Get Updated Amazon SAP-C02 Exam Questions

QUESTION 1

A company uses Amazon EC2 instances to run business-critical applications. Software that is running on the EC2 instances recently caused Amazon GuardDuty to generate the PenTest:S3/KaliLinux finding for some of the company's environments. The company wants to prevent this software from running again. The company is using AWS Organizations to manage its AWS accounts.

What should a solutions architect do to meet these requirements?

A

Configure Amazon Inspector to check the EC2 instances for the forbidden software and to send an Amazon Simple Notification Service (Amazon SNS) notification when the software is identified. Create an AWS Lambda function that stops the EC2 instances and notifies the company. Subscribe the Lambda function to the SNS topic.

B

Create a centralized Amazon EventBridge (Amazon CloudWatch Events) bus to receive GuardDuty events from all accounts. Configure an EventBridge (CloudWatch Events) rule to invoke an AWS Lambda function when the GuardDuty event is generated. Configure the Lambda function to stop the EC2 instances and notify the company.

C

Configure an SCP to prevent the software from being installed. Apply the SCP to the root OU for the organization.

D

Create a library of approved EC2 AMIS. Create a catalog in AWS Service Catalog to deploy the AMIS for the organization. Update IAM policies to allow EC2 instances to be created only with Service Catalog AMIS.

Correct Option: B

✅ Create a centralized Amazon EventBridge (Amazon CloudWatch Events) bus to receive GuardDuty events from all accounts. Configure an EventBridge (CloudWatch Events) rule to invoke an AWS Lambda function when the GuardDuty event is generated. Configure the Lambda function to stop the EC2 instances and notify the company.
Description: Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across your AWS accounts and workloads, generating findings for suspicious activities like the installation of forbidden software. Amazon EventBridge (formerly CloudWatch Events) is a serverless event bus service that enables applications to communicate through events. It can receive events from various AWS services, your own applications, and SaaS applications. AWS Lambda is a serverless compute service that executes code in response to events, allowing for automated remediation actions.

Why this fits: This solution leverages GuardDuty's continuous threat detection capabilities to identify the installation of forbidden software. By integrating with a centralized EventBridge bus, events from GuardDuty across all accounts in an AWS Organization can be aggregated. An EventBridge rule can then trigger an AWS Lambda function, providing an automated, real-time response to stop the compromised EC2 instances and notify relevant personnel. This approach is highly scalable, automated, and aligns with best practices for security incident response in a multi-account environment, focusing on detecting and remediating threats post-deployment.

Example: In a large organization, GuardDuty detects an instance of an unauthorized cryptocurrency mining application being installed and executed on an EC2 instance in a development account. This generates a GuardDuty finding, which is routed to a central EventBridge bus in the security master account. An EventBridge rule, configured to match this specific finding type, invokes a Lambda function. The Lambda function extracts the instance ID, calls the ec2:StopInstances API to isolate the compromised instance, and then sends an Amazon SNS notification to the security operations team with the details of the incident.

QUESTION 2

A company that develops consumer electronics with offices in Europe and Asia has 60 TB of software images stored on premises in Europe. The company wants to transfer the images to an Amazon S3 bucket in the ap-northeast-1 Region. New software images are created daily and must be encrypted in transit. The company needs a solution that does not require custom development to automatically transfer all existing and new software images to Amazon S3.

What is the next step in the transfer process?

A

Deploy an AWS DataSync agent and configure a task to transfer the images to the S3 bucket.

B

Configure Amazon Kinesis Data Firehose to transfer the images using S3 Transfer Acceleration.

C

Use an AWS Snowball device to transfer the images with the S3 bucket as the target.

D

Transfer the images over a Site-to-Site VPN connection using the S3 API with multipart upload.

Correct Option: A

✅ Deploy an AWS DataSync agent and configure a task to transfer the images to the S3 bucket.
Description: AWS DataSync is a secure, online data transfer service that simplifies, automates, and accelerates moving data between on-premises storage systems and AWS storage services, as well as between different AWS storage services. It utilizes a software agent deployed in your on-premises environment (e.g., on a virtual machine or hardware server) to access your existing file systems (NFS, SMB, HDFS) or object storage and efficiently transfer data to Amazon S3, Amazon EFS, or Amazon FSx.

Why this fits: For migrating "millions of images" from an on-premises source to Amazon S3, DataSync is the most suitable managed service. It is specifically designed for high-performance, large-scale online data migrations. DataSync optimizes network utilization, handles network interruptions, provides in-flight encryption, and performs data integrity verification, ensuring reliable and efficient transfers. This approach is superior to manual scripting over a VPN or using services not designed for bulk file transfers, offering automation, speed, and robustness for significant datasets.

Example: An organization needs to migrate 300 TB of image files from an on-premises NFS share to an S3 bucket for archival and new cloud-native processing workflows. They would deploy a DataSync agent on a VM in their data center, configure the NFS share as a source location and the S3 bucket as a destination, then create a DataSync task to automatically and securely transfer all existing images. Subsequent changes could also be synchronized.

Reference: https://aws.amazon.com/datasync/

QUESTION 3

A company has implemented a new security requirement. According to the new requirement, the company must scan all traffic from corporate AWS instances in the company's VPC for violations of the company's security policies. As a result of these scans, the company can block access to and from specific IP addresses.

To meet the new requirement, the company deploys a set of Amazon EC2 instances in private subnets to serve as transparent proxies. The company installs approved proxy server software on these EC2 instances. The company modifies the route tables on all subnets to use the corresponding EC2 instances with proxy software as the default route. The company also creates security groups that are compliant with the security policies and assigns these security groups to the EC2 instances.

Despite these configurations, the traffic of the EC2 instances in their private subnets is not being properly forwarded to the internet.

What should a solutions architect do to resolve this issue?

A

Disable source/destination checks on the EC2 instances that run the proxy software.

B

Add a rule to the security group that is assigned to the proxy EC2 instances to allow all traffic between instances that have this security group. Assign this security group to all EC2 instances in the VPC.

C

Change the VPC's DHCP options set. Set the DNS server options to point to the addresses of the proxy EC2 instances.

D

Assign one additional elastic network interface to each proxy EC2 instance. Ensure that one of these network interfaces has a route to the private subnets. Ensure that the other network interface has a route to the internet.

Correct Option: A

✅ Disable source/destination checks on the EC2 instances that run the proxy software.
Description: By default, every EC2 instance performs source/destination checks. This means the instance must be the source or the destination of any network traffic it sends or receives. If an instance needs to act as a router, firewall, NAT device, or a proxy, it must be able to send and receive traffic where it is neither the source nor the final destination.

Why this fits: When an EC2 instance acts as a proxy, it receives network traffic on behalf of other instances and then forwards that traffic to its ultimate destination. Without disabling source/destination checks, the AWS networking infrastructure would drop packets because the proxy instance is sending traffic with source IPs that are not its own, or receiving traffic for destination IPs that are not its own. Disabling this check explicitly permits the instance to forward traffic for other entities, which is fundamental to a proxy's operation.

Example: Consider an EC2 instance configured as a web proxy for internal applications. Client applications within the VPC send HTTP/HTTPS requests to the proxy instance. The proxy then processes these requests and forwards them to external web servers on the internet. For the proxy to successfully forward these requests (where the original source IP is the client and the destination IP is the external web server), its source/destination checks must be disabled.

QUESTION 4

A company needs to improve the reliability of its ticketing application. The application runs on an Amazon Elastic Container Service (Amazon ECS) cluster. The company uses Amazon CloudFront to serve the application. A single ECS service of the ECS cluster is the CloudFront distribution's origin.

The application allows only a specific number of active users to enter a ticket purchasing flow. These users are Identified by an encrypted attribute in their JSON Web Token (JWT). All other users are redirected to a waiting room module until there is available capacity for purchasing.

The application is experiencing high loads. The waiting room module is working as designed, but load on the waiting room is disrupting the application's availability. This disruption is negatively affecting the application's ticket sale transactions.

Which solution will provide the MOST reliability for ticket sale transactions during periods of high load?

A

Create a separate service in the ECS cluster for the waiting room. use a separate scaling configuration. Ensure that the ticketing service uses the JWT information and appropriately forwards requests to the waiting room service.

B

Move the application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. Split the waiting room module into a pod that is separate from the ticketing pod. Make the ticketing pod part of a StatefulSet. Ensure that the ticketing pod uses the JWT information and appropriately forwards requests to the waiting room pod.

C

Create a separate service in the ECS cluster for the waiting room. Use a separate scaling configuration. Create a CloudFront function that inspects the JWT information and appropriately forwards requests to the ticketing service or the waiting room service.

D

Move the application to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. Split the waiting room module into a pod that is separate from the ticketing pod. Use AWS App Mesh by provisioning the App Mesh controller for Kubernetes. Enable mTLS authentication and service-to-service authentication for communication between the ticketing pod and the waiting room pod. Ensure that the ticketing pod uses the JWT information and appropriately forwards requests to the waiting room pod.

Correct Option: C

✅ Create a separate service in the ECS cluster for the waiting room. Use a separate scaling configuration. Create a CloudFront function that inspects the JWT information and appropriately forwards requests to the ticketing service or the waiting room service.
Description: This solution leverages Amazon Elastic Container Service (ECS) for microservices deployment and AWS CloudFront with CloudFront Functions for intelligent, low-latency edge routing. By creating a separate ECS service for the waiting room, it can be scaled independently of the main ticketing service, handling fluctuating demand without impacting core functionality. CloudFront Functions, executing at AWS edge locations, inspect incoming requests and their JSON Web Tokens (JWTs) to make real-time routing decisions, directing users to either the waiting room or the ticketing service based on the JWT's claims (e.g., user status, queue position).

Why this fits: This approach is highly scalable and efficient.

Microservices Architecture: Separating the waiting room into its own ECS service allows independent scaling, deployment, and management, which is crucial for handling large, unpredictable spikes in traffic often associated with waiting rooms.
Edge Routing with CloudFront Functions: CloudFront Functions provide extremely low-latency execution at the AWS edge network, close to the users. Inspecting the JWT at this stage enables intelligent routing decisions before the request even reaches the origin servers. This significantly reduces the load on backend services and provides a faster, more responsive user experience. JWTs can carry session information, user authentication status, or even a 'waiting room token' that the function can use to decide the destination.
Decoupling Routing Logic: By placing the routing logic in a CloudFront function, the ticketing service is relieved of this responsibility, allowing it to focus solely on its core function. This reduces complexity and potential bottlenecks in the backend application.

Example: During a popular concert ticket sale, millions of users might simultaneously attempt to access the ticketing website. A CloudFront function can be configured to inspect the JWT of each incoming request. If the JWT indicates the user has not yet passed through the waiting room or is currently in a queue, the CloudFront function redirects them to the waiting room ECS service. If the JWT indicates they are authorized to proceed, they are directed to the main ticketing ECS service. This ensures that the ticketing service is only hit by requests from users who are ready to purchase, while the waiting room absorbs the initial surge.

QUESTION 5

A company wants to migrate virtual Microsoft workloads from an on-premises data center to AWS. The company has successfully tested a few sample workloads on AWS. The company also has created an AWS Site-to-Site VPN connection to a VPC. A solutions architect needs to generate a total cost of ownership (TCO) report for the migration of all the workloads from the data center.

Simple Network Management Protocol (SNMP) has been enabled on each VM in the data center. The company cannot add more VMs in the data center and cannot install additional software on the VMs. The discovery data must be automatically imported into AWS Migration Hub.

Which solution will meet these requirements?

A

Use the AWS Application Migration Service agentless service and the AWS Migration Hub Strategy Recommendations to generate the TCO report.

B

Launch a Windows Amazon EC2 instance. Install the Migration Evaluator agentless collector on the EC2 instance. Configure Migration Evaluator to generate the TCO report.

C

Launch a Windows Amazon EC2 instance. Install the Migration Evaluator agentless collector on the EC2 instance. Configure Migration Hub to generate the TCO report.

D

Use the AWS Migration Readiness Assessment tool inside the VPC. Configure Migration Evaluator to generate the TCO report.

Correct Option: B

✅ Launch a Windows Amazon EC2 instance. Install the Migration Evaluator agentless collector on the EC2 instance. Configure Migration Evaluator to generate the TCO report.
Description: AWS Migration Evaluator (formerly TSO Logic) is a complimentary service that provides data-driven business cases for cloud migration. It operates by collecting performance and utilization data from an existing on-premises environment using an agentless collector to estimate the Total Cost of Ownership (TCO) of migrating workloads to AWS.

Why this fits: To utilize Migration Evaluator for generating a TCO report, an agentless collector application needs to be deployed within the customer's environment. This collector is typically installed on a dedicated Windows server. While it can be installed on an on-premises server, deploying it on a Windows Amazon EC2 instance (especially for environments already connected to AWS or for specific network architectures) is a valid and common approach. The collector gathers data such as CPU, RAM, storage, and network utilization, which is then uploaded to the Migration Evaluator service. It is Migration Evaluator itself that processes this data and generates the comprehensive TCO report.

Example: A company aims to understand the financial implications of moving its data centers to AWS. They provision a Windows Server EC2 instance, install the Migration Evaluator collector, and configure it to scan their on-premises VMware environment. After a defined data collection period, Migration Evaluator analyzes the gathered performance metrics and generates a detailed TCO report comparing their current expenditures with potential AWS costs, including recommended instance types and savings.

Reference: https://docs.aws.amazon.com/migrationhub/latest/ug/evaluator-getting-started.html

QUESTION 6

A company wants to migrate its website to AWS. The website uses microservices and runs on containers that are deployed in an on-premises, self-managed Kubernetes cluster. All the manifests that define the deployments for the containers in the Kubernetes deployment are in source control.

All data for the website is stored in a PostgreSQL database. An open source container image repository runs alongside the on-premises environment.

A solutions architect needs to determine the architecture that the company will use for the website on AWS.

Which solution will meet these requirements with the LEAST effort to migrate?

A

Create an AWS App Runner service. Connect the App Runner service to the open source container image repository. Deploy the manifests from on premises to the App Runner service. Create an Amazon RDS for PostgreSQL database.

B

Create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that has managed node groups. Copy the application containers to a new Amazon Elastic Container Registry (Amazon ECR) repository. Deploy the manifests from on premises to the EKS cluster. Create an Amazon Aurora PostgreSQL DBcluster.

C

Create an Amazon Elastic Container Service (Amazon ECS) cluster that has an Amazon EC2 capacity pool. Copy the application containers to a new Amazon Elastic Container Registry (Amazon ECR) repository. Register each container image as a new task definition. Configure ECS services for each task definition to match the original Kubernetes deployments. Create an Amazon Aurora PostgreSQL DB cluster.

D

Rebuild the on-premises Kubernetes cluster by hosting the cluster on Amazon EC2 instances. Migrate the open source container image repository to the EC2 instances. Deploy the manifests from on premises to the new cluster on AWS. Deploy an open source PostgreSQL database on the new cluster.

Correct Option: B

✅ Choice B: Create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that has managed node groups. Copy the application containers to a new Amazon Elastic Container Registry (Amazon ECR) repository. Deploy the manifests from on premises to the EKS cluster. Create an Amazon Aurora PostgreSQL DBcluster.
Description: Amazon EKS is a managed service that makes it easy to run Kubernetes on AWS without needing to install, operate, and maintain your own Kubernetes control plane. It integrates with various AWS services for networking, storage, and security. Amazon ECR is a fully managed Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images. Amazon Aurora PostgreSQL is a fully managed, PostgreSQL-compatible relational database built for the cloud, offering superior performance, high availability, and scalability compared to standard PostgreSQL installations.

Why this fits: This choice represents the most direct and operationally efficient migration path for an existing on-premises Kubernetes workload.

Amazon EKS: By using Amazon EKS, the existing Kubernetes manifests (YAML files defining deployments, services, etc.) can be deployed with minimal to no changes, significantly reducing migration effort and risk. Managed node groups further simplify operations by handling patching, updating, and scaling of EC2 instances for the worker nodes. This directly addresses the need to migrate an "on-premises Kubernetes cluster."
Amazon ECR: Copying the application containers to Amazon ECR provides a secure, highly available, and integrated container image repository within AWS, which is essential for deploying applications to EKS.
Amazon Aurora PostgreSQL DB cluster: Replacing an on-premises PostgreSQL database with Amazon Aurora PostgreSQL provides a robust, highly available, and scalable managed database solution. Aurora's compatibility with PostgreSQL means application code changes are typically minimal, if any, while benefiting from AWS's managed service advantages like automated backups, patching, and replication.

Consider why other options are less optimal:

Choice A (App Runner): AWS App Runner is a good solution for quickly deploying web applications and APIs, but it's not designed for directly consuming and managing existing Kubernetes manifests. It would require significant refactoring of the application's deployment strategy.
Choice C (ECS): While Amazon ECS is a powerful container orchestration service, migrating from Kubernetes to ECS typically involves converting Kubernetes manifests to ECS task definitions and services. This conversion introduces additional refactoring effort and complexity compared to using EKS, which natively supports Kubernetes.
Choice D (Rebuild on EC2): Rebuilding a Kubernetes cluster on EC2 instances yourself (Kubeadm, kops, etc.) would mean managing the Kubernetes control plane, worker nodes, and all underlying infrastructure. This significantly increases operational overhead and complexity compared to using a managed service like EKS. Deploying an "open source PostgreSQL database on the new cluster" would also mean self-managing the database, losing the benefits of a managed service like Aurora or RDS.

