A company hosts its multi-tier, public web application in the AWS Cloud. The web application runs on Amazon EC2 instances, and its database runs on Amazon RDS. The company is anticipating a large increase in sales during an upcoming holiday weekend. A solutions architect needs to build a solution to analyze the performance of the web application with a granularity of no more than 2 minutes.
What should the solutions architect do to meet this requirement?
A. Send Amazon CloudWatch logs to Amazon Redshift. Use Amazon QuickS ght to perform further analysis.
B. Enable detailed monitoring on all EC2 instances. Use Amazon CloudWatch metrics to perform further analysis.
C. Create an AWS Lambda function to fetch EC2 logs from Amazon CloudWatch Logs. Use Amazon CloudWatch metrics to perform further analysis.
D. Send EC2 logs to Amazon S3. Use Amazon Redshift to fetch logs from the S3 bucket to process raw data for further analysis with Amazon QuickSight.
Show Answer
Correct Answer: B
Explanation: The requirement is to analyze application performance with a granularity of no more than 2 minutes. Enabling detailed monitoring on Amazon EC2 provides CloudWatch metrics at 1‑minute granularity, which satisfies this requirement and is designed specifically for near real-time performance analysis. The other options focus on log aggregation and analytics platforms, which are unnecessary and introduce more complexity and latency than required.
Question 104
A company runs a self-managed Microsoft SQL Server on Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS). Daily snapshots are taken of the EBS volumes.
Recently, all the company’s EBS snapshots were accidentally deleted while running a snapshot cleaning script that deletes all expired EBS snapshots. A solutions architect needs to update the architecture to prevent data loss without retaining EBS snapshots indefinitely.
Which solution will meet these requirements with the LEAST development effort?
A. Change the IAM policy of the user to deny EBS snapshot deletion.
B. Copy the EBS snapshots to another AWS Region after completing the snapshots daily.
C. Create a 7-day EBS snapshot retention rule in Recycle Bin and apply the rule for all snapshots.
D. Copy EBS snapshots to Amazon S3 Standard-Infrequent Access (S3 Standard-IA).
Show Answer
Correct Answer: C
Explanation: AWS Recycle Bin for EBS snapshots provides a built-in safety net against accidental deletions by retaining deleted snapshots for a defined period (for example, 7 days). This prevents permanent data loss without requiring indefinite snapshot retention, additional scripting, or architectural changes. It directly addresses accidental deletion with minimal development effort compared to IAM changes, cross-Region copying, or exporting snapshots to S3.
Question 105
A company hosts an application on AWS. The application gives users the ability to upload photos and store the photos in an Amazon S3 bucket. The company wants to use Amazon CloudFront and a custom domain name to upload the photo files to the S3 bucket in the eu-west-1 Region.
Which solution will meet these requirements? (Choose two.)
A. Use AWS Certificate Manager (ACM) to create a public certificate in the us-east-1 Region. Use the certificate in CloudFront.
B. Use AWS Certificate Manager (ACM) to create a public certificate in eu-west-1. Use the certificate in CloudFront.
C. Configure Amazon S3 to allow uploads from CloudFront. Configure S3 Transfer Acceleration.
D. Configure Amazon S3 to allow uploads from CloudFront origin access control (OAC).
E. Configure Amazon S3 to allow uploads from CloudFront. Configure an Amazon S3 website endpoint.
Show Answer
Correct Answer: A, D
Explanation: CloudFront requires any ACM certificate used with a custom domain name to be issued in the us-east-1 Region, regardless of where the origin S3 bucket is located, so option A is required. To securely allow CloudFront to upload objects into an S3 bucket, the recommended approach is to use CloudFront Origin Access Control (OAC), which restricts S3 access so only CloudFront can perform actions such as PUT objects. Therefore, option D is also required.
Question 106
A company wants to move its application to a serverless solution. The serverless solution needs to analyze existing data and new data by using SQL. The company stores the data in an Amazon S3 bucket. The data must be encrypted at rest and replicated to a different AWS Region.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a new S3 bucket that uses server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon Athena to query the data.
B. Create a new S3 bucket that uses server-side encryption with Amazon S3 managed keys (SSE-S3). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon RDS to query the data.
