zone for the example com domain in Account B

E. Associate a new VPC in Account B with a hosted zone in Account A

View answer

Correct Answer: CE

Question #19

A company is providing weather data over a REST-based API to several customers. The API is hosted by Amazon API Gateway and is integrated with different AWS Lambda functions for each API operation. The company uses Amazon Route 53 for DNS and has created a resource record of weather.example.com. The company stores data for the API in Amazon DynamoDB tables. The company needs a solution that will give the API the ability to fail over to a different AWS Region.Which solution will meet these requirements?

A. Deploy a new set of Lambda functions in a new Region

B. Deploy a new API Gateway API and Lambda functions in another Region

C. Deploy a new API Gateway API and Lambda functions in another Region

D. Deploy a new API Gateway API in a new Region

View answer

Correct Answer: C

Question #20

A company has mounted sensors to collect information about environmental parameters such as humidity and light throughout all the company's factories. The company needs to stream and analyze the data in the AWS Cloud in real time. If any of the parameters fall out of acceptable ranges, the factory operations team must receive a notification immediately.

A. Stream the data to an Amazon Kinesis Data Firehose delivery stream

B. Stream the data to an Amazon Managed Streaming for Apache Kafka (Amazon MSK) cluster

C. Stream the data to an Amazon Kinesis data stream

D. Stream the data to an Amazon Kinesis Data Analytics application

View answer

Correct Answer: C

Question #21

A company is hosting a monolithic REST-based API for a mobile app on five Amazon EC2 instances in public subnets of a VPC. Mobile clients connect to the API by using a domain name that is hosted on Amazon Route 53. The company has created a Route 53 multivalue answer routing policy with the IP addresses of all the EC2 instances. Recently, the app has been overwhelmed by large and sudden increases to traffic. The app has not been able to keep up with the traffic.A solutions architect needs to implement a solution so that the app can handle the new and varying load. Which solution will meet these requirements with the LEAST operational overhead?

A. Separate the API into individual AWS Lambda functions

B. Containerize the API logic

C. Create an Auto Scaling group

D. Create an Application Load Balancer (ALB) in front of the API

View answer

Correct Answer: D

Question #22

A company uses AWS Organizations with a single OU named Production to manage multiple accounts. All accounts are members of the Production OU. Administrators use deny list SCPs in the root of the organization to manage access to restricted services.The company recently acquired a new business unit and invited the new unit’s existing AWS account to the organization. Once onboarded, the administrators of the new business unit discovered that they are not able to update existing AWS Config rules to meet the company’s policies.Which option will allow administrators to make changes and continue to enforce the current policies without introducing additional long-term maintenance?

A. Remove the organization’s root SCPs that limit access to AWS Config

B. Create a temporary OU named Onboarding for the new account

C. Convert the organization’s root SCPs from deny list SCPs to allow list SCPs to allow the required services only

D. Create a temporary OU named Onboarding for the new account

View answer

Correct Answer: D

Question #23

An enterprise company wants to allow its developers to purchase third-party software through AWS Marketplace. The company uses an AWS Organizations account structure with full features enabled, and has a shared services account in each organizational unit (OU) that will be used by procurement managers. The procurement team’s policy indicates that developers should be able to obtain third-party software from an approved list only and use Private Marketplace in AWS Marketplace to achieve this requirement. The procurement team wants administration of Private Marketplace to be restricted to a role named procurement-manager-role, which could be assumed by procurement managers. Other IAM users, groups, roles, and account administrators in the company should be denied Private Marketplace administrative access.What is the MOST efficient way to design an architecture to meet these requirements?

A. Create an IAM role named procurement-manager-role in all AWS accounts in the organization

B. Create an IAM role named procurement-manager-role in all AWS accounts in the organization

C. Create an IAM role named procurement-manager-role in all the shared services accounts in the organization

D. Create an IAM role named procurement-manager-role in all AWS accounts that will be used by developers

View answer

Correct Answer: C

Question #24

A company is running an application in the AWS Cloud. The application collects and stores a large amount of unstructured data in an Amazon S3 bucket. The S3 bucket contains several terabytes of data and uses the S3 Standard storage class. The data increases in size by several gigabytes every day.The company needs to query and analyze the data. The company does not access data that is more than 1 year old. However, the company must retain all the data indefinitely for compliance reasons.Which solution will meet these requirements MOST cost-effectively?

A. Use S3 Select to query the data

B. Use Amazon Redshift Spectrum to query the data

C. Use an AWS Glue Data Catalog and Amazon Athena to query the data

D. Use Amazon Redshift Spectrum to query the data

View answer

Correct Answer: C

Question #25

A company has migrated Its forms-processing application to AWS. When users interact with the application, they upload scanned forms as files through a web application. A database stores user metadata and references to files that are stored in Amazon S3. The web application runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.When forms are uploaded, the application sends notifications to a team through Amazon Simple Notification Service (Amazon SNS). A team member then logs in and processes each form. The team member performs data validation on the form and extracts relevant data before entering the information into another system that uses an API.A solutions architect needs to automate the manual processing of the forms. The solution must provide accurate form extraction. minimize time to market, and minimize tong-term operational overhead.Which solution will meet these requirements?

A. Develop custom libraries to perform optical character recognition (OCR) on the forms

B. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

C. Host a new application tier on EC2 instances

D. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

View answer

Correct Answer: D

Question #26

A company wants to change its internal cloud billing strategy for each of its business units. Currently, the cloud governance team shares reports for overall cloud spending with the head of each business unit. The company uses AWS Organizations to manage the separate AWS accounts for each business unit. The existing tagging standard in Organizations includes the application, environment, and owner. The cloud governance team wants a centralized solution so each business unit receives monthly reports on its cloud spending. The solution should also send notifications for any cloud spending that exceeds a set threshold.Which solution is the MOST cost-effective way to meet these requirements?

A. Configure AWS Budgets in each account and configure budget alerts that are grouped by application, environment, and owner

B. Configure AWS Budgets in the organization's management account and configure budget alerts that are grouped by application, environment, and owner

C. Configure AWS Budgets in each account and configure budget alerts that are grouped by application, environment, and owner

D. Enable AWS Cost and Usage Reports in the organization's management account and configure reports grouped by application, environment

View answer

Correct Answer: B

Question #27

A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization.The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company’s on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts when changes are made to the allow list.The solutions architect must design a solution that distributes the common set of CIDR ranges across all accounts.Which solution meets these requirements with the LEAST amount of operational overhead?

A. Set up an Amazon Simple Notification Service (Amazon SNS) topic in the security team's AWS account

B. Create new customer-managed prefix lists in each AWS account within the organization

C. Create a new customer-managed prefix list in the security team’s AWS account

D. Create an IAM role in each account in the organization

View answer

Correct Answer: C

Question #28

A company is running an application in the AWS Cloud. The application collects and stores a large amount of unstructured data in an Amazon S3 bucket. The S3 bucket contains several terabytes of data and uses the S3 Standard storage class. The data increases in size by several gigabytes every day.The company needs to query and analyze the data. The company does not access data that is more than 1 year old. However, the company must retain all the data indefinitely for compliance reasons.Which solution will meet these requirements MOST cost-effectively?

A. Use S3 Select to query the data

B. Use Amazon Redshift Spectrum to query the data

C. Use an AWS Glue Data Catalog and Amazon Athena to query the data

D. Use Amazon Redshift Spectrum to query the data

View answer

Correct Answer: C

Question #29

A company is hosting a three-tier web application in an on-premises environment. Due to a recent surge in traffic that resulted in downtime and a significant financial impact, company management has ordered that the application be moved to AWS. The application is written in .NET and has a dependency on a MySQL database. A solutions architect must design a scalable and highly available solution to meet the demand of 200,000 daily users.Which steps should the solutions architect take to design an appropriate solution?

A. se AWS Elastic Beanstalk to create a new application with a web server environment and an Amazon RDS MySQL Multi-AZ DB instance

B. se AWS CloudFormation to launch a stack containing an Application Load Balancer (ALB) in front of an Amazon EC2 Auto Scaling group spanning three Availability Zones

C. se AWS Elastic Beanstalk to create an automatically scaling web server environment that spans two separate Regions with an Application Load Balancer (ALB) in each Region

D. se AWS CloudFormation to launch a stack containing an Application Load Balancer (ALB) in front of an Amazon ECS cluster of Spot instances spanning three Availability Zones

View answer

Correct Answer: B

Question #30

A company has a serverless application comprised of Amazon CloudFront, Amazon API Gateway, and AWS Lambda functions. The current deployment process of the application code is to create a new version number of the Lambda function and run an AWS CLI script to update. If the new function version has errors, another CLI script reverts by deploying the previous working version of the function. The company would like to decrease the time to deploy new versions of the application logic provided by the Lambda functions, and also reduce the time to detect and revert when errors are identified.How can this be accomplished?

A. Create and deploy nested AWS CloudFormation stacks with the parent stack consisting of the AWS CloudFront distribution and API Gateway, and the child stack containing the Lambda function

B. Use AWS SAM and built-in AWS CodeDeploy to deploy the new Lambda version, gradually shift traffic to the new version, and use pre-traffic and post-traffic test functions to verify code

C. Refactor the AWS CLI scripts into a single script that deploys the new Lambda version

D. Create and deploy an AWS CloudFormation stack that consists of a new API Gateway endpoint that references the new Lambda version

View answer

Correct Answer: B

Question #31

A company is storing data on premises on a Windows file server. The company produces 5 GB of new data daily.The company migrated part of its Windows-based workload to AWS and needs the data to be available on a file system in the cloud. The company already has established an AWS Direct Connect connection between the on-premises network and AWS.Which data migration strategy should the company use?

A. se the file gateway option in AWS Storage Gateway to replace the existing Windows file server, and point the existing file share to the new file gateway

B. se AWS DataSync to schedule a daily task to replicate data between the on-premises Windows file server and Amazon FSx

C. se AWS Data Pipeline to schedule a daily task to replicate data between the on-premises Windows file server and Amazon Elastic File System (Amazon EFS)

D. se AWS DataSync to schedule a daily task to replicate data between the on-premises Windows file server and Amazon Elastic File System (Amazon EFS)

View answer

Correct Answer: B

Question #32

A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application.How should a solutions architect configure the web ACLs to meet these requirements?

A. Set the action of the web ACL rules to Count

B. Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible

C. Set the action of the web ACL rules to Block

D. Use only custom rule groups in the web ACLs, and set the action to Allow

View answer

Correct Answer: A

Question #33

A company used Amazon EC2 instances to deploy a web fleet to host a blog site. The EC2 instances are behind an Application Load Balancer (ALB) and are configured in an Auto Scaling group. The web application stores all blog content on an Amazon EFS volume.The company recently added a feature for bloggers to add video to their posts, attracting 10 times the previous user traffic. At peak times of day, users report buffering and timeout issues while attempting to reach the site or watch videos.Which is the MOST cost-efficient and scalable deployment that will resolve the issues for users?

A. Reconfigure Amazon EFS to enable maximum I/O

B. Update the blog site to use instance store volumes for storage

C. Configure an Amazon CloudFront distribution

D. Set up an Amazon CloudFront distribution for all site contents, and point the distribution at the ALB

View answer

Correct Answer: C

Question #34

A company is refactoring its on-premises order-processing platform in the AWS Cloud. The platform includes a web front end that is hosted on a fleet of VMs, RabbitMQ to connect the front end to the backend, and a Kubernetes cluster to run a containerized backend system to process the orders. The company does not want to make any major changes to the application.Which solution will meet these requirements with the LEAST operational overhead?

A. Create an AMI of the web server VM

B. Create a custom AWS Lambda runtime to mimic the web server environment

C. Create an AMI of the web server VM

D. Create an AMI of the web server VM

View answer

Correct Answer: A

Question #35

A health insurance company stores personally identifiable information (PII) in an Amazon S3 bucket. The company uses server-side encryption with S3 managed encryption keys (SSE-S3) to encrypt the objects. According to a new requirement, all current and future objects in the S3 bucket must be encrypted by keys that the company’s security team manages. The S3 bucket does not have versioning enabled.Which solution will meet these requirements?

A. In the S3 bucket properties, change the default encryption to SSE-S3 with a customer managed key

B. In the S3 bucket properties, change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS)

C. In the S3 bucket properties, change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS)

D. In the S3 bucket properties, change the default encryption to AES-256 with a customer managed key

View answer

Correct Answer: B

Question #36

A company is refactoring its on-premises order-processing platform in the AWS Cloud. The platform includes a web front end that is hosted on a fleet of VMs, RabbitMQ to connect the front end to the backend, and a Kubernetes cluster to run a containerized backend system to process the orders. The company does not want to make any major changes to the application.Which solution will meet these requirements with the LEAST operational overhead?

A. Create an AMI of the web server VM

B. Create a custom AWS Lambda runtime to mimic the web server environment

C. Create an AMI of the web server VM

D. Create an AMI of the web server VM

View answer

Correct Answer: A

Question #37

A video processing company wants to build a machine learning (ML) model by using 600 TB of compressed data that is stored as thousands of files in the company's on-premises network attached storage system. The company does not have the necessary compute resources on premises for ML experiments and wants to use AWS.The company needs to complete the data transfer to AWS within 3 weeks. The data transfer will be a one-time transfer. The data must be encrypted in transit. The measured upload speed of the company's internet connection is 100 Mbps. and multiple departments share the connection.Which solution will meet these requirements MOST cost-effectively?

A. Order several AWS Snowball Edge Storage Optimized devices by using the AWS Management Console

B. Set up a 10 Gbps AWS Direct Connect connection between the company location and the nearest AWS Region

C. Create a VPN connection between the on-premises network attached storage and the nearest AWS Region

D. Deploy an AWS Storage Gateway file gateway on premises

View answer

Correct Answer: A

Question #38

A company is building an electronic document management system in which users upload their documents. The application stack is entirely serverless and runs on AWS in the eu-central-1 Region. The system includes a web application that uses an Amazon CloudFront distribution for delivery with Amazon S3 as the origin. The web application communicates with Amazon API Gateway Regional endpoints. The API Gateway APIs call AWS Lambda functions that store metadata in an Amazon Aurora Serverless database and put the documents into an S3 bucket.The company is growing steadily and has completed a proof of concept with its largest customer. The company must improve latency outside of Europe.Which combination of actions will meet these requirements? (Choose two.)

A. Enable S3 Transfer Acceleration on the S3 bucket

B. Create an accelerator in AWS Global Accelerator

C. Change the API Gateway Regional endpoints to edge-optimized endpoints

D. Provision the entire stack in two other locations that are spread across the world

E. Add an Amazon RDS proxy between the Lambda functions and the Aurora Serverless database

View answer

Correct Answer: AC

Question #39

A company is refactoring its on-premises order-processing platform in the AWS Cloud. The platform includes a web front end that is hosted on a fleet of VMs, RabbitMQ to connect the front end to the backend, and a Kubernetes cluster to run a containerized backend system to process the orders. The company does not want to make any major changes to the application.Which solution will meet these requirements with the LEAST operational overhead?

A. Create an AMI of the web server VM

B. Create a custom AWS Lambda runtime to mimic the web server environment

C. Create an AMI of the web server VM

D. Create an AMI of the web server VM

View answer

Correct Answer: A

Question #40

A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application.How should a solutions architect configure the web ACLs to meet these requirements?

A. Set the action of the web ACL rules to Count

B. Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible

C. Set the action of the web ACL rules to Block

D. Use only custom rule groups in the web ACLs, and set the action to Allow

View answer

Correct Answer: A

Question #41

A company needs to implement a patching process for its servers. The on-premises servers and Amazon EC2 instances use a variety of tools to perform patching. Management requires a single report showing the patch status of all the servers and instances.Which set of actions should a solutions architect take to meet these requirements?

A. Use AWS Systems Manager to manage patches on the on-premises servers and EC2 instances

B. Use AWS OpsWorks to manage patches on the on-premises servers and EC2 instances

C. Use an Amazon EventBridge rule to apply patches by scheduling an AWS Systems Manager patch remediation job

D. Use AWS OpsWorks to manage patches on the on-premises servers and EC2 instances

View answer

Correct Answer: A

Question #42

A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application.How should a solutions architect configure the web ACLs to meet these requirements?