Example: An e-commerce company wants to migrate its existing microservices application, currently running on an on-premises Kubernetes cluster with a PostgreSQL database, to AWS. Their development team uses kubectl and standard Kubernetes YAML files for deployments. They would provision an Amazon EKS cluster, push their Docker images to Amazon ECR, and then use kubectl to apply their existing deployment manifests directly to the EKS cluster. For the database, they would create an Amazon Aurora PostgreSQL DB cluster, migrate their data, and update their application's database connection strings.

QUESTION 7

A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company hosts some applications in a VPC in the company's shared services account. The company has attached a transit gateway to the VPC in the shared services account.

The company is developing a new capability and has created a development environment that requires access to the applications that are in the shared services account. The company intends to delete and recreate resources frequently in the development account. The company also wants to give a development team the ability to recreate the team's connection to the shared services account as required.

Which solution will meet these requirements?

A

Create a transit gateway in the development account. Create a transit gateway peering request to the shared services account. Configure the shared services transit gateway to automatically accept peering connections.

B

Turn on automatic acceptance for the transit gateway in the shared services account. Use AWS Resource Access Manager (AWS RAM) to share the transit gateway resource in the shared services account with the development account. Accept the resource in the development account. Create a transit gateway attachment in the development account.

C

Turn on automatic acceptance for the transit gateway in the shared services account. Create a VPC endpoint. Use the endpoint policy to grant permissions on the VPC endpoint for the development account. Configure the endpoint service to automatically accept connection requests. Provide the endpoint details to the development team.

D

Create an Amazon EventBridge rule to invoke an AWS Lambda function that accepts the transit gateway attachment when the development account makes an attachment request. use AWS Network Manager to share the transit gateway in the shared services account with the development account. Accept the transit gateway in the development account.

Correct Option: B

✅ Turn on automatic acceptance for the transit gateway in the shared services account. Use AWS Resource Access Manager (AWS RAM) to share the transit gateway resource in the shared services account with the development account. Accept the resource in the development account. Create a transit gateway attachment in the development account.
Description: AWS Resource Access Manager (RAM) is a service that enables you to securely share your AWS resources with other AWS accounts or within your AWS Organization. When a Transit Gateway (TGW) is shared via RAM, it allows recipient accounts to create attachments from their Virtual Private Clouds (VPCs) or Direct Connect gateways to the shared TGW, effectively extending the network to other accounts.

Why this fits: This approach correctly leverages AWS RAM, the standard and most secure method for cross-account resource sharing, specifically for Transit Gateways. The shared services account shares its Transit Gateway with the development account using RAM. The development account then accepts this shared resource. Once accepted, the development account can create its own Transit Gateway attachment, connecting its VPCs to the shared TGW. Enabling automatic acceptance on the Transit Gateway simplifies the attachment process by removing the need for manual approval for each new attachment from the owner account. This sequence of steps ensures secure and scalable cross-account connectivity to a central Transit Gateway.

Example: A company operates a central networking team in an AWS "Shared Services" account that provisions a Transit Gateway. Individual application teams, like a "Development" team, operate in separate AWS accounts. To allow the Development team's VPCs to communicate with other VPCs attached to the central TGW, the Shared Services account uses AWS RAM to share the TGW resource with the Development account. The Development account accepts the shared resource. Subsequently, the Development team can create TGW attachments from their application VPCs to the shared Transit Gateway, enabling seamless inter-VPC communication.

QUESTION 8

A company needs to implement disaster recovery for a critical application that runs in a single AWS Region. The application's users interact with a web frontend that is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application writes to an Amazon RDS for MySQL DB instance. The application also outputs processed documents that are stored in an Amazon S3 bucket.

The company's finance team directly queries the database to run reports. During busy periods, these queries consume resources and negatively affect application performance.

A solutions architect must design a solution that will provide resiliency during a disaster. The solution must minimize data loss and must resolve the performance problems that result from the finance team's queries.

Which solution will meet these requirements?

A

Migrate the database to Amazon DynamoDB and use DynamoDB global tables. Instruct the finance team to query a global table in a separate Region. Create an AWS Lambda function to periodically synchronize the contents of the original S3 bucket to a new S3 bucket in the separate Region. Launch EC2 instances and create an ALB in the separate Region. Configure the application to point to the new S3 bucket.

B

Launch additional EC2 instances that host the application in a separate Region. Add the additional instances to the existing ALB. In the separate Region. Create a read replica of the RDS DB instance. Instruct the finance team to run queries against the read replica. Use S3 Cross-Region Replication (CRR) from the original S3 bucket to a new S3 bucket in the separate Region. During a disaster. promote the read replica to a standalone DB instance. Configure the application to point to the new S3 bucket and to the newly promoted read replica.

C

Create a read replica of the RDS DB instance in a separate Region. Instruct the finance team to run queries against the read replica. Create AMIS of the EC2 instances that host the application frontend. Copy the AMIS to the separate Region. Use S3 Cross-Region Replication (CRR) from the original S3 bucket to a new S3 bucket in the separate Region. During a disaster. promote the read replica to a standalone DB instance. Launch EC2 instances from the AMIS and create an ALB to present the application to end users. Configure the application to point to the new S3 bucket.

D

Create hourly snapshots of the RDS DB instance. Copy the snapshots to a separate Region. Add an Amazon ElastiCache cluster in front of the existing RDS database. Create AMIs of the EC2 instances that host the application frontend. Copy the AMIs to the separate Region. Use S3 Cross-Region Replication (CRR) from the original S3 bucket to a new S3 bucket in the separate Region. During a disaster. restore the database from the latest RDS snapshot. Launch EC2 instances from the AMIs and create an ALB to present the application to end users. Configure the application to point to the new S3 bucket.

Correct Option: C

✅ Choice C: Create a read replica of the RDS DB instance in a separate Region. Instruct the finance team to run queries against the read replica. Create AMIS of the EC2 instances that host the application frontend. Copy the AMIS to the separate Region. Use S3 Cross-Region Replication (CRR) from the original S3 bucket to a new S3 bucket in the separate Region. During a disaster. promote the read replica to a standalone DB instance. Launch EC2 instances from the AMIS and create an ALB to present the application to end users. Configure the application to point to the new S3 bucket.
Description: This choice outlines a comprehensive multi-region disaster recovery (DR) strategy for a three-tier application (EC2 frontend, RDS database, S3 storage) aiming for a low Recovery Point Objective (RPO) and Recovery Time Objective (RTO). It leverages AWS native services for data replication and infrastructure provisioning in a secondary region.

Why this fits:

RDS Disaster Recovery: Creating a read replica in a separate region is a standard and highly effective pattern for RDS disaster recovery. It provides continuous data synchronization with minimal lag, enabling a low RPO. In the event of a disaster, promoting the read replica to a standalone DB instance ensures rapid database recovery with minimal data loss. Directing finance queries to the read replica also provides operational benefits by offloading analytical workloads from the primary database, improving performance and availability.
Application Frontend DR: Creating and copying Amazon Machine Images (AMIs) of the EC2 instances to the DR region ensures that the application frontend can be quickly provisioned with consistent configurations. Launching new EC2 instances from these AMIs behind an Application Load Balancer (ALB) provides a resilient and scalable application tier in the DR region.
S3 Data Replication: S3 Cross-Region Replication (CRR) automatically and asynchronously replicates objects between S3 buckets in different AWS Regions. This ensures that the application's static assets and other S3-stored data are continuously available in the DR region with high durability and a low RPO.
This approach minimizes downtime and data loss by employing active-passive DR patterns for all critical components, making it a robust solution for the AWS Certified Solutions Architect - Professional exam context.

Example: An e-commerce platform hosted in us-east-1 with its database on RDS, static content on S3, and application servers on EC2. To implement DR in us-west-2, an engineer configures an RDS read replica in us-west-2, sets up S3 CRR from us-east-1 to us-west-2, creates AMIs of the EC2 instances and copies them to us-west-2. In a disaster scenario affecting us-east-1, the read replica in us-west-2 is promoted, new EC2 instances are launched from the copied AMIs behind a new ALB, and the application is reconfigured to point to the us-west-2 S3 bucket and the newly promoted database.

QUESTION 9

A company runs a video-on-demand (VOD) content streaming application on AWS. The application includes an Amazon CloudFront distribution that uses the default cache behavior. The distribution has a single origin that points to an Amazon S3 bucket that contains the video files.

The company wants to improve the application's reliability. The company creates a second S3 bucket and configures S3 Cross-Region Replication (CRR) between the S3 buckets. The company must implement high availability for the CloudFront deployment and must ensure that failover begins within 1 second.

Which change to the current architecture will meet these requirements with the LEAST operational overhead?

A

Create a second CloudFront distribution that uses the second S3 bucket as a single origin. Create an origin group. Add both distributions to the origin group. Set the original distribution as the primary distribution. Set the new distribution as the secondary distribution. Create an Amazon Route 53 health check to monitor the health of the primary distribution and secondary distribution every second.

B

Create a new origin in the existing CloudFront distribution. Specify the second S3 bucket as the new origin. Create an origin group. Add the original origin as the primary origin. Add the new origin as the secondary origin. Set the origin response timeout value to 1. Set the origin connection attempts value to 1.

C

Create a new origin in the existing CloudFront distribution. Specify the second S3 bucket as the new origin. Create an origin group. Add the original origin as the primary origin. Add the new origin as the secondary origin. Update the default cache behavior to use the origin group. Set the origin connection timeout value to 1. Set the origin connection attempts value to 1.

D

Create a new origin in the existing CloudFront distribution. Specify the second S3 bucket as the new origin. Create an AWS Lambda function to monitor the health of the original origin. Program the Lambda function to update the CloudFront distribution and promote the secondary origin to primary if a health check fails. Create an Amazon EventBridge scheduled rule to invoke the Lambda function every second.

Correct Option: C

✅ Create a new origin in the existing CloudFront distribution. Specify the second S3 bucket as the new origin. Create an origin group. Add the original origin as the primary origin. Add the new origin as the secondary origin. Update the default cache behavior to use the origin group. Set the origin connection timeout value to 1. Set the origin connection attempts value to 1.
Description: CloudFront origin groups enable automatic failover to a secondary origin when the primary origin becomes unavailable. To implement this, you define multiple origins for your distribution and then group them, designating one as primary and others as secondary. By configuring a cache behavior to use this origin group, CloudFront will automatically route requests to the secondary origin if the primary origin fails to respond within the specified connection timeout and attempts.

Why this fits: This choice precisely outlines the correct and recommended architectural pattern for achieving high availability and failover for S3 origins with CloudFront.

Creating a new origin for the second S3 bucket: This is the first logical step to make the backup S3 bucket available to CloudFront.
Creating an origin group with primary/secondary: This is the core CloudFront feature designed for origin failover. CloudFront actively monitors the primary origin and automatically switches to the secondary upon detecting issues.
Updating the default cache behavior to use the origin group: This is a crucial step that ensures all relevant requests are routed through the origin group, enabling the failover logic. Without this, the origin group would exist but not be utilized.
Setting origin connection timeout to 1 and origin connection attempts to 1: These parameters significantly reduce the time CloudFront waits before declaring an origin unhealthy and attempting failover. A low connection timeout (e.g., 1 second) and minimal connection attempts (e.g., 1) ensure rapid detection of origin failures and quick switching to the secondary origin, minimizing downtime.

Example: An e-commerce website serving static assets (images, CSS, JS) from an S3 bucket via CloudFront. To ensure continuous availability, a replica S3 bucket in a different region (or Availability Zone) is set up. By following the steps in Choice C, if the primary S3 bucket experiences an outage, CloudFront will detect the connection failure within 1 second and automatically start serving content from the secondary S3 bucket, ensuring users continue to access the website without interruption.

QUESTION 10

A company runs its architecture in multiple AWS Regions. The architecture includes Amazon CloudFront distributions that are connected to Application Load Balancers (ALBs) that terminate in the TLS. The architecture has cross-Region failover capabilities.

The ALBs handle traffic from customers who have different protocol capabilities. Load Balancer Capacity Unit (LCU) usage is high in new connection and data-processed dimensions. The company needs a solution to optimize LCIJ costs without modifying backend services or adding operational overhead. The solution must support users who use legacy protocols and preserve CloudFront behaviors and cross- Region failover.

Which solution will meet these requirements?

A

Configure an ALB listener that advertises only HTTP/2 for direct customer connections. Configure the listeners to reject HTTP/I .1 protocol negotiation attempts across Regions.B, Configure ALB listener idle timeout adjustments that are aligned with CloudFront origin settings, Maintain existing target connection patterns.

C

Configure ALPN protocol negotiation for the ALB listener configuration, Configure protocol compatibility for CloudFront connections across Regions.

D

Create a custom TLS security policy for the ALB listener configuration. Maintain updated cipher preferences across CloudFront origins,

Correct Option: C

✅ Option C (Correct)Reasoning: Configuring ALPN (Application-Layer Protocol Negotiation) on the ALB listener enables CloudFront to negotiate and establish HTTP/2 connections with the ALB. HTTP/2 multiplexes multiple requests over a single TCP connection, significantly reducing the "new connection" LCU usage and TLS handshakes. It also optimizes data transfer efficiency, addressing the "data-processed" LCU dimension. This approach requires no backend changes or operational overhead. CloudFront supports legacy client protocols and efficiently communicates with the ALB via HTTP/2, preserving existing behaviors and cross-Region failover capabilities.❌ Why the other choices are incorrect:* Option A is incorrect: Rejecting HTTP/1.1 would prevent users with legacy protocols from connecting, violating a key requirement.* Option B is incorrect: While adjusting idle timeouts helps with connection reuse, ALPN with HTTP/2 offers a more comprehensive optimization for both new connections and data processing.* Option D is incorrect: Creating a custom TLS security policy focuses on security posture and cipher preferences, not directly on reducing LCU costs from new connections or data processed.

Reference: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistributions.html#DownloadingObjectsHTTPS

QUESTION 11

A company wants to record key performance indicators (KPIs) from its application as part of a strategy to convert to a user-based licensing schema. The application is a multi-tier application with a web-based UI. The company saves all log files to Amazon CloudWatch by using the CloudWatch agent. All logins to the application are saved in a log file.

As part of the new license schema, the company needs to find out how many unique users each client has on a daily basis, weekly basis, and monthly basis.

Which solution will provide this information with the LEAST change to the application?

A

Configure an Amazon CloudWatch Logs metric filter that saves each successful login as a metric. Configure the user name and client name as dimensions for the metric.

B

Change the application logic to make each successful login generate a call to the AWS SDK to increment a custom metric that records user name and client name dimensions in CloudWatch.

C

Configure the CloudWatch agent to extract successful login metrics from the logs. Additionally, configure the CloudWatch agent to save the successful login metrics as a custom metric that uses the user name and client name as dimensions for the metric.

D

Configure an AWS Lambda function to consume an Amazon CloudWatch Logs stream of the application logs. Additionally, configure the Lambda function to increment a custom CloudWatch that uses the user name and client name as dimensions for the metric.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 12

A retail company is operating its ecommerce application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses an Amazon RDS DB instance as the database backend. Amazon CloudFront is configured with one origin that points to the ALB. Static content is cached. Amazon Route 53 is used to host all public zones.

After an update of the application, the ALB occasionally returns a 502 status code (Bad Gateway) error. The root cause is malformed HTTP headers that are returned to the ALB. The webpage returns successfully when a solutions architect reloads the webpage immediately after the error occurs.

While the company is working on the problem, the solutions architect needs to provide a custom error page instead of the standard ALB error page to visitors.

Which combination of steps will meet this requirement with the LEAST amount of operational overhead? (Select TWO.)

A

Create an Amazon S3 bucket. Configure the S3 bucket to host a static webpage. Upload the custom error pages to Amazon S3.

B

Create an Amazon CloudWatch alarm to invoke an AWS Lambda function if the ALB health check response Target.FailedHealthChecks is greater than O.

C

Configure the Lambda function to modify the forwarding rule at the ALB to point to a publicly accessible web server.

D

Configure a fallback target if the health check fails, Modify DNS records to point to a publicly accessible webpage-

E

Create an Amazon CloudWatch alarm to invoke an AWS Lambda function if the ALB health check response Elb.lnternalError is greater than O- Configure the Lambda function to modify the forwarding rule at the ALB to point to a public accessible web server.

F

Add a custom error response by configuring a CloudFront custom error page, Modify DNS records to point to a publicly accessible web page.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 13

A company runs an ecommerce web application on AWS. The web application is hosted as a static website on Amazon S3 with Amazon CloudFront for content delivery. An Amazon API Gateway API invokes AWS Lambda functions to handle user requests and order processing for the web application. The Lambda functions store data in an Amazon RDS for MySQL DB cluster that uses On-Demand Instances- The DB cluster usage has been consistent in tete past 12 months.

Recently the website has experienced SOL injection and web exploit attempts. Customers also report that order processing time has increased during periods of peak usage, During these periods the Lambda functions often have cold starts. As the company grows. the company needs to ensure scalability and Iow-latency access during traffic peaks, The company also must optimize the database costs and add protection against the SQL injection and web exploit attempts.

Which solution will meet these requirements?

A

Configure the Lambda functions to have an increased timeout value during peak periods. Use RDS Reserved Instances for the database- Use CloudFront and subscribe to AWS Shield Advanced to protect against the SOL injection and web exploit attempts

B

Increase the memory of the Lambda functions- Transition to Amazon Redshift for the database. Integrate Amazon Inspector with CloudFront to protect against the SOL injection and web exploit attempts.

C

Use Lambda functions with provisioned concurrency for compute during peak periods. Transition to Amazon Aurora Serverless for the database. Use CloudFront and subscribe to AWS Shield Advanced to protect against the SOL injection and web exploit attempts.

