A company is migrating its data processing application to the AWS Cloud. The application processes several short-lived batch jobs that cannot be disrupted. Data is generated after each batch job is completed. The data is accessed for 30 days and retained for 2 years.
The company wants to keep the cost of running the application in the AWS Cloud as low as possible.
Which solution will meet these requirements?
A. Migrate the data processing application to Amazon EC2 Spot Instances. Store the data in Amazon S3 Standard. Move the data to Amazon S3 Glacier Instant. Retrieval after 30 days. Set an expiration to delete the data after 2 years.
B. Migrate the data processing application to Amazon EC2 On-Demand Instances. Store the data in Amazon S3 Glacier Instant Retrieval. Move the data to S3 Glacier Deep Archive after 30 days. Set an expiration to delete the data after 2 years.
C. Deploy Amazon EC2 Spot Instances to run the batch jobs. Store the data in Amazon S3 Standard. Move the data to Amazon S3 Glacier Flexible Retrieval after 30 days. Set an expiration to delete the data after 2 years.
D. Deploy Amazon EC2 On-Demand Instances to run the batch jobs. Store the data in Amazon S3 Standard. Move the data to Amazon S3 Glacier Deep Archive after 30 days. Set an expiration to delete the data after 2 years.
Show Answer
Correct Answer: D
Explanation: The batch jobs cannot be disrupted, so Amazon EC2 On-Demand Instances are required instead of Spot Instances. The data is actively accessed for the first 30 days, which makes Amazon S3 Standard the most appropriate and cost-effective choice for frequent access. For long-term retention (up to 2 years) with minimal access, Amazon S3 Glacier Deep Archive provides the lowest storage cost. A lifecycle policy can transition the data after 30 days and expire it after 2 years, minimizing overall cost while meeting all requirements.
Question 93
A company has an internal application that runs on Amazon EC2 instances in an Auto Scaling group. The EC2 instances are compute optimized and use Amazon Elastic Block Store (Amazon EBS) volumes.
The company wants to identify cost optimizations across the EC2 instances, the Auto Scaling group, and the EBS volumes.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a new AWS Cost and Usage Report. Search the report for cost recommendations for the EC2 instances the Auto Scaling group, and the EBS volumes.
B. Create new Amazon CloudWatch billing alerts. Check the alert statuses for cost recommendations for the EC2 instances, the Auto Scaling group, and the EBS volumes.
C. Configure AWS Compute Optimizer for cost recommendations for the EC2 instances, the Auto Scaling group and the EBS volumes.
D. Configure AWS Compute Optimizer for cost recommendations for the EC2 instances. Create a new AWS Cost and Usage Report. Search the report for cost recommendations for the Auto Scaling group and the EBS volumes.
Show Answer
Correct Answer: C
Explanation: AWS Compute Optimizer analyzes historical utilization data and provides right-sizing and cost optimization recommendations for EC2 instances, Auto Scaling groups, and EBS volumes in a single service. This directly meets the requirement to identify cost optimizations across all three resource types with minimal setup and ongoing effort. The other options either do not provide optimization recommendations (CloudWatch, Cost and Usage Report) or require combining multiple services, which reduces operational efficiency.
Question 94
A company runs thousands of AWS Lambda functions. The company needs a solution to securely store sensitive information that all the Lambda functions use. The solution must also manage the automatic rotation of the sensitive information.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
A. Create HTTP security headers by using Lambda@Edge to retrieve and create sensitive information
B. Create a Lambda layer that retrieves sensitive information
C. Store sensitive information in AWS Secrets Manager
D. Store sensitive information in AWS Systems Manager Parameter Store
E. Create a Lambda consumer with dedicated throughput to retrieve sensitive information and create environmental variables
Show Answer
Correct Answer: B, C
Explanation: AWS Secrets Manager is purpose-built to securely store sensitive information and supports automatic rotation, meeting the security and rotation requirements with minimal operational effort. Using a Lambda layer to retrieve secrets centralizes and reuses the access logic across thousands of Lambda functions, avoiding code duplication and reducing operational overhead. Systems Manager Parameter Store does not natively provide automatic rotation, and the other options are not suitable for secure, scalable secret management.
Question 95
A company has multiple Microsoft Windows SMB file servers and Linux NFS file servers for file sharing in an on-premises environment. As part of the company's AWS migration plan, the company wants to consolidate the file servers in the AWS Cloud.
