A company has a custom application with embedded credentials that retrieves information from a database in an Amazon RDS for MySQL DB cluster. The company needs to make the application more secure with minimal programming effort. The company has created credentials on the RDS for MySQL database for the application user.
Which solution will meet these requirements?
A. Store the credentials in AWS Key Management Service (AWS KMS). Create keys in AWS KMS. Configure the application to load the database credentials from AWS KMS. Enable automatic key rotation
B. Store the credentials in encrypted local storage. Configure the application to load the database credentials from the local storage. Set up a credentials rotation schedule by creating a cron job.
C. Store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Set up a credentials rotation schedule by creating an AWS Lambda function for Secrets Manager.
D. Store the credentials in AWS Systems Manager Parameter Store. Configure the application to load the database credentials from Parameter Store. Set up a credentials rotation schedule in the RDS for MySQL database by using Parameter Store.
Show Answer
Correct Answer: C
Explanation: AWS Secrets Manager is purpose-built for storing, retrieving, and rotating application credentials. It integrates with Amazon RDS and supports automatic credential rotation using AWS Lambda with minimal application changes. AWS KMS manages encryption keys rather than storing secrets, local storage is less secure and requires manual rotation, and Systems Manager Parameter Store does not provide native RDS credential rotation like Secrets Manager.
Question 91
An ecommerce company runs several internal applications in multiple AWS accounts. The company uses AWS Organizations to manage its AWS accounts.
A security appliance in the company's networking account must inspect interactions between applications across AWS accounts.
Which solution will meet these requirements?
A. Deploy a Network Load Balancer (NLB) in the networking account to send traffic to the security appliance. Configure the application accounts to send traffic to the NLB by using an interface VPC endpoint in the application accounts.
B. Deploy an Application Load Balancer (ALB) in the application accounts to send traffic directly to the security appliance.
C. Deploy a Gateway Load Balancer (GWLB) in the networking account to send traffic to the security appliance. Configure the application accounts to send traffic to the GWLB by using an interface GWLB endpoint in the application accounts.
D. Deploy an interface VPC endpoint in the application accounts to send traffic directly to the security appliance.
Show Answer
Correct Answer: C
Explanation: Gateway Load Balancer (GWLB) is purpose-built to deploy, scale, and insert third-party virtual network appliances such as firewalls and intrusion detection/inspection devices transparently into traffic flows. For centralized inspection across multiple AWS accounts, deploy the GWLB in the networking account with the security appliance as targets, and use Gateway Load Balancer endpoints (GWLBE) in the application accounts to steer traffic through the appliance. NLB and ALB do not provide transparent inline appliance insertion, and interface VPC endpoints alone cannot send traffic directly to an appliance.
Question 92
A company is migrating its data processing application to the AWS Cloud. The application processes several short-lived batch jobs that cannot be disrupted. Data is generated after each batch job is completed. The data is accessed for 30 days and retained for 2 years.
The company wants to keep the cost of running the application in the AWS Cloud as low as possible.
Which solution will meet these requirements?
A. Migrate the data processing application to Amazon EC2 Spot Instances. Store the data in Amazon S3 Standard. Move the data to Amazon S3 Glacier Instant. Retrieval after 30 days. Set an expiration to delete the data after 2 years.
B. Migrate the data processing application to Amazon EC2 On-Demand Instances. Store the data in Amazon S3 Glacier Instant Retrieval. Move the data to S3 Glacier Deep Archive after 30 days. Set an expiration to delete the data after 2 years.
C. Deploy Amazon EC2 Spot Instances to run the batch jobs. Store the data in Amazon S3 Standard. Move the data to Amazon S3 Glacier Flexible Retrieval after 30 days. Set an expiration to delete the data after 2 years.
D. Deploy Amazon EC2 On-Demand Instances to run the batch jobs. Store the data in Amazon S3 Standard. Move the data to Amazon S3 Glacier Deep Archive after 30 days. Set an expiration to delete the data after 2 years.
Show Answer
Correct Answer: D
Explanation: The batch jobs cannot be disrupted, so EC2 On-Demand Instances are required instead of Spot Instances. The data is actively accessed for the first 30 days, making Amazon S3 Standard the appropriate storage class. After that, the data only needs to be retained for up to 2 years at the lowest cost, so transitioning it to S3 Glacier Deep Archive minimizes storage costs. Finally, configure an S3 Lifecycle expiration rule to delete the data after 2 years.
Question 93
A company has an internal application that runs on Amazon EC2 instances in an Auto Scaling group. The EC2 instances are compute optimized and use Amazon Elastic Block Store (Amazon EBS) volumes.
The company wants to identify cost optimizations across the EC2 instances, the Auto Scaling group, and the EBS volumes.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a new AWS Cost and Usage Report. Search the report for cost recommendations for the EC2 instances the Auto Scaling group, and the EBS volumes.
B. Create new Amazon CloudWatch billing alerts. Check the alert statuses for cost recommendations for the EC2 instances, the Auto Scaling group, and the EBS volumes.
C. Configure AWS Compute Optimizer for cost recommendations for the EC2 instances, the Auto Scaling group and the EBS volumes.
D. Configure AWS Compute Optimizer for cost recommendations for the EC2 instances. Create a new AWS Cost and Usage Report. Search the report for cost recommendations for the Auto Scaling group and the EBS volumes.
Show Answer
Correct Answer: C
Explanation: AWS Compute Optimizer provides rightsizing and cost optimization recommendations for supported EC2 instances, Auto Scaling groups, and EBS volumes based on utilization metrics. AWS Cost and Usage Reports provide detailed billing and usage data but do not generate optimization recommendations, and CloudWatch billing alerts only notify about spending thresholds rather than recommending optimizations.
Question 94
A company runs thousands of AWS Lambda functions. The company needs a solution to securely store sensitive information that all the Lambda functions use. The solution must also manage the automatic rotation of the sensitive information.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
A. Create HTTP security headers by using Lambda@Edge to retrieve and create sensitive information
B. Create a Lambda layer that retrieves sensitive information
C. Store sensitive information in AWS Secrets Manager
D. Store sensitive information in AWS Systems Manager Parameter Store
E. Create a Lambda consumer with dedicated throughput to retrieve sensitive information and create environmental variables
Show Answer
Correct Answer: B, C
Explanation: AWS Secrets Manager is the AWS service designed to securely store secrets and provides built-in automatic rotation. To minimize operational overhead across thousands of Lambda functions, place the secret-retrieval code in a shared Lambda layer so all functions reuse the same implementation instead of duplicating logic. Parameter Store can store secure strings but does not provide the same built-in automatic secret rotation capability as Secrets Manager. Lambda@Edge and the dedicated consumer/environment variable options do not fit the stated requirements.
Question 95
A company has multiple Microsoft Windows SMB file servers and Linux NFS file servers for file sharing in an on-premises environment. As part of the company's AWS migration plan, the company wants to consolidate the file servers in the AWS Cloud.
The company needs a managed AWS storage service that supports both NFS and SMB access. The solution must be able to share between protocols. The solution must have redundancy at the Availability Zone level.
Which solution will meet these requirements?
A. Use Amazon FSx for NetApp ONTAP for storage. Configure multi-protocol access.
B. Create two Amazon EC2 instances. Use one EC2 instance for Windows SMB file server access and one EC2 instance for Linux NFS file server access.
C. Use Amazon FSx for NetApp ONTAP for SMB access. Use Amazon FSx for Lustre for NFS access.
D. Use Amazon S3 storage. Access Amazon S3 through an Amazon S3 File Gateway.
Show Answer
Correct Answer: A
Explanation: Amazon FSx for NetApp ONTAP is a managed file storage service that supports simultaneous SMB and NFS multi-protocol access to the same data, enabling sharing between Windows and Linux clients. Its Multi-AZ deployment option provides high availability and redundancy across Availability Zones. The other options either are not managed, do not provide shared multi-protocol access, or do not meet the file service requirements.
Question 96
A company hosts an ecommerce application that stores all data in a single Amazon RDS for MySQL DB instance that is fully managed by AWS. The company needs to mitigate the risk of a single point of failure.
Which solution will meet these requirements with the LEAST implementation effort?
A. Modify the RDS DB instance to use a Multi-AZ deployment. Apply the changes during the next maintenance window.
B. Migrate the current database to a new Amazon DynamoDB Multi-AZ deployment. Use AWS Database Migration Service (AWS DMS) with a heterogeneous migration strategy to migrate the current RDS DB instance to DynamoDB tables.
C. Create a new RDS DB instance in a Multi-AZ deployment. Manually restore the data from the existing RDS DB instance from the most recent snapshot.
D. Configure the DB instance in an Amazon EC2 Auto Scaling group with a minimum group size of three. Use Amazon Route 53 simple routing to distribute requests to all DB instances.
Show Answer
Correct Answer: A
Explanation: Enabling Multi-AZ on the existing Amazon RDS for MySQL instance is the least-effort way to eliminate the single point of failure while keeping the database fully managed. Multi-AZ creates a synchronous standby in another Availability Zone and provides automatic failover without requiring application changes. Migrating to DynamoDB is a major redesign, restoring to a new Multi-AZ instance requires more manual work, and running databases in an EC2 Auto Scaling group is not an appropriate RDS high-availability architecture.
Question 97
A company wants to use an AWS CloudFormation stack for its application in a test environment. The company stores the CloudFormation template in an Amazon S3 bucket that blocks public access. The company wants to grant CloudFormation access to the template in the S3 bucket based on specific user requests to create the test environment. The solution must follow security best practices.
Which solution will meet these requirements?
A. Create a gateway VPC endpoint for Amazon S3. Configure the CloudFormation stack to use the S3 object URL.
B. Create an Amazon API Gateway REST API that has the S3 bucket as the target. Configure the CloudFormation stack to use the API Gateway URL.
C. Create a presigned URL for the template object. Configure the CloudFormation stack to use the presigned URL.
D. Allow public access to the template object in the S3 bucket. Block the public access after the test environment is created.
Show Answer
Correct Answer: C
Explanation: A presigned S3 URL provides time-limited access to a private CloudFormation template without making the bucket or object public. CloudFormation can retrieve the template using the presigned URL when the user requests stack creation. A gateway VPC endpoint does not help because CloudFormation is a managed AWS service, not running inside your VPC. API Gateway is unnecessary for simple template access, and making the object public violates the security requirement.
Question 98
A healthcare company is developing an AWS Lambda function that publishes notifications to an encrypted Amazon Simple Notification Service (Amazon SNS) topic. The notifications contain protected health information (PHI).
The SNS topic uses AWS Key Management Service (AWS KMS) customer managed keys for encryption. The company must ensure that the application has the necessary permissions to publish messages securely to the SNS topic.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a resource policy for the SNS topic that allows the Lambda function to publish messages to the topic.
B. Use server-side encryption with AWS KMS keys (SSE-KMS) for the SNS topic instead of customer managed keys.
C. Create a resource policy for the encryption key that the