D

Use Lambda functions with provisioned concurrency for compute during peak periods use RDS Reserved Instances for the database. Integrate AWS WAF with CloudFront to protect against the SOL injection and web exploit attempts.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 14

A publishing company's design team updates the icons and other static assets that an ecommerce web application uses. The company serves the icons and assets from an Amazon S3 bucket that is hosted in the company's production account. The company also uses a development account that members of the design team can access.

After the design team tests the static assets in the development account, the design team needs to load the assets into the S3 bucket in the production account. A solutions architect must provide the design team with access to the production account without exposing other parts of the web application to the risk of unwanted changes.

Which combination of steps will meet these requirements? (Select THREE.)

A

In the production account, create a new IAM policy that allows read and write access to the S3 bucket.

B

In the development account, create a new IAM policy that allows read and write access to the S3 bucket.

C

In the production account, create a role. Attach the new policy to the role. Define the development account as a trusted entity.

D

In the development account, create a role. Attach the new policy to the role. Define the production account as a trusted entity.

E

In the development account, create a group that contains all the IAM users of the design team. Attach a different IAM policy to the group to allow the sts:AssumeRole action on the role in the production account.

F

In the development account, create a group that contains all the IAM users of the design team. Attach a different IAM policy to the group to allow the sts:AssumeRole action on the role in the development account.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 15

A company has multiple lines of business (LOBs) that roll up to the parent company. The company has asked its solutions architect to develop a solution with the following requirements:

✑ Produce a single AWS invoice for all of the AWS accounts used by its LOBs.

✑ The costs for each LOB account should be broken out on the invoice.

✑ Provide the ability to restrict services and features in the LOB accounts, as defined by the company's governance policy.

✑ Each LOB account should be delegated full administrator permissions, regardless of the governance policy.

Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)

A

Use AWS Organizations to create an organization in the parent account for each LOB. Then, invite each LOB account to the appropriate organization.

B

Use AWS Organizations to create a single organization in the parent account. Then, invite each LOB's AWS account to pin the organization.

C

Implement service quotas to define the services and features that are permitted and apply the quotas to each LOB as appropriate.

D

Create an SCP that allows only approved services and features, then apply the policy to the LOB accounts.

E

Enable consolidated billing in the parent account's billing console and link the LOB accounts.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 16

A retail company has an on-premises data center in Europe. The company also has a multi-Region AWS presence that includes the eu-west1 and us-east-1 Regions. The company wants to be able to route network traffic from its on-premises infrastructure into VPCs in either of those Regions. The company also needs to support traffic that is routed directly between VPCs in those Regions. No single points of failure can exist on the network.

The company already has created two 1 Gbps AWS Direct Connect connections from its on-premises data center. Each connection goes into a separate Direct Connect location in Europe for high availability. These two locations are named DX-A and DX-B, respectively. Each Region has a single AWS Transit Gateway that is configured to route all inter-VPC traffic within that Region.

Which solution will meet these requirements?

A

Create a private VIF from the DX-A connection into a Direct Connect gateway. Create a private VIF from the DX-B connection into the same Direct Connect gateway for high availability, Associate both the eu-west-1 and us-east-1 transit gateways with the Direct Connect gateway. Peer the transit gateways with each other to support cross-Region routing.

B

Create a transit VIF from the DX-A connection into a Direct Connect gateway Associate the eu-west-1 transit gateway with this Direct Connect gateway, Create a transit VIF from the DX-B connection into a separate Direct Connect gateway. Associate the us-east-I transit gateway with this separate Direct Connect gateway. Peer the Direct Connect gateways with each other to support high availability and cross-Region routing.

C

Create a transit VIF from the DX-A connection into a Direct Connect gateway. Create a transit VIF from the DX-B connection into the same Direct Connect gateway for high availability. Associate both the eu-west-l and us-east-I transit gateways with this Direct Connect gateway. Configure the Direct Connect gateway to route traffic between the transit gateways,

D

Create a transit VIF from the DX-A connection into a Direct Connect gateway. Create a transit VIF from the DX-B connection into the same Direct Connect gateway for high availability. Associate both the eu-west-l and us-east-I transit gateways with this Direct Connect gateway Peer the transit gateways with each other to support cross-Region routing.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 17

A company runs a software-as-a-service (SaaS) application on AWS. The application consists of AWS Lambda functions and an Amazon RDS for MySQL Multi- AZ database. During market events, the application has a much higher workload than normal. Users notice slow response times during the peak periods because of many database connections. The company needs to improve the scalable performance and availability of the database.

Which solution meets these requirements?

A

Create an Amazon CloudWatch alarm action that triggers a Lambda function to add an Amazon RDS for MySQL read replica when resource utilization hits a threshold.

B

Migrate the database to Amazon Aurora, and add a read replica. Add a database connection pool outside of the Lambda handler function.

C

Migrate the database to Amazon Aurora, and add a read replica. Use Amazon Route 53 weighted records.

D

Migrate the database to Amazon Aurora, and add an Aurora Replica. Configure Amazon RDS Proxy to manage database connection pools.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 18

A media streaming company stores millions of video files in Amazon S3. The company uses tags for content type, popularity score, and last access date. The company needs to optimize storage costs by automatically transitioning content to storage tiers based on custom rules for high, medium, and low-popularity content. The company wants to store files in archival storage tiers after 2 years of inactivity. The company must track transition events.

Which solution will meet these requirements with the LEAST operational overhead?

A

Configure S3 Lifecycle policies with multiple rules that use object tags and prefixes to filter files. Use S3 Event Notifications to capture S3 lifecycle transitions and to invoke AWS Lambda functions that track transition events and store metadata in an S3 bucket.

B

Use AWS DataSync to periodically scan S3 objects and to evaluate transition criteria. Use Amazon EventBridge with custom patterns to invoke AWS Stepn Functions workflows to transition objects to cost-effective storage tiers. Use Amazon Athena to query AWS CloudTrail logs to track transition events,

C

Implement Amazon S3 Intelligent-Tiering and use S3 Inventory reports that are processed by AWS Glue jobs to identify objects that meet transition criteria. Configure Amazon SNS to send notifications for S3 Lifecycle events,

D

Create custom AWS Lambda functions that are invoked by S3 PUT events to evaluate object metadata and to transition objects to correct storage classes- Use Amazon SQS to queue transition requests. Load transition requests into Amazon RDS to track transition events.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 19

A company has developed an application that is running Windows Server on VMware vSphere VMs that the company hosts or premises. The application data is stored in a proprietary format that must be read through the application. The company manually provisioned the servers and the application.

As part of its disaster recovery plan, the company warns the ability to host its application on AWS temporarily the company's on-premises environment becomes unavailable. The company wants the application to return to on-premises hosting after a disaster recovery event is complete The RPO 5 minutes.

Which solution meets these requirements with the LEAST amount of operational overhead?

A

Configure AWS DataSync. Replicate the data to Amazon Elastic Block Store (Amazon EBS) volumes When the on-premises environment is unavailable, use AWS CloudFormation templates to provision Amazon EC2 instances and attach the EBS volumes.

B

Configure AWS Elastic Disaster Recovery Replicate the data to replication Amazon EC2 instances that are attached to Amazon Elastic Block Store (Amazon EBS) volumes. When the on-premises environment is unavailable, use Elastic Disaster Recovery to launch EC2 instances that use the replicated volumes.

C

Provision an AWS Storage Gateway file gateway. Recreate the data to an Amazon S3 bucket. When the on-premises environment is unavailable, use AWS Backup to restore the data to Amazon Elastic Block Store (Amazon EBS) volumes and launch Amazon EC2 instances from these EBS volumes.

D

Provision an Amazon FSx for Windows File Server file system on AWS Replicate the data to the system. When the on-premise environment is unavailable, use AWS CloudFormation templates to provision Amazon EC2 instances and use AWS :CloudFormation::lnit commands to mount the Amazon FSx file shares

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 20

A company is running its solution on AWS in a manually created VPC. The company is using AWS CloudFormation to provision other parts of the infrastructure. According to a new requirement, the company must manage all infrastructure in an automatic way.

What should the company do to meet this new requirement with the LEAST effort?

A

Create a new AWS Cloud Development Kit (AWS CDK) stack that strictly provisions the existing VPC resources and configuration. Use AWS CDK to import the VPC into the stack and to manage the VPC.

B

Create a CloudFormation stack set that creates the VPC. Use the stack set to import the VPC into the stack.

C

Create a new CloudFormation template that strictly provisions the existing VPC resources and configuration. From the CloudFormation console, create a new stack by importing the existing resources.

D

Create a new CloudFormation template that creates the VPC. Use the AWS Serverless Application Model (AWS SAM) CLI to import the VPC.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 21

A company has a legacy monolithic application that is critical to the company's business. The company hosts the application on an Amazon EC2 instance that runs Amazon Linux 2. The company's application team receives a directive from the legal department to back up the data from the instance's encrypted Amazon EBS volume to an Amazon S3 bucket. The application team does not have the administrative SSH key pair for the instance. The application must continue to serve the users.

Which solution will meet these requirements?

A

Attach a role to the instance with permission to write to Amazon S3. Use the AWS Systems Manager Session Manager option to gain access to the instance and run commands to copy data into Amazon S3.

B

Create an image of the instance with the reboot option turned on. Launch a new EC2 instance from the image. Attach a role to the new instance with permission to write to Amazon S3. Run a command to copy data into Amazon S3.

C

Take a snapshot of the EBS volume by using Amazon Data Lifecycle Manager. Copy the data to Amazon S3.

D

Create an image of the instance. Launch a new EC2 instance from the image, Attach a role to the new instance with permission to write to Amazon S3. Run a command to copy data into Amazon S3.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 22

A company is running a three-tier web application in an on-premises data center. The frontend is served by an Apache web server, the middle tier is a monolithic Java application, and the storage tier is a PostgreSOL database.

During a recent marketing promotion, customers could not place orders through the application because the application crashed An analysis showed that all three tiers were overloaded. The application became unresponsive, and the database reached its capacity limit because of read operations. The company already has several similar promotions scheduled in the near future.

A solutions architect must develop a plan for migration to AWS to resolve these issues. The solution must maximize scalability and must minimize operational effort.

Which combination of steps will meet these requirements? (Select THREE.)

A

Refactor the frontend so that static assets can be hosted on Amazon S3. Use Amazon CloudFront to serve the frontend to customers. Connect the frontend to the Java application.

B

Rehost the Apache web server of the frontend on Amazon EC2 instances that are in an Auto Scaling group. Use a load balancer in front of the Auto Scaling group. Use Amazon Elastic File System (Amazon EFS) to host the static assets that the Apache web server needs.

C

Rehost the Java application in an AWS Elastic Beanstalk environment that includes auto scaling.

D

Refactor the Java application. Develop a Docker container to run the Java application. Use AWS Fargate to host the container.

E

Use AWS Database Migration Service (AWS DMS) to replatform the PostgreSQL database to an Amazon Aurora PostgreSQL database. Use Aurora Auto Scaling for read replicas.

F

Rehost the PostgreSQL database on an Amazon EC2 instance that has twice as much memory as the on-premises server.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 23

A company is developing a new on-demand video application that is based on microservices. The application will have 5 million users at launch and will have 30 million users after 6 months. The company has deployed the application on Amazon ECS on AWS Fargate. The company developed the application by using ECS services that use the HTTPS protocol.

A solutions architect needs to implement updates to the application by using blue/green deployments. The solution must distribute traffic to each ECS service through a load balancer. The application must automatically adjust the number of tasks in response to an Amazon CloudWatch alarm.

Which solution will meet these requirements?

A

Configure the ECS services to use the blue/green deployment type and a Network Load Balancer. Request increases to the service quota for tasks per service to meet the demand.

B

Configure the ECS services to use the blue/green deployment type and a Network Load Balancer. Implement an Auto Scaling group for each ECS service by using the Cluster Autoscaler.

C

Configure the ECS services to use the blue/green deployment type and an Application Load Balancer Implement an Auto Scaling group for each ECS service by using the Cluster Autoscaler.

D

Configure the ECS services to use the blue/green deployment type and an Application Load Balancer Implement Service Auto Scaling for each ECS service.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 24

A company provides a centralized Amazon EC2 application hosted in a single shared VPC. The centralized application must be accessible from client applications running in the VPCs of other business units. The centralized application front end is configured with a Network Load Balancer (NLB) for scalability.

Up to 10 business unit VPCs will need to be connected to the shared VPC. Some of the business unit VPC CIDR blocks overlap with the shared VPC, and some overlap with each other. Network connectivity to the centralized application in the shared VPC should be allowed from authorized business unit VPCs only.

Which network configuration should a solutions architect use to provide connectivity from the client applications in the business unit VPCs to the centralized application in the shared VPC?

A

Create an AWS Transit Gateway. Attach the shared VPC and the authorized business unit VPCs to the transit gateway. Create a single transit gateway route table and associate it with all of the attached VPCs. Allow automatic propagation of routes from the attachments into the route table. Configure VPC routing tables to send traffic to the transit gateway.

B

Create a VPC endpoint service using the centralized application NLB and enable the option to require endpoint acceptance. Create a VPC endpoint in each of the business unit VPCs using the service name of the endpoint service. Accept authorized endpoint requests from the endpoint service console.

C

Create a VPC peering connection from each business unit VPC to the shared VPC. Accept the VPC peering connections from the shared VPC console. Configure VPC routing tables to send traffic to the VPC peering connection.

D

Configure a virtual private gateway for the shared VPC and create customer gateways for each of the authorized business unit VPCs. Establish a Site-to-Site VPN connection from the business unit VPCs to the shared VPC. Configure VPC routing tables to send traffic to the VPN connection.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 25

A media storage application uploads user photos to Amazon S3 for processing by AWS Lambda functions. Application state is stored in Amazon DynamoDB tables. Users are reporting that some uploaded photos are not being processed properly. The application developers trace the logs and find that Lambda is experiencing photo processing issues when thousands of users upload photos simultaneously. The issues are the result of Lambda concurrency limits and the performance of DynamoDB when data is saved.

Which combination of actions should a solutions architect take to increase the performance and reliability of the application? (Select TWO.)

A

Evaluate and adjust the RCIJs for the DynamoDB tables.

B

Evaluate and adjust the WCUs for the DynamoDB tables.

C

Add an Amazon ElastiCache layer.

D

Add an Amazon SQS queue and reprocessing logic between Amazon S3 and the Lambda functions.

E

Use S3 Transfer Acceleration.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 26

A company runs an intranet application on premises. The company wants to configure a cloud backup of the application. The company has selected AWS Elastic Disaster Recovery for this solution.

The company requires that replication traffic does not travel through the public internet. The application also must not be accessible from the internet. The company does not want this solution to consume all available network bandwidth because other applications require bandwidth.

Which combination of steps will meet these requirements? (Choose three.)

A

Create a VPC that has at least two private subnets, two NAT gateways, and a virtual private gateway.

B

Create a VPC that has at least two public subnets, a virtual private gateway, and an internet gateway.

C

Create an AWS Site-to-Site VPN connection between the on-premises network and the target AWS network.

D

Create an AWS Direct Connect connection and a Direct Connect gateway between the on-premises network and the target AWS network.

E

During configuration of the replication servers, select the option to use private IP addresses for data replication.

F

During configuration of the launch settings for the target servers, select the option to ensure that the Recovery instance’s private IP address matches the source server's private IP address.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 27

A company has millions of objects in an Amazon S3 bucket. The objects are in the S3 Standard storage class. The number of users and applications that access the objects is increasing rapidly. Most of the objects in the S3 bucket are accessed frequently. The S3 objects are encrypted with server-side encryption with AWS KMS keys (SSE-KMS).

A solutions architect reviewed the company's monthly AWS invoice and noticed that AWS KMS costs are increasing because of the high number of requests from Amazon S3. The solutions architect needs to optimize costs with minimal changes to the application. Company policy mandates the use of customer managed keys.

Which solution will meet these requirements?

A

Create a new S3 bucket that uses server-side encryption with Amazon S3 managed keys (SSE-S3). Use S3 Batch Operations to copy the existing objects to the new S3 bucket. Configure an Amazon EventBridge rule to delete the old S3 bucket after the copy operation is successful.

B

Enable S3 Bucket Key with SSE-KMS on the existing S3 bucket. Use the S3 Batch Operations copy operation to copy existing objects and write the existing objects back to the same S3 bucket as objects encrypted with the S3 Bucket Key. Set up an S3 Lifecycle expiration policy for noncurrent versions.

C

Use AWS CloudHSM to store the encryption keys. Create a new S3 bucket. Use S3 Batch Operations to copy the existing objects to the new S3 bucket. Encrypt the objects by using the keys from CloudHSM. Set up an S3 Lifecycle expiration policy for noncurrent versions.

D

Use the S3 Intelligent-Tiering storage class for the S3 bucket, Create an S3 Intelligent-Tiering archive configuration to transition objects that are not accessed for 90 days to S3 Glacier Deep Archive.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 28

A company plans to deploy a new private intranet service on Amazon EC2 instances inside a VPC. An AWS Site-to-site VPN connects the VPC to the company's on-premises network. The new service must communicate with existing on-premises services. The on-premises services are accessible through the use of hostnames that reside in the company.example DNS zone. This DNS zone is wholly hosted on premises and is available only on the company’s private network.

A solutions architect must ensure that the new service can resolve hostnames on the company.example domain to integrate with existing services.

Which solution meets these requirements?

A

Create an empty private Zone in Amazon Route 53 for company.example. Add an additional NS record to the company's on-premises company.example Zone that to the authoritative name servers for the new private zone in Route 53.