The company needs a managed AWS storage service that supports both NFS and SMB access. The solution must be able to share between protocols. The solution must have redundancy at the Availability Zone level.
Which solution will meet these requirements?
A. Use Amazon FSx for NetApp ONTAP for storage. Configure multi-protocol access.
B. Create two Amazon EC2 instances. Use one EC2 instance for Windows SMB file server access and one EC2 instance for Linux NFS file server access.
C. Use Amazon FSx for NetApp ONTAP for SMB access. Use Amazon FSx for Lustre for NFS access.
D. Use Amazon S3 storage. Access Amazon S3 through an Amazon S3 File Gateway.
Show Answer
Correct Answer: A
Explanation: Amazon FSx for NetApp ONTAP is a fully managed service that supports true multiprotocol access (SMB and NFS) on the same file system, allowing data to be shared between Windows and Linux clients. It offers Multi-AZ deployment for Availability Zone–level redundancy and high availability, meeting all stated requirements.
Question 96
A company hosts an ecommerce application that stores all data in a single Amazon RDS for MySQL DB instance that is fully managed by AWS. The company needs to mitigate the risk of a single point of failure.
Which solution will meet these requirements with the LEAST implementation effort?
A. Modify the RDS DB instance to use a Multi-AZ deployment. Apply the changes during the next maintenance window.
B. Migrate the current database to a new Amazon DynamoDB Multi-AZ deployment. Use AWS Database Migration Service (AWS DMS) with a heterogeneous migration strategy to migrate the current RDS DB instance to DynamoDB tables.
C. Create a new RDS DB instance in a Multi-AZ deployment. Manually restore the data from the existing RDS DB instance from the most recent snapshot.
D. Configure the DB instance in an Amazon EC2 Auto Scaling group with a minimum group size of three. Use Amazon Route 53 simple routing to distribute requests to all DB instances.
Show Answer
Correct Answer: A
Explanation: A Multi-AZ deployment for Amazon RDS provides synchronous replication to a standby instance in another Availability Zone with automatic failover. It directly mitigates the single point of failure while keeping the same database engine and configuration, requiring only a modification of the existing instance. This is the least implementation effort compared to redesigning the data layer, migrating to a different database, or manually managing multiple instances.
Question 97
A company wants to use an AWS CloudFormation stack for its application in a test environment. The company stores the CloudFormation template in an Amazon S3 bucket that blocks public access. The company wants to grant CloudFormation access to the template in the S3 bucket based on specific user requests to create the test environment. The solution must follow security best practices.
Which solution will meet these requirements?
A. Create a gateway VPC endpoint for Amazon S3. Configure the CloudFormation stack to use the S3 object URL.
B. Create an Amazon API Gateway REST API that has the S3 bucket as the target. Configure the CloudFormation stack to use the API Gateway URL.
C. Create a presigned URL for the template object. Configure the CloudFormation stack to use the presigned URL.
D. Allow public access to the template object in the S3 bucket. Block the public access after the test environment is created.
Show Answer
Correct Answer: C
Explanation: CloudFormation needs read access to a template stored in a private S3 bucket, granted only when specific users request stack creation. A presigned S3 URL provides time-limited, scoped access to a single object without making the bucket or object public, aligning with least-privilege and temporary access best practices. VPC endpoints do not help because CloudFormation is not running inside a customer VPC, API Gateway is unnecessary, and making the object public violates security requirements.
Question 98
A healthcare company is developing an AWS Lambda function that publishes notifications to an encrypted Amazon Simple Notification Service (Amazon SNS) topic. The notifications contain protected health information (PHI).
The SNS topic uses AWS Key Management Service (AWS KMS) customer managed keys for encryption. The company must ensure that the application has the necessary permissions to publish messages securely to the SNS topic.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a resource policy for the SNS topic that allows the Lambda function to publish messages to the topic.
B. Use server-side encryption with AWS KMS keys (SSE-KMS) for the SNS topic instead of customer managed keys.
C. Create a resource policy for the encryption key that the SNS topic uses that has the necessary AWS KMS permissions.
D. Specify the Lambda function's Amazon Resource Name (ARN) in the SNS topic's resource policy.
E. Associate an Amazon API Gateway HTTP API with the SNS topic to control access to the topic by using API Gateway resource policies.