C. Configure Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3). Use Amazon Athena to query the data.
D. Configure S3 Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use Amazon RDS to query the data.
Show Answer
Correct Answer: C
Explanation: The requirements are a serverless SQL analytics solution over data in S3, encryption at rest, cross-Region replication, and the least operational overhead. Amazon Athena is fully serverless and queries data directly in S3 using SQL, which eliminates database management. Server-side encryption with S3-managed keys (SSE-S3) satisfies encryption-at-rest requirements without KMS key creation, policies, or key rotation overhead. Cross-Region Replication works with SSE-S3 and can be enabled on the existing bucket, avoiding data migration to a newly created source bucket. Options using RDS are not serverless, and using SSE-KMS multi-Region keys introduces additional operational complexity.
Question 107
A solutions architect needs to connect a company's corporate network to its VPC to allow on-premises access to its AWS resources. The solution must provide encryption of all traffic between the corporate network and the VPC at the network layer and the session layer. The solution also must provide security controls to prevent unrestricted access between AWS and the on-premises systems.
Which solution meets these requirements?
A. Configure AWS Direct Connect to connect to the VPC. Configure the VPC route tables to allow and deny traffic between AWS and on premises as required.
B. Create an IAM policy to allow access to the AWS Management Console only from a defined set of corporate IP addresses. Restrict user access based on job responsibility by using an IAM policy and roles.
C. Configure AWS Site-to-Site VPN to connect to the VPConfigure route table entries to direct traffic from on premises to the VPConfigure instance security groups and network ACLs to allow only required traffic from on premises.
D. Configure AWS Transit Gateway to connect to the VPC. Configure route table entries to direct traffic from on premises to the VPC. Configure instance security groups and network ACLs to allow only required traffic from on premises.
Show Answer
Correct Answer: C
Explanation: The requirements are encrypted connectivity at both the network and session layers between on‑premises and a VPC, plus controls to restrict access. AWS Site‑to‑Site VPN uses IPsec to encrypt all traffic over the internet, satisfying network‑layer encryption, and supports secure session establishment. Traffic flow can be tightly controlled using VPC route tables, security groups, and network ACLs. Direct Connect alone does not provide encryption, IAM policies are irrelevant to network connectivity, and Transit Gateway by itself does not ensure the required end‑to‑end encrypted VPN connection from on‑premises.
Question 108
A company has a multi-tier web application. The application's internal service components are deployed on Amazon EC2 instances. The internal service components need to access third-party software as a service (SaaS) APIs that are hosted on AWS.
The company needs to provide secure and private connectivity from the application's internal services to the third-party SaaS application. The company needs to ensure that there is minimal public internet exposure.
Which solution will meet these requirements?
A. Implement an AWS Site-to-Site VPN to establish a secure connection with the third-party SaaS provider.
B. Deploy AWS Transit Gateway to manage and route traffic between the application's VPC and the third-party SaaS provider.
C. Configure AWS PrivateLink to allow only outbound traffic from the VPC without enabling the third-party SaaS provider to establish.
D. Use AWS PrivateLink to create a private connection between the application's VPC and the third-party SaaS provider.
Show Answer
Correct Answer: D
Explanation: AWS PrivateLink provides private, secure connectivity between a VPC and a third-party SaaS service hosted on AWS without traversing the public internet. It enables unidirectional, client-initiated access from the application’s internal services to the SaaS APIs, minimizing public internet exposure and meeting the requirement for secure and private connectivity. Site-to-Site VPN and Transit Gateway are not appropriate for SaaS integration, and option C is an incorrect or incomplete description of how PrivateLink is used.
Question 109
A company wants to replicate existing and ongoing data changes from an on-premises Oracle database to Amazon RDS for Oracle. The amount of data to replicate varies throughout each day. The company wants to use AWS Database Migration Service (AWS DMS) for data replication. The solution must allocate only the capacity that the replication instance requires.
Which solution will meet these requirements?
A. Configure the AWS DMS replication instance with a Multi-AZ deployment to provision instances across multiple Availability Zones.
B. Create an AWS DMS Serverless replication task to analyze and replicate the data while provisioning the required capacity.
C. Use Amazon EC2 Auto Scaling to scale the size of the AWS DMS replication instance up or down based on the amount of data toreplicate.
D. Provision AWS DMS replication capacity by using Amazon Elastic Container Service (Amazon ECS) with an AWS Fargate launch type to analyze and replicate the data while provisioning the required capacity.
Show Answer
Correct Answer: B
Explanation: AWS DMS Serverless automatically provisions and scales replication capacity based on workload, which fits variable data volumes and the requirement to allocate only the capacity needed. Multi-AZ does not address capacity scaling, EC2 Auto Scaling cannot scale DMS instances, and DMS does not run on ECS/Fargate.