B

Turn on DNS hostnames for the VPC. Configure a new outbound endpoint with Amazon Route Resolver. Create a Resolver rule to forward requests for company-example to the on-premises name servers.

C

Turn on DNS for the VPC. Configure a new inbound resolver with Amazon Route 53 Resolver. Configure the on-premises DNS server to forward requests for company.example to the new resolver.

D

Use AWS Systems Manager to configure a run document that will install a hosts file that contains any required hostnames. use an Amazon Event3ridge (Amazon CloudWatch Events) rule to run the document when an instance is entering the running state.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 29

A medical company is running a REST API on a set of Amazon EC2 instances. The EC2 instances run in an Auto Scaling group behind an Application Load Balancer (ALB). The ALB runs in three public subnets, and the EC2 instances run in three private subnets. The company has deployed an Amazon CloudFront distribution that has the ALB as the only origin.

Which solution should a solutions architect recommend to enhance the origin security?

A

Store a random string in AWS Secrets Manager. Create an AWS Lambda function for automatic secret rotation. Configure CloudFront to inject the random string as a custom HTTP header for the origin request. Create an AWS WAF web ACL rule with a string match rule for the custom header. Associate the web ACL with the ALB.

B

Create an AWS WAF web ACL rule with an IP match condition of the CloudFront service IP address ranges. Associate the web ACL with the ALB. Move the ALB into the three private subnets.

C

Store a random string in AWS Systems Manager Parameter Store. Configure Parameter Store automatic rotation for the string. Configure CloudFront to inject the random string as a custom HTTP header for the origin request. Inspect the value of the custom HTTP header, and block access in the ALB.

D

Configure AWS Shield Advanced. Create a security group policy to allow connections from CloudFront service IP address ranges. Add the policy to AWS Shield Advanced, and attach the policy to the ALB.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 30

A company needs its remote employees to access the web interface of an application. The company hosts the application in a VPC in the AWS Cloud. The application runs on a fleet of Amazon EC2 instances in private subnets across multiple Availability Zones.

The remote employees are not currently using a corporate VPN connection. Company policy does not allow a direct connection from the public internet to the application.

Which solution will meet these requirements?

A

Create a customer gateway by using the company's external IP address. Create a virtual private gateway, and attach it to the VPC. Create an AWS Site-to-Site VPN connection between the customer gateway and the virtual private gateway. Modify the route table to route corporate traffic back to the customer gateway

B

Generate server and client certificates and keys. Create an AWS Client VPN endpoint. Associate the private subnets with the Client VPN endpoint. Authorize the remote employees to access the VPC. Download the Client VPN endpoint configuration file to use in the remote employees' VPN client application.

C

Create a transit gateway in the VPC, Associate the private subnets with the transit gateway. Enable AWS Client VPN connection endpoints on the transit gateway. Deploy the Client VPN software to each of the remote employees. Configure route tables to route traffic between the Client VPN connections and the private subnets.

D

Create a network ACL. Add inbound and outbound rules for the IP addresses of the remote employees. Associate the private subnets with the network ACL. Update the existing security group that is associated with the fleet of EC2 instances to permit the IP addresses of the remote employees.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 31

A company is serving files to its customers through an SFTP server that is accessible over the internet. The SFTP server is running on a single Amazon EC2 instance with an Elastic IP address attached. Customers connect to the SFTP server through Elastic IP address and use SSH for authentication. The EC2 instance also has an attached security group that allows access from all customer IP addresses.

A solutions architect must implement a solution to improve availability, minimize the complexity of infrastructure management, and minimize the disruption to customers who access files. The solution must not change the way customers connect.

Which solution will meet these requirements?

A

Disassociate the Elastic IP address from the EC2 instance Create an Amazon S3 bucket to be used for SFTP file hosting. Create an AWS Transfer Family server. Configure the Transfer Family server with a publicity accessible endpoint, Associate the SFTP Elastic IP address with the new endpoint. Point the Transfer Family server to the S3 bucket. Sync all files from the SFTP to the S3 bucket.

B

Disassociate the Elastic IP address from the EC2 instance, Create an Amazon S3 bucket to be used for SFTP file hosting. Create an AWS Transfer Family server. Configure the Transfer Family server a 'UPC- hosted, internet-facing endpoint. Associate the SFTP Elastic IP address the new endpoint. Attach the security group with customer IP addresses to the new endpoint. Point the Transfer Family server to the S3 bucket. Sync all files from the SFTP server to the S3bucket.

C

Disassociate the Elastic IP address from the EC2 instance. Create a new Amazon Elastic File System (Amazon EFS) file system to be used for SFTP file hosting. Create an AWS Fargate task definition to run an SFTP server, Special the EFS file system as a mount in the task definition, create a Fargate service by using the task definition, and place a Network Load Balancer (NLB) in front of the service. When configuring the service, attach the security group with customer IP addresses to the tasks that run the SFTP server. Associate the Elastic IP address with the NIB. Sync all files from the SFTP server to the S3 bucket.

D

Disassociate the Elastic IP address from the EC2 instance. Create a multi-attach Amazon Elastic Block Store (Amazon EBS) volume to be used for SFTP file hosting. Create Network Load Balancer (NLB) with the Elastic IP address attached. Create an Auto Scaling group with EC2 instances that run an SFTP server. Define in the Auto Scaling group that are launched should attach the new multi-attach EBS volume. Configure the Auto Scaling group to automatically add instances behind the NLB. Configure the Auto Scaling group to use the security group that allows customer IP addresses for the EC2 instances that the Auto Scaling group launches. Sync all files from the SFTP server to the new multi-attach EBS volume.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 32

A company used AWS CloudFormation to create all new infrastructure in its AWS member accounts. The resources rarely change and are properly sized for the expected load. The monthly AWS bill is consistent.

Occasionally, a developer creates a new resource for testing and forgets to remove the resource when the test is complete. Most of these tests last a few days before the resources are no longer needed.

The company wants to automate the process of finding unused resources. A solutions architect needs to design a solution that determines whether the cost in the AWS bill is increasing. The solution must help identify resources that cause an increase in cost and must automatically notify the company's operations team.

Which solution will meet these requirements?

A

Turn on billing alerts. Use AWS Cost Explorer to determine the costs for the past month. Create an Amazon CloudWatch alarm for total estimated charges. Specify a cost threshold that is higher than the costs that Cost Explorer determined. Add a notification to alert the operations team if the alarm threshold is breached.

B

Turn on billing alerts. Use AWS Cost Explorer to determine the average monthly costs for the past 3 months. Create an Amazon CloudWatch alarm for total estimated charges. Specify a cost threshold that is higher than the costs that Cost Explorer determined. Add a notification to alert the operations team if the alarm threshold is breached.

C

Use AWS Cost Anomaly Detection to create a cost monitor that has a monitor type of Linked account. Create a subscription to send daily AWS cost summaries to the operations team. Specify a threshold for cost variance.

D

Use AWS Cost Anomaly Detection to create a cost monitor that has a monitor type of AWS services. Create a subscription to send daily AWS cost summaries to the operations team. Specify a threshold for cost variance.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 33

A media company deploys a web application that allows users from around the world to upload videos. The company stores the videos in an Amazon S3 bucket in the us- east-I Region by using presigned URLs.

Users report performance issues when they attempt to upload objects that are larger than 100 MB, especially from locations that are far from us-east-1.

The company must improve performance for uploads and reduce network latency.

Which solution will meet these requirements?

A

Set up an Amazon API Gateway REST API with an edge-optimized API endpoint. Configure a resource for the API with the PUT method that integrates with the Amazon S3 PutObject operation. Configure the web application to use the REST API instead of presigned URLs to upload objects.

B

Set up an Amazon API Gateway REST API with a Regional API endpoint. Configure a resource for the API with the PUT method that integrates with the Amazon S3 PutObject method. Configure the web application to use the REST API instead of presigned URLs to upload objects.

C

Configure an S3 Transfer Acceleration endpoint for the S3 bucket. Use the Transfer Acceleration endpoint to generate presigned URLs. Configure the web browser to upload objects to presigned IJRLs by using the Amazon S3 multipart upload APL

D

Configure an Amazon CloudFront distribution for the S3 bucket and allow the PUT method, Update the CloudFront origin to use an origin access control (OAC). Do not grant s3:PutObject permissions to the CloudFront distribution. Configure the web application to upload objects by using the CloudFront distribution.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 34

A company has multiple lines of business (LOBs) that roll up to the parent company. The company has asked its solutions architect to develop a solution with the following requirements:

✑ Produce a single AWS invoice for all of the AWS accounts used by its LOBs.

✑ The costs for each LOB account should be broken out on the invoice.

✑ Provide the ability to restrict services and features in the LOB accounts, as defined by the company's governance policy.

✑ Each LOB account should be delegated full administrator permissions, regardless of the governance policy.

Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)

A

Use AWS Organizations to create an organization in the parent account for each LOB. Then, invite each LOB account to the appropriate organization.

B

Use AWS Organizations to create a single organization in the parent account. Then, invite each LOB's AWS account to pin the organization. Most Voted

C

Implement service quotas to define the services and features that are permitted and apply the quotas to each LOB as appropriate.

D

Create an SCP that allows only approved services and features, then apply the policy to the LOB accounts.

E

Enable consolidated billing in the parent account's billing console and link the LOB accounts.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 35

A financial services company operates a trading application on self-managed infrastructure that consists of a fleet of EC2 instances that run as a Kubernetes cluster. The company has limited Kubernetes expertise and struggles to configure effective scaling policies for the cluster.

During peak trading hours, the application experiences unpredictable resource demands that vary significantly from day to day. The company wants to improve application performance with minimal configuration effort. The company wants to continue to use a containerized architecture.

Which solution will meet these requirements with LEAST operational overhead?

A

Migrate the Kubernetes cluster to Amazon EKS. Enable EKS Auto Mode for the cluster. Configure a node pool that will meet the application's demand.

B

Migrate the Kubernetes cluster to Amazon EKS, Configure EKS managed node groups that have scaling policies that are based on application workload patterns.

C

Migrate the Kubemetes cluster to Amazon ECS. Configure AWS Application Auto Scaling to scale by using target tracking that is based on CPU utilization.

D

Migrate the application to run the containers on AWS Lambda functions. Configure Lambda provisioned concurrency settings to handle the application's peak load.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 36

A software as a service (SaaS) company has developed a multi-tenant environment. The company uses Amazon DynamoDB tables that the tenants share for the storage layer. The company uses AWS Lambda functions for the application services.

The company wants to offer a tiered subscription model that is based on resource consumption by each tenant. Each tenant is identified by a unique tenant ID that is sent as part of each request to the Lambda functions. The company has created an AWS Cost and Usage Report (AWS CUR) in an AWS account. The company wants to allocate the DynamoDB costs to each tenant to match that tenant's resource consumption.

Which solution will provide a granular view of the DynamoDB cost for each tenant with the LEAST operational effort?

A

Associate a new tag that is named tenant ID with each table in DynamoDB. Activate the tag as a cost allocation tag in the AWS Billing and Cost Management console. Deploy new Lambda function code to log the tenant ID in Amazon CloudWatch Logs. Use the AWS CUR to separate DynamoDB consumption cost for each tenant ID.

B

Configure the Lambda functions to log the tenant ID and the number of RCUs and WCUs consumed from DynamoDB for each transaction to Amazon CloudWatch Logs. Deploy another Lambda function to calculate the tenant costs by using the logged capacity units and the overall DynamoDB cost from the AWS Cost Explorer API. Create an Amazon EventBridge rule to invoke the calculation Lambda function on a schedule.

C

Create a new partition key that associates DynamoDB items with individual tenants. Deploy a Lambda function to populate the new column as part of each transaction. Deploy another Lambda function to calculate the tenant costs by using Amazon Athena to calculate the number of tenant items from DynamoDB and the overall DynamoDB cost from the AWS CUR. Create an Amazon EventBridge rule to invoke the calculation Lambda function on a schedule.

D

Deploy a Lambda function to log the tenant ID, the size of each response, and the duration of the transaction call as custom metrics to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query the custom metrics for each tenant. Use AWS Pricing Calculator to obtain the overall DynamoDB costs and to calculate the tenant costs.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 37

A company has an on-premises monitoring solution using a PostgreSQL database for persistence of events. The database is unable to scale due to heavy ingestion and it frequently runs out of storage.

The company wants to create a hybrid solution and has already set up a VPN connection between its network and AWS- The solution should include the following attributes:

• Managed AWS services to minimize operational complexity

• A buffer that automatically scales to match the throughput of data and requires no ongoing administration.

• A visualization tool to create dashboards to observe events in near-real time.

• Support for semi-structured JSON data and dynamic schemas.

Which combination of components will enable the company to create a monitoring solution that will satisfy these requirements? (Select TWO.)

A

Use Amazon Data Firehose to buffer events. Create an AWS Lambda function to process and transform events.

B

Create an Amazon Kinesis data stream to buffer events. Create an AWS Lambda function to process and transform events.

C

Configure an Amazon Aurora PostgreSQL DB cluster to receive events. Use Amazon Quick Sight to read from the database and create near-real-time visualizations and dashboards.

D

Configure Amazon OpenSearch Service to receive events. Use the OpenSearch Dashboards endpoint deployed with OpenSearch Service to create near- real-time visualizations and dashboards.

E

Configure an Amazon Neptune DB instance to receive events. Use Amazon Quick Sight to read from the database and create near-real-time visualizations and dashboards.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 38

A company has an application that has a web frontend. The application runs in the company's on-premises data center and requires access to file storage for critical data.

The application runs on three Linux VMS for redundancy. The architecture includes a load balancer with HTTP request-based routing. The company needs to migrate the application to AWS as quickly as possible. The architecture on AWS must be highly available.

Which solution will meet these requirements with the FEWEST changes to the architecture?

A

Migrate the application to Amazon Elastic Container Service (Amazon ECS) containers that use the Fargate launch type in three Availability Zones. Use Amazon S3 to provide file storage for all three containers. Use a Network Load Balancer to direct traffic to the containers.

B

Migrate the application to Amazon EC2 instances in three Availability Zones. Use Amazon Elastic File System (Amazon EFS) for file storage. Mount the file storage on all three EC2 instances. Use an Application Load Balancer to direct traffic to the EC2 instances.

C

Migrate the application to Amazon Elastic Kubernetes Service (Amazon EKS) containers that use the Fargate launch type in three Availability Zones. Use Amazon FSx for Lustre to provide file storage for all three containers. Use a Network Load Balancer to direct traffic to the containers.

D

Migrate the application to Amazon EC2 instances in three AWS Regions. Use Amazon Elastic Block Store (Amazon EBS) for file storage. Enable Cross-Region Replication (CRR) for all three EC2 instances. Use an Application Load Balancer to direct traffic to the EC2 instances.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 39

A company runs more than 20 applications in a single VPC. The applications run on a combination of Amazon EC2 instances, Amazon ECS clusters, and Amazon RDS databases.

The company has three teams of software engineers, Each application is assigned to one of the three teams. Each team is responsible for the cost and performance of all of the team's assigned applications. Team resources have tags that represent the application and team. The teams use IAM to manage access for daily activities.

The company needs to determine which costs on the company's monthly AWS bill are attributable to each application or team. The company also needs an AWS Billing and Cost Management solution to produce reports to compare costs from the previous 12 months and to forecast costs for the next 12 months.

Which combination of actions will meet these requirements? (Select THREE.)

A

Activate the user-defined cost allocation tags that represent each application and team.

B

Activate the AWS generated cost allocation tags that represent each application and team.

C

Create a billing group in AWS Billing Conductor

D

Configure IAM access to Billing and Cost Management.

E

Create a cost budget.

F

Enable AWS Cost Explorer

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 40

A company runs an application in the cloud that consists of a database and a website. Users can post data to the website, have the data processed, and have the data sent back to them in an email. Data is stored in a MySQL database running on an Amazon EC2 instance. The database is running in a VPC with two private subnets. The website is running on Apache Tomcat in a single EC2 instance in a different VPC with one public subnet. There is a single VPC peering connection between the database and website VPC.

The website has suffered several outages during the last month due to high traffic.

Which actions should a solutions architect take to increase the reliability of the application? (Select THREE.)

A

Place the Tomcat server in an Auto Scaling group with multiple EC2 instances behind an Application Load Balancer.

B

Provision an additional VPC peering connection.

C

Migrate the MySQL database to Amazon Aurora with one Aurora Replica.

D

Provision two NAT gateways in the database VPC.

E

Move the Tomcat server to the database VPC.

F

Create an additional public subnet in a different Availability Zone in the website VPC.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 41

A company has an application that is deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are part of an Auto Scaling group- The application has unpredictable workloads and frequently scales out and in. The company's development team wants to analyze application logs to find ways to improve the application's performance. However, the logs are no longer available after instances scale in.

Which solution will give the development team the ability to view the application logs after a scale-in event?

A, Enable access logs for the ALB. Store the logs in an Amazon S3 bucket.

B

Configure the EC2 instances to publish logs to Amazon CloudWatch Logs by using the unified CloudWatch agent.

C

Modify the Auto Scaling group to use a step scaling policy

D

Instrument the application with AWS X-Ray tracing,

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 42

A company is rearchitecting its applications to run on AWS. The company’s Infrastructure Includes multiple Amazon EC2 instances. The company's development team needs different levels of access. The company wants to implement a policy that requires all Windows EC2 instances to be joined to an Active Directory domain on AWS. The company also wants to implement enhanced security processes such as multi-factor authentication (MFA). The company wants to use managed AWS services wherever possible.

Which solution will meet these requirements?