F. Configure a Lambda execution role that has the necessary IAM permissions to use a customer managed key in AWS KMS.
Show Answer
Correct Answer: A, C, F
Explanation: To securely publish PHI to an SNS topic encrypted with a customer managed KMS key, three permission layers are required. The SNS topic must allow the Lambda function to publish messages (A). Because a customer managed KMS key is used, the KMS key policy must permit Amazon SNS to use the key for encryption and decryption (C). Additionally, the Lambda execution role must have IAM permissions to interact with KMS as required when publishing to a KMS-encrypted SNS topic (F). Other options are unnecessary or redundant for this scenario.
Question 100
A company runs its customer-facing web application on containers. The workload uses Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The web application is resource intensive.
The web application needs to be available 24 hours a day, 7 days a week for customers. The company expects the application to experience short bursts of high traffic. The workload must be highly available.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an ECS capacity provider with Fargate. Conduct load testing by using a third-party tool. Rightsize the Fargate tasks in Amazon CloudWatch.
B. Configure an ECS capacity provider with Fargate for steady state and Fargate Spot for burst traffic.
C. Configure an ECS capacity provider with Fargate Spot for steady state and Fargate for burst traffic.
D. Configure an ECS capacity provider with Fargate. Use AWS Compute Optimizer to rightsize the Fargate task.
Show Answer
Correct Answer: B
Explanation: The application must be highly available 24/7 while handling short bursts of high traffic at the lowest cost. Using standard Fargate for the steady-state workload ensures continuous availability, while adding Fargate Spot via an ECS capacity provider for burst traffic provides significant cost savings during spikes. Spot interruptions are acceptable for burst capacity because baseline availability is maintained by regular Fargate tasks. Other options either do not address burst cost optimization or rely on Spot for steady state, which risks availability.
Question 101
A company runs all its business applications in the AWS Cloud. The company uses AWS Organizations to manage multiple AWS accounts.
A solutions architect needs to review all permissions that are granted to IAM users to determine which IAM users have more permissions than required.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Use Network Access Analyzer to review all access permissions in the company's AWS accounts.
B. Create an AWS CloudWatch alarm that activates when an IAM user creates or modifies resources in an AWS account.
C. Use AWS Identity and Access Management (IAM) Access Analyzer to review all the company’s resources and accounts.
D. Use Amazon Inspector to find vulnerabilities in existing IAM policies.
Show Answer
Correct Answer: C
Explanation: IAM Access Analyzer is specifically designed to analyze IAM policies and identify permissions that are overly broad or grant unintended access across accounts in an AWS Organization. It works across multiple accounts with minimal setup, providing centralized visibility into excessive permissions. The other options either focus on network paths, monitoring activity, or vulnerability scanning and do not directly assess least-privilege permissions.
Question 102
A company runs an application that stores and shares photos. Users upload the photos to an Amazon S3 bucket. Every day, users upload approximately 150 photos. The company wants to design a solution that creates a thumbnail of each new photo and stores the thumbnail in a second S3 bucket.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an Amazon EventBridge scheduled rule to invoke a script every minute on a long-running Amazon EMR cluster. Configure the script to generate thumbnails for the photos that do not have thumbnails. Configure the script to upload the thumbnails to the second S3 bucket.
B. Configure an Amazon EventBridge scheduled rule to invoke a script every minute on a memory-optimized Amazon EC2 instance that is always on. Configure the script to generate thumbnails for the photos that do not have thumbnails. Configure the script to upload the thumbnails to the second S3 bucket.
C. Configure an S3 event notification to invoke an AWS Lambda function each time a user uploads a new photo to the application. Configure the Lambda function to generate a thumbnail and to upload the thumbnail to the second S3 bucket.
D. Configure S3 Storage Lens to invoke an AWS Lambda function each time a user uploads a new photo to the application. Configure the Lambda function to generate a thumbnail and to upload the thumbnail to a second S3 bucket.
Show Answer
Correct Answer: C
Explanation: The most cost-effective solution is to process photos only when they are uploaded, without running always-on or scheduled compute resources. An Amazon S3 event notification can directly trigger an AWS Lambda function whenever a new photo is uploaded. Lambda automatically scales, incurs cost only per invocation and execution time, and easily handles a low daily volume such as ~150 photos. The Lambda function can generate the thumbnail and store it in a second S3 bucket. The other options require continuously running or scheduled infrastructure (EMR or EC2), which would be significantly more expensive. S3 Storage Lens is for analytics and does not support per-object event processing.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.