A company needs to implement a new data retention policy for regulatory compliance. As part of this policy, sensitive documents that are stored in an Amazon S3 bucket must be protected from deletion or modification for a fixed period of time.
Which solution will meet these requirements?
A. Activate S3 Object Lock on the required objects and enable governance mode.
B. Activate S3 Object Lock on the required objects and enable compliance mode.
C. Enable versioning on the S3 bucket. Set a lifecycle policy to delete the objects after a specified period.
D. Configure an S3 Lifecycle policy to transition objects to S3 Glacier Flexible Retrieval for the retention duration.
Show Answer
Correct Answer: B
Explanation: For regulatory compliance requiring that sensitive S3 objects cannot be deleted or modified for a fixed retention period, Amazon S3 Object Lock in compliance mode is the correct choice. Compliance mode prevents any user, including the root user, from deleting or overwriting protected object versions until the retention period expires. Governance mode can be bypassed by authorized users with special permissions, so it is not sufficient for strict regulatory compliance. Versioning with lifecycle rules and Glacier transitions do not enforce immutable retention against deletion or modification.
Question 81
A company needs to design a resilient web application to process customer orders. The web application must automatically handle increases in web traffic and application usage without affecting the customer experience or losing customer orders.
Which solution will meet these requirements?
A. Use a NAT gateway to manage web traffic. Use Amazon EC2 Auto Scaling groups to receive, process, and store processed customer orders. Use an AWS Lambda function to capture and store unprocessed orders.
B. Use a Network Load Balancer (NLB) to manage web traffic. Use an Application Load Balancer to receive customer orders from the NLUse Amazon Redshift with a Multi-AZ deployment to store unprocessed and processed customer orders.
C. Use a Gateway Load Balancer (GWLB) to manage web traffic. Use Amazon Elastic Container Service (Amazon ECS) to receive and process customer orders. Use the GWLB to capture and store unprocessed orders. Use Amazon DynamoDB to store processed customer orders.
D. Use an Application Load Balancer to manage web traffic. Use Amazon EC2 Auto Scaling groups to receive and process customer orders. Use Amazon Simple Queue Service (Amazon SQS) to store unprocessed orders. Use Amazon RDS with a Multi-AZ deployment to store processed customer orders.
Show Answer
Correct Answer: D
Explanation: An Application Load Balancer distributes HTTP/HTTPS web traffic to EC2 instances in Auto Scaling groups, allowing the application to scale automatically with demand. Amazon SQS provides durable buffering of incoming orders so requests are not lost during traffic spikes and can be processed asynchronously. Amazon RDS Multi-AZ provides high availability for the processed order data. The other options misuse AWS services: a NAT gateway does not manage inbound web traffic, Redshift is not the appropriate transactional database for order processing and does not provide Multi-AZ in the described way, and a Gateway Load Balancer is for deploying virtual network appliances rather than handling application traffic or storing orders.
Question 82
A company has developed a non-production application that is composed of multiple microservices for each of the company's business units. A single development team maintains all the microservices.
The current architecture uses a static web frontend and a Java-based backend that contains the application logic. The architecture also uses a MySQL database that the company hosts on an Amazon EC2 instance.
The company needs to ensure that the application is secure and available globally.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon CloudFront and AWS Amplify to host the static web frontend. Refactor the microservices to use AWS Lambda functions that the microservices access by using Amazon API Gateway. Migrate the MySQL database to an Amazon EC2 Reserved Instance.
B. Use Amazon CloudFront and Amazon S3 to host the static web frontend. Refactor the microservices to use AWS Lambda functions that the microservices access by using Amazon API Gateway. Migrate the MySQL database to Amazon RDS for MySQL.
C. Use Amazon CloudFront and Amazon S3 to host the static web frontend. Refactor the microservices to use AWS Lambda functions that are in a target group behind a Network Load Balancer. Migrate the MySQL database to Amazon RDS for MySQL.
D. Use Amazon S3 to host the static web frontend. Refactor the microservices to use AWS Lambda functions that are in a target group behind an Application Load Balancer. Migrate the MySQL database to an Amazon EC2 Reserved Instance.
Show Answer
Correct Answer: B
Explanation: CloudFront with Amazon S3 is the standard low-operational-overhead pattern for globally available static websites. Refactoring the backend to AWS Lambda behind Amazon API Gateway provides a fully managed, secure serverless API. Migrating MySQL from EC2 to Amazon RDS for MySQL significantly reduces database management overhead. Option A keeps the database on EC2 (even with Reserved Instances), which does not reduce operations. Option C is invalid because Lambda integrates with API Gateway or ALB, not as a target for a Network Load Balancer. Option D lacks CloudFront for global acceleration and keeps the database on EC2.