A. Set the action of the web ACL rules to Count

B. Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible

C. Set the action of the web ACL rules to Block

D. Use only custom rule groups in the web ACLs, and set the action to Allow

View answer

Correct Answer: A

Question #43

A company is using Amazon OpenSearch Service to analyze data. The company loads data into an OpenSearch Service cluster with 10 data nodes from an Amazon S3 bucket that uses S3 Standard storage. The data resides in the cluster for 1 month for read-only analysis. After 1 month, the company deletes the index that contains the data from the cluster. For compliance purposes, the company must retain a copy of all input data.The company is concerned about ongoing costs and asks a solutions architect to recommend a new solution. Which solution will meet these requirements MOST cost-effectively?

A. Replace all the data nodes with UltraWarm nodes to handle the expected capacity

B. Reduce the number of data nodes in the cluster to 2 Add UltraWarm nodes to handle the expected capacity

C. Reduce the number of data nodes in the cluster to 2

D. Reduce the number of data nodes in the cluster to 2

View answer

Correct Answer: B

Question #44

A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization.The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company’s on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts when changes are made to the allow list.The solutions architect must design a solution that distributes the common set of CIDR ranges across all accounts.Which solution meets these requirements with the LEAST amount of operational overhead?

A. Set up an Amazon Simple Notification Service (Amazon SNS) topic in the security team's AWS account

B. Create new customer-managed prefix lists in each AWS account within the organization

C. Create a new customer-managed prefix list in the security team’s AWS account

D. Create an IAM role in each account in the organization

View answer

Correct Answer: C

Question #45

A video processing company wants to build a machine learning (ML) model by using 600 TB of compressed data that is stored as thousands of files in the company's on-premises network attached storage system. The company does not have the necessary compute resources on premises for ML experiments and wants to use AWS.The company needs to complete the data transfer to AWS within 3 weeks. The data transfer will be a one-time transfer. The data must be encrypted in transit. The measured upload speed of the company's internet connection is 100 Mbps. and multiple departments share the connection.Which solution will meet these requirements MOST cost-effectively?

A. Order several AWS Snowball Edge Storage Optimized devices by using the AWS Management Console

B. Set up a 10 Gbps AWS Direct Connect connection between the company location and the nearest AWS Region

C. Create a VPN connection between the on-premises network attached storage and the nearest AWS Region

D. Deploy an AWS Storage Gateway file gateway on premises

View answer

Correct Answer: A

Question #46

A company is running an application in the AWS Cloud. The application collects and stores a large amount of unstructured data in an Amazon S3 bucket. The S3 bucket contains several terabytes of data and uses the S3 Standard storage class. The data increases in size by several gigabytes every day.The company needs to query and analyze the data. The company does not access data that is more than 1 year old. However, the company must retain all the data indefinitely for compliance reasons.Which solution will meet these requirements MOST cost-effectively?

A. Use S3 Select to query the data

B. Use Amazon Redshift Spectrum to query the data

C. Use an AWS Glue Data Catalog and Amazon Athena to query the data

D. Use Amazon Redshift Spectrum to query the data

View answer

Correct Answer: C

Question #47

A company is providing weather data over a REST-based API to several customers. The API is hosted by Amazon API Gateway and is integrated with different AWS Lambda functions for each API operation. The company uses Amazon Route 53 for DNS and has created a resource record of weather.example.com. The company stores data for the API in Amazon DynamoDB tables. The company needs a solution that will give the API the ability to fail over to a different AWS Region.Which solution will meet these requirements?

A. Deploy a new set of Lambda functions in a new Region

B. Deploy a new API Gateway API and Lambda functions in another Region

C. Deploy a new API Gateway API and Lambda functions in another Region

D. Deploy a new API Gateway API in a new Region

View answer

Correct Answer: C

Question #48

A video processing company has an application that downloads images from an Amazon S3 bucket, processes the images, stores a transformed image in a second S3 bucket, and updates metadata about the image in an Amazon DynamoDB table. The application is written in Node.js and runs by using an AWS Lambda function. The Lambda function is invoked when a new image is uploaded to Amazon S3.The application ran without incident for a while. However, the size of the images has grown significantly. The Lambda function is now failing frequently with timeout errors. The function timeout is set to its maximum value. A solutions architect needs to refactor the application’s architecture to prevent invocation failures. The company does not want to manage the underlying infrastructure.Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)

A. Modify the application deployment by building a Docker image that contains the application code

B. Create a new Amazon Elastic Container Service (Amazon ECS) task definition with a compatibility type of AWS Fargate

C. Create an AWS Step Functions state machine with a Parallel state to invoke the Lambda function

D. Create a new Amazon Elastic Container Service (Amazon ECS) task definition with a compatibility type of Amazon EC2

E. Modify the application to store images on Amazon Elastic File System (Amazon EFS) and to store metadata on an Amazon RDS DB instance

View answer

Correct Answer: AB

Question #49

A company uses a service to collect metadata from applications that the company hosts on premises. Consumer devices such as TVs and internet radios access the applications. Many older devices do not support certain HTTP headers and exhibit errors when these headers are present in responses. The company has configured an on-premises load balancer to remove the unsupported headers from responses sent to older devices, which the company identified by the User-Agent headers.The company wants to migrate the service to AWS, adopt serverless technologies, and retain the ability to support the older devices. The company has already migrated the applications into a set of AWS Lambda functions.Which solution will meet these requirements?

A. Create an Amazon CloudFront distribution for the metadata service

B. Create an Amazon API Gateway REST API for the metadata service

C. Create an Amazon API Gateway HTTP API for the metadata service

D. Create an Amazon CloudFront distribution for the metadata service

View answer

Correct Answer: B

Question #50

A company with global offices has a single 1 Gbps AWS Direct Connect connection to a single AWS Region. The company’s on-premises network uses the connection to communicate with the company’s resources in the AWS Cloud. The connection has a single private virtual interface that connects to a single VPC.A solutions architect must implement a solution that adds a redundant Direct Connect connection in the same Region. The solution also must provide connectivity to other Regions through the same pair of Direct Connect connections as the company expands into other Regions.Which solution meets these requirements?

A. Provision a Direct Connect gateway

B. Keep the existing private virtual interface

C. Keep the existing private virtual interface

D. Provision a transit gateway

View answer

Correct Answer: A

Question #51

A financial services company in North America plans to release a new online web application to its customers on AWS. The company will launch the application in the us-east-1 Region on Amazon EC2 instances. The application must be highly available and must dynamically scale to meet user traffic. The company also wants to implement a disaster recovery environment for the application in the us-west-1 Region by using active-passive failover.Which solution will meet these requirements?

A. Create a VPC in us-east-1 and a VPC in us-west-1

B. Create a VPC in us-east-1 and a VPC in us-west-1

C. Create a VPC in us-east-1 and a VPC in us-west-1

D. Create a VPC in us-east-1 and a VPC in us-west-1

View answer

Correct Answer: C

Question #52

A company is using Amazon OpenSearch Service to analyze data. The company loads data into an OpenSearch Service cluster with 10 data nodes from an Amazon S3 bucket that uses S3 Standard storage. The data resides in the cluster for 1 month for read-only analysis. After 1 month, the company deletes the index that contains the data from the cluster. For compliance purposes, the company must retain a copy of all input data.The company is concerned about ongoing costs and asks a solutions architect to recommend a new solution. Which solution will meet these requirements MOST cost-effectively?

A. Replace all the data nodes with UltraWarm nodes to handle the expected capacity

B. Reduce the number of data nodes in the cluster to 2 Add UltraWarm nodes to handle the expected capacity

C. Reduce the number of data nodes in the cluster to 2

D. Reduce the number of data nodes in the cluster to 2

View answer

Correct Answer: B

Question #53

A company’s factory and automation applications are running in a single VPC. More than 20 applications run on a combination of Amazon EC2, Amazon Elastic Container Service (Amazon ECS), and Amazon RDS.The company has software engineers spread across three teams. One of the three teams owns each application, and each time is responsible for the cost and performance of all of its applications. Team resources have tags that represent their application and team. The teams use IAM access for daily activities.The company needs to determine which costs on the monthly AWS bill are attributable to each application or team. The company also must be able to create reports to compare costs from the last 12 months and to help forecast costs for the next 12 months. A solutions architect must recommend an AWS Billing and Cost Management solution that provides these cost reports.Which combination of actions will meet these requirements? (Choose three.)

A. Activate the user-define cost allocation tags that represent the application and the team

B. Activate the AWS generated cost allocation tags that represent the application and the team

C. Create a cost category for each application in Billing and Cost Management

D. Activate IAM access to Billing and Cost Management

E. Create a cost budget

F. Enable Cost Explorer

View answer

Correct Answer: ACF

Question #54

A solutions architect is designing the data storage and retrieval architecture for a new application that a company will be launching soon. The application is designed to ingest millions of small records per minute from devices all around the world. Each record is less than 4 KB in size and needs to be stored in a durable location where it can be retrieved with low latency. The data is ephemeral and the company is required to store the data for 120 days only, after which the data can be deleted.The solutions architect calculates that, during the course of a year, the storage requirements would be about 10-15 TB.Which storage strategy is the MOST cost-effective and meets the design requirements?

A. Design the application to store each incoming record as a single

B. Design the application to store each incoming record in an Amazon DynamoDB table properly configured for the scale

C. Design the application to store each incoming record in a single table in an Amazon RDS MySQL database

D. Design the application to batch incoming records before writing them to an Amazon S3 bucket

View answer

Correct Answer: B

Question #55

A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization.The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company’s on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts when changes are made to the allow list.The solutions architect must design a solution that distributes the common set of CIDR ranges across all accounts.Which solution meets these requirements with the LEAST amount of operational overhead?

A. Set up an Amazon Simple Notification Service (Amazon SNS) topic in the security team's AWS account

B. Create new customer-managed prefix lists in each AWS account within the organization

C. Create a new customer-managed prefix list in the security team’s AWS account

D. Create an IAM role in each account in the organization

View answer

Correct Answer: C

Question #56

A company is developing a new service that will be accessed using TCP on a static port. A solutions architect must ensure that the service is highly available, has redundancy across Availability Zones, and is accessible using the DNS name my.service.com, which is publicly accessible. The service must use fixed address assignments so other companies can add the addresses to their allow lists.Assuming that resources are deployed in multiple Availability Zones in a single Region, which solution will meet these requirements?

A. Create Amazon EC2 instances with an Elastic IP address for each instance

B. Create an Amazon ECS cluster and a service definition for the application

C. Create Amazon EC2 instances for the service

D. Create an Amazon ECS cluster and a service definition for the application

View answer

Correct Answer: C

Question #57

A company is using an on-premises Active Directory service for user authentication. The company wants to use the same authentication service to sign in to the company’s AWS accounts, which are using AWS Organizations. AWS Site-to-Site VPN connectivity already exists between the on-premises environment and all the company’s AWS accounts.The company’s security policy requires conditional access to the accounts based on user groups and roles. User identities must be managed in a single location.Which solution will meet these requirements?

A. Configure AWS IAM Identity Center (AWS Single Sign-On) to connect to Active Directory by using SAML 2

B. Configure AWS IAM Identity Center (AWS Single Sign-On) by using IAM Identity Center as an identity source

C. In one of the company’s AWS accounts, configure AWS Identity and Access Management (IAM) to use a SAML 2

D. In one of the company’s AWS accounts, configure AWS Identity and Access Management (IAM) to use an OpenID Connect (OIDC) identity provider

View answer

Correct Answer: A

Question #58

A company is planning to store a large number of archived documents and make the documents available to employees through the corporate intranet. Employees will access the system by connecting through a client VPN service that is attached to a VPC. The data must not be accessible to the public.The documents that the company is storing are copies of data that is held on physical media elsewhere. The number of requests will be low. Availability and speed of retrieval are not concerns of the company.Which solution will meet these requirements at the LOWEST cost?

A. Create an Amazon S3 bucket

B. Launch an Amazon EC2 instance that runs a web server

C. Launch an Amazon EC2 instance that runs a web server Attach an Amazon Elastic Block Store (Amazon EBS) volume to store the archived data

D. Create an Amazon S3 bucket

View answer

Correct Answer: A

Question #59

A company is refactoring its on-premises order-processing platform in the AWS Cloud. The platform includes a web front end that is hosted on a fleet of VMs, RabbitMQ to connect the front end to the backend, and a Kubernetes cluster to run a containerized backend system to process the orders. The company does not want to make any major changes to the application.Which solution will meet these requirements with the LEAST operational overhead?

A. Create an AMI of the web server VM

B. Create a custom AWS Lambda runtime to mimic the web server environment

C. Create an AMI of the web server VM

D. Create an AMI of the web server VM

View answer

Correct Answer: A

Question #60

A company consists or two separate business units. Each business unit has its own AWS account within a single organization in AWS Organizations. The business units regularly share sensitive documents with each other. To facilitate sharing, the company created an Amazon S3 bucket in each account and configured low-way replication between the S3 buckets. The S3 buckets have millions of objects.Recently, a security audit identified that neither S3 bucket has encryption at rest enabled. Company policy requires that all documents must be stored with encryption at rest. The company wants to implement server-side encryption with Amazon S3 managed encryption keys (SSE-S3).What is the MOST operationally efficient solution that meets these requirements?

A. Turn on SSE-S3 on both S3 buckets

B. Create an AWS Key Management Service (AWS KMS) key in each account

C. Turn on SSE-S3 on both S3 buckets

D. Create an AWS Key Management Service, (AWS KMS) key in each account

View answer

Correct Answer: A

Question #61

A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application.How should a solutions architect configure the web ACLs to meet these requirements?

A. Set the action of the web ACL rules to Count

B. Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible

C. Set the action of the web ACL rules to Block

D. Use only custom rule groups in the web ACLs, and set the action to Allow

View answer

Correct Answer: A

Question #62

A company is hosting a critical application on a single Amazon EC2 instance. The application uses an Amazon ElastiCache for Redis single-node cluster for an in-memory data store. The application uses an Amazon RDS for MariaDB DB instance for a relational database. For the application to function, each piece of the infrastructure must be healthy and must be in an active state.A solutions architect needs to improve the application's architecture so that the infrastructure can automatically recover from failure with the least possible downtime.Which combination of steps will meet these requirements? (Choose three.)

A. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances

B. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances

C. Modify the DB instance to create a read replica in the same Availability Zone

D. Modify the DB instance to create a Multi-AZ deployment that extends across two Availability Zones

E. Create a replication group for the ElastiCache for Redis cluster

F. Create a replication group for the ElastiCache for Redis cluster

View answer

Correct Answer: ADF

Question #63

A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application.How should a solutions architect configure the web ACLs to meet these requirements?

A. Set the action of the web ACL rules to Count

B. Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible

C. Set the action of the web ACL rules to Block

D. Use only custom rule groups in the web ACLs, and set the action to Allow

View answer

Correct Answer: A

Question #64

A company is using an on-premises Active Directory service for user authentication. The company wants to use the same authentication service to sign in to the company’s AWS accounts, which are using AWS Organizations. AWS Site-to-Site VPN connectivity already exists between the on-premises environment and all the company’s AWS accounts.The company’s security policy requires conditional access to the accounts based on user groups and roles. User identities must be managed in a single location.Which solution will meet these requirements?

A. Configure AWS IAM Identity Center (AWS Single Sign-On) to connect to Active Directory by using SAML 2

B. Configure AWS IAM Identity Center (AWS Single Sign-On) by using IAM Identity Center as an identity source

C. In one of the company’s AWS accounts, configure AWS Identity and Access Management (IAM) to use a SAML 2

D. In one of the company’s AWS accounts, configure AWS Identity and Access Management (IAM) to use an OpenID Connect (OIDC) identity provider

View answer

Correct Answer: A

Question #65

A company has VPC flow logs enabled for Its NAT gateway. The company is seeing Action = ACCEPT for inbound traffic that comes from public IP address 198.51.100.2 destined for a private Amazon EC2 instance.A solutions architect must determine whether the traffic represents unsolicited inbound connections from the internet. The first two octets of the VPC CIDR block are 203.0.Which set of steps should the solutions architect take to meet these requirements?