A

Create an AWS Directory Service for Microsoft Active Directory implementation. Launch an Amazon WorkSpace. Connect to and use the WorkSpace for domain security configuration tasks.

B

Create an AWS Directory Service for Microsoft Active Directory implementation. Launch an EC2 instance. Connect to and use the EC2 instance for domain security configuration tasks.

C

Create an AWS Directory Service Simple AD implementation. Launch an EC2 instance. Connect to and use the EC2 instance for domain security configuration tasks.

D

Create an AWS Directory Service Simple AD implementation. Launch an Amazon WorkSpace. Connect to and use the WorkSpace for domain security configuration tasks.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 43

A company wants to record key performance indicators (KPIs) from its application as part of a strategy to convert to a user-based licensing schema. The application is a multi-tier application with a web-based I-Jl. The company saves all log files to Amazon CloudWatch by using the CloudWatch agent. All logins to the application are saved in a log file.

As part of the new license schema, the company needs to find out how many unique users each client has on a daily basis, weekly basis, and monthly basis.

Which solution will provide this information with the LEAST change to the application?

A

Configure an Amazon CloudWatch Logs metric filter that saves each successful login as a metric. Configure the user name and client name as dimensions for the metric.

B

Change the application logic to make each successful login generate a call to the AWS SDK to increment a custom metric that records user name and client name dimensions in CloudWatch.

C

Configure the CloudWatch agent to extract successful login metrics from the logs. Additionally, configure the CloudWatch agent to save the successful login metrics as a custom metric that uses the user name and client name as dimensions for the metric.

D

Configure an AWS Lambda function to consume an Amazon CloudWatch Logs stream of the application logs. Additionally, configure the Lambda function to increment a custom metric in CloudWatch that uses the user name and client name as dimensions for the metric.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 44

A company runs a content management application on a single Windows Amazon EC2 instance in a development environment. The application reads and writes static content to a 2 TB Amazon EBS volume that is attached to the instance as the root device. The company plans to deploy this application in production as a highly available and fault-tolerant solution that runs on at least three EC2 instances across multiple Availability Zones.

A solutions architect must design a solution that joins all the instances that run the application to an Active Directory domain. The solution also must implement Windows ACLs to control access to file contents. The application always must maintain exactly the same content on all running instances at any given point in time.

Which solution will meet these requirements with the LEAST management overhead?

A

Create an Amazon EFS file share. Create an Auto Scaling group that extends across three Availability Zones and maintains a minimum size of three instances. Implement a user data script to install the application, join the instance to the AD domain, and mount the EFS file share.

B

Create a new AMI from the current EC2 instance that is running. Create an Amazon FSx for Lustre file system. Create an Auto Scaling group that extends across three Availability Zones and maintains a minimum size of three instances. Implement a user data script to join the instance to the AD domain and mount the FSx for Lustre file system.

C

Create an Amazon FSx for Windows File Server file system. Create an Auto Scaling group that extends across three Availability Zones and maintains a minimum size of three instances. Implement a user data script to install the application and mount the FSx for Windows File Server file system. Perform a seamless domain join to join the instance to the AD domain.

D

Create a new AMI from the current EC2 instance that is running. Create an Amazon EFS file system. Create an Auto Scaling group that extends across three Availability Zones and maintains a minimum size of three instances. Perform a seamless domain join to join the instance to the AD domain.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 45

A company is migrating infrastructure for its massive multiplayer game to AWS. The game's application features a leaderboard where players can see rankings in real time. The leaderboard requires microsecond reads and single-digit-millisecond write latencies. The datasets are single-digit terabytes in size and must be available to accept writes in less than a minute if a primary node failure occurs.

The company needs a solution in which data can persist for further analytical processing through a data pipeline.

Which solution will meet these requirements with the LEAST operational overhead?

A

Create an Amazon ElastiCache for Redis cluster with cluster mode enabled. Configure the application to interact with the primary node.

B

Create an Amazon RDS database with a read replica. Configure the application to point writes to the writer endpoint. Configure the application to point reads to the reader endpoint.

C

Create an Amazon MemoryDB for Redis cluster in Multi-AZ mode. Configure the application to interact with the primary node.

D

Create multiple Redis nodes on Amazon EC2 instances that are spread across multiple Availability Zones. Configure backups to Amazon S3.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 46

A company runs a containerized application that makes predictions based on client messages that arrive in near real time. The number of messages that the application processes each day varies. The number ranges from a few messages each minute to up to 200,000 messages each minute.

The company needs a solution to scale the application to meet the variable message demand, The solution also must retain all messages for 48 hours for audits.

Which solution will meet these requirements?

A

Create an Amazon SQS queue for the messages. Deploy the application on Amazon EKS. Configure the Horizontal Pod Autoscaler and the Cluster Autoscaler to scale based on the size of the SQS queue. Create a second SQS queue with a 48-hour retention period to retain processed messages.

B

Create an Amazon SNS topic for the messages. Deploy the application on Amazon EKS, Configure the Horizontal Pod Autoscaler and the Cluster Autoscaler to scale based on SNS topic metrics. Subscribe an Amazon SQS queue to the SNS topic with a 48-hour retention period to retain processed messages.

C

Create an Amazon SQS queue for the messages. Deploy the application on Amazon ECS and configure scheduled scaling. Create a second SQS queue with a 48-hour retention period to retain processed messages.

D

Create an Amazon SNS topic for the messages. Deploy the application on Amazon ECS. Configure ECS service auto scaling to scale based on Amazon CloudWatch metrics. Configure SNS message filtering to route messages to ECS tasks. Subscribe an Amazon SQS queue to the SNS topic with a 48-hour retention period to retain processed messages,

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 47

A company runs an application in an on-premises data center. The application gives users the ability to upload media files. The files persist in a file server. The web application has many users. The application server is overutilized, which causes data uploads to fail occasionally. The company frequently adds new storage to the file server. The company wants to resolve these challenges by migrating the application to AWS.

Users from across the United States and Canada access the application. Only authenticated users should have the ability to access the application to upload files. The company will consider a solution that refactors the application. and the company needs to accelerate application development.

Which solution will meet these requirements with the LEAST operational overhead?

A

Use AWS Application Migration Service to migrate the application server to Amazon EC2 instances. Create an Auto Scaling group for the EC2 instances. Use an Application Load Balancer to distribute the requests. Modify the application to use Amazon S3 to persist the files. use Amazon Cognito to authenticate users.

B

Use AWS Application Migration Service to migrate the application server to Amazon EC2 instances. Create an Auto Scaling group for the EC2 instances. use an Application Load Balancer to distribute the requests. Set up AWS IAM Identity Center (AWS Single Sign-On) to give users the ability to sign in to the application. Modify the application to use Amazon S3 to persist the files.

C

Create a static website for uploads of media files. Store the static assets in Amazon S3. Use AWS AppSync to create an API. Use AWS Lambda resolvers to upload the media files to Amazon S3. use Amazon Cognito to authenticate users.

D

Use AWS Amplify to create a static website for uploads of media files. Use Amplify Hosting to serve the website through Amazon CloudFront. Use Amazon S3 to store the uploaded media files. Use Amazon Cognito to authenticate users.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 48

A company has a data lake in Amazon S3 that needs to be accessed by hundreds of applications across many AWS accounts- The company's information security policy states that the S3 bucket must not be accessed over the public internet and that each application should have the minimum permissions necessary to function.

To meet these requirements, a solutions architect plans to use an S3 access point that is restricted to specific VPCs for each application,

Which combination of steps should the solutions architect take to implement this solution? (Select TWO.)

A

Create an S3 access point for each application in the AWS account that owns the S3 bucket. Configure each access point to be accessible only from the application's VPC. Update the bucket policy to require access from an access point.

B

Create an interface endpoint for Amazon S3 in each application's VPC. Configure the endpoint policy to allow access to an S3 access point, Create a VPC gateway attachment for the S3 endpoint-

C

Create a gateway endpoint for Amazon S3 in each application's VPC, Configure the endpoint policy to allow access to an S3 access point, Specify the route table that is used to access the access point.

D

Create an S3 access point for each application in each AWS account and attach the access points to the S3 bucket. Configure each access point to be accessible only from the application's VPC. Update the bucket policy to require access from an access point.

E

Create a gateway endpoint for Amazon S3 in the data lake's VPC. Attach an endpoint policy to allow access to the S3 bucket. Specify the route table that is used to access the bucket.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 49

A solutions architect has launched multiple Amazon EC2 instances in a placement group within a single Availability Zone. Because of additional load on the system, the solutions architect attempts to add new instances to the placement group. However, the solutions architect receives an insufficient capacity error.

What should the solutions architect do to troubleshoot this issue?

A

Use a spread placement group. Set a minimum of eight instances for each Availability Zone.

B

Stop and start all the instances in the placement group. Try the launch again.

C

Create a new placement group. Merge the new placement group with the original placement group.

D

Launch the additional instances as Dedicated Hosts in the placement groups.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 50

A company has an on-premises data center and is using Kubernetes to develop a new solution on AWS. The company uses Amazon Elastic Kubernetes Service (Amazon EKS) clusters for its development and test environments.

The EKS control plane and data plane for production workloads must reside on premises. The company needs an AWS managed solution for Kubernetes management.

Which solution will meet these requirements with the LEAST operational overhead?

A

Install an AWS Outposts server in the on-premises data center. Deploy Amazon EKS by using a local cluster configuration on the Outposts server for the production workloads.

B

Install Amazon EKS Anywhere on the company's hardware in the on-promises data center. Deploy the production workloads on an EKS Anywhere cluster.

C

Install an AWS Outposts server in the on-premises data center. Deploy Amazon EKS by using an extended cluster configuration on the Outposts server for the production workloads.

D

Install an AWS Outposts server in the on-premises data center. Install Amazon EKS Anywhere on the Outposts server. Deploy the production workloads on an EKS Anywhere cluster.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 51

A company is developing a new service that will be accessed using TCP on a static port. A solutions architect must ensure that the service is highly available, has redundancy across Availability Zones, and is accessible using the DNS name my.service.com, which is publicly accessible. The service must use fixed address assignments so other companies can add the addresses to their allow lists.

Assuming that resources are deployed in multiple Availability Zones in a single Region, which solution will meet these requirements?

A

Create Amazon EC2 instances with an Elastic IP address for each instance. Create a Network Load Balancer (NLB) and expose the static TCP port. Register EC2 instances with the NLB. Create a new name server record set named my.service.com, and assign the Elastic IP addresses of the EC2 instances to the record set, Provide the Elastic IP addresses of the EC2 instances to the other companies to add to their allow lists.

B

Create an Amazon ECS cluster and a service definition for the application. Create and assign public IP addresses for the ECS cluster. Create a Network Load Balancer (NLB) and expose the TCP port. Create a target group and assign the ECS cluster name to the NLB- Create a new A record set named my.service.com, and assign the public IP addresses of the ECS cluster to the record set. Provide the public IP addresses of the ECS cluster to the other companies to add to their allow lists.

C

Create Amazon EC2 instances for the service. Create one Elastic IP address for each Availability Zone. Create a Network Load Balancer (NLB) and expose the assigned TCP port, Assign the Elastic IP addresses to the NLB for each Availability Zone. Create a target group and register the EC2 instances with the NLB- Create a new A (alias) record set named my-service-com, and assign the NLB DNS name to the record set.

D

Create an Amazon ECS cluster and a service definition for the application. Create and assign public IP address for each host in the cluster. Create an Application Load Balancer (ALB) and expose the static TCP port. Create a target group and assign the ECS service definition name to the ALB. Create a new CNAME record set and associate the public IP addresses to the record set. Provide the Elastic IP addresses of the Amazon EC2 instances to the other companies to add to their allow lists.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 52

A company is deploying a new web-based application and needs a storage solution for the Linux application servers. The company wants to create a single location for updates to application data for all instances. The active dataset will be up to 100 GB in size. A solutions architect has determined that peak operations will occur for 3 hours daily and will require a total of 225 MiBps of read throughput.

The solutions architect must design a Multi-AZ solution that makes a copy of the data available in another AWS Region for disaster recovery (DR). The DR copy has an RPO of less than 1 hour.

Which solution will meet these requirements?

A

Deploy a new Amazon Elastic File System (Amazon EFS) Multi-AZ file system. Configure the file system for 75 MiBps of provisioned throughput. Implement replication to a file system in the DR Region.

B

Deploy a new Amazon FSx for Lustre file system. Configure Bursting Throughput mode for the file system. Use AWS Backup to back up the file system to the DR Region.

C

Deploy a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume with 225 MiBps of throughput. Enable Multi-Attach for the EBS volume. Use AWS Elastic Disaster Recovery to replicate the EBS volume to the DR Region.

D

Deploy an Amazon FSx for OpenZFS file system in both the production Region and the DR Region. Create an AWS DataSync scheduled task to replicate the data from the production file system to the DR file system every 10 minutes.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 53

A company has a Windows-based desktop application that is packaged and deployed to the users' Windows machines. The company recently acquired another company that has employees who primarily use machines with a Linux operating system. The acquiring company has decided to migrate and rehost the Windows-based desktop application to AWS.

All employees must be authenticated before they use the application. The acquiring company uses Active Directory on premises but wants a simplified way to manage access to the application on AWS for all the employees.

Which solution will rehost the application on AWS with the LEAST development effort?

A

Set up and provision an Amazon WorkSpaces virtual desktop for every employee. Implement authentication by using Amazon Cognito identity pools. Instruct employees to run the application from their provisioned WorkSpaces virtual desktops.

B

Create an Auto Scaling group of Windows-based Amazon EC2 instances. Join each EC2 instance to the company's Active Directory domain. Implement authentication by using the Active Directory that is running on premises. Instruct employees to run the application by using a Windows remote desktop.

C

Use an Amazon AppStream 2.0 image builder to create an image that includes the application and the required configurations. Provision an AppStream 2.0 On-Demand fleet with dynamic Fleet Auto Scaling policies for running the image. Implement authentication by using AppStream 2.0 user pools. Instruct the employees to access the application by starting browser-based AppStream 2.0 streaming sessions.

D

Refactor and containerize the application to run as a web-based application. Run the application in Amazon Elastic Container Service (Amazon ECS) on AWS Fargate with step scaling policies. Implement authentication by using Amazon Cognito user pools. Instruct the employees to run the application from their browsers.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 54

A company has a static web application that gives users the ability to upload short videos. The website experiences variable traffic with peaks during certain months. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application stores the videos on Amazon EBS volumes. The company wants to rearchitect the application to use AWS managed services where possible. The company also wants to stop using the third-party software for video categorization. Which solution meets these requirements?

A

Deploy the application on Amazon ECS with the EC2 launch type. Configure the application to upload and store videos in Amazon EFS and post messages to an Amazon SQS queue. Configure an AWS Step Functions state machine to process SQS queue messages and invoke the Amazon Rekognition Video API to categorize the videos.

B

Host the application on an AWS Batch environment that uploads and stores videos in Amazon EFS. Configure the application to post messages to an Amazon SQS queue. Configure an AWS Lambda function to process SQS queue messages and invoke the Amazon Rekognition Video API to categorize the videos.

C

Host the static website on an Amazon S3 bucket. Store uploaded videos in a separate S3 bucket. Configure S3 Event Notifications to publish events to an Amazon SQS queue when new objects upload. Configure an AWS Lambda function that processes SQS queue messages and calls the Amazon Rekognition Video API to categorize the videos.

D

Deploy the application in an AWS Elastic Beanstalk environment that uses EC2 instances in an Auto Scaling group. Configure the application to upload and store videos in an EBS volume and post messages to an SQS queue. Configure an AWS Lambda function to process SQS queue messages and invoke the Amazon Rekognition Video API to categorize the videos.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 55

A company is migrating its application to a containerized solution. The company has created a stage that builds the container image and pushes the container image to an Amazon ECR repository Recently, the company's security team identified several vulnerabilities in the application that could expose detailed information about the application's users.

The security team requires that the existing AWS CodePipeline pipeline include safeguards to identify critical operating system and code vulnerabilities before deploying the updated application. The security team needs to receive an alert immediately when a vulnerability is detected in the container image.

Which solution Will meet these requirements?

A

Enable scan on push in Amazon ECR- Create an AWS CodeBuild stage after the image build stage that invokes the DescribelmageScanFindings API and fails the CodeBuild stage if a vulnerability is detected- Create an Amazon EventBridge rule that matches the ECR scan completion event Use Amazon SES to send the findings.

B

Configure Amazon GuardDuty to perform ECR container image scanning when an image is pushed to Amazon ECR Create an Amazon EventBridge rule that matches GuardDuty findings and sends the findings to an Amazon SNS topic. Create an AWS Lambda function that is invoked by GuardDuty to stop the pipeline if a vulnerability is detected.

C

Deploy an AWS Config rule that evaluates the ECR images after the build stage. Create an AWS Lambda function that AWS Config invokes when the rule is non-compliant Configure the Lambda function to invoke the StopPipelineExecution API to stop the CodePipeline deployment if the rule is non-compliant. Create an Amazon EventBridge rule that sends the findings from AWS Config to Amazon SES.

D

Enable enhanced scanning in Amazon ECR. Create an InspectorScan action after the build stage that has a critical severity threshold and fails the pipeline if vulnerabilities are detected. Create an Amazon EventBridge rule that matches the Amazon Inspector findings event. Publish the findings to an Amazon SNS topic.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 56

A company needs to gather data from an experiment in a remote location that does not have internet connectivity. During the experiment, sensors that are connected to a local network will generate 6 TB of data in a proprietary format over the course of I week. The sensors can be configured to upload their data files to an FTP server periodically, but the sensors do not have their own FTP server. The sensors also do not support other protocols. The company needs to collect the data centrally and move the data to object storage in the AWS Cloud as soon as possible after the experiment.

Which solution will meet these requirements?

A

Order an AWS Snowball Edge Compute Optimized device. Connect the device to the local network. Configure AWS DataSync with a target bucket name, and unload the data over NFS to the device. After the experiment, return the device to AWS so that the data can be loaded into Amazon S3.

B

Order an AWS Snowcone device. including an Amazon Linux 2 AMI. Connect the device to the local network. Launch an Amazon EC2 instance on the device. Create a shell script that periodically downloads data from each sensor. After the experiment. return the device to AWS so that the data can be loaded as an Amazon Elastic Block Store (Amazon E3S) volume.

C

Order an AWS Snowcone device, including an Amazon Linux 2 AMI. Connect the device to the local network. Launch an Amazon EC2 instance on the device. Install and configure an FTP server on the EC2 instance. Configure the sensors to upload data to the EC2 instance. After the experiment, return the device to AWS so that the data can be loaded into Amazon S3.

D

Order an AWS Snowcone device. Connect the device to the local network. Configure the device to use Amazon FSx. Configure the sensors to upload data to the device. Configure AWS DataSync on the device to synchronize the uploaded data with an Amazon S3 bucket. Return the device to AWS so that the data can be loaded as an Amazon Elastic Block Store (Amazon EBS) volume.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 57

A company is migrating a document processing workload to AWS. The company has updated many applications to use the Amazon S3 API to store, retrieve, and modify documents. A processing server generates the documents at a rate of approximately five documents every second. After the document processing is finished, customers can download the documents directly from Amazon S3. During the migration, the company discovered that it could not immediately update the processing server that generates many documents to support the S3 API. The server runs on Linux and requires fast local access to the files that the server generates and modifies. When the server finishes processing, the files must be available to customers for download within 30 minutes. Which solution will meet these requirements with the LEAST operational overhead?

A

Configure AWS DataSync to connect to an Amazon EC2 instance. Configure a DataSync task to synchronize the generated files to and from Amazon S3.

B

Configure Amazon FSx for Lustre with an import and export policy. Link the new file system to an S3 bucket. Install the Lustre client and mount the document store to an Amazon EC2 instance.

C

Refactor the application as an AWS Lambda function. Use the AWS SDK for Java to generate, modify, and access the files that the company stores directly in Amazon S3.

D

Set up an Amazon S3 File Gateway. Configure a file share linked to the document store. Mount the file share on an Amazon EC2 instance by using SFTP. Initiate a RefreshCache API call to update the S3 File Gateway when changes occur in Amazon S3.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 58

A multinational media company is building a video processing platform on AWS. The platform is deployed across multiple AWS accounts in an organization in AWS Organizations.

Customers upload videos through Amazon API Gateway AWS Lambda functions process the videos- The company stores processed media and metadata in Amazon S3 and Amazon DynamoDB. The company serves customers globally.

Regulatory requirements state that the company must process and store European Union (EU) customer content only within AWS Regions in the EU. The company must prevent workloads outside the EU sovereignty boundary from processing EU customer content. The company needs preventive governance controls so that teams cannot accidentally deploy EU workloads or infrastructure outside EU Regions.

Which solution Will meet these requirements?

A

Deploy separate EU and non-EU processing stacks by using API Gateway and Lambda. Use Amazon Route 53 geolocation routing to send EU uploads to EU endpoints. Store EU media in Amazon S3 in EU Regions. Store EU metadata in DynamoDB in EU Regions. Enforce Region restrictions by using Organizations SCPs.

B

Deploy a single global API Gateway endpoint that invokes Lambda functions in multiple Regions- Use Amazon Route 53 geolocation routing for EU uploads- Store EU media in an S3 bucket in the eu-west-l Region. Store EU metadata in a DynamoDB table in the same Region. Restrict access by using IAM policies.

C

Deploy API Gateway and Lambda workloads only in EU Regions for all customer uploads. Use Amazon Route 53 geolocation routing for EU uploads. Store EU media in Amazon S3 in EU Regions- Store EU metadata in DynamoDB in EU Regions- Use AWS Config rules to detect resources that are deployed outside EU Regions.

D

Deploy separate EU and non-EU processing stacks by using API Gateway and Lambda. Use Amazon Route 53 latency-based routing to send requests to the nearest endpoint. Store EU media in Amazon S3 in EU Regions. Store EU metadata in DynamoDB in EU Regions. Use AWS Control Tower controls to monitor deployments outside EU Regions.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 59

A solutions architect needs to improve the performance of a batch job. The batch pb loads a large dataset of user transactions into an Amazon DynamoDB table from a relational database. The batch pb is the only application that writes to the DynamoDB table.

The existing solution involves an Amazon Elastic Container Service (Amazon ECS) task that pulls the data from the relational database and pushes the data into the DynamoDB table. The DynamoDB table has a composite primary key. with UserlD as the partition key and Transaction Timestamp as the sort key. Each table item is less than 1 KB in sue. The DynamoDB table is using on-demand capacity. The WriteThrottleEvents metric shows that database writes are being throttled for the first 30 minutes of each batch run.

Which combination of actions should the solutions architect take to improve performance of the batch job? (Select THREE.)

A

Change the order that data will be pulled from the database to be by Transaction Timestamp.

B

Change the order that data will be pulled from the database to be by UserlD.

C

Switch the table to use provisioned capacity. At the start of each batch job, set the write capacity to match the pb's expected peak throughput in transactions per second. Set the write capacity to 1 at the end of the job.

D

Switch the table to use provisioned capacity. At the start of each batch job, set the write capacity to match the job's expected peak throughput in kilobytes (KB) per second. Set the write capacity to 1 at the end of the job.

E

Review the DynamoDB service quotas of the account. Ensure that the maximum item size is greater than the required 1 KB in size.

F

Review the DynamoDB service quotas of the account. Ensure that the maximum write capacity for each table is greater than the write capacity that the batch job requires.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 60

A company has a payment gateway that processes millions of daily transactions on AWS. The solution uses Amazon ECS with a single Amazon EC2 instance that is not configured for auto scaling and an Amazon Aurora PostgreSQL database. All the solution's resources are deployed in the same Availability Zone. The company uses Amazon Route 53 to manage its domain name resolution. The company needs to implement a new strategy to make the application more highly available. Which solution will meet this requirement with the LEAST operational overhead?

A

Set up an Amazon RDS proxy in front of the Aurora database. Modify the Aurora database to a Multi-AZ DB cluster by adding a read-replica in a second Availability Zone.

B

Configure Amazon ECS services to distribute tasks across multiple Availability Zones. Create a cross-Region read replica of the Aurora database in a second AWS Region. Create a script to perform a manual failover process.

C

Configure Amazon ECS services on AWS Fargate to distribute tasks across multiple Availability Zones. Modify the Aurora database to a Multi-AZ DB cluster by adding a read-replica in a second Availability Zone.

D

Deploy the gateway application into a second AWS Region. Migrate the Aurora database to an Aurora global database. Configure Route 53 for active-active gateway request routing.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 61

A media streaming company runs an application on AWS by using a microservices architecture. The application consists of multiple services that are deployed on Amazon ECS with the AWS Fargate launch type. During peak usage periods, users from multiple geographic locations report inconsistent video streaming quality and slow responses.

The company needs to implement a comprehensive monitoring solution to identify performance bottlenecks and improve the user experience. The solution must capture real user experience data including page load times and API response delays, The solution must collect performance metrics and identify resource constraints, The company must be able to correlate frontend performance issues with backend service dependencies.

Which combination of solutions will meet these requirements? (Select TWO.)

A

Configure Amazon CloudWatch Container Insights to collect container-level metrics from the ECS clusters- Add custom dashboards to visualize CPU, memory, and network metrics for each microservice.

B

Deploy AWS X-Ray as a cluster-level monitoring service and configure Amazon EventBridge to run X-Ray scans during peak usage periods Use X-Ray service maps to visualize performance bottlenecks-

C

Implement multiple Amazon CloudWatch Synthetics canaries to simulate user interactions with the application from multiple geographic locations. Configure canaries to run every 5 minutes and generate alerts for performance issues.

D

Enable Amazon CloudWatch RUM in the application to collect client-side performance data from user sessions. Configure the CloudWatch RUM web client to capture page load metrics and client-side errors from end users.

E

Use Amazon CloudWatch Logs Insights to write custom queries that analyze error patterns in application logs- Create metric filters to generate metrics based on specific error patterns-

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 62

A company has an online learning platform that teaches data science. The platform uses the AWS Cloud to provision on-demand lab environments for its students. Each student receives a dedicated AWS account for a short time. Students need access to ml.p2.xlarge instances to run a single Amazon SageMaker machine learning training job and to deploy the inference endpoint.

Account provisioning is automated. The accounts are members of an organization in AWS Organizations with all features enabled. The accounts must be provisioned in the ap-southeast-2 Region.

The default resource usage quotas are not sufficient for the accounts. A solutions architect must enhance the account provisioning process to include automated quota increases.

Which solution will meet these requirements?

A

Create a quota request template in the us-east-1 Region in the organizations management account. Enable template association. Add a quota for SageMaker in ap-southoast-2 for ml.p2.xIargo training job usage. Set the desired quota to 1. Add a quota for SageMaker in ap.southeast.2 for ml.p2xlarge endpoint usage. Set the desired quota to 1.

B

Create a quota request template in the us-east-1 Region in the organization's management Enable template association. Add a quota for SageMaker in ap-southeast-2 for ml.p2.xlarge training warm pool usage. Set the desired quota to 2.

C

Create a quota request template in ape-southeast-2 in the organization's management account. Enable template association. Add a quota for SageMaker in the us-east-1 Region for ml.p2.xlarge training job usage. Set the desired quota to 1. Add a quota for SageMaker in us-east-1 for ml.p2.xlarge endpoint usage. Set the desired quota to 1.

D

Create a quota request template in ap-southeast-2 in the organization's management account. Enable template association. Add a quota for SageMaker in the us-east-1 Region for ml.p2.xlarge training warm pool usage. Set the desired quota to 2.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 63

A company is running a compute workload by using Amazon EC2 Spot Instances in an Auto Scaling group. The launch template uses two placement groups and one instance type.

Recently, a monitoring system reported Auto Scaling instance launch failures that correlated with longer wait times for system users. The company needs to improve the overall reliability of the workload.

Which solution will meet these requirements?

A

Create a launch configuration that uses attribute-based instance type selection. Configure the Auto Scaling group to use the new launch configuration.

B

Create a launch configuration that uses a larger instance type. Configure the Auto Scaling group to use the launch configuration and the launch template.

C

Create a new launch template version that increases the number of placement groups to 3. Configure the Auto Scaling group to use the new launch template version.

D

Create a new launch template version that uses attribute-based instance type selection. Configure the Auto Scaling group to use the new launch template version.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 64

A global media company is planning a multi-Region deployment of an application. Amazon DynamoDB global tables will back the deployment to keep the user experience consistent across the two continents where users are concentrated. Each deployment will have a public Application Load Balancer (ALB). The company manages public DNS internally. The company wants to make the application available through an apex domain.

Which solution will meet these requirements with the LEAST effort?

A

Migrate public DNS to Amazon Route 53. Create CNAME records for the apex domain to point to the ALB. Use a geolocation routing policy to route traffic based on user location.

B

Place a Network Load Balancer (NLB) in front of the ALMigrate public DNS to Amazon Route 53. Create a CNAME record for the apex domain to point to the NLB’s static IP address. Use a geolocation routing policy to route traffic based on user location.

C

Create an AWS Global Accelerator accelerator with multiple endpoint groups that target endpoints in appropriate AWS Regions. Use the accelerator’s static IP address to create a record in public DNS for the apex domain.

D

Create an Amazon API Gateway API that is backed by AWS Lambda in one of the AWS Regions. Configure a Lambda function to route traffic to application deployments by using the round robin method. Create CNAME records for the apex domain to point to the API's URL.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 65

A company that is developing a mobile game is making game assets available in two AWS Regions. Game assets are served from a set of Amazon EC2 instances behind an Application Load Balancer (ALB) in each Region. The company requires game assets to be fetched from the closest Region. If game assets become unavailable in the closest Region, they should be fetched from the other Region.

What should a solutions architect do to meet these requirements?

A

Create an Amazon CloudFront distribution. Create an origin group with one origin for each ALB. Set one of the origins as primary.

B

Create an Amazon Route 53 health check for each ALB. Create a Route 53 failover routing record pointing to the two ALBs. Set the Evaluate Target Health value to Yes.

C

Create two Amazon CloudFront distributions, each with one ALB as the origin. Create an Amazon Route 53 failover routing record pointing to the two CloudFront distributions. Set the Evaluate Target Health value to Yes.

D

Create an Amazon Route 53 health check for each ALB. Create a Route 53 latency alias record pointing to the two ALBs. Set the Evaluate Target Health value to Yes.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 66

A company migrated its antivirus solution for 10,000 Amazon EC2 instances to a new software as a service (SaaS) solution. Fewer than 5% of instances reported in the new SaaS agent. The company suspects that either the new agent failed to load or the new agent's configuration was altered. The company needs to implement a solution to ensure that all instances consistently run the most recent agent version with a predefined configuration. Which solution will meet these requirements with the LEAST administrative overhead?

A

Create an AWS Lambda function that is invoked on a schedule. Store a machine list in Amazon S3. Configure the Lambda function to log in to every machine, download and install the most recent version of the agent, and configure the agent.

B

Implement an AWS Config rule with auto remediation that uses AWS Lambda for noncompliant events. Develop a Lambda function to access machines and download and install the most recent agent version. Schedule the Lambda function to invoke daily.

C

Create an AWS Systems Manager document that defines the agent installation and configuration process. Configure AWS Systems Manager State Manager to associate the document with EC2 instances. Apply the desired state on a daily schedule.

D

Log in to EC2 instances by using AWS Systems Manager Session Manager. Update the EC2 user data script to download and install the most recent agent and configure the agent. Reboot all EC2 instances to ensure that the script applies successfully.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 67

A public retail web application uses an Application Load Balancer (ALB) in front of Amazon EC2 instances running across multiple Availability Zones (AZs) in a Region backed by an Amazon RDS MySQL Multi-AZ deployment. Target group health checks are configured to use HTTP and pointed at the product catalog page. Auto Scaling is configured to maintain the web fleet size based on the ALB health check.

Recently, the application experienced an outage. Auto Scaling continuously replaced the instances during the outage. A subsequent investigation determined that the web server metrics were within the normal range, but the database tier was experiencing high load, resulting in severely elevated query response times.

Which of the following changes together would remediate these issues while improving monitoring capabilities for the availability and functionality of the entire application stack for future growth? (Choose two.)

A

Configure read replicas for Amazon RDS MySQL and use the single reader endpoint in the web application to reduce the load on the backend database tier.

B

Configure the target group health check to point at a simple HTML page instead of a product catalog page and the Amazon Route 53 health check against the product page to evaluate full application functionality. Configure Amazon CloudWatch alarms to notify administrators when the site fails.

C

Configure the target group health check to use a TCP check of the Amazon EC2 web server and the Amazon Route 53 health check against the product page to evaluate full application functionality. Configure Amazon CloudWatch alarms to notify administrators when the site fails.

D

Configure an Amazon CloudWatch alarm for Amazon RDS with an action to recover a high-load, impaired RDS instance in the database tier.

E

Configure an Amazon ElastiCache cluster and place it between the web application and RDS MySQL instances to reduce the load on the backend database tier.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 68

A company needs a hybrid DNS architecture. The architecture must include the company's on-premises network and a VPC. An AWS Site-to-Site VPN connection connects the VPC to the on-premises network. The company already hosts the onprem.mydc.com domain name on premises. The company wants to host the myvpc.example.com domain name in the company's AWS account and resolve to the VPC. The company also needs the on-premises devices to resolve DNS queries to the myvpc.example.com domain. Which combination of steps will meet these requirements? (Select THREE.)

A

Create an Amazon Route 53 private hosted zone for the myvpc.example.com reserved domain. Associate the reserved domain with the VPC.

B

Create an Amazon Route 53 public hosted zone for the myvpc.example.com reserved domain. Associate the reserved domain with the VPC.

C

Use Amazon Route 53 Resolver to create an inbound endpoint in the AWS Region of the VPC.

D

Use Amazon Route 53 Resolver to create an outbound endpoint in the AWS Region of the VPC.

E

Use Amazon Route 53 Resolver to create a forwarding rule for the Route 53 private hosted zone domain and IP addresses of the outbound endpoint.

F

Configure the on-premises DNS resolvers with a conditional forwarding rule for DNS queries for the Amazon Route 53 private hosted zone domain and IP addresses of the inbound endpoint.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 69

A company has many services running in its on-premises data center. The data center is connected to AWS using AWS Direct Connect (DX) and an IPSec VPN. The service data is sensitive and connectivity cannot traverse the internet. The company wants to expand into a new market segment and begin offering its services to other companies that are using AWS.

Which solution will meet these requirements?

A

Create a VPC Endpoint Service that accepts TCP traffic, host it behind a Network Load Balancer, and make the service available over DX.

B

Create a VPC Endpoint Service that accepts HTTP or HTTPS traffic, host it behind an Application Load Balancer, and make the service available over DX.

C

Attach an internet gateway to the VPC, and ensure that network access control and security group rules allow the relevant inbound and outbound traffic.

D

Attach a NAT gateway to the VPC, and ensure that network access control and security group rules allow the relevant inbound and outbound traffic.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 70

A solutions architect must implement a least privilege permissions policy that allows the centralized Lambda functions to update resources in each of the company's accounts. Which combination of steps will meet these requirements? (Select TWO.)

A

In the centralized account, create an IAM role that has the Lambda service as a trusted entity. Add an inline policy to assume the roles of the other accounts.

B

In the centralized account, create an IAM role that has the roles of the other accounts as trusted entities. Provide minimal required permissions.

C

In the other accounts, create an IAM role that has minimal required permissions. Add the centralized account's Lambda IAM role as a trusted entity.

D

In the other accounts, create an IAM role that has permissions to assume the role of the centralized account. Add the Lambda service as a trusted entity.

E

In the other accounts, create an IAM role that has minimal required permissions. Add the Lambda service as a trusted entity.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 71

A solutions architect must implement a multi-Region architecture for an Amazon RDS for PostgreSQL database that supports a web application. The database launches from an AWS CloudFormation template that includes AWS services and features that are present in both the primary and secondary Regions.

The database is configured for automated backups, and it has an RTO of 15 minutes and an RPO of 2 hours. The web application is configured to use an Amazon Route 53 record to route traffic to the database.

Which combination of steps will result in a highly available architecture that meets all the requirements? (Choose two.)

A

Create a cross-Region read replica of the database in the secondary Region. Configure an AWS Lambda function in the secondary Region to promote the read replica during failover event.

B

In the primary Region, create a health check on the database that will invoke an AWS Lambda function when a failure is detected. Program the Lambda function to recreate the database from the latest database snapshot in the secondary Region and update the Route 53 host records for the database.

C

Create an AWS Lambda function to copy the latest automated backup to the secondary Region every 2 hours.

D

Create a failover routing policy in Route 53 for the database DNS record. Set the primary and secondary endpoints to the endpoints in each Region.

E

Create a hot standby database in the secondary Region. Use an AWS Lambda function to restore the secondary database to the latest RDS automatic backup in the event that the primary database fails.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 72

A company is running a three-tier web application in an on-premises data center. The frontend is a PHP application that is served by an Apache web server. The middle tier is a monolithic Java SE application. The storage tier is a 60 TB PostgreSQL database. The three-tier web application recently crashed and became unresponsive. The database also reached capacity because of read operations. The company wants to migrate to AWS to resolve these issues and improve scalability. Which combination of steps will meet these requirements with the LEAST development effort? (Select THREE.)

A

Configure an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer to host the web server. Use Amazon EFS for the frontend static assets.

B

Host the static single-page application on Amazon S3. Use an Amazon CloudFront distribution to serve the application.

C

Create a Docker container to run the Java SE application. Use AWS Fargate to host the container.

D

Create an AWS Elastic Beanstalk environment for Java to host the Java SE application.

E

Migrate the PostgreSQL database to an Amazon EC2 instance that is larger than the on-premises PostgreSQL database.

F

Use AWS DMS to replatform the PostgreSQL database to an Amazon Aurora PostgreSQL database. Use Aurora Auto Scaling for read replicas.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 73

A company deploys workloads in multiple AWS accounts. Each account has a VPC with VPC flow logs published in text log format to a centralized Amazon S3 bucket. Each log file is compressed with gzip compression. The company must retain the log files indefinitely.

A security engineer occasionally analyzes the logs by using Amazon Athena to query the VPC flow logs. The query performance is degrading over time as the number of ingested logs is growing. A solutions architect must improve the performance of the log analysis and reduce the storage space that the VPC flow logs use.

Which solution will meet these requirements with the LARGEST performance improvement?

A

Create an AWS Lambda function to decompress the gzip files and to compress the files with bzip2 compression. Subscribe the Lambda function to an s3:ObjectCreated:Put S3 event notification for the S3 bucket.

B

Enable S3 Transfer Acceleration for the S3 bucket. Create an S3 Lifecycle configuration to move files to the S3 Intelligent-Tiering storage class as soon as the files are uploaded.

C

Update the VPC flow log configuration to store the files in Apache Parquet format. Specify hourly partitions for the log files.

D

Create a new Athena workgroup without data usage control limits. Use Athena engine version 2.Correct Answer:

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 74

A company runs an ecommerce website that sells sporting goods. The company deployed the website by using an Application Load Balancer (ALB), Amazon ECS on Amazon EC2 instances that are in an Auto Scaling group, and an Amazon RDS for MySQL database. During sales events, users report experiencing high latency when they search for items. CPU utilization for the RDS for MySQL database is 95%. The company needs to implement a temporary solution to reduce the latency of searches during sales events before the application can be refactored. Which solution will meet these requirements with the LEAST development effort?

A

Use Amazon CloudFront to cache HTTP query responses. Create one AWS Systems Manager Automation runbook to increase the instance size of the RDS database. Create a second runbook to return the instance size to its previous value. Schedule the first runbook to run one day before sales events.

B

Use Amazon CloudFront to cache HTTP query responses. Schedule the EC2 Auto Scaling group to increase the number of EC2 instances one day before sales events.

C

Use Amazon ElastiCache to cache database query responses. Refactor the website to use ElastiCache. Schedule the EC2 Auto Scaling group to increase the number of EC2 instances.

D

Migrate the RDS for MySQL database to Amazon DynamoDB. Use Amazon ElastiCache to cache database query responses. Refactor the website to use DynamoDB and ElastiCache.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 75

A company runs a new application as a static website in Amazon S3. The company has deployed the application to a production AWS account and uses Amazon CloudFront to deliver the website. The website calls an Amazon API Gateway REST API. An AWS Lambda function backs each API method.

The company wants to create a CSV report every 2 weeks to show each API Lambda function’s recommended configured memory, recommended cost, and the price difference between current configurations and the recommendations. The company will store the reports in an S3 bucket.

Which solution will meet these requirements with the LEAST development time?

A

Create a Lambda function that extracts metrics data for each API Lambda function from Amazon CloudWatch Logs for the 2-week period. Collate the data into tabular format. Store the data as a .csv file in an S3 bucket. Create an Amazon EventBridge rule to schedule the Lambda function to run every 2 weeks.

B

Opt into AWS Compute Optimizer. Create a Lambda function that calls the Export Lambda Function Recommendations operation. Export the .csv file to an S3 bucket. Create an Amazon EventBridge rule to schedule the Lambda function to run every 2 weeks.

C

Opt in to AWS Compute Optimizer. Set up enhanced infrastructure metrics. Within the Compute Optimizer console, schedule a job to export the Lambda recommendations to a .csv file. Store the file in an S3 bucket every 2 weeks.

D

Purchase the AWS Business Support plan for the production account. Opt in to AWS Compute Optimizer for AWS Trusted Advisor checks. In the Trusted Advisor console, schedule a job to export the cost optimization checks to a .csv file. Store the file in an S3 bucket every 2 weeks.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 76

A company wants to establish a dedicated connection between its on-premises infrastructure and AWS. The company is setting up a 1 Gbps AWS Direct Connect connection to its account VPC. The architecture includes a transit gateway and a Direct Connect gateway to connect multiple VPCs and the on-premises infrastructure.

The company must connect to VPC resources over a transit VIF by using the Direct Connect connection.

Which combination of steps will meet these requirements? (Choose two.)

A

Update the 1 Gbps Direct Connect connection to 10 Gbps.

B

Advertise the on-premises network prefixes over the transit VIF.

C

Advertise the VPC prefixes from the Direct Connect gateway to the on-premises network over the transit VIF.

D

Update the Direct Connect connection's MACsec encryption mode attribute to must_encrypt.

E

Associate a MACsec Connection Key Name/Connectivity Association Key (CKN/CAK) pair with the Direct Connect connection.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 77

A company uses infrastructure as code (IaC) to provision Amazon EC2 instances. The company uses a launch template to implement an EC2 Auto Scaling group. After a recent update that required instance reboots, the Auto Scaling group terminated the instances and launched new, unpatched instances. The company must ensure that the Auto Scaling group launches instances that have the latest security patches. Which combination of solutions will meet this requirement? (Select TWO.)

A

Configure the Auto Scaling group termination policy to use the OldestLaunchTemplate setting.

B

Create a new Auto Scaling group before the next patch maintenance window.

C

Deploy an Application Load Balancer (ALB) in front of the Auto Scaling group.

D

Use AWS Systems Manager to automatically produce patched AMIs. Update the Auto Scaling group launch template. Initiate an instance refresh for the Auto Scaling group.

E

Deploy a Network Load Balancer (NLB) in front of the Auto Scaling group.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 78

A company is using Amazon SageMaker Al Notebook Instances and SageMaker APIs to train machine leaming (ML) models. The SageMaker Al Notebook Instances are deployed in a VPC that does not have access to or from the internet. Datasets for ML model training are stored in an Amazon S3 bucket. Interface VPC endpoints provide access to Amazon S3 and the SageMaker APIs.

Occasionally, data scientists require access to a private Git repository to update application packages that they use as part of their workflow The company must provide access to the Git repository while ensuring that the SageMaker Al Notebook Instances remain Isolated from the internet

Which solution meets these requirements with the LEAST operational overhead?

A

Add the Git repository as a resource for SageMaker by referencing the remote URL. Configure AWS Secrets Manager to use Git credentials to access the repository

B

Add the Git repository as a resource for SageMaker by referencing the remote URL. Add the username to the URL that is required to access the repository

C

Create a NAT gateway in the VPC. Configure VPC routes to allow access to the internet Configure network ACL rules that allow the SageMaker Al Notebook Instances access to only the Git repository URL

D

Create a NAT gateway in the VPC. Configure VPC routes to allow access to the internet with a network ACL that allows access to only the Git repository URL.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 79

A company uses AWS Organizations to manage its AWS accounts. A solutions architect must design a solution in which only administrator roles are allowed to use IAM actions. However, the solutions architect does not have access to all the AWS accounts throughout the company.

Which solution meets these requirements with the LEAST operational overhead?

A

Create an SCP that applies to all the AWS accounts to allow IAM actions only for administrator roles. Apply the SCP to the root OU.

B

Configure AWS CloudTrail to invoke an AWS Lambda function for each event that is related to IAM actions. Configure the function to deny the action if the user who invoked the action is not an administrator.

C

Create an SCP that applies to all the AWS accounts to deny IAM actions for all users except for those with administrator roles. Apply the SCP to the root OU.

D

Set an IAM permissions boundary that allows IAM actions. Attach the permissions boundary to every administrator role across all the AWS accounts.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 80

A company is creating a new organization in AWS Organizations to manage multiple AWS accounts and to consolidate billing. The company needs a visual dashboard to display AWS spend across the organization. Which solution will meet this requirement?

A

Configure AWS Cost Explorer in all member accounts to export cost data to an Amazon S3 bucket. Create a CloudWatch dashboard.

B

Use AWS Glue Data Catalog to connect to AWS Billing and Cost Management. Create a new AWS account and deploy the open source Cloud Intelligence Dashboards solution.

C

Set up Cost Optimization Hub in a centralized management account. Configure a standard data export to a new DynamoDB table.

D

Deploy Amazon QuickSight in the organization's management account. Configure AWS Cost and Usage Reports (CUR) to export data to a new Amazon S3 bucket. Configure QuickSight dashboards to visualize the CUR data.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 81

A company hosts an ecommerce platform on an Amazon EC2 instance and uses an on-premises MySQL database that requires consistent data reliability The company stores static web assets in an on-premises NFS file system. The company uses a VPN connection to connect the EC2 instance with the on-premises resources.

Batch processing jobs on the EC2 instance are causing bottlenecks during periods of high traffic. As a result, critical workloads are failing. A solutions architect must design a solution that improves the reliability and scalability of the platform. The solution must ensure that batches are not interrupted.

Which solution will meet these requirements with the LEAST operational overhead?

A

Migrate the platform to AWS Elastic Beanstalk. Migrate the on-premises MySQL database to an Amazon RDS Multi-AZ database. Use AWS DataSync to migrate the static assets from the NFS file system to an Amazon S3 bucket Use EC2 Spot Instances to run the batch processing jobs.

B

Migrate the platform to Amazon EKS on AWS Fargate. Migrate the on-premises MySQL database to an Amazon DynamoDB table. Use AWS DataSync to migrate the static assets from the NFS file system to an Amazon EFS file system. Use a mix of EC2 Spot Instances and EC2 Reserved Instances run the batch processing jobs.

C

Migrate the platform to Amazon ECS on AWS Fargate. Migrate the on-premises MySQL database to an Amazon RDS Multi-AZ database. Use AWS DataSync to migrate the static assets from the NFS file system to an Amazon S3 bucket. Use AWS Batch with Fargate to run batch processing jobs.

D

Keep the platform on Amazon EC2 and implement EC2 Auto Scaling. Migrate the on-premises MySQL database to an Amazon Aurora database. Use AWS DataSync to migrate the static assets from the NFS file system to an Amazon EFS file system. Use AWS Lambda functions to run the batch processing jobs.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 82

A company is planning a migration from an on-premises data center to the AWS Cloud. The company plans to use multiple AWS accounts that are managed in an organization in AWS Organizations. The company will create a small number of accounts initially and will add accounts as needed. A solutions architect must design a solution that turns on AWS CloudTrail in all AWS accounts.

What is the MOST operationally efficient solution that meets these requirements?

A

Create an AWS Lambda function that creates a new CloudTrail trail in all AWS accounts in the organization. Invoke the Lambda function daily by using a scheduled action in Amazon EventBridge (Amazon CloudWatch Events).

B

Create a new CloudTrail trail in the organization's management account. Configure the trail to log all events for all AWS accounts in the organization.

C

Create a new CloudTrail trail in all AWS accounts in the organization. Create new trails whenever a new account is created. Define an SCP that prevents deletion or modification of trails. Apply the SCP to the root OU.

D

Create an AWS Systems Manager Automation runbook that creates a CloudTrail trail in all AWS accounts in the organization. Invoke the automation by using Systems Manager State Manager.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 83

A company is running an application on Amazon EC2 instances. The application uses a MongoDB database with a replica set as its data tier on-premises. A solutions architect must migrate the on-premises MongoDB database to Amazon DocumentDB. Which solution will meet these requirements?

A

Create a fleet of EC2 instances. Install MongoDB Community Edition. Create a database. Configure continuous synchronous replication.

B

Create an AWS DMS replication instance. Create a source endpoint for the on-premises MongoDB database by using change data capture (CDC). Create a target endpoint for the Amazon DocumentDB database. Create and run a DMS migration task.

C

Create an AWS Application Migration Service replication template. Install the AWS Replication Agent on the MongoDB database. Set the Amazon DocumentDB database service as the target endpoint.

D

Create a source endpoint for the on-premises MongoDB database by using AWS Glue crawlers. Configure continuous asynchronous replication.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 84

A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company hosts some applications in a VPC in the company's shared services account. The company has attached a transit gateway to the VPC in the shared services account.

The company is developing a new capability and has created a development environment that requires access to the applications that are in the shared services account.

The company intends to delete and recreate resources frequently in the development account The company also wants to give a development team the ability to recreate the team's connection to the shared services account as required

Which solution will meet these requirements?

A

Create a transit gateway in the development account. Create a transit gateway peering request to the shared services account. Configure the shared services transit gateway to automatically accept peering connections.

B

Turn on automatic acceptance for the transit gateway in the shared services account. Use AWS Resource Access Manager (AWS RAM) to share the transit gateway resource in the shared services account with the development account. Accept the resource in the development account. Create a transit gateway attachment in the development account

C

Turn on automatic acceptance for the transit gateway in the shared services account. Create a VPC endpoint. Use the endpoint policy to grant permissions on the VPC endpoint for the development account Configure the endpoint service to automatically accept connection requests. Provide the endpoint details to the development team.

D

Create an Amazon EventBridge rule to invoke an AWS Lambda function that accepts the transit gateway attachment when the development account makes an attachment request. Use AWS Network Manager to share the transit gateway in the shared services account with the development account. Accept the transit gateway in the development account.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 85

A company wants to manage the costs associated with a group of 20 applications that are infrequently used, but are still business-critical, by migrating to AWS. The applications are a mix of Java and Node.js spread across different instance clusters. The company wants to minimize costs while standardizing by using a single deployment methodology.

Most of the applications are part of month-end processing routines with a small number of concurrent users, but they are occasionally run at other times. Average application memory consumption is less than 1 GB, though some applications use as much as 2.5 GB of memory during peak processing. The most important application in the group is a billing report written in Java that accesses multiple data sources and often for several hours.

Which is the MOST cost-effective solution?

A

Deploy a separate AWS Lambda function for each application. Use AWS CloudTrail logs and Amazon CloudWatch alarms to verify completion of critical jobs.

B

Deploy Amazon ECS containers on Amazon EC2 with Auto Scaling configured for memory utilization of 75%. Deploy an ECS task for each application being migrated with ECS task scaling. Monitor services and hosts by using Amazon CloudWatch.

C

Deploy AWS Elastic Beanstalk for each application with Auto Scaling to ensure that all requests have sufficient resources. Monitor each AWS Elastic Beanstalk deployment by using CloudWatch alarms.

D

Deploy a new Amazon EC2 instance cluster that co-hosts all applications by using EC2 Auto Scaling and Application Load Balancers. Scale cluster size based on a custom metric set on instance memory utilization. Purchase 3-year Reserved Instance reservations equal to the GroupMaxSize parameter of the Auto Scaling group. <h1>

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 86

A company wants to use Amazon WorkSpaces in combination with thin client devices to replace aging desktops. Employees use the desktops to access applications that work with clinical trial data. Corporate security policy states that access to the applications must be restricted to only company branch office locations. The company is considering adding an additional branch office in the next 6 months.

Which solution meets these requirements with the MOST operational efficiency?

A

Create an IP access control group rule with the list of public addresses from the branch offices. Associate the IP access control group with the WorkSpaces directory.

B

Use AWS Firewall Manner to create a web ACL rule with an IPSet with the list of public addresses from the branch office locations. Associate the web ACL with the WorkSpaces directory.

C

Use AWS Certificate Manager (ACM) to issue trusted device certificates to the machines deployed in the branch office locations. Enable restricted access on the WorkSpaces directory.

D

Create a custom WorkSpace image with Windows Firewall configured to restrict access to the public addresses of the branch offices. Use the image to deploy the WorkSpaces.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 87

A company has deployed production workloads on Amazon EC2 On-Demand Instances and Amazon RDS for PostgreSQL. The company has the AWS Business Support plan. A solutions architect must optimize the cost of the workloads without negatively affecting the availability or compute capacity. Which solution will meet these requirements?

A

Use AWS Cost and Usage Reports. Use AWS Lambda to terminate underutilized instances. Purchase Compute Savings Plans.

B

Use AWS Budgets to track spending. Configure AWS Trusted Advisor cost optimization checks to rightsize instances. Purchase Reserved Instances.

C

Opt in to AWS Compute Optimizer. Use Compute Optimizer and AWS Trusted Advisor to identify underutilized instances. Implement recommendations and purchase a Compute Savings Plan.

D

Use AWS Cost Explorer recommendations to rightsize underutilized instances. Replace On-Demand Instances with Spot Instances.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 88

A company has a new requirement to store all database backups in an isolated AWS account. The company is using AWS Organizations and has created a central write-once, read-many (WORM) account for the backups.

The company has 40 Amazon RDS for MySQL databases in its production account. The databases are encrypted with the default RDS AWS KMS key. RDS automated backups of the databases occur daily and have a retention period of 30 days

Which solution will successfully copy the database backups to the central account?

A

Enable Organizations trusted access and backup policies for AWS Backup. Configure the central account as the delegated administrator for AWS Backup. Create IAM policies and backup policies. Enable cross-account management. Create a backup vault in the central account. Create a KMS key for the backup vault and share the key with the production account. In the production account, restore the databases from a snapshot and apply the shared KMS key to the new DB instances. Create a backup plan in the central account to back up the databases to the backup vault

B

Enable Organizations trusted access and backup policies for AWS Backup. Configure the central account as the delegated administrator for AWS Backup. Create IAM policies and backup policies. Enable cross-account management In the production account, share the default RDS KMS key with the central account. Create a backup vault in the central account Apply the shared default RDS KMS key to the backup vault. Create a backup plan in the central account to back up the databases to the backup vault

C

Create an Amazon EventBridge rule to invoke an AWS Lambda function every day. Program the Lambda function to decrypt the snapshots and to initiate a copy request of all unencrypted snapshots to the central account. After the copy job is complete, create a new KMS key. Use the new KMS key to encrypt the database snapshots in the central account.

D

Create an Amazon EventBridge rule to invoke an AWS Lambda function every day. In the production account, share the default RDS KMS key with the central account. Program the Lambda function to decrypt the snapshots and to initiate a copy request of all unencrypted snapshots to the central account After the copy job is complete, encrypt the database snapshots with the shared default RDS KMS key in the central account.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 89

A company wants to migrate its website to AWS. The website uses containers that are deployed in an on-premises, self-managed Kubernetes cluster. All data for the website is stored in an on-premises PostgreSQL database.

The company has decided to migrate the on-premises Kubernetes cluster to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster will use EKS managed node groups with a static number of nodes. The company will also migrate the on-premises database to an Amazon RDS for PostgreSQL database.

A solutions architect needs to estimate the total cost of ownership (TCO) for this workload before the migration.

Which solution will provide the required TCO information?

A

Request access to Migration Evaluator. Run the Migration Evaluator Collector and import the data. Configure a scenario. Export a Quick Insights report from Migration Evaluator

B

Launch AWS Database Migration Service (AWS DMS) for the on-premises database. Generate an assessment report. Create an estimate in AWS Pricing Calculator for the costs of the EKS migration.

C

Initialize AWS Application Migration Service. Add the on-premises servers as source servers. Launch a test instance. Output a TCO report from Application Migration Service.

D

Access the AWS Cloud Economics Center webpage to assess the AWS Cloud Value Framework. Create an AWS Cost and usage report from the Cloud Value Framework.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 90

A company is deploying a new web-based application and needs a storage solution for the Linux application servers. The company wants to create a single location for updates to application data for all instances. The active dataset will be up to 100 GB. Peak operations require 225 MiBps of read throughput. The solutions architect must design a Multi-AZ solution that makes a copy of the data available in another AWS Region for disaster recovery (DR) with an RPO of less than 1 hour. Which solution will meet these requirements?

A

Deploy a new Amazon EFS Multi-AZ file system. Configure the file system for 75 MiBps of provisioned throughput. Implement replication to a file system in the DR Region.

B

Deploy a new Amazon FSx for Lustre file system. Configure Bursting Throughput mode. Use AWS Backup to back up the file system to the DR Region.

C

Deploy a General Purpose SSD (gp3) Amazon EBS volume with 225 MiBps. Enable Multi-Attach. Use AWS Elastic Disaster Recovery.

D

Deploy an Amazon FSx for OpenZFS file system in both Regions. Create an AWS DataSync scheduled task to replicate the data every 10 minutes.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 91

A company runs an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The EC2 instances are in an Auto Scaling group across multiple Availability Zones.

The application stores data in a block-level, proprietary clustered database that is Linux-based. The company will host the database on EC2 instances in the same Availability Zones where the application EC2 instances run- The database requires high availability and will handle its own data synchronization and locking mechanisms.

Which storage solution for the database cluster will meet these requirements?

A

Create an Amazon EFS Regional file system. Mount the EFS file system to each EC2 instance in the database cluster.

B

Create an Amazon FSx for NetApp ONTAP Multi-AZ file system. Provision iSCSI logical units of storage (LUNs). Mount the LUNS to each EC2 instance in the database cluster.

C

Create an Amazon EBS Multi-Attach enabled General Purpose SSD (gp3) volume. Attach the volume to each EC2 instance in the database cluster.

D

Create an Amazon EBS Multi-Attach enabled Provisioned IOPS SSD (i02) volume. Attach the volume to each EC2 instance in the database cluster.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 92

A company uses a mobile app on AWS to run online contests. The company selects a winner at random at the end of each contest. The contests run for variable lengths of time. The company does not need to retain any data from a contest after the contest is finished.

The company uses custom code that is hosted on Amazon EC2 instances to process the contest data and select a winner. The EC2 instances run behind an Application Load Balancer and store contest entries on Amazon RDS DB instances. The company must design a new architecture to reduce the cost of running the contests.

Which solution will meet these requirements MOST cost-effectively?

A

Migrate storage of the contest entries to Amazon DynamoDB. Create a DynamoDB Accelerator (DAX) cluster. Rewrite the code to run as Amazon Elastic Container Service (Amazon ECS) containers that use the Fargate launch type. At the end of the contest. delete the DynamoDB table.

B

Migrate the storage of the contest entries to Amazon Redshift. Rewrite the code as AWS Lambda functions. At the end of the contest. delete the Redshift cluster.

C

Add an Amazon ElastiCache for Redis cluster in front of the RDS DB instances to cache the contest entries. Rewrite the code to run as Amazon Elastic Container Service (Amazon ECS) containers that use the Fargate launch type. Set the ElastiCache TTL attribute on each entry to expire each entry at the end of the contest.

D

Migrate the storage of the contest entries to Amazon DynamoDB. Rewrite the code as AWS Lambda functions. Set the DynamoDB TTL attribute on each entry to expire each entry at the end of the contest.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 93

A company hosts an ecommerce platform in us-east-1 on Amazon ECS and Amazon Neptune DB. A solutions architect must design a similar solution in eu-west-1 for European customers. The solution must provide low latency and implement read-only data replication for the DB cluster from us-east-1 to eu-west-1. The solution must use the same container images across both Regions. Which combination of steps will meet these requirements with the LEAST operational overhead? (Select TWO.)

A

Convert the DB cluster in us-east-1 into a global database. Add a secondary DB cluster in eu-west-1.

B

Create VPC peering connections. Create an AWS DMS task in us-east-1 to replicate to eu-west-1.

C

Create VPC peering connections. Enable Neptune Streams and use a Lambda function to replicate streams.

D

Update the resource policy of the ECR repository in us-east-1 to allow access from the other account.

E

Enable Cross-Region Replication in Amazon ECR in us-east-1 with eu-west-1 as destination. Re-push existing images with a new tag.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 94

A company hosts a payment processing platform across multiple AWS Regions. The processing platform exposes payment processing API endpoints. The company uses Amazon Route 53 to route traffic to an Application Load Balancer (ALB) in each Region to distribute requests to backend payment gateways. The company has implemented auto scaling for the payment gateways.

The company needs to improve reliability and availability by handling application failures quickly.

Which solution will meet this requirement with the LEAST response time for global users?

A

Configure Route 53 to use a geolocation routing policy to resolve DNS to an Amazon CloudFront distribution. Configure the distribution with an origin group that includes the ALBs from each Region as origins.

B

Create an accelerator in AWS Global Accelerator Create an endpoint group and add each ALB as an endpoint in the group. Update the Route 53 alias records to point to the accelerator.

C

Configure Route 53 to use a latency-based routing policy and health checks for each Regional endpoint.

D

Set up cross-Region connectivity by using AWS Cloud WAN to connect VPCs across Regions. Use network policies to route traffic from each Region to the.1 Region that is closest to the origin Region

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 95

A company has an application that analyzes and stores image data on premises. The application receives millions of new image files every day. Files are an average of 1 MB in size. The files are analyzed in batches of 1 GB. When the application analyzes a batch, the application zips the images together. The application then archives the images as a single file in an on-premises NFS server for long-term storage.

The company has a Microsoft Hyper-V environment on premises and has compute capacity available. The company does not have storage capacity and wants to archive the images on AWS. The company needs the ability to retrieve archived data within 1 week of a request.

The company has a 10 Gbps AWS Direct Connect connection between its on-premises data center and AWS. The company needs to set bandwidth limits and schedule archived images to be copied to AWS during non-business hours.

Which solution will meet these requirements MOST cost-effectively?

A

Deploy an AWS DataSync agent on a new GPU-based Amazon EC2 instance. Configure the DataSync agent to copy the batch of files from the NFS on- premises server to Amazon S3 Glacier Instant Retrieval. After the successful copy. delete the data from the on-premises storage.

B

Deploy an AWS DataSync agent as a Hyper-V VM on premises. Configure the DataSync agent to copy the batch of files from the NFS on-premises server to Amazon S3 Glacier Deep Archive. After the successful copy, delete the data from the on-premises storage.

C

Deploy an AWS DataSync agent on a new general purpose Amazon EC2 instance. Configure the DataSync agent to copy the batch of files from the NFS on-premises server to Amazon S3 Standard. After the successful copy. delete the data from the on-premises storage. Create an S3 Lifecycle rule to transition objects from S3 Standard to S3 Glacier Deep Archive after 1 day.

D

Deploy an AWS Storage Gateway Tape Gateway on premises in the Hyper-V environment. Connect the Tape Gateway to AWS. Use automatic tape creation. Specify an Amazon S3 Glacier Deep Archive pool. Eject the tape after the batch of images is copied.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 96

A company runs an application on Amazon ECS with the Amazon EC2 launch type. The application experiences large sudden spikes in traffic up to 1,000 TPS and long periods of no traffic. Requests return results within 50 ms. The company wants to migrate to a serverless architecture while retaining a synchronous request-response pattern. Which solution is MOST cost-effective?

A

Migrate to AWS Fargate. Create an Amazon ECS scheduled scaling policy. Set Fargate as a target for the ALB.

B

Migrate to AWS Lambda. Create an Amazon SQS queue. Set Lambda as a target for SQS.

C

Migrate the application logic to AWS Lambda functions. Set the Lambda functions as targets for the ALB.

D

Migrate the application logic to an AWS Step Functions workflow. Set Step Functions as a target for the ALB.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 97

A company hosts a metadata API on Amazon EC2 instances behind an internet-facing Application Load Balancer (ALB). Only intemal applications that run on EC2 instances in separate AWS accounts need to access the metadata API. All the internal EC2 instances use NAT gateways.

A new policy requires that traffic between intemal applications must not travel across the public internet

Which solution will meet this requirement?

A

Create an HTTP API in Amazon API Gateway Configure a route for the metadata API. Configure a VPC link to the VPC that hosts the metadata API's EC2 instances. Update the API Gateway resource policy to include the account IDs of the internal applications that access the metadata API.

B

Create a REST API in Amazon API Gateway. Specify the API Gateway endpoint type as prrvate. Associate the REST API With the metadata API's VPC. Create a gateway VPC endpoint for the REST API. Share the endpoint across accounts by using AWS Resource Access Manager (AWS RAM). Configure the internal applications to connect to the gateway VPC endpoint.

C

Create an internal ALB. Register the metadata API's EC2 instances with the internal ALB. Create an internal Network Load Balancer (NLB) that has a target group type ofALB Register the internal ALB as the target. Configure an AWS PrivateLink endpoint service for the NLB. Grant the internal applications access to the metadata API through the PrivateLink endpoint

D

Create an internal ALB. Register the metadata API's EC2 instances with the internal ALB. Configure an AWS PrivateLink endpoint service for the internal ALB Grant the internal applications access to the metadata API through the PrivateLink endpoint.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 98

A solutions architect needs to define a reference architecture for a solution for three-tier applications with web, application, and NoSQL data layers. The reference architecture must meet the following requirements:

High availability within an AWS Region.
Able to fail over in 1 minute to another AWS Region for disaster recovery.
Provide the most efficient solution while minimizing the impact on the user experience.

Which combination of steps will meet these requirements? (Choose three.)

A

Use an Amazon Route53 weighted routing policy set to100/0 across the two selected Regions. Set Time to Live (TTL) to 1 hour.

B

Use an Amazon Route 53 failover routing policy for failover from the primary Region to the disaster recovery Region. Set Time to Live (TTL) to 30 seconds.

C

Use a global table within Amazon DynamoDB so data can be accessed in the two selected Regions.

D

Back up data from an Amazon DynamoDB table in the primary Region every 60 minutes and then write the data to Amazon S3. Use S3 cross-Region replication to copy the data from the primary Region to the disaster recovery Region. Have a script import the data into DynamoDB in a disaster recovery scenario.

E

Implement a hot standby model using Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use zonal Reserved Instances for the minimum number of servers and On-Demand Instances for any additional resources.

F

Use Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use Spot Instances for the required resources.<h1>

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 99

A global company has a mobile app that displays ticket barcodes. Customers use the tickets on the mobile app to attend live events. Event scanners read the ticket barcodes and call a backend API to validate the barcode data against data in a database. After the barcode is scanned, the backend logic writes to the database's single table to mark the barcode as used.

The company needs to deploy the app on AWS with a DNS name of api.example.com. The company will host the database in three AWS Regions around the world.

Which solution will meet these requirements with the LOWEST latency?

A

Host the database on Amazon Aurora global database clusters. Host the backend on three Amazon Elastic Container Service (Amazon ECS) clusters that are in the same Regions as the database. Create an accelerator in AWS Global Accelerator to route requests to the nearest ECS cluster. Create an Amazon Route 53 record that maps api.example.com to the accelerator endpoint.

B

Host the database on Amazon Aurora global database clusters. Host the backend on three Amazon Elastic Kubemetes Service (Amazon EKS) clusters that are in the same Regions as the database. Create an Amazon CloudFront distribution with the three clusters as origins. Route requests to the nearest EKScluster. Create an Amazon Route 53 record that maps api.example.com to the CloudFront distribution.

C

Host the database on Amazon DynamoDB global tables. Create an Amazon CloudFront distribution. Associate the CloudFront distribution with a CloudFront function that contains the backend logic to validate the barcodes. Create an Amazon Route 53 record that maps api.example.com to the CloudFront distribution.

D

Host the database on Amazon DynamoDB global tables. Create an Amazon CloudFront distribution. Associate the CloudFront distribution with a Lambda@Edge function that contains the backend logic to validate the barcodes. Create an Amazon Route 53 record that maps api.example.com to the CloudFront distribution.

Premium Solution Locked

Unlock all 640 answers & explanations

QUESTION 100

A company needs to optimize the cost of an AWS environment. The company needs EC2 instances for 3 more years and has a new serverless workload. Which strategy will provide the MOST cost savings?

A

Purchase a 1-year Compute Savings Plan with No Upfront payment in each member account.

B

Purchase a 3-year EC2 Instance Savings Plan with No Upfront payment in the management account.

C

Purchase a 3-year EC2 Instance Savings Plan with All Upfront payment in each member account.

D

Purchase a 3-year EC2 Instance Savings Plan with All Upfront payment in the management account to cover EC2 instance costs. Purchase a 3-year Compute Savings Plan with All Upfront payment in the management account to cover additional compute costs.

Premium Solution Locked

Unlock all 640 answers & explanations

Amazon AWS Certified Solutions Architect - Professional (SAP-C02)

Test the Practice Engine

Premium Bundle

Standard Simulation

Basic Tier

Verified Community

Success Network

Exam Overview

Skills Measured

Career Path

Common Questions

Is the material up to date?

What format do I get?

Is there a guarantee?

When do I get the download?

Free Study Guide Samples

Full Question Bank Locked

Certification Path

Related Certifications

Customer Reviews

David M.

Sarah J.

Michael C.

Need Assistance?

Get Exam Updates