Question 110
A software company needs to upgrade a critical web application. The application currently runs on a single Amazon EC2 instance that the company hosts in a public subnet. The EC2 instance runs a MySQL database. The application's DNS records are published in an Amazon Route 53 zone.
A solutions architect must reconfigure the application to be scalable and highly available. The solutions architect must also reduce MySQL read latency.
Which combination of solutions will meet these requirements? (Choose two.)
A. Launch a second EC2 instance in a second AWS Region. Use a Route 53 failover routing policy to redirect the traffic to the second EC2 instance.
B. Create and configure an Auto Scaling group to launch private EC2 instances in multiple Availability Zones. Add the instances to a target group behind a new Application Load Balancer.
C. Migrate the database to an Amazon Aurora MySQL cluster. Create the primary DB instance and reader DB instance in separate Availability Zones.
D. Create and configure an Auto Scaling group to launch private EC2 instances in multiple AWS Regions. Add the instances to a target group behind a new Application Load Balancer.
E. Migrate the database to an Amazon Aurora MySQL cluster with cross-Region read replicas.
Show Answer
Correct Answer: B, C
Explanation: The application must be scalable and highly available, and MySQL read latency must be reduced.
B is correct because placing EC2 instances in an Auto Scaling group across multiple Availability Zones behind an Application Load Balancer provides horizontal scalability and high availability within a Region.
C is correct because migrating to an Amazon Aurora MySQL cluster with reader instances in separate Availability Zones provides built-in high availability and allows read traffic to be served by read replicas, reducing MySQL read latency.
The other options focus on cross-Region disaster recovery, which is not required by the question and does not directly address scalability or read-latency reduction.
Question 111
A finance company uses an on-premises search application to collect streaming data from various producers. The application provides real-time updates to search and visualization features.
The company is planning to migrate to AWS and wants to use an AWS native solution.
Which solution will meet these requirements?
A. Use Amazon EC2 instances to ingest and process the data streams to Amazon S3 buckets tor storage. Use Amazon Athena to search the data. Use Amazon Managed Grafana to create visualizations.
B. Use Amazon EMR to ingest and process the data streams to Amazon Redshift for storage. Use Amazon Redshift Spectrum to search the data. Use Amazon QuickSight to create visualizations.
C. Use Amazon Elastic Kubernetes Service (Amazon EKS) to ingest and process the data streams to Amazon DynamoDB for storage. Use Amazon CloudWatch to create graphical dashboards to search and visualize the data.
D. Use Amazon Kinesis Data Streams to ingest and process the data streams to Amazon OpenSearch Service. Use OpenSearch Service to search the data. Use Amazon QuickSight to create visualizations.
Show Answer
Correct Answer: D
Explanation: The requirement is for an AWS-native, real-time streaming, search, and visualization solution. Amazon Kinesis Data Streams is purpose-built for real-time ingestion from multiple producers. Amazon OpenSearch Service provides near real-time indexing and search capabilities, replacing an on-premises search engine. Amazon QuickSight integrates with OpenSearch to deliver dashboards and visualizations. The other options rely on batch-oriented analytics (Athena, Redshift), non-search-optimized storage, or services not designed for real-time search use cases.
Question 112
A solutions architect is designing an application that helps users fill out and submit registration forms. The solutions architect plans to use a two-tier architecture that includes a web application server tier and a worker tier.
The application needs to process submitted forms quickly. The application needs to process each form exactly once. The solution must ensure that no data is lost.
Which solution will meet these requirements?
A. Use an Amazon Simple Queue Service (Amazon SQS) FIFO queue between the web application server tier and the worker tier to store and forward form data.
B. Use an Amazon API Gateway HTTP API between the web application server tier and the worker tier to store and forward form data.
C. Use an Amazon Simple Queue Service (Amazon SQS) standard queue between the web application server tier and the worker tier to store and forward form data.
D. Use an AWS Step Functions workflow. Create a synchronous workflow between the web application server tier and the worker tier that stores and forwards form data.
Show Answer
Correct Answer: A
Explanation: The application requires fast processing, exactly-once handling of each form, and no data loss between tiers. An Amazon SQS FIFO queue provides durable message storage, decouples the web and worker tiers, and supports exactly-once processing through message deduplication and ordered delivery within a message group. Standard SQS queues can deliver messages more than once, API Gateway does not provide durable queuing, and Step Functions are not designed as a high-throughput buffering mechanism between tiers. Therefore, using an SQS FIFO queue best meets all requirements.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.