A. Open the AWS CloudTrail console

B. Open the Amazon CloudWatch console

C. Open the AWS CloudTrail console

D. Open the Amazon CloudWatch console

View answer

Correct Answer: B

Question #66

A company has applications in an AWS account that is named Source. The account is in an organization in AWS Organizations. One of the applications uses AWS Lambda functions and stores inventory data in an Amazon Aurora database. The application deploys the Lambda functions by using a deployment package. The company has configured automated backups for Aurora.The company wants to migrate the Lambda functions and the Aurora database to a new AWS account that is named Target. The application processes critical data, so the company must minimize downtime.Which solution will meet these requirements?

A. Download the Lambda function deployment package from the Source account

B. Download the Lambda function deployment package from the Source account

C. Use AWS Resource Access Manager (AWS RAM) to share the Lambda functions and the Aurora DB cluster with the Target account

D. Use AWS Resource Access Manager (AWS RAM) to share the Lambda functions with the Target account

View answer

Correct Answer: B

Question #67

A company is using AWS Organizations to manage multiple AWS accounts. For security purposes, the company requires the creation of an Amazon Simple Notification Service (Amazon SNS) topic that enables integration with a third-party alerting system in all the Organizations member accounts.A solutions architect used an AWS CloudFormation template to create the SNS topic and stack sets to automate the deployment of CloudFormation stacks. Trusted access has been enabled in Organizations.What should the solutions architect do to deploy the CloudFormation StackSets in all AWS accounts?

A. reate a stack set in the Organizations member accounts

B. reate stacks in the Organizations member accounts

C. reate a stack set in the Organizations management account

D. reate stacks in the Organizations management account

View answer

Correct Answer: C

Question #68

A company is running an application in the AWS Cloud. The application collects and stores a large amount of unstructured data in an Amazon S3 bucket. The S3 bucket contains several terabytes of data and uses the S3 Standard storage class. The data increases in size by several gigabytes every day.The company needs to query and analyze the data. The company does not access data that is more than 1 year old. However, the company must retain all the data indefinitely for compliance reasons.Which solution will meet these requirements MOST cost-effectively?

A. Use S3 Select to query the data

B. Use Amazon Redshift Spectrum to query the data

C. Use an AWS Glue Data Catalog and Amazon Athena to query the data

D. Use Amazon Redshift Spectrum to query the data

View answer

Correct Answer: C

Question #69

A company runs an IoT platform on AWS. IoT sensors in various locations send data to the company’s Node.js API servers on Amazon EC2 instances running behind an Application Load Balancer. The data is stored in an Amazon RDS MySQL DB instance that uses a 4 TB General Purpose SSD volume.The number of sensors the company has deployed in the field has increased over time, and is expected to grow significantly. The API servers are consistently overloaded and RDS metrics show high write latency.Which of the following steps together will resolve the issues permanently and enable growth as new sensors are provisioned, while keeping this platform cost-efficient? (Choose two.)

A. Resize the MySQL General Purpose SSD storage to 6 TB to improve the volume’s IOPS

B. Re-architect the database tier to use Amazon Aurora instead of an RDS MySQL DB instance and add read replicas

C. Leverage Amazon Kinesis Data Streams and AWS Lambda to ingest and process the raw data

D. Use AWS X-Ray to analyze and debug application issues and add more API servers to match the load

E. Re-architect the database tier to use Amazon DynamoDB instead of an RDS MySQL DB instance

View answer

Correct Answer: CE

Question #70

A company used Amazon EC2 instances to deploy a web fleet to host a blog site. The EC2 instances are behind an Application Load Balancer (ALB) and are configured in an Auto Scaling group. The web application stores all blog content on an Amazon EFS volume.The company recently added a feature for bloggers to add video to their posts, attracting 10 times the previous user traffic. At peak times of day, users report buffering and timeout issues while attempting to reach the site or watch videos.Which is the MOST cost-efficient and scalable deployment that will resolve the issues for users?

A. Reconfigure Amazon EFS to enable maximum I/O

B. Update the blog site to use instance store volumes for storage

C. Configure an Amazon CloudFront distribution

D. Set up an Amazon CloudFront distribution for all site contents, and point the distribution at the ALB

View answer

Correct Answer: C

Question #71

A company has an environment that has a single AWS account. A solutions architect is reviewing the environment to recommend what the company could improve specifically in terms of access to the AWS Management Console. The company’s IT support workers currently access the console for administrative tasks, authenticating with named IAM users that have been mapped to their job role.The IT support workers no longer want to maintain both their Active Directory and IAM user accounts. They want to be able to access the console by using their existing Active Directory credentials. The solutions architect is using AWS IAM Identity Center (AWS Single Sign-On) to implement this functionality.Which solution will meet these requirements MOST cost-effectively?

A. Create an organization in AWS Organizations

B. Create an organization in AWS Organizations

C. Create an organization in AWS Organizations

D. Create an organization in AWS Organizations

View answer

Correct Answer: D

Question #72

A company is using multiple AWS accounts. The DNS records are stored in a private hosted zone for Amazon Route 53 in Account A. The company’s applications and databases are running in Account B.A solutions architect will deploy a two-tier application in a new VPC. To simplify the configuration, the db.example.com CNAME record set for the Amazon RDS endpoint was created in a private hosted zone for Amazon Route 53.During deployment, the application failed to start. Troubleshooting revealed that db.example.com is not resolvable on the Amazon EC2 instance. The solutions architect confirmed that the record set was created correctly in Route 53.Which combination of steps should the solutions architect take to resolve this issue? (Choose two.)

A. Deploy the database on a separate EC2 instance in the new VPC

B. Use SSH to connect to the application tier EC2 instance

C. Create an authorization to associate the private hosted zone in Account A with the new VPC in Account B

D. Create a private hosted zone for the example com domain in Account B

E. Associate a new VPC in Account B with a hosted zone in Account A

View answer

Correct Answer: CE

Question #73

A company uses an on-premises data analytics platform. The system is highly available in a fully redundant configuration across 12 servers in the company’s data center.The system runs scheduled jobs, both hourly and daily, in addition to one-time requests from users. Scheduled jobs can take between 20 minutes and 2 hours to finish running and have tight SLAs. The scheduled jobs account for 65% of the system usage. User jobs typically finish running in less than 5 minutes and have no SLA. The user jobs account for 35% of system usage. During system failures, scheduled jobs must continue to meet SLAs. However, user jobs can be delayed.A solutions architect needs to move the system to Amazon EC2 instances and adopt a consumption-based model to reduce costs with no long-term commitments. The solution must maintain high availability and must not affect the SLAs.Which solution will meet these requirements MOST cost-effectively?

A. Split the 12 instances across two Availability Zones in the chosen AWS Region

B. Split the 12 instances across three Availability Zones in the chosen AWS Region

C. Split the 12 instances across three Availability Zones in the chosen AWS Region

D. Split the 12 instances across three Availability Zones in the chosen AWS Region

View answer

Correct Answer: D

Question #74

A company is hosting a monolithic REST-based API for a mobile app on five Amazon EC2 instances in public subnets of a VPC. Mobile clients connect to the API by using a domain name that is hosted on Amazon Route 53. The company has created a Route 53 multivalue answer routing policy with the IP addresses of all the EC2 instances. Recently, the app has been overwhelmed by large and sudden increases to traffic. The app has not been able to keep up with the traffic.A solutions architect needs to implement a solution so that the app can handle the new and varying load. Which solution will meet these requirements with the LEAST operational overhead?

A. Separate the API into individual AWS Lambda functions

B. Containerize the API logic

C. Create an Auto Scaling group

D. Create an Application Load Balancer (ALB) in front of the API

View answer

Correct Answer: D

Question #75

A company that has multiple AWS accounts is using AWS Organizations. The company’s AWS accounts host VPCs, Amazon EC2 instances, and containers.The company’s compliance team has deployed a security tool in each VPC where the company has deployments. The security tools run on EC2 instances and send information to the AWS account that is dedicated for the compliance team. The company has tagged all the compliance-related resources with a key of “costCenter” and a value or “compliance”.The company wants to identify the cost of the security tools that are running on the EC2 instances so that the company can charge the compliance team’s AWS account. The cost calculation must be as accurate as possible.What should a solutions architect do to meet these requirements?

A. In the management account of the organization, activate the costCenter user-defined tag

B. In the member accounts of the organization, activate the costCenter user-defined tag

C. In the member accounts of the organization activate the costCenter user-defined tag

D. Create a custom report in the organization view in AWS Trusted Advisor

View answer

Correct Answer: A

Question #76

A company is refactoring its on-premises order-processing platform in the AWS Cloud. The platform includes a web front end that is hosted on a fleet of VMs, RabbitMQ to connect the front end to the backend, and a Kubernetes cluster to run a containerized backend system to process the orders. The company does not want to make any major changes to the application.Which solution will meet these requirements with the LEAST operational overhead?

A. Create an AMI of the web server VM

B. Create a custom AWS Lambda runtime to mimic the web server environment

C. Create an AMI of the web server VM

D. Create an AMI of the web server VM

View answer

Correct Answer: A

Question #77

A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application.How should a solutions architect configure the web ACLs to meet these requirements?

A. Set the action of the web ACL rules to Count

B. Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible

C. Set the action of the web ACL rules to Block

D. Use only custom rule groups in the web ACLs, and set the action to Allow

View answer

Correct Answer: A

Question #78

A company uses a service to collect metadata from applications that the company hosts on premises. Consumer devices such as TVs and internet radios access the applications. Many older devices do not support certain HTTP headers and exhibit errors when these headers are present in responses. The company has configured an on-premises load balancer to remove the unsupported headers from responses sent to older devices, which the company identified by the User-Agent headers.The company wants to migrate the service to AWS, adopt serverless technologies, and retain the ability to support the older devices. The company has already migrated the applications into a set of AWS Lambda functions.Which solution will meet these requirements?

A. Create an Amazon CloudFront distribution for the metadata service

B. Create an Amazon API Gateway REST API for the metadata service

C. Create an Amazon API Gateway HTTP API for the metadata service

D. Create an Amazon CloudFront distribution for the metadata service

View answer

Correct Answer: B

Question #79

A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application.How should a solutions architect configure the web ACLs to meet these requirements?

A. Set the action of the web ACL rules to Count

B. Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible

C. Set the action of the web ACL rules to Block

D. Use only custom rule groups in the web ACLs, and set the action to Allow

View answer

Correct Answer: A

Question #80

A company has its cloud infrastructure on AWS. A solutions architect needs to define the infrastructure as code. The infrastructure is currently deployed in one AWS Region. The company’s business expansion plan includes deployments in multiple Regions across multiple AWS accounts.What should the solutions architect do to meet these requirements?

A. Use AWS CloudFormation templates

B. Use AWS Organizations

C. Use AWS Organizations and AWS CloudFormation StackSets

D. Use nested stacks with AWS CloudFormation templates

View answer

Correct Answer: C

Question #81

A solutions architect is designing the data storage and retrieval architecture for a new application that a company will be launching soon. The application is designed to ingest millions of small records per minute from devices all around the world. Each record is less than 4 KB in size and needs to be stored in a durable location where it can be retrieved with low latency. The data is ephemeral and the company is required to store the data for 120 days only, after which the data can be deleted.The solutions architect calculates that, during the course of a year, the storage requirements would be about 10-15 TB.Which storage strategy is the MOST cost-effective and meets the design requirements?

A. Design the application to store each incoming record as a single

B. Design the application to store each incoming record in an Amazon DynamoDB table properly configured for the scale

C. Design the application to store each incoming record in a single table in an Amazon RDS MySQL database

D. Design the application to batch incoming records before writing them to an Amazon S3 bucket

View answer

Correct Answer: B

Question #82

A company wants to migrate an application to Amazon EC2 from VMware Infrastructure that runs in an on-premises data center. A solutions architect must preserve the software and configuration settings during the migration.What should the solutions architect do to meet these requirements?

A. Configure the AWS DataSync agent to start replicating the data store to Amazon FSx for Windows File Server

B. Use the VMware vSphere client to export the application as an image in Open Virtualization Format (OVF) format

C. Configure AWS Storage Gateway for files service to export a Common Internet File System (CIFS) share

D. Create a managed-instance activation for a hybrid environment in AWS Systems Manager

View answer

Correct Answer: B

Question #83

A company has VPC flow logs enabled for Its NAT gateway. The company is seeing Action = ACCEPT for inbound traffic that comes from public IP address 198.51.100.2 destined for a private Amazon EC2 instance.A solutions architect must determine whether the traffic represents unsolicited inbound connections from the internet. The first two octets of the VPC CIDR block are 203.0.Which set of steps should the solutions architect take to meet these requirements?

A. Open the AWS CloudTrail console

B. Open the Amazon CloudWatch console

C. Open the AWS CloudTrail console

D. Open the Amazon CloudWatch console

View answer

Correct Answer: B

Question #84

A company is providing weather data over a REST - based API to several customers. The API is hosted by Amazon API Gateway and is integrated with different AWS Lambda functions for each API operation. The company uses Amazon Route 53 for DNS and has created a resource record of weather.example.com. The company stores data for the API in Amazon DynamoDB tables. The company needs a solution that will give the API the ability to fail over to a different AWS Region. Which solution will meet these requirements?

A. Deploy a new set of Lambda functions in a new Region

B. Deploy a new API Gateway API and Lambda functions in another Region

C. Deploy a new API Gateway API and Lambda functions in another Region

D. Deploy a new API Gateway API in a new Region

View answer

Correct Answer: C

Question #85

A company is running an application in the AWS Cloud. The application collects and stores a large amount of unstructured data in an Amazon S3 bucket. The S3 bucket contains several terabytes of data and uses the S3 Standard storage class. The data increases in size by several gigabytes every day.The company needs to query and analyze the data. The company does not access data that is more than 1 year old. However, the company must retain all the data indefinitely for compliance reasons.Which solution will meet these requirements MOST cost-effectively?

A. Use S3 Select to query the data

B. Use Amazon Redshift Spectrum to query the data

C. Use an AWS Glue Data Catalog and Amazon Athena to query the data

D. Use Amazon Redshift Spectrum to query the data

View answer

Correct Answer: C

Question #86

A video streaming company recently launched a mobile app for video sharing. The app uploads various files to an Amazon S3 bucket in the us-east-1 Region. The files range in size from 1 GB to 10 GB.Users who access the app from Australia have experienced uploads that take long periods of time. Sometimes the files fail to completely upload for these users. A solutions architect must improve the app’s performance for these uploads.Which solutions will meet these requirements? (Choose two.)

A. Enable S3 Transfer Acceleration on the S3 bucket

B. Configure an S3 bucket in each Region to receive the uploads

C. Set up Amazon Route 53 with latency-based routing to route the uploads to the nearest S3 bucket Region

D. Configure the app to break the video files into chunks

E. Modify the app to add random prefixes to the files before uploading

View answer

Correct Answer: AD

Question #87

A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization.The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company’s on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts when changes are made to the allow list.The solutions architect must design a solution that distributes the common set of CIDR ranges across all accounts.Which solution meets these requirements with the LEAST amount of operational overhead?

A. Set up an Amazon Simple Notification Service (Amazon SNS) topic in the security team's AWS account

B. Create new customer-managed prefix lists in each AWS account within the organization

C. Create a new customer-managed prefix list in the security team’s AWS account

D. Create an IAM role in each account in the organization

View answer

Correct Answer: C

Question #88

A company is storing data in several Amazon DynamoDB tables. A solutions architect must use a serverless architecture to make the data accessible publicly through a simple API over HTTPS. The solution must scale automatically in response to demand.Which solutions meet these requirements? (Choose two.)

A. Create an Amazon API Gateway REST API

B. Create an Amazon API Gateway HTTP API

C. Create an Amazon API Gateway HTTP API

D. Create an accelerator in AWS Global Accelerator

E. Create a Network Load Balancer

View answer

Correct Answer: AC

Question #89

A company recently acquired several other companies. Each company has a separate AWS account with a different billing and reporting method. The acquiring company has consolidated all the accounts into one organization in AWS Organizations. However, the acquiring company has found it difficult to generate a cost report that contains meaningful groups for all the teams.The acquiring company’s finance team needs a solution to report on costs for all the companies through a self-managed application.Which solution will meet these requirements?

A. Create an AWS Cost and Usage Report for the organization

B. Create an AWS Cost and Usage Report for the organization

C. Create an Amazon QuickSight dataset that receives spending information from the AWS Price List Query API

D. Use the AWS Price List Query API to collect account spending information

View answer

Correct Answer: A

Question #90

A company runs a Python script on an Amazon EC2 instance to process data. The script runs every 10 minutes. The script ingests files from an Amazon S3 bucket and processes the files. On average, the script takes approximately 5 minutes to process each file The script will not reprocess a file that the script has already processed.The company reviewed Amazon CloudWatch metrics and noticed that the EC2 instance is idle for approximately 40% of the time because of the file processing speed. The company wants to make the workload highly available and scalable. The company also wants to reduce long-term management overhead.Which solution will meet these requirements MOST cost-effectively?

A. Migrate the data processing script to an AWS Lambda function

B. Create an Amazon Simple Queue Service (Amazon SQS) queue

C. Migrate the data processing script to a container image

D. Migrate the data processing script to a container image that runs on Amazon Elastic Container Service (Amazon ECS) on AWS Fargate

View answer

Correct Answer: A

Question #91

A company has a serverless application comprised of Amazon CloudFront, Amazon API Gateway, and AWS Lambda functions. The current deployment process of the application code is to create a new version number of the Lambda function and run an AWS CLI script to update. If the new function version has errors, another CLI script reverts by deploying the previous working version of the function. The company would like to decrease the time to deploy new versions of the application logic provided by the Lambda functions, and also reduce the time to detect and revert when errors are identified.How can this be accomplished?

A. Create and deploy nested AWS CloudFormation stacks with the parent stack consisting of the AWS CloudFront distribution and API Gateway, and the child stack containing the Lambda function

B. Use AWS SAM and built-in AWS CodeDeploy to deploy the new Lambda version, gradually shift traffic to the new version, and use pre-traffic and post-traffic test functions to verify code

C. Refactor the AWS CLI scripts into a single script that deploys the new Lambda version

D. Create and deploy an AWS CloudFormation stack that consists of a new API Gateway endpoint that references the new Lambda version

View answer

Correct Answer: B

Question #92

A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application.How should a solutions architect configure the web ACLs to meet these requirements?

A. Set the action of the web ACL rules to Count

B. Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible

C. Set the action of the web ACL rules to Block

D. Use only custom rule groups in the web ACLs, and set the action to Allow

View answer

Correct Answer: A

Question #93

A company consists or two separate business units. Each business unit has its own AWS account within a single organization in AWS Organizations. The business units regularly share sensitive documents with each other. To facilitate sharing, the company created an Amazon S3 bucket in each account and configured low-way replication between the S3 buckets. The S3 buckets have millions of objects.Recently, a security audit identified that neither S3 bucket has encryption at rest enabled. Company policy requires that all documents must be stored with encryption at rest. The company wants to implement server-side encryption with Amazon S3 managed encryption keys (SSE-S3).What is the MOST operationally efficient solution that meets these requirements?

A. Turn on SSE-S3 on both S3 buckets

B. Create an AWS Key Management Service (AWS KMS) key in each account

C. Turn on SSE-S3 on both S3 buckets

D. Create an AWS Key Management Service, (AWS KMS) key in each account

View answer

Correct Answer: A

Question #94

A company has VPC flow logs enabled for Its NAT gateway. The company is seeing Action = ACCEPT for inbound traffic that comes from public IP address 198.51.100.2 destined for a private Amazon EC2 instance.A solutions architect must determine whether the traffic represents unsolicited inbound connections from the internet. The first two octets of the VPC CIDR block are 203.0.Which set of steps should the solutions architect take to meet these requirements?

A. Open the AWS CloudTrail console

B. Open the Amazon CloudWatch console

C. Open the AWS CloudTrail console

D. Open the Amazon CloudWatch console

View answer

Correct Answer: B

Question #95

A company has VPC flow logs enabled for Its NAT gateway. The company is seeing Action = ACCEPT for inbound traffic that comes from public IP address 198.51.100.2 destined for a private Amazon EC2 instance.A solutions architect must determine whether the traffic represents unsolicited inbound connections from the internet. The first two octets of the VPC CIDR block are 203.0.Which set of steps should the solutions architect take to meet these requirements?

A. Open the AWS CloudTrail console

B. Open the Amazon CloudWatch console

C. Open the AWS CloudTrail console

D. Open the Amazon CloudWatch console

View answer

Correct Answer: B

Question #96

A company has a monolithic application that is critical to the company’s business. The company hosts the application on an Amazon EC2 instance that runs Amazon Linux 2. The company’s application team receives a directive from the legal department to back up the data from the instance’s encrypted Amazon Elastic Block Store (Amazon EBS) volume to an Amazon S3 bucket. The application team does not have the administrative SSH key pair for the instance. The application must continue to serve the users.Which solution will meet these requirements?

A. Attach a role to the instance with permission to write to Amazon S3

B. Create an image of the instance with the reboot option turned on

C. Take a snapshot of the EBS volume by using Amazon Data Lifecycle Manager (Amazon DLM)

D. Create an image of the instance

View answer

Correct Answer: A

Question #97

A software company has deployed an application that consumes a REST API by using Amazon API Gateway, AWS Lambda functions, and an Amazon DynamoDB table. The application is showing an increase in the number of errors during PUT requests. Most of the PUT calls come from a small number of clients that are authenticated with specific API keys.A solutions architect has identified that a large number of the PUT requests originate from one client. The API is noncritical, and clients can tolerate retries of unsuccessful calls. However, the errors are displayed to customers and are causing damage to the API’s reputation.What should the solutions architect recommend to improve the customer experience?

A. Implement retry logic with exponential backoff and irregular variation in the client application

B. Implement API throttling through a usage plan at the API Gateway level

C. Turn on API caching to enhance responsiveness for the production stage

D. Implement reserved concurrency at the Lambda function level to provide the resources that are needed during sudden increases in traffic

View answer

Correct Answer: B

Question #98

A company’s factory and automation applications are running in a single VPC. More than 20 applications run on a combination of Amazon EC2, Amazon Elastic Container Service (Amazon ECS), and Amazon RDS.The company has software engineers spread across three teams. One of the three teams owns each application, and each time is responsible for the cost and performance of all of its applications. Team resources have tags that represent their application and team. The teams use IAM access for daily activities.The company needs to determine which costs on the monthly AWS bill are attributable to each application or team. The company also must be able to create reports to compare costs from the last 12 months and to help forecast costs for the next 12 months. A solutions architect must recommend an AWS Billing and Cost Management solution that provides these cost reports.Which combination of actions will meet these requirements? (Choose three.)

A. Activate the user-define cost allocation tags that represent the application and the team

B. Activate the AWS generated cost allocation tags that represent the application and the team

C. Create a cost category for each application in Billing and Cost Management

D. Activate IAM access to Billing and Cost Management

E. Create a cost budget

F. Enable Cost Explorer

View answer

Correct Answer: ACF

Question #99

A company is running an application in the AWS Cloud. The application collects and stores a large amount of unstructured data in an Amazon S3 bucket. The S3 bucket contains several terabytes of data and uses the S3 Standard storage class. The data increases in size by several gigabytes every day.The company needs to query and analyze the data. The company does not access data that is more than 1 year old. However, the company must retain all the data indefinitely for compliance reasons.Which solution will meet these requirements MOST cost-effectively?

A. Use S3 Select to query the data

B. Use Amazon Redshift Spectrum to query the data

C. Use an AWS Glue Data Catalog and Amazon Athena to query the data

D. Use Amazon Redshift Spectrum to query the data

View answer

Correct Answer: C

Question #100

A company is running an application in the AWS Cloud. The application collects and stores a large amount of unstructured data in an Amazon S3 bucket. The S3 bucket contains several terabytes of data and uses the S3 Standard storage class. The data increases in size by several gigabytes every day.The company needs to query and analyze the data. The company does not access data that is more than 1 year old. However, the company must retain all the data indefinitely for compliance reasons.Which solution will meet these requirements MOST cost-effectively?

A. Use S3 Select to query the data

B. Use Amazon Redshift Spectrum to query the data

C. Use an AWS Glue Data Catalog and Amazon Athena to query the data

D. Use Amazon Redshift Spectrum to query the data

View answer

Correct Answer: C

Question #101

A solutions architect has developed a web application that uses an Amazon API Gateway Regional endpoint and an AWS Lambda function. The consumers of the web application are all close to the AWS Region where the application will be deployed. The Lambda function only queries an Amazon Aurora MySQL database. The solutions architect has configured the database to have three read replicas.During testing, the application does not meet performance requirements. Under high load, the application opens a large number of database connections. The solutions architect must improve the application’s performance.Which actions should the solutions architect take to meet these requirements? (Choose two.)

A. Use the cluster endpoint of the Aurora database

B. Use RDS Proxy to set up a connection pool to the reader endpoint of the Aurora database

C. Use the Lambda Provisioned Concurrency feature

D. Move the code for opening the database connection in the Lambda function outside of the event handler

E. Change the API Gateway endpoint to an edge-optimized endpoint

View answer

Correct Answer: BD

Question #102

A company is running a web application in the AWS Cloud. The application consists of dynamic content that is created on a set of Amazon EC2 instances. The EC2 instances run in an Auto Scaling group that is configured as a target group for an Application Load Balancer (ALB).The company is using an Amazon CloudFront distribution to distribute the application globally. The CloudFront distribution uses the ALB as an origin. The company uses Amazon Route 53 for DNS and has created an A record of www.example.com for the CloudFront distribution.A solutions architect must configure the application so that itis highly available and fault tolerant.Which solution meets these requirements?

A. Provision a full, secondary application deployment in a different AWS Region

B. Provision an ALB, an Auto Scaling group, and EC2 instances in a different AWS Region

C. Provision an Auto Scaling group and EC2 instances in a different AWS Region

D. Provision a full, secondary application deployment in a different AWS Region

View answer

Correct Answer: B

Question #103

A company consists or two separate business units. Each business unit has its own AWS account within a single organization in AWS Organizations. The business units regularly share sensitive documents with each other. To facilitate sharing, the company created an Amazon S3 bucket in each account and configured low-way replication between the S3 buckets. The S3 buckets have millions of objects.Recently, a security audit identified that neither S3 bucket has encryption at rest enabled. Company policy requires that all documents must be stored with encryption at rest. The company wants to implement server-side encryption with Amazon S3 managed encryption keys (SSE-S3).What is the MOST operationally efficient solution that meets these requirements?

A. Turn on SSE-S3 on both S3 buckets

B. Create an AWS Key Management Service (AWS KMS) key in each account

C. Turn on SSE-S3 on both S3 buckets

D. Create an AWS Key Management Service, (AWS KMS) key in each account

View answer

Correct Answer: A

Question #104

A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application.How should a solutions architect configure the web ACLs to meet these requirements?

A. Set the action of the web ACL rules to Count

B. Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible

C. Set the action of the web ACL rules to Block

D. Use only custom rule groups in the web ACLs, and set the action to Allow

View answer

Correct Answer: A

Question #105

A company recently acquired several other companies. Each company has a separate AWS account with a different billing and reporting method. The acquiring company has consolidated all the accounts into one organization in AWS Organizations. However, the acquiring company has found it difficult to generate a cost report that contains meaningful groups for all the teams.The acquiring company’s finance team needs a solution to report on costs for all the companies through a self-managed application.Which solution will meet these requirements?

A. Create an AWS Cost and Usage Report for the organization

B. Create an AWS Cost and Usage Report for the organization

C. Create an Amazon QuickSight dataset that receives spending information from the AWS Price List Query API

D. Use the AWS Price List Query API to collect account spending information

View answer

Correct Answer: A

Question #106

A company has VPC flow logs enabled for Its NAT gateway. The company is seeing Action = ACCEPT for inbound traffic that comes from public IP address 198.51.100.2 destined for a private Amazon EC2 instance.A solutions architect must determine whether the traffic represents unsolicited inbound connections from the internet. The first two octets of the VPC CIDR block are 203.0.Which set of steps should the solutions architect take to meet these requirements?

A. Open the AWS CloudTrail console

B. Open the Amazon CloudWatch console

C. Open the AWS CloudTrail console

D. Open the Amazon CloudWatch console

View answer

Correct Answer: B

Question #107

A company is refactoring its on-premises order-processing platform in the AWS Cloud. The platform includes a web front end that is hosted on a fleet of VMs, RabbitMQ to connect the front end to the backend, and a Kubernetes cluster to run a containerized backend system to process the orders. The company does not want to make any major changes to the application.Which solution will meet these requirements with the LEAST operational overhead?

A. Create an AMI of the web server VM

B. Create a custom AWS Lambda runtime to mimic the web server environment

C. Create an AMI of the web server VM

D. Create an AMI of the web server VM

View answer

Correct Answer: A

Question #108

A company has migrated Its forms-processing application to AWS. When users interact with the application, they upload scanned forms as files through a web application. A database stores user metadata and references to files that are stored in Amazon S3. The web application runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.When forms are uploaded, the application sends notifications to a team through Amazon Simple Notification Service (Amazon SNS). A team member then logs in and processes each form. The team member performs data validation on the form and extracts relevant data before entering the information into another system that uses an API.A solutions architect needs to automate the manual processing of the forms. The solution must provide accurate form extraction. minimize time to market, and minimize tong-term operational overhead.Which solution will meet these requirements?

A. Develop custom libraries to perform optical character recognition (OCR) on the forms

B. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

C. Host a new application tier on EC2 instances

D. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

View answer

Correct Answer: D

Question #109

A company has an application that runs on Amazon EC2 instances. A solutions architect is designing VPC infrastructure in an AWS Region where the application needs to access an Amazon Aurora DB Cluster. The EC2 instances are all associated with the same security group. The DB cluster is associated with its own security group.The solutions architect needs to add rules to the security groups to provide the application with least privilege access to the DB Cluster.Which combination of steps will meet these requirements? (Choose two.)

A. Add an inbound rule to the EC2 instances' security group

B. Add an outbound rule to the EC2 instances' security group

C. Add an inbound rule to the DB cluster's security group

D. Add an outbound rule to the DB cluster's security group

E. Add an outbound rule to the DB cluster's security group

View answer

Correct Answer: BC

Question #110

A company recently deployed an application on AWS. The application uses Amazon DynamoDB. The company measured the application load and configured the RCUs and WCUs on the DynamoDB table to match the expected peak load. The peak load occurs once a week for a 4-hour period and is double the average load. The application load is close to the average load for the rest of the week. The access pattern includes many more writes to the table than reads of the table.A solutions architect needs to implement a solution to minimize the cost of the table.Which solution will meet these requirements?

A. Use AWS Application Auto Scaling to increase capacity during the peak period

B. Configure on-demand capacity mode for the table

C. Configure DynamoDB Accelerator (DAX) in front of the table

D. Configure DynamoDB Accelerator (DAX) in front of the table

View answer

Correct Answer: A

Question #111

A software company has deployed an application that consumes a REST API by using Amazon API Gateway, AWS Lambda functions, and an Amazon DynamoDB table. The application is showing an increase in the number of errors during PUT requests. Most of the PUT calls come from a small number of clients that are authenticated with specific API keys.A solutions architect has identified that a large number of the PUT requests originate from one client. The API is noncritical, and clients can tolerate retries of unsuccessful calls. However, the errors are displayed to customers and are causing damage to the API’s reputation.What should the solutions architect recommend to improve the customer experience?

A. Implement retry logic with exponential backoff and irregular variation in the client application

B. Implement API throttling through a usage plan at the API Gateway level

C. Turn on API caching to enhance responsiveness for the production stage

D. Implement reserved concurrency at the Lambda function level to provide the resources that are needed during sudden increases in traffic

View answer

Correct Answer: B

Question #112

A company plans to refactor a monolithic application into a modern application design deployed on AWS. The CI/CD pipeline needs to be upgraded to support the modern design for the application with the following requirements:-It should allow changes to be released several times every hour.-It should be able to roll back the changes as quickly as possible.Which design will meet these requirements?