Question 83
A company is building an application on AWS. The application uses multiple AWS Lambda functions to retrieve sensitive data from a single Amazon S3 bucket for processing. The company must ensure that only authorized Lambda functions can access the data. The solution must comply with the principle of least privilege.
Which solution will meet these requirements?
A. Grant full S3 bucket access to all Lambda functions through a shared IAM role.
B. Configure the Lambda functions to run within a VPC. Configure a bucket policy to grant access based on the Lambda functions' VPC endpoint IP addresses.
C. Create individual IAM roles for each Lambda function. Grant the IAM roles access to the S3 bucket. Assign each IAM role as the Lambda execution role for its corresponding Lambda function.
D. Configure a bucket policy granting access to the Lambda functions based on their function ARNs.
Show Answer
Correct Answer: C
Explanation: Use a distinct IAM execution role for each Lambda function and grant only the S3 permissions that each function requires. This enforces least privilege and uses IAM identity-based access control, which is the standard AWS pattern. A shared role with full access violates least privilege. VPC/IP-based bucket policies do not identify individual Lambda functions and are not the recommended authorization mechanism. S3 bucket policies cannot directly authorize Lambda function ARNs as principals; access is made using the Lambda execution role's IAM principal.
Question 84
A company has stored millions of objects across multiple prefixes in an Amazon S3 bucket by using the Amazon S3 Glacier Deep Archive storage class. The company needs to delete all data older than 3 years except for a subset of data that must be retained. The company has identified the data that must be retained and wants to implement a serverless solution.
Which solution will meet these requirements?
A. Use S3 Inventory to list all objects. Use the AWS CLI to create a script that runs on an Amazon EC2 instance that deletes objects from the inventory list.
B. Use AWS Batch to delete objects older than 3 years except for the data that must be retained.
C. Provision an AWS Glue crawler to query objects older than 3 years. Save the manifest file of old objects. Create a script to delete objects in the manifest.
D. Enable S3 Inventory. Create an AWS Lambda function to filter and delete objects. Invoke the Lambda function with S3 Batch Operations to delete objects by using the inventory reports.
Show Answer
Correct Answer: D
Explanation: The correct serverless approach is to use S3 Inventory to generate an object list, filter out the objects that must be retained, and use S3 Batch Operations with an AWS Lambda function to perform bulk deletions. S3 Batch Operations is designed for large-scale object actions, S3 Inventory provides the manifest of objects, and Lambda provides the serverless filtering/deletion logic. EC2 is not serverless, AWS Batch is for compute jobs rather than S3 object management, and AWS Glue crawlers are for metadata discovery, not object lifecycle management.
Question 85
A company is designing an application on AWS that processes sensitive data. The application stores and processes financial data for multiple customers.
To meet compliance requirements, the data for each customer must be encrypted separately at rest by using a secure, centralized key management solution. The company wants to use AWS Key Management Service (AWS KMS) to implement encryption.
Which solution will meet these requirements with the LEAST operational overhead?
A. Generate a unique encryption key for each customer. Store the keys in an Amazon S3 bucket. Enable server-side encryption.
B. Deploy a hardware security appliance in the AWS environment that securely stores customer-provided encryption keys. Integrate the security appliance with AWS KMS to encrypt the sensitive data in the application.
C. Create a single AWS KMS key to encrypt all sensitive data across the application.
D. Create separate AWS KMS keys for each customer's data that have granular access control and logging enabled.
Show Answer
Correct Answer: D
Explanation: Using separate AWS KMS keys for each customer's data satisfies the requirement for separate encryption per customer while leveraging AWS KMS as the centralized key management service. Customer-specific KMS keys provide granular IAM access control, key policies, CloudTrail audit logging, and simplified lifecycle management with far less operational overhead than managing keys yourself or deploying HSM appliances. A single KMS key does not meet the requirement for separate encryption per customer, and storing keys in S3 is not an appropriate key management solution.
Question 86
A video game company is deploying a new gaming application to its global users. The company requires a solution that will provide near real-time reviews and rankings of the players.
A solutions architect must design a solution to provide fast access to the data. The solution must also ensure the data persists on disks in the event that the company restarts the application.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure an Amazon CloudFront distribution with an Amazon S3 bucket as the origin. Store the player data in the S3 bucket.
B. Create Amazon EC2 instances in multiple AWS Regions. Store the player data on the EC2 instances. Configure Amazon Route 53 with geolocation records to direct users to the closest EC2 instance.
C. Deploy an Amazon ElastiCache for Redis duster. Store the player data in the ElastiCache cluster.
D. Deploy an Amazon ElastiCache for Memcached duster. Store the player data in the ElastiCache cluster.
Show Answer
Correct Answer: C
Explanation: Amazon ElastiCache for Redis provides in-memory performance suitable for near real-time leaderboards and player rankings while supporting persistence to disk (such as RDB snapshots and AOF, depending on configuration) so data can survive application/cache node restarts. Memcached does not support persistence. S3 with CloudFront is not appropriate for low-latency mutable leaderboard data, and managing EC2 instances across Regions has significantly higher operational overhead.