A. Deploy a CI/CD pipeline that incorporates AMIs to contain the application and their configurations

B. Specify AWS Elastic Beanstalk to stage in a secondary environment as the deployment target for the CI/CD pipeline of the application

C. Use AWS Systems Manager to re-provision the infrastructure for each deployment

D. Roll out the application updates as part of an Auto Scaling event using prebuilt AMIs

View answer

Correct Answer: B

Question #113

A financial company uses AWS Control Tower to govern multiple AWS accounts. The company must comply with data residency regulations. The regulations require customer data and backups to remain only in specific approved AWS Regions. Additionally, the company must retain control of the cryptographic root of trust. The company must use encryption keys in hardware security modules (HSMs) that the company operates in-country. The company needs a preventive control that blocks resource creation outside the approved Regions.Which solution will meet these requirements with the LEAST operational overhead?

A. se standard AWS KMS customer managed keys for encryption

B. se an AWS KMS custom key store backed by an AWS CloudHSM cluster deployed in one approved Region

C. se AWS KMS multi-Region keys for all encryption

D. se an AWS KMS external key store (XKS) backed by the company's in-country HSMs for encryption

View answer

Correct Answer: D

Question #114

A company has migrated Its forms-processing application to AWS. When users interact with the application, they upload scanned forms as files through a web application. A database stores user metadata and references to files that are stored in Amazon S3. The web application runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.When forms are uploaded, the application sends notifications to a team through Amazon Simple Notification Service (Amazon SNS). A team member then logs in and processes each form. The team member performs data validation on the form and extracts relevant data before entering the information into another system that uses an API.A solutions architect needs to automate the manual processing of the forms. The solution must provide accurate form extraction. minimize time to market, and minimize tong-term operational overhead.Which solution will meet these requirements?

A. Develop custom libraries to perform optical character recognition (OCR) on the forms

B. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

C. Host a new application tier on EC2 instances

D. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

View answer

Correct Answer: D

Question #115

A company that has multiple AWS accounts is using AWS Organizations. The company’s AWS accounts host VPCs, Amazon EC2 instances, and containers.The company’s compliance team has deployed a security tool in each VPC where the company has deployments. The security tools run on EC2 instances and send information to the AWS account that is dedicated for the compliance team. The company has tagged all the compliance-related resources with a key of “costCenter” and a value or “compliance”.The company wants to identify the cost of the security tools that are running on the EC2 instances so that the company can charge the compliance team’s AWS account. The cost calculation must be as accurate as possible.What should a solutions architect do to meet these requirements?

A. In the management account of the organization, activate the costCenter user-defined tag

B. In the member accounts of the organization, activate the costCenter user-defined tag

C. In the member accounts of the organization activate the costCenter user-defined tag

D. Create a custom report in the organization view in AWS Trusted Advisor

View answer

Correct Answer: A

Question #116

A company is hosting a three-tier web application in an on-premises environment. Due to a recent surge in traffic that resulted in downtime and a significant financial impact, company management has ordered that the application be moved to AWS. The application is written in .NET and has a dependency on a MySQL database. A solutions architect must design a scalable and highly available solution to meet the demand of 200,000 daily users.Which steps should the solutions architect take to design an appropriate solution?

A. Use AWS Elastic Beanstalk to create a new application with a web server environment and an Amazon RDS MySQL Multi-AZ DB instance

B. Use AWS CloudFormation to launch a stack containing an Application Load Balancer (ALB) in front of an Amazon EC2 Auto Scaling group spanning three Availability Zones

C. Use AWS Elastic Beanstalk to create an automatically scaling web server environment that spans two separate Regions with an Application Load Balancer (ALB) in each Region

D. Use AWS CloudFormation to launch a stack containing an Application Load Balancer (ALB) in front of an Amazon ECS cluster of Spot instances spanning three Availability Zones

View answer

Correct Answer: B

Question #117

A company has migrated Its forms-processing application to AWS. When users interact with the application, they upload scanned forms as files through a web application. A database stores user metadata and references to files that are stored in Amazon S3. The web application runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.When forms are uploaded, the application sends notifications to a team through Amazon Simple Notification Service (Amazon SNS). A team member then logs in and processes each form. The team member performs data validation on the form and extracts relevant data before entering the information into another system that uses an API.A solutions architect needs to automate the manual processing of the forms. The solution must provide accurate form extraction. minimize time to market, and minimize tong-term operational overhead.Which solution will meet these requirements?

A. Develop custom libraries to perform optical character recognition (OCR) on the forms

B. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

C. Host a new application tier on EC2 instances

D. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

View answer

Correct Answer: D

Question #118

A solutions architect has developed a web application that uses an Amazon API Gateway Regional endpoint and an AWS Lambda function. The consumers of the web application are all close to the AWS Region where the application will be deployed. The Lambda function only queries an Amazon Aurora MySQL database. The solutions architect has configured the database to have three read replicas.During testing, the application does not meet performance requirements. Under high load, the application opens a large number of database connections. The solutions architect must improve the application’s performance.Which actions should the solutions architect take to meet these requirements? (Choose two.)

A. Use the cluster endpoint of the Aurora database

B. Use RDS Proxy to set up a connection pool to the reader endpoint of the Aurora database

C. Use the Lambda Provisioned Concurrency feature

D. Move the code for opening the database connection in the Lambda function outside of the event handler

E. Change the API Gateway endpoint to an edge-optimized endpoint

View answer

Correct Answer: BD

Question #119

A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization.The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company’s on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts when changes are made to the allow list.The solutions architect must design a solution that distributes the common set of CIDR ranges across all accounts.Which solution meets these requirements with the LEAST amount of operational overhead?

A. Set up an Amazon Simple Notification Service (Amazon SNS) topic in the security team's AWS account

B. Create new customer-managed prefix lists in each AWS account within the organization

C. Create a new customer-managed prefix list in the security team’s AWS account

D. Create an IAM role in each account in the organization

View answer

Correct Answer: C

Question #120

A company has migrated Its forms-processing application to AWS. When users interact with the application, they upload scanned forms as files through a web application. A database stores user metadata and references to files that are stored in Amazon S3. The web application runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.When forms are uploaded, the application sends notifications to a team through Amazon Simple Notification Service (Amazon SNS). A team member then logs in and processes each form. The team member performs data validation on the form and extracts relevant data before entering the information into another system that uses an API.A solutions architect needs to automate the manual processing of the forms. The solution must provide accurate form extraction. minimize time to market, and minimize tong-term operational overhead.Which solution will meet these requirements?

A. Develop custom libraries to perform optical character recognition (OCR) on the forms

B. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

C. Host a new application tier on EC2 instances

D. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

View answer

Correct Answer: D

Question #121

A company’s factory and automation applications are running in a single VPC. More than 20 applications run on a combination of Amazon EC2, Amazon Elastic Container Service (Amazon ECS), and Amazon RDS.The company has software engineers spread across three teams. One of the three teams owns each application, and each time is responsible for the cost and performance of all of its applications. Team resources have tags that represent their application and team. The teams use IAM access for daily activities.The company needs to determine which costs on the monthly AWS bill are attributable to each application or team. The company also must be able to create reports to compare costs from the last 12 months and to help forecast costs for the next 12 months. A solutions architect must recommend an AWS Billing and Cost Management solution that provides these cost reports.Which combination of actions will meet these requirements? (Choose three.)

A. Activate the user-define cost allocation tags that represent the application and the team

B. Activate the AWS generated cost allocation tags that represent the application and the team

C. Create a cost category for each application in Billing and Cost Management

D. Activate IAM access to Billing and Cost Management

E. Create a cost budget

F. Enable Cost Explorer

View answer

Correct Answer: ACF

Question #122

A video processing company wants to build a machine learning (ML) model by using 600 TB of compressed data that is stored as thousands of files in the company's on-premises network attached storage system. The company does not have the necessary compute resources on premises for ML experiments and wants to use AWS.The company needs to complete the data transfer to AWS within 3 weeks. The data transfer will be a one-time transfer. The data must be encrypted in transit. The measured upload speed of the company's internet connection is 100 Mbps. and multiple departments share the connection.Which solution will meet these requirements MOST cost-effectively?

A. Order several AWS Snowball Edge Storage Optimized devices by using the AWS Management Console

B. Set up a 10 Gbps AWS Direct Connect connection between the company location and the nearest AWS Region

C. Create a VPN connection between the on-premises network attached storage and the nearest AWS Region

D. Deploy an AWS Storage Gateway file gateway on premises

View answer

Correct Answer: A

Question #123

A company has 10 accounts that are part of an organization in AWS Organizations. AWS Config is configured in each account. All accounts belong to either the Prod OU or the NonProd OU.The company has set up an Amazon EventBridge rule in each AWS account to notify an Amazon Simple Notification Service (Amazon SNS) topic when an Amazon EC2 security group inbound rule is created with 0.0.0.0/0 as the source. The company’s security team is subscribed to the SNS topic.For all accounts in the NonProd OU, the security team needs to remove the ability to create a security group inbound rule that includes 0.0.0.0/0 as the source.Which solution will meet this requirement with the LEAST operational overhead?

A. Modify the EventBridge rule to invoke an AWS Lambda function to remove the security group inbound rule and to publish to the SNS topic

B. Add the vpc-sg-open-only-to-authorized-ports AWS Config managed rule to the NonProd OU

C. Configure an SCP to allow the ec2:AuthorizeSecurityGroupIngress action when the value of the aws:SourceIp condition key is not 0

D. Configure an SCP to deny the ec2:AuthorizeSecurityGroupIngress action when the value of the aws:SourceIp condition key is 0

View answer

Correct Answer: C

Question #124

A software company has deployed an application that consumes a REST API by using Amazon API Gateway, AWS Lambda functions, and an Amazon DynamoDB table. The application is showing an increase in the number of errors during PUT requests. Most of the PUT calls come from a small number of clients that are authenticated with specific API keys.A solutions architect has identified that a large number of the PUT requests originate from one client. The API is noncritical, and clients can tolerate retries of unsuccessful calls. However, the errors are displayed to customers and are causing damage to the API’s reputation.What should the solutions architect recommend to improve the customer experience?

A. Implement retry logic with exponential backoff and irregular variation in the client application

B. Implement API throttling through a usage plan at the API Gateway level

C. Turn on API caching to enhance responsiveness for the production stage

D. Implement reserved concurrency at the Lambda function level to provide the resources that are needed during sudden increases in traffic

View answer

Correct Answer: B

Question #125

A company has migrated Its forms-processing application to AWS. When users interact with the application, they upload scanned forms as files through a web application. A database stores user metadata and references to files that are stored in Amazon S3. The web application runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.When forms are uploaded, the application sends notifications to a team through Amazon Simple Notification Service (Amazon SNS). A team member then logs in and processes each form. The team member performs data validation on the form and extracts relevant data before entering the information into another system that uses an API.A solutions architect needs to automate the manual processing of the forms. The solution must provide accurate form extraction. minimize time to market, and minimize tong-term operational overhead.Which solution will meet these requirements?

A. Develop custom libraries to perform optical character recognition (OCR) on the forms

B. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

C. Host a new application tier on EC2 instances

D. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

View answer

Correct Answer: D

Question #126

An AWS customer has a web application that runs on premises. The web application fetches data from a third-party API that is behind a firewall. The third party accepts only one public CIDR block in each client’s allow list.The customer wants to migrate their web application to the AWS Cloud. The application will be hosted on a set of Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. The ALB is located in public subnets. The EC2 instances are located in private subnets. NAT gateways provide internet access to the private subnets.How should a solutions architect ensure that the web application can continue to call the third-party API after the migration?

A. Associate a block of customer-owned public IP addresses to the VPC

B. Register a block of customer-owned public IP addresses in the AWS account

C. Create Elastic IP addresses from the block of customer-owned IP addresses

D. Register a block of customer-owned public IP addresses in the AWS account

View answer

Correct Answer: B

Question #127

A company is planning to host a web application on AWS and wants to load balance the traffic across a group of Amazon EC2 instances. One of the security requirements is to enable end-to-end encryption in transit between the client and the web server.Which solution will meet this requirement?

A. Place the EC2 instances behind an Application Load Balancer (ALB)

B. Associate the EC2 instances with a target group

C. Place the EC2 instances behind an Application Load Balancer (ALB) Provision an SSL certificate using AWS Certificate Manager (ACM), and associate the SSL certificate with the ALB

D. Place the EC2 instances behind a Network Load Balancer (NLB)

View answer

Correct Answer: C

Question #128

A company wants to migrate an application to Amazon EC2 from VMware Infrastructure that runs in an on-premises data center. A solutions architect must preserve the software and configuration settings during the migration.What should the solutions architect do to meet these requirements?

A. Configure the AWS DataSync agent to start replicating the data store to Amazon FSx for Windows File Server

B. Use the VMware vSphere client to export the application as an image in Open Virtualization Format (OVF) format

C. Configure AWS Storage Gateway for files service to export a Common Internet File System (CIFS) share

D. Create a managed-instance activation for a hybrid environment in AWS Systems Manager

View answer

Correct Answer: B

Question #129

A company uses AWS Organizations with a single OU named Production to manage multiple accounts. All accounts are members of the Production OU. Administrators use deny list SCPs in the root of the organization to manage access to restricted services.The company recently acquired a new business unit and invited the new unit’s existing AWS account to the organization. Once onboarded, the administrators of the new business unit discovered that they are not able to update existing AWS Config rules to meet the company’s policies.Which option will allow administrators to make changes and continue to enforce the current policies without introducing additional long-term maintenance?

A. Remove the organization’s root SCPs that limit access to AWS Config

B. Create a temporary OU named Onboarding for the new account

C. Convert the organization’s root SCPs from deny list SCPs to allow list SCPs to allow the required services only

D. Create a temporary OU named Onboarding for the new account

View answer

Correct Answer: B

Question #130

A video streaming company recently launched a mobile app for video sharing. The app uploads various files to an Amazon S3 bucket in the us-east-1 Region. The files range in size from 1 GB to 10 GB.Users who access the app from Australia have experienced uploads that take long periods of time. Sometimes the files fail to completely upload for these users. A solutions architect must improve the app’s performance for these uploads.Which solutions will meet these requirements? (Choose two.)

A. Enable S3 Transfer Acceleration on the S3 bucket

B. Configure an S3 bucket in each Region to receive the uploads

C. Set up Amazon Route 53 with latency-based routing to route the uploads to the nearest S3 bucket Region

D. Configure the app to break the video files into chunks

E. Modify the app to add random prefixes to the files before uploading

View answer

Correct Answer: AD

Question #131

A company is running an application in the AWS Cloud. The application collects and stores a large amount of unstructured data in an Amazon S3 bucket. The S3 bucket contains several terabytes of data and uses the S3 Standard storage class. The data increases in size by several gigabytes every day.The company needs to query and analyze the data. The company does not access data that is more than 1 year old. However, the company must retain all the data indefinitely for compliance reasons.Which solution will meet these requirements MOST cost-effectively?

A. Use S3 Select to query the data

B. Use Amazon Redshift Spectrum to query the data

C. Use an AWS Glue Data Catalog and Amazon Athena to query the data

D. Use Amazon Redshift Spectrum to query the data

View answer

Correct Answer: C

Question #132

A company is refactoring its on-premises order-processing platform in the AWS Cloud. The platform includes a web front end that is hosted on a fleet of VMs, RabbitMQ to connect the front end to the backend, and a Kubernetes cluster to run a containerized backend system to process the orders. The company does not want to make any major changes to the application.Which solution will meet these requirements with the LEAST operational overhead?

A. Create an AMI of the web server VM

B. Create a custom AWS Lambda runtime to mimic the web server environment

C. Create an AMI of the web server VM

D. Create an AMI of the web server VM

View answer

Correct Answer: A

Question #133

A company uses an on-premises data analytics platform. The system is highly available in a fully redundant configuration across 12 servers in the company’s data center.The system runs scheduled jobs, both hourly and daily, in addition to one-time requests from users. Scheduled jobs can take between 20 minutes and 2 hours to finish running and have tight SLAs. The scheduled jobs account for 65% of the system usage. User jobs typically finish running in less than 5 minutes and have no SLA. The user jobs account for 35% of system usage. During system failures, scheduled jobs must continue to meet SLAs. However, user jobs can be delayed.A solutions architect needs to move the system to Amazon EC2 instances and adopt a consumption-based model to reduce costs with no long-term commitments. The solution must maintain high availability and must not affect the SLAs.Which solution will meet these requirements MOST cost-effectively?

A. Split the 12 instances across two Availability Zones in the chosen AWS Region

B. Split the 12 instances across three Availability Zones in the chosen AWS Region

C. Split the 12 instances across three Availability Zones in the chosen AWS Region

D. Split the 12 instances across three Availability Zones in the chosen AWS Region

View answer

Correct Answer: D

Question #134

A company plans to refactor a monolithic application into a modern application design deployed on AWS. The CI/CD pipeline needs to be upgraded to support the modern design for the application with the following requirements:-It should allow changes to be released several times every hour.-It should be able to roll back the changes as quickly as possible.Which design will meet these requirements?

A. Deploy a CI/CD pipeline that incorporates AMIs to contain the application and their configurations

B. Specify AWS Elastic Beanstalk to stage in a secondary environment as the deployment target for the CI/CD pipeline of the application

C. Use AWS Systems Manager to re-provision the infrastructure for each deployment

D. Roll out the application updates as part of an Auto Scaling event using prebuilt AMIs

View answer

Correct Answer: B

Question #135

A company has migrated Its forms-processing application to AWS. When users interact with the application, they upload scanned forms as files through a web application. A database stores user metadata and references to files that are stored in Amazon S3. The web application runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.When forms are uploaded, the application sends notifications to a team through Amazon Simple Notification Service (Amazon SNS). A team member then logs in and processes each form. The team member performs data validation on the form and extracts relevant data before entering the information into another system that uses an API.A solutions architect needs to automate the manual processing of the forms. The solution must provide accurate form extraction. minimize time to market, and minimize tong-term operational overhead.Which solution will meet these requirements?

A. Develop custom libraries to perform optical character recognition (OCR) on the forms

B. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

C. Host a new application tier on EC2 instances

D. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

View answer

Correct Answer: D

Question #136

A company wants to migrate its workloads from on premises to AWS. The workloads run on Linux and Windows. The company has a large on-premises infrastructure that consists of physical machines and VMs that host numerous applications.The company must capture details about the system configuration, system performance, running processes, and network connections of its on-premises workloads. The company also must divide the on-premises applications into groups for AWS migrations. The company needs recommendations for Amazon EC2 instance types so that the company can run its workloads on AWS in the most cost-effective manner.Which combination of steps should a solutions architect take to meet these requirements? (Choose three.)

A. Assess the existing applications by installing AWS Application Discovery Agent on the physical machines and VMs

B. Assess the existing applications by installing AWS Systems Manager Agent on the physical machines and VMs

C. Group servers into applications for migration by using AWS Systems Manager Application Manager

D. Group servers into applications for migration by using AWS Migration Hub

E. Generate recommended instance types and associated costs by using AWS Migration Hub

F. Import data about server sizes into AWS Trusted Advisor

View answer

Correct Answer: ADE

Question #137

A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization.The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company’s on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts when changes are made to the allow list.The solutions architect must design a solution that distributes the common set of CIDR ranges across all accounts.Which solution meets these requirements with the LEAST amount of operational overhead?

A. Set up an Amazon Simple Notification Service (Amazon SNS) topic in the security team's AWS account

B. Create new customer-managed prefix lists in each AWS account within the organization

C. Create a new customer-managed prefix list in the security team’s AWS account

D. Create an IAM role in each account in the organization

View answer

Correct Answer: C

Question #138

A company needs to architect a hybrid DNS solution. This solution will use an Amazon Route 53 private hosted zone for the domain cloud.example.com for the resources stored within VPCs.The company has the following DNS resolution requirements:-On-premises systems should be able to resolve and connect to cloud.example.com.-All VPCs should be able to resolve cloud.example.com.There is already an AWS Direct Connect connection between the on-premises corporate network and AWS Transit Gateway.Which architecture should the company use to meet these requirements with the HIGHEST performance?

A. Associate the private hosted zone to all the VPCs

B. Associate the private hosted zone to all the VPCs

C. Associate the private hosted zone to the shared services VP Create a Route 53 outbound resolver in the shared services VP Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for cloud

D. Associate the private hosted zone to the shared services VPC

View answer

Correct Answer: A

Question #139

A company consists or two separate business units. Each business unit has its own AWS account within a single organization in AWS Organizations. The business units regularly share sensitive documents with each other. To facilitate sharing, the company created an Amazon S3 bucket in each account and configured low-way replication between the S3 buckets. The S3 buckets have millions of objects.Recently, a security audit identified that neither S3 bucket has encryption at rest enabled. Company policy requires that all documents must be stored with encryption at rest. The company wants to implement server-side encryption with Amazon S3 managed encryption keys (SSE-S3).What is the MOST operationally efficient solution that meets these requirements?

A. Turn on SSE-S3 on both S3 buckets

B. Create an AWS Key Management Service (AWS KMS) key in each account

C. Turn on SSE-S3 on both S3 buckets

D. Create an AWS Key Management Service, (AWS KMS) key in each account

View answer

Correct Answer: A

Question #140

A video processing company wants to build a machine learning (ML) model by using 600 TB of compressed data that is stored as thousands of files in the company's on-premises network attached storage system. The company does not have the necessary compute resources on premises for ML experiments and wants to use AWS.The company needs to complete the data transfer to AWS within 3 weeks. The data transfer will be a one-time transfer. The data must be encrypted in transit. The measured upload speed of the company's internet connection is 100 Mbps. and multiple departments share the connection.Which solution will meet these requirements MOST cost-effectively?

A. Order several AWS Snowball Edge Storage Optimized devices by using the AWS Management Console

B. Set up a 10 Gbps AWS Direct Connect connection between the company location and the nearest AWS Region

C. Create a VPN connection between the on-premises network attached storage and the nearest AWS Region

D. Deploy an AWS Storage Gateway file gateway on premises

View answer

Correct Answer: A

Question #141

A company runs a new application as a static website in Amazon S3. The company has deployed the application to a production AWS account and uses Amazon CloudFront to deliver the website. The website calls an Amazon API Gateway REST API. An AWS Lambda function backs each API method.The company wants to create a CSV report every 2 weeks to show each API Lambda function’s recommended configured memory, recommended cost, and the price difference between current configurations and the recommendations. The company will store the reports in an S3 bucket.Which solution will meet these requirements with the LEAST development time?

A. Create a Lambda function that extracts metrics data for each API Lambda function from Amazon CloudWatch Logs for the 2-week period

B. Opt in to AWS Compute Optimizer

C. Opt in to AWS Compute Optimizer

D. Purchase the AWS Business Support plan for the production account

View answer

Correct Answer: B

Question #142

A startup company hosts a fleet of Amazon EC2 instances in private subnets using the latest Amazon Linux 2 AMI. The company’s engineers rely heavily on SSH access to the instances for troubleshooting.The company’s existing architecture includes the following:-A VPC with private and public subnets, and a NAT gateway.-Site-to-Site VPN for connectivity with the on-premises environment.-EC2 security groups with direct SSH access from the on-premises environment.The company needs to increase security controls around SSH access and provide auditing of commands run by the engineers.Which strategy should a solutions architect use?

A. Install and configure EC2 Instance Connect on the fleet of EC2 instances

B. Update the EC2 security groups to only allow inbound TCP on port 22 to the IP addresses of the engineer’s devices

C. Update the EC2 security groups to only allow inbound TCP on port 22 to the IP addresses of the engineer’s devices

D. Create an IAM role with the AmazonSSMManagedInstanceCore managed policy attached

View answer

Correct Answer: D

Question #143

A company has migrated Its forms-processing application to AWS. When users interact with the application, they upload scanned forms as files through a web application. A database stores user metadata and references to files that are stored in Amazon S3. The web application runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.When forms are uploaded, the application sends notifications to a team through Amazon Simple Notification Service (Amazon SNS). A team member then logs in and processes each form. The team member performs data validation on the form and extracts relevant data before entering the information into another system that uses an API.A solutions architect needs to automate the manual processing of the forms. The solution must provide accurate form extraction. minimize time to market, and minimize tong-term operational overhead.Which solution will meet these requirements?

A. Develop custom libraries to perform optical character recognition (OCR) on the forms

B. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

C. Host a new application tier on EC2 instances

D. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

View answer

Correct Answer: D

Question #144

A company has migrated Its forms-processing application to AWS. When users interact with the application, they upload scanned forms as files through a web application. A database stores user metadata and references to files that are stored in Amazon S3. The web application runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.When forms are uploaded, the application sends notifications to a team through Amazon Simple Notification Service (Amazon SNS). A team member then logs in and processes each form. The team member performs data validation on the form and extracts relevant data before entering the information into another system that uses an API.A solutions architect needs to automate the manual processing of the forms. The solution must provide accurate form extraction. minimize time to market, and minimize tong-term operational overhead.Which solution will meet these requirements?

A. Develop custom libraries to perform optical character recognition (OCR) on the forms

B. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

C. Host a new application tier on EC2 instances

D. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

View answer

Correct Answer: D

Question #145

A company is running a data-intensive application on AWS. The application runs on a cluster of hundreds of Amazon EC2 instances. A shared file system also runs on several EC2 instances that store 200 TB of data. The application reads and modifies the data on the shared file system and generates a report. The job runs once monthly, reads a subset of the files from the shared file system, and takes about 72 hours to complete. The compute instances scale in an Auto Scaling group, but the instances that host the shared file system run continuously. The compute and storage instances are all in the same AWS Region.A solutions architect needs to reduce costs by replacing the shared file system instances. The file system must provide high performance access to the needed data for the duration of the 72-hour run.Which solution will provide the LARGEST overall cost reduction while meeting these requirements?

A. Migrate the data from the existing shared file system to an Amazon S3 bucket that uses the S3 Intelligent-Tiering storage class

B. Migrate the data from the existing shared file system to a large Amazon Elastic Block Store (Amazon EBS) volume with Multi-Attach enabled

C. Migrate the data from the existing shared file system to an Amazon S3 bucket that uses the S3 Standard storage class

D. Migrate the data from the existing shared file system to an Amazon S3 bucket

View answer

Correct Answer: A

Question #146

A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization.The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company’s on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts when changes are made to the allow list.The solutions architect must design a solution that distributes the common set of CIDR ranges across all accounts.Which solution meets these requirements with the LEAST amount of operational overhead?

A. Set up an Amazon Simple Notification Service (Amazon SNS) topic in the security team's AWS account

B. Create new customer-managed prefix lists in each AWS account within the organization

C. Create a new customer-managed prefix list in the security team’s AWS account

D. Create an IAM role in each account in the organization

View answer

Correct Answer: C

Question #147

A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization.The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company’s on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts when changes are made to the allow list.The solutions architect must design a solution that distributes the common set of CIDR ranges across all accounts.Which solution meets these requirements with the LEAST amount of operational overhead?

A. Set up an Amazon Simple Notification Service (Amazon SNS) topic in the security team's AWS account

B. Create new customer-managed prefix lists in each AWS account within the organization

C. Create a new customer-managed prefix list in the security team’s AWS account

D. Create an IAM role in each account in the organization

View answer

Correct Answer: C

Question #148

A company wants to use a third-party software-as-a-service (SaaS) application. The third-party SaaS application is consumed through several API calls. The third-party SaaS application also runs on AWS inside a VPC.The company will consume the third-party SaaS application from inside a VPC. The company has internal security policies that mandate the use of private connectivity that does not traverse the internet. No resources that run in the company VPC are allowed to be accessed from outside the company’s VPC. All permissions must conform to the principles of least privilege.Which solution meets these requirements?

A. Create an AWS PrivateLink interface VPC endpoint

B. Create an AWS Site-to-Site VPN connection between the third-party SaaS application and the company VPC

C. Create a VPC peering connection between the third-party SaaS application and the company VP Update route tables by adding the needed routes for the peering connection

D. Create an AWS PrivateLink endpoint service

View answer

Correct Answer: A

Question #149

A company consists or two separate business units. Each business unit has its own AWS account within a single organization in AWS Organizations. The business units regularly share sensitive documents with each other. To facilitate sharing, the company created an Amazon S3 bucket in each account and configured low-way replication between the S3 buckets. The S3 buckets have millions of objects.Recently, a security audit identified that neither S3 bucket has encryption at rest enabled. Company policy requires that all documents must be stored with encryption at rest. The company wants to implement server-side encryption with Amazon S3 managed encryption keys (SSE-S3).What is the MOST operationally efficient solution that meets these requirements?

A. Turn on SSE-S3 on both S3 buckets

B. Create an AWS Key Management Service (AWS KMS) key in each account

C. Turn on SSE-S3 on both S3 buckets

D. Create an AWS Key Management Service, (AWS KMS) key in each account

View answer

Correct Answer: A

Question #150

A company runs an IoT platform on AWS. IoT sensors in various locations send data to the company’s Node.js API servers on Amazon EC2 instances running behind an Application Load Balancer. The data is stored in an Amazon RDS MySQL DB instance that uses a 4 TB General Purpose SSD volume.The number of sensors the company has deployed in the field has increased over time, and is expected to grow significantly. The API servers are consistently overloaded and RDS metrics show high write latency.Which of the following steps together will resolve the issues permanently and enable growth as new sensors are provisioned, while keeping this platform cost-efficient? (Choose two.)

A. Resize the MySQL General Purpose SSD storage to 6 TB to improve the volume’s IOPS

B. Re-architect the database tier to use Amazon Aurora instead of an RDS MySQL DB instance and add read replicas

C. Leverage Amazon Kinesis Data Streams and AWS Lambda to ingest and process the raw data

D. Use AWS X-Ray to analyze and debug application issues and add more API servers to match the load

E. Re-architect the database tier to use Amazon DynamoDB instead of an RDS MySQL DB instance

View answer

Correct Answer: CE

Question #151

A company wants to change its internal cloud billing strategy for each of its business units. Currently, the cloud governance team shares reports for overall cloud spending with the head of each business unit. The company uses AWS Organizations to manage the separate AWS accounts for each business unit. The existing tagging standard in Organizations includes the application, environment, and owner. The cloud governance team wants a centralized solution so each business unit receives monthly reports on its cloud spending. The solution should also send notifications for any cloud spending that exceeds a set threshold.Which solution is the MOST cost-effective way to meet these requirements?

A. Configure AWS Budgets in each account and configure budget alerts that are grouped by application, environment, and owner

B. Configure AWS Budgets in the organization's management account and configure budget alerts that are grouped by application, environment, and owner

C. Configure AWS Budgets in each account and configure budget alerts that are grouped by application, environment, and owner

D. Enable AWS Cost and Usage Reports in the organization's management account and configure reports grouped by application, environment

View answer

Correct Answer: B

Question #152

A company runs an IoT platform on AWS. IoT sensors in various locations send data to the company’s Node.js API servers on Amazon EC2 instances running behind an Application Load Balancer. The data is stored in an Amazon RDS MySQL DB instance that uses a 4 TB General Purpose SSD volume.The number of sensors the company has deployed in the field has increased over time, and is expected to grow significantly. The API servers are consistently overloaded and RDS metrics show high write latency.Which of the following steps together will resolve the issues permanently and enable growth as new sensors are provisioned, while keeping this platform cost-efficient? (Choose two.)

A. Resize the MySQL General Purpose SSD storage to 6 TB to improve the volume’s IOPS

B. Re-architect the database tier to use Amazon Aurora instead of an RDS MySQL DB instance and add read replicas

C. Leverage Amazon Kinesis Data Streams and AWS Lambda to ingest and process the raw data

D. Use AWS X-Ray to analyze and debug application issues and add more API servers to match the load

E. Re-architect the database tier to use Amazon DynamoDB instead of an RDS MySQL DB instance

View answer

Correct Answer: CE

Question #153

A company is in the process of implementing AWS Organizations to constrain its developers to use only Amazon EC2, Amazon S3, and Amazon DynamoDB. The developers account resides in a dedicated organizational unit (OU). The solutions architect has implemented the following SCP on the developers account:When this policy is deployed, IAM users in the developers account are still able to use AWS services that are not listed in the policy.What should the solutions architect do to eliminate the developers’ ability to use services outside the scope of this policy?

A. Create an explicit deny statement for each AWS service that should be constrained

B. Remove the FullAWSAccess SCP from the developers account’s OU

C. Modify the FullAWSAccess SCP to explicitly deny all services

D. Add an explicit deny statement using a wildcard to the end of the SCP

View answer

Correct Answer: B

Question #154

A video processing company wants to build a machine learning (ML) model by using 600 TB of compressed data that is stored as thousands of files in the company's on-premises network attached storage system. The company does not have the necessary compute resources on premises for ML experiments and wants to use AWS.The company needs to complete the data transfer to AWS within 3 weeks. The data transfer will be a one-time transfer. The data must be encrypted in transit. The measured upload speed of the company's internet connection is 100 Mbps. and multiple departments share the connection.Which solution will meet these requirements MOST cost-effectively?

A. Order several AWS Snowball Edge Storage Optimized devices by using the AWS Management Console

B. Set up a 10 Gbps AWS Direct Connect connection between the company location and the nearest AWS Region

C. Create a VPN connection between the on-premises network attached storage and the nearest AWS Region

D. Deploy an AWS Storage Gateway file gateway on premises

View answer

Correct Answer: A

Question #155

A company is refactoring its on-premises order-processing platform in the AWS Cloud. The platform includes a web front end that is hosted on a fleet of VMs, RabbitMQ to connect the front end to the backend, and a Kubernetes cluster to run a containerized backend system to process the orders. The company does not want to make any major changes to the application.Which solution will meet these requirements with the LEAST operational overhead?

A. Create an AMI of the web server VM

B. Create a custom AWS Lambda runtime to mimic the web server environment

C. Create an AMI of the web server VM

D. Create an AMI of the web server VM

View answer

Correct Answer: A

Question #156

A company is deploying a new API to AWS. The API uses Amazon API Gateway with a Regional API endpoint and an AWS Lambda function for hosting. The API retrieves data from an external vendor API, stores data in an Amazon DynamoDB global table, and retrieves data from the DynamoDB global table. The API key for the vendor's API is stored in AWS Secrets Manager and is encrypted with a customer managed key in AWS Key Management Service (AWS KMS). The company has deployed its own API into a single AWS Region.A solutions architect needs to change the API components of the company's API to ensure that the components can run across multiple Regions in an active-active configuration.Which combination of changes will meet this requirement with the LEAST operational overhead? (Choose three.)

A. Deploy the API to multiple Regions

B. Create a new KMS multi-Region customer managed key

C. Replicate the existing Secrets Manager secret to other Regions

D. Create a new AWS managed KMS key in each in-scope Region

E. Create a new Secrets Manager secret in each in-scope Region

F. Modify the deployment process for the Lambda function to repeat the deployment across in-scope Regions

View answer

Correct Answer: ABC

Question #157

A company built an application based on AWS Lambda deployed in an AWS CloudFormation stack. The last production release of the web application introduced an issue that resulted in an outage lasting several minutes. A solutions architect must adjust the deployment process to support a canary release.Which solution will meet these requirements?

A. Create an alias for every new deployed version of the Lambda function

B. Deploy the application into a new CloudFormation stack

C. Create a version for every new deployed Lambda function

D. Configure AWS CodeDeploy and use CodeDeployDefault

View answer

Correct Answer: A

Question #158

A company has separate AWS accounts for each of its departments. The accounts are in OUs that are in an organization in AWS Organizations. The IT department manages a private certificate authority (CA) by using AWS Private Certificate Authority in its account.The company needs a solution to allow developer teams in the other departmental accounts to access the private CA to issue certificates for their applications. The solution must maintain appropriate security boundaries between accounts.Which solution will meet these requirements?

A. Create an AWS Lambda function in the IT account

B. Create an 1AM identity-based policy that allows cross-account access to AWS Private CA

C. In the organization's management account, create an AWS CloudFormation stack to set up a resource-based delegation policy

D. Use AWS Resource Access Manager (AWS RAM) in the IT account to enable sharing in the organization

View answer

Correct Answer: C

Question #159

A company runs a Python script on an Amazon EC2 instance to process data. The script runs every 10 minutes. The script ingests files from an Amazon S3 bucket and processes the files. On average, the script takes approximately 5 minutes to process each file The script will not reprocess a file that the script has already processed.The company reviewed Amazon CloudWatch metrics and noticed that the EC2 instance is idle for approximately 40% of the time because of the file processing speed. The company wants to make the workload highly available and scalable. The company also wants to reduce long-term management overhead.Which solution will meet these requirements MOST cost-effectively?

A. Migrate the data processing script to an AWS Lambda function

B. Create an Amazon Simple Queue Service (Amazon SQS) queue

C. Migrate the data processing script to a container image

D. Migrate the data processing script to a container image that runs on Amazon Elastic Container Service (Amazon ECS) on AWS Fargate

View answer

Correct Answer: A

Question #160

A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization.The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company’s on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts when changes are made to the allow list.The solutions architect must design a solution that distributes the common set of CIDR ranges across all accounts.Which solution meets these requirements with the LEAST amount of operational overhead?

A. Set up an Amazon Simple Notification Service (Amazon SNS) topic in the security team's AWS account

B. Create new customer-managed prefix lists in each AWS account within the organization

C. Create a new customer-managed prefix list in the security team’s AWS account

D. Create an IAM role in each account in the organization

View answer

Correct Answer: C

Question #161

A company is building a serverless application that runs on an AWS Lambda function that is attached to a VPC. The company needs to integrate the application with a new service from an external provider. The external provider supports only requests that come from public IPv4 addresses that are in an allow list.The company must provide a single public IP address to the external provider before the application can start using the new service.Which solution will give the application the ability to access the new service?

A. Deploy a NAT gateway

B. Deploy an egress-only internet gateway

C. Deploy an internet gateway

D. Deploy an internet gateway

View answer

Correct Answer: A

Question #162

An application is using an Amazon RDS for MySQL Multi-AZ DB instance in the us-east-1 Region. After a failover test, the application lost the connections to the database and could not re-establish the connections. After a restart of the application, the application re-established the connections.A solutions architect must implement a solution so that the application can re-establish connections to the database without requiring a restart.Which solution will meet these requirements?

A. Create an Amazon Aurora MySQL Serverless v1 DB instance

B. Create an RDS proxy

C. Create a two-node Amazon Aurora MySQL DB cluster

D. Create an Amazon S3 bucket

View answer

Correct Answer: B

Question #163

A company is running a web application in the AWS Cloud. The application consists of dynamic content that is created on a set of Amazon EC2 instances. The EC2 instances run in an Auto Scaling group that is configured as a target group for an Application Load Balancer (ALB).The company is using an Amazon CloudFront distribution to distribute the application globally. The CloudFront distribution uses the ALB as an origin. The company uses Amazon Route 53 for DNS and has created an A record of www.example.com for the CloudFront distribution.A solutions architect must configure the application so that itis highly available and fault tolerant.Which solution meets these requirements?

A. Provision a full, secondary application deployment in a different AWS Region

B. Provision an ALB, an Auto Scaling group, and EC2 instances in a different AWS Region

C. Provision an Auto Scaling group and EC2 instances in a different AWS Region

D. Provision a full, secondary application deployment in a different AWS Region

View answer

Correct Answer: B

Question #164

A company is refactoring its on-premises order-processing platform in the AWS Cloud. The platform includes a web front end that is hosted on a fleet of VMs, RabbitMQ to connect the front end to the backend, and a Kubernetes cluster to run a containerized backend system to process the orders. The company does not want to make any major changes to the application.Which solution will meet these requirements with the LEAST operational overhead?

A. Create an AMI of the web server VM

B. Create a custom AWS Lambda runtime to mimic the web server environment

C. Create an AMI of the web server VM

D. Create an AMI of the web server VM

View answer

Correct Answer: A

Question #165

A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization.The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company’s on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts when changes are made to the allow list.The solutions architect must design a solution that distributes the common set of CIDR ranges across all accounts.Which solution meets these requirements with the LEAST amount of operational overhead?

A. Set up an Amazon Simple Notification Service (Amazon SNS) topic in the security team's AWS account

B. Create new customer-managed prefix lists in each AWS account within the organization

C. Create a new customer-managed prefix list in the security team’s AWS account

D. Create an IAM role in each account in the organization

View answer

Correct Answer: C

Question #166

A company has built a high performance computing (HPC) cluster in AWS tor a tightly coupled workload that generates a large number of shared files stored in Amazon EFS. The cluster was performing well when the number of Amazon EC2 instances in the cluster was 100. However, when the company increased the cluster size to 1,000 EC2 instances, overall performance was well below expectations. Which collection of design choices should a solutions architect make to achieve the maximum performance from the HPC cluster? (Select THREE.) A . High performance computing (HPC) workload cluster should be in a single AZ. C . Elastic Fabric Adapter (EFA) is a network device that you can attach to your Amazon EC2 instances to accelerate High Performance Computing (HPC) F . Amazon FSx for Lustre - Use it for workloads where speed matters, such as machine learning, high performance computing (HPC), video processing, and financial modeling. Cluster -- packs instances close together inside an Availability Zone. This strategy enables workloads to achieve the low-latency network performance necessary for tightly-coupled node-to-node communication that is typical of HPC applications. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html

A. Ensure the HPC cluster Is launched within a single Availability Zone

B. Launch the EC2 instances and attach elastic network interfaces in multiples of four

C. Select EC2 Instance types with an Elastic Fabric Adapter (EFA) enabled

D. Ensure the cluster Is launched across multiple Availability Zones

E. Replace Amazon EFS with multiple Amazon EBS volumes in a RAID array

F. Replace Amazon EFS with Amazon FSx for Lustre

View answer

Correct Answer: ACF

Question #167

A company is hosting an image-processing service on AWS in a VPC. The VPC extends across two Availability Zones. Each Availability Zone contains one public subnet and one private subnet.The service runs on Amazon EC2 instances in the private subnets. An Application Load Balancer in the public subnets is in front of the service. The service needs to communicate with the internet and does so through two NAT gateways. The service uses Amazon S3 for image storage. The EC2 instances retrieve approximately 1 ТВ of data from an S3 bucket each day.The company has promoted the service as highly secure. A solutions architect must reduce cloud expenditures as much as possible without compromising the service’s security posture or increasing the time spent on ongoing operations.Which solution will meet these requirements?

A. eplace the NAT gateways with NAT instances

B. ove the EC2 instances to the public subnets

C. et up an S3 gateway VPC endpoint in the VPAttach an endpoint policy to the endpoint to allow the required actions on the S3 bucket

D. ttach an Amazon Elastic File System (Amazon EFS) volume to the EC2 instances

View answer

Correct Answer: C

Question #168

A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application.How should a solutions architect configure the web ACLs to meet these requirements?

A. Set the action of the web ACL rules to Count

B. Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible

C. Set the action of the web ACL rules to Block

D. Use only custom rule groups in the web ACLs, and set the action to Allow

View answer

Correct Answer: A

Question #169

A company is hosting a critical application on a single Amazon EC2 instance. The application uses an Amazon ElastiCache for Redis single-node cluster for an in-memory data store. The application uses an Amazon RDS for MariaDB DB instance for a relational database. For the application to function, each piece of the infrastructure must be healthy and must be in an active state.A solutions architect needs to improve the application's architecture so that the infrastructure can automatically recover from failure with the least possible downtime.Which combination of steps will meet these requirements? (Choose three.)

A. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances

B. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances

C. Modify the DB instance to create a read replica in the same Availability Zone

D. Modify the DB instance to create a Multi-AZ deployment that extends across two Availability Zones

E. Create a replication group for the ElastiCache for Redis cluster

F. Create a replication group for the ElastiCache for Redis cluster

View answer

Correct Answer: ADF

Question #170

A company has migrated Its forms-processing application to AWS. When users interact with the application, they upload scanned forms as files through a web application. A database stores user metadata and references to files that are stored in Amazon S3. The web application runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.When forms are uploaded, the application sends notifications to a team through Amazon Simple Notification Service (Amazon SNS). A team member then logs in and processes each form. The team member performs data validation on the form and extracts relevant data before entering the information into another system that uses an API.A solutions architect needs to automate the manual processing of the forms. The solution must provide accurate form extraction. minimize time to market, and minimize tong-term operational overhead.Which solution will meet these requirements?

A. Develop custom libraries to perform optical character recognition (OCR) on the forms

B. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

C. Host a new application tier on EC2 instances

D. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

View answer

Correct Answer: D

Question #171

A company has VPC flow logs enabled for Its NAT gateway. The company is seeing Action = ACCEPT for inbound traffic that comes from public IP address 198.51.100.2 destined for a private Amazon EC2 instance.A solutions architect must determine whether the traffic represents unsolicited inbound connections from the internet. The first two octets of the VPC CIDR block are 203.0.Which set of steps should the solutions architect take to meet these requirements?

A. Open the AWS CloudTrail console

B. Open the Amazon CloudWatch console

C. Open the AWS CloudTrail console

D. Open the Amazon CloudWatch console

View answer

Correct Answer: B

Question #172

A company is planning to host a web application on AWS and wants to load balance the traffic across a group of Amazon EC2 instances. One of the security requirements is to enable end-to-end encryption in transit between the client and the web server.Which solution will meet this requirement?

A. Place the EC2 instances behind an Application Load Balancer (ALB)

B. Associate the EC2 instances with a target group

C. Place the EC2 instances behind an Application Load Balancer (ALB) Provision an SSL certificate using AWS Certificate Manager (ACM), and associate the SSL certificate with the ALB

D. Place the EC2 instances behind a Network Load Balancer (NLB)

View answer

Correct Answer: C

Question #173

A company wants to use a third-party software-as-a-service (SaaS) application. The third-party SaaS application is consumed through several API calls. The third-party SaaS application also runs on AWS inside a VPC.The company will consume the third-party SaaS application from inside a VPC. The company has internal security policies that mandate the use of private connectivity that does not traverse the internet. No resources that run in the company VPC are allowed to be accessed from outside the company’s VPC. All permissions must conform to the principles of least privilege.Which solution meets these requirements?

A. Create an AWS PrivateLink interface VPC endpoint

B. Create an AWS Site-to-Site VPN connection between the third-party SaaS application and the company VPC

C. Create a VPC peering connection between the third-party SaaS application and the company VP Update route tables by adding the needed routes for the peering connection

D. Create an AWS PrivateLink endpoint service

View answer

Correct Answer: A

Question #174

A company is running a two-tier web-based application in an on-premises data center. The application layer consists of a single server running a stateful application. The application connects to a PostgreSQL database running on a separate server. The application’s user base is expected to grow significantly, so the company is migrating the application and database to AWS. The solution will use Amazon Aurora PostgreSQL, Amazon EC2 Auto Scaling, and Elastic Load Balancing.Which solution will provide a consistent user experience that will allow the application and database tiers to scale?

A. Enable Aurora Auto Scaling for Aurora Replicas

B. Enable Aurora Auto Scaling for Aurora writers

C. Enable Aurora Auto Scaling for Aurora Replicas

D. Enable Aurora Scaling for Aurora writers

View answer

Correct Answer: C

Question #175

A company recently deployed an application on AWS. The application uses Amazon DynamoDB. The company measured the application load and configured the RCUs and WCUs on the DynamoDB table to match the expected peak load. The peak load occurs once a week for a 4-hour period and is double the average load. The application load is close to the average load for the rest of the week. The access pattern includes many more writes to the table than reads of the table.A solutions architect needs to implement a solution to minimize the cost of the table.Which solution will meet these requirements?

A. Use AWS Application Auto Scaling to increase capacity during the peak period

B. Configure on-demand capacity mode for the table

C. Configure DynamoDB Accelerator (DAX) in front of the table

D. Configure DynamoDB Accelerator (DAX) in front of the table

View answer

Correct Answer: A

Question #176

An AWS customer has a web application that runs on premises. The web application fetches data from a third-party API that is behind a firewall. The third party accepts only one public CIDR block in each client’s allow list.The customer wants to migrate their web application to the AWS Cloud. The application will be hosted on a set of Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. The ALB is located in public subnets. The EC2 instances are located in private subnets. NAT gateways provide internet access to the private subnets.How should a solutions architect ensure that the web application can continue to call the third-party API after the migration?

A. Associate a block of customer-owned public IP addresses to the VPC

B. Register a block of customer-owned public IP addresses in the AWS account

C. Create Elastic IP addresses from the block of customer-owned IP addresses

D. Register a block of customer-owned public IP addresses in the AWS account

View answer

Correct Answer: B

Question #177

A company has migrated Its forms-processing application to AWS. When users interact with the application, they upload scanned forms as files through a web application. A database stores user metadata and references to files that are stored in Amazon S3. The web application runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.When forms are uploaded, the application sends notifications to a team through Amazon Simple Notification Service (Amazon SNS). A team member then logs in and processes each form. The team member performs data validation on the form and extracts relevant data before entering the information into another system that uses an API.A solutions architect needs to automate the manual processing of the forms. The solution must provide accurate form extraction. minimize time to market, and minimize tong-term operational overhead.Which solution will meet these requirements?

A. Develop custom libraries to perform optical character recognition (OCR) on the forms

B. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

C. Host a new application tier on EC2 instances

D. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

View answer

Correct Answer: D

Question #178

A company has an application that runs on Amazon EC2 instances. A solutions architect is designing VPC infrastructure in an AWS Region where the application needs to access an Amazon Aurora DB Cluster. The EC2 instances are all associated with the same security group. The DB cluster is associated with its own security group.The solutions architect needs to add rules to the security groups to provide the application with least privilege access to the DB Cluster.Which combination of steps will meet these requirements? (Choose two.)

A. Add an inbound rule to the EC2 instances' security group

B. Add an outbound rule to the EC2 instances' security group

C. Add an inbound rule to the DB cluster's security group

D. Add an outbound rule to the DB cluster's security group

E. Add an outbound rule to the DB cluster's security group

View answer

Correct Answer: BC

Question #179

A company is in the process of implementing AWS Organizations to constrain its developers to use only Amazon EC2, Amazon S3, and Amazon DynamoDB. The developers account resides in a dedicated organizational unit (OU). The solutions architect has implemented the following SCP on the developers account:When this policy is deployed, IAM users in the developers account are still able to use AWS services that are not listed in the policy.What should the solutions architect do to eliminate the developers’ ability to use services outside the scope of this policy?

A. reate an explicit deny statement for each AWS service that should be constrained

B. emove the FullAWSAccess SCP from the developers account’s OU

C. odify the FullAWSAccess SCP to explicitly deny all services

D. dd an explicit deny statement using a wildcard to the end of the SCP

View answer

Correct Answer: B

Question #180

A company has created an OU in AWS Organizations for each of its engineering teams. Each OU owns multiple AWS accounts. The organization has hundreds of AWS accounts.A solutions architect must design a solution so that each OU can view a breakdown of usage costs across its AWS accounts.Which solution meets these requirements?

A. Create an AWS Cost and Usage Report (CUR) for each OU by using AWS Resource Access Manager

B. Create an AWS Cost and Usage Report (CUR) from the AWS Organizations management account

C. Create an AWS Cost and Usage Report (CUR) in each AWS Organizations member account

D. Create an AWS Cost and Usage Report (CUR) by using AWS Systems Manager

View answer

Correct Answer: B

Question #181

A company is hosting a three-tier web application in an on-premises environment. Due to a recent surge in traffic that resulted in downtime and a significant financial impact, company management has ordered that the application be moved to AWS. The application is written in .NET and has a dependency on a MySQL database. A solutions architect must design a scalable and highly available solution to meet the demand of 200,000 daily users.Which steps should the solutions architect take to design an appropriate solution?

A. Use AWS Elastic Beanstalk to create a new application with a web server environment and an Amazon RDS MySQL Multi-AZ DB instance

B. Use AWS CloudFormation to launch a stack containing an Application Load Balancer (ALB) in front of an Amazon EC2 Auto Scaling group spanning three Availability Zones

C. Use AWS Elastic Beanstalk to create an automatically scaling web server environment that spans two separate Regions with an Application Load Balancer (ALB) in each Region

D. Use AWS CloudFormation to launch a stack containing an Application Load Balancer (ALB) in front of an Amazon ECS cluster of Spot instances spanning three Availability Zones

View answer

Correct Answer: B

Question #182

A company has an organization in AWS Organizations that has a large number of AWS accounts. One of the AWS accounts is designated as a transit account and has a transit gateway that is shared with all of the other AWS accounts. AWS Site-to-Site VPN connections are configured between all of the company’s global offices and the transit account. The company has AWS Config enabled on all of its accounts.The company’s networking team needs to centrally manage a list of internal IP address ranges that belong to the global offices. Developers will reference this list to gain access to their applications securely.Which solution meets these requirements with the LEAST amount of operational overhead?

A. Create a JSON file that is hosted in Amazon S3 and that lists all of the internal IP address ranges

B. Create a new AWS Config managed rule that contains all of the internal IP address ranges

C. In the transit account, create a VPC prefix list with all of the internal IP address ranges

D. In the transit account, create a security group with all of the internal IP address ranges

View answer

Correct Answer: C

Question #183

A retail company is operating its ecommerce application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses an Amazon RDS DB instance as the database backend. Amazon CloudFront is configured with one origin that points to the ALB. Static content is cached. Amazon Route 53 is used to host all public zones.After an update of the application, the ALB occasionally returns a 502 status code (Bad Gateway) error. The root cause is malformed HTTP headers that are returned to the ALB. The webpage returns successfully when a solutions architect reloads the webpage immediately after the error occurs.While the company is working on the problem, the solutions architect needs to provide a custom error page instead of the standard ALB error page to visitors.Which combination of steps will meet this requirement with the LEAST amount of operational overhead? (Choose two.)

A. reate an Amazon S3 bucket

B. reate an Amazon CloudWatch alarm to invoke an AWS Lambda function if the ALB health check response Target

C. odify the existing Amazon Route 53 records by adding health checks

D. reate an Amazon CloudWatch alarm to invoke an AWS Lambda function if the ALB health check response Elb

E. dd a custom error response by configuring a CloudFront custom error page

View answer

Correct Answer: AE

Question #184

A company consists or two separate business units. Each business unit has its own AWS account within a single organization in AWS Organizations. The business units regularly share sensitive documents with each other. To facilitate sharing, the company created an Amazon S3 bucket in each account and configured low-way replication between the S3 buckets. The S3 buckets have millions of objects.Recently, a security audit identified that neither S3 bucket has encryption at rest enabled. Company policy requires that all documents must be stored with encryption at rest. The company wants to implement server-side encryption with Amazon S3 managed encryption keys (SSE-S3).What is the MOST operationally efficient solution that meets these requirements?

A. Turn on SSE-S3 on both S3 buckets

B. Create an AWS Key Management Service (AWS KMS) key in each account

C. Turn on SSE-S3 on both S3 buckets

D. Create an AWS Key Management Service, (AWS KMS) key in each account

View answer

Correct Answer: A

Question #185

A company has several AWS accounts. A development team is building an automation framework for cloud governance and remediation processes. The automation framework uses AWS Lambda functions in a centralized account. A solutions architect must implement a least privilege permissions policy that allows the Lambda functions to run in each of the company's AWS accounts.Which combination of steps will meet these requirements? (Choose two.)

A. In the centralized account

B. In the other AWS accounts, create an IAM role that has minimal permissions

C. In the centralized account, create an IAM role that has roles of the other accounts as trusted entities

D. In the other AWS accounts, create an IAM role that has permissions to assume the role of the centralized account

E. In the other AWS accounts, create an IAM role that has minimal permissions

View answer

Correct Answer: AB

Question #186

A company is hosting an image-processing service on AWS in a VPC. The VPC extends across two Availability Zones. Each Availability Zone contains one public subnet and one private subnet.The service runs on Amazon EC2 instances in the private subnets. An Application Load Balancer in the public subnets is in front of the service. The service needs to communicate with the internet and does so through two NAT gateways. The service uses Amazon S3 for image storage. The EC2 instances retrieve approximately 1 ТВ of data from an S3 bucket each day.The company has promoted the service as highly secure. A solutions architect must reduce cloud expenditures as much as possible without compromising the service’s security posture or increasing the time spent on ongoing operations.Which solution will meet these requirements?

A. Replace the NAT gateways with NAT instances

B. Move the EC2 instances to the public subnets

C. Set up an S3 gateway VPC endpoint in the VP Attach an endpoint policy to the endpoint to allow the required actions on the S3 bucket

D. Attach an Amazon Elastic File System (Amazon EFS) volume to the EC2 instances

View answer

Correct Answer: C

Question #187

A company has developed a web application. The company is hosting the application on a group of Amazon EC2 instances behind an Application Load Balancer. The company wants to improve the security posture of the application and plans to use AWS WAF web ACLs. The solution must not adversely affect legitimate traffic to the application.How should a solutions architect configure the web ACLs to meet these requirements?

A. Set the action of the web ACL rules to Count

B. Use only rate-based rules in the web ACLs, and set the throttle limit as high as possible

C. Set the action of the web ACL rules to Block

D. Use only custom rule groups in the web ACLs, and set the action to Allow

View answer

Correct Answer: A

Question #188

A company is running an application in the AWS Cloud. The application collects and stores a large amount of unstructured data in an Amazon S3 bucket. The S3 bucket contains several terabytes of data and uses the S3 Standard storage class. The data increases in size by several gigabytes every day.The company needs to query and analyze the data. The company does not access data that is more than 1 year old. However, the company must retain all the data indefinitely for compliance reasons.Which solution will meet these requirements MOST cost-effectively?

A. Use S3 Select to query the data

B. Use Amazon Redshift Spectrum to query the data

C. Use an AWS Glue Data Catalog and Amazon Athena to query the data

D. Use Amazon Redshift Spectrum to query the data

View answer

Correct Answer: C

Question #189

An enterprise company wants to allow its developers to purchase third-party software through AWS Marketplace. The company uses an AWS Organizations account structure with full features enabled, and has a shared services account in each organizational unit (OU) that will be used by procurement managers. The procurement team’s policy indicates that developers should be able to obtain third-party software from an approved list only and use Private Marketplace in AWS Marketplace to achieve this requirement. The procurement team wants administration of Private Marketplace to be restricted to a role named procurement-manager-role, which could be assumed by procurement managers. Other IAM users, groups, roles, and account administrators in the company should be denied Private Marketplace administrative access.What is the MOST efficient way to design an architecture to meet these requirements?

A. reate an IAM role named procurement-manager-role in all AWS accounts in the organization

B. reate an IAM role named procurement-manager-role in all AWS accounts in the organization

C. reate an IAM role named procurement-manager-role in all the shared services accounts in the organization

D. reate an IAM role named procurement-manager-role in all AWS accounts that will be used by developers

View answer

Correct Answer: C

Question #190

A company is hosting a critical application on a single Amazon EC2 instance. The application uses an Amazon ElastiCache for Redis single-node cluster for an in-memory data store. The application uses an Amazon RDS for MariaDB DB instance for a relational database. For the application to function, each piece of the infrastructure must be healthy and must be in an active state.A solutions architect needs to improve the application's architecture so that the infrastructure can automatically recover from failure with the least possible downtime.Which combination of steps will meet these requirements? (Choose three.)

A. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances

B. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances

C. Modify the DB instance to create a read replica in the same Availability Zone

D. Modify the DB instance to create a Multi-AZ deployment that extends across two Availability Zones

E. Create a replication group for the ElastiCache for Redis cluster

F. Create a replication group for the ElastiCache for Redis cluster

View answer

Correct Answer: ADF

Question #191

A company is planning to host a web application on AWS and wants to load balance the traffic across a group of Amazon EC2 instances. One of the security requirements is to enable end-to-end encryption in transit between the client and the web server.Which solution will meet this requirement?

A. Place the EC2 instances behind an Application Load Balancer (ALB)

B. Associate the EC2 instances with a target group

C. Place the EC2 instances behind an Application Load Balancer (ALB) Provision an SSL certificate using AWS Certificate Manager (ACM), and associate the SSL certificate with the ALB

D. Place the EC2 instances behind a Network Load Balancer (NLB)

View answer

Correct Answer: C

Question #192

A company is hosting a critical application on a single Amazon EC2 instance. The application uses an Amazon ElastiCache for Redis single-node cluster for an in-memory data store. The application uses an Amazon RDS for MariaDB DB instance for a relational database. For the application to function, each piece of the infrastructure must be healthy and must be in an active state.A solutions architect needs to improve the application's architecture so that the infrastructure can automatically recover from failure with the least possible downtime.Which combination of steps will meet these requirements? (Choose three.)

A. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances

B. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances

C. Modify the DB instance to create a read replica in the same Availability Zone

D. Modify the DB instance to create a Multi-AZ deployment that extends across two Availability Zones

E. Create a replication group for the ElastiCache for Redis cluster

F. Create a replication group for the ElastiCache for Redis cluster

View answer

Correct Answer: ADF

Question #193

A company has its cloud infrastructure on AWS. A solutions architect needs to define the infrastructure as code. The infrastructure is currently deployed in one AWS Region. The company’s business expansion plan includes deployments in multiple Regions across multiple AWS accounts.What should the solutions architect do to meet these requirements?

A. Use AWS CloudFormation templates

B. Use AWS Organizations

C. Use AWS Organizations and AWS CloudFormation StackSets

D. Use nested stacks with AWS CloudFormation templates

View answer

Correct Answer: C

Question #194

A company has migrated Its forms-processing application to AWS. When users interact with the application, they upload scanned forms as files through a web application. A database stores user metadata and references to files that are stored in Amazon S3. The web application runs on Amazon EC2 instances and an Amazon RDS for PostgreSQL database.When forms are uploaded, the application sends notifications to a team through Amazon Simple Notification Service (Amazon SNS). A team member then logs in and processes each form. The team member performs data validation on the form and extracts relevant data before entering the information into another system that uses an API.A solutions architect needs to automate the manual processing of the forms. The solution must provide accurate form extraction. minimize time to market, and minimize tong-term operational overhead.Which solution will meet these requirements?

A. Develop custom libraries to perform optical character recognition (OCR) on the forms

B. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

C. Host a new application tier on EC2 instances

D. Extend the system with an application tier that uses AWS Step Functions and AWS Lambda

View answer

Correct Answer: D

Question #195

A company has an organization in AWS Organizations that has a large number of AWS accounts. One of the AWS accounts is designated as a transit account and has a transit gateway that is shared with all of the other AWS accounts. AWS Site-to-Site VPN connections are configured between all of the company’s global offices and the transit account. The company has AWS Config enabled on all of its accounts.The company’s networking team needs to centrally manage a list of internal IP address ranges that belong to the global offices. Developers will reference this list to gain access to their applications securely.Which solution meets these requirements with the LEAST amount of operational overhead?

A. Create a JSON file that is hosted in Amazon S3 and that lists all of the internal IP address ranges

B. Create a new AWS Config managed rule that contains all of the internal IP address ranges

C. In the transit account, create a VPC prefix list with all of the internal IP address ranges

D. In the transit account, create a security group with all of the internal IP address ranges

View answer

Correct Answer: C

Question #196

A company has 50 AWS accounts that are members of an organization in AWS Organizations. Each account contains multiple VPCs. The company wants to use AWS Transit Gateway to establish connectivity between the VPCs in each member account. Each time a new member account is created, the company wants to automate the process of creating a new VPC and a transit gateway attachment.Which combination of steps will meet these requirements? (Choose two.)

A. From the management account, share the transit gateway with member accounts by using AWS Resource Access Manager

B. From the management account, share the transit gateway with member accounts by using an AWS Organizations SCP

C. Launch an AWS CloudFormation stack set from the management account that automatically creates a new VPC and a VPC transit gateway attachment in a member account

D. Launch an AWS CloudFormation stack set from the management account that automatically creates a new VPC and a peering transit gateway attachment in a member account

E. From the management account, share the transit gateway with member accounts by using AWS Service Catalog

View answer

Correct Answer: AC

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free AWS SAP-C02 Practice Questions & Answers 2026 Part4

View The Updated SAP-C02 Exam Questions

View The Updated AWS Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free AWS SAP-C02 Practice Questions & Answers 2026 Part4

View The Updated SAP-C02 Exam Questions

View The Updated AWS Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now