Question 87
A company hosts a monolithic web application on an Amazon EC2 instance. Application users have recently reported poor performance at specific times. Analysis of Amazon CloudWatch metrics shows that CPU utilization is 100% during the periods of poor performance.
The company wants to resolve this performance issue and improve application availability.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
A. Use AWS Compute Optimizer to obtain a recommendation for an instance type to scale vertically.
B. Create an Amazon Machine Image (AMI) from the web server. Reference the AMI in a new launch template.
C. Create an Auto Scaling group and an Application Load Balancer to scale vertically.
D. Use AWS Compute Optimizer to obtain a recommendation for an instance type to scale horizontally.
E. Create an Auto Scaling group and an Application Load Balancer to scale horizontally.
Show Answer
Correct Answer: B, E
Explanation: To implement horizontal scaling with an Auto Scaling group, you first need a reusable image (AMI) and a launch template. Then create an Auto Scaling group behind an Application Load Balancer to add instances during peak CPU periods and improve availability. Option C is incorrect because Auto Scaling groups with an ALB provide horizontal, not vertical, scaling. Options A and D misuse Compute Optimizer in this context; D is incorrect because Compute Optimizer does not recommend instance types for horizontal scaling, and A does not address the availability requirement as cost-effectively as Auto Scaling.
Sources:
https://codingnconcepts.com/aws/aws-certified-solutions-architect-associate-exam-questions
Question 88
A company uses Amazon RDS for PostgreSQL to run its applications in the us-east-1 Region. The company also uses machine learning (ML) models to forecast annual revenue based on near real-time reports. The reports are generated by using the same RDS for PostgreSQL database. The database performance slows during business hours. The company needs to improve database performance.
Which solution will meet these requirements MOST cost-effectively?
A. Create a cross-Region read replica. Configure the reports to be generated from the read replica.
B. Activate Multi-AZ DB instance deployment for RDS for PostgreSQL. Configure the reports to be generated from the standby database.
C. Use AWS Data Migration Service (AWS DMS) to logically replicate data to a new database. Configure the reports to be generated from the new database.
D. Create a read replica in us-east-1. Configure the reports to be generated from the read replica.
Show Answer
Correct Answer: D
Explanation: An Amazon RDS for PostgreSQL read replica in the same Region offloads read-heavy reporting workloads from the primary database with the lowest additional cost. A cross-Region read replica adds unnecessary cross-Region replication costs and latency. Multi-AZ standby instances are for high availability and cannot be used for read traffic. AWS DMS replication to a separate database is more operationally complex and generally less cost-effective than using the built-in read replica feature for reporting workloads.
Question 89
A company has applications that run in an organization in AWS Organizations. The company outsources operational support of the applications. The company needs to provide access for the external support engineers without compromising security.
The external support engineers need access to the AWS Management Console. The external support engineers also need operating system access to the company’s fleet ofAmazon EC2 instances that run Amazon Linux in private subnets.
Which solution will meet these requirements MOST securely?
A. Confirm that AWS Systems Manager Agent (SSM Agent) is installed on all instances. Assign an instance profile with the necessary policy to connect to Systems Manager. Use AWS IAM Identity Center to provide the external support engineers console access. Use Systems Manager Session Manager to assign the required permissions.
B. Confirm that AWS Systems Manager Agent (SSM Agent) is installed on all instances. Assign an instance profile with the necessary policy to connect to Systems Manager. Use Systems Manager Session Manager to provide local IAM user credentials in each AWS account to the external support engineers for console access.
C. Confirm that all instances have a security group that allows SSH access only from the external support engineers’ source IP address ranges. Provide local IAM user credentials in each AWS account to the external support engineers for console access. Provide each external support engineer an SSH key pair to log in to the application instances.
D. Create a bastion host in a public subnet. Set up the bastion host security group to allow access from only the external engineers’ IP address ranges. Ensure that all instances have a security group that allows SSH access from the bastion host. Provide each external support engineer an SSH key pair to log in to the application instances. Provide local account IAM user credentials to the engineers for console access.
Show Answer
Correct Answer: A
Explanation: AWS Systems Manager Session Manager provides secure, auditable OS access to EC2 instances in private subnets without opening SSH ports, using bastion hosts, or distributing SSH keys. IAM Identity Center is the recommended way to provide federated AWS Management Console access across AWS Organizations, avoiding long-lived IAM users in each account. This combination minimizes attack surface and centralizes identity and access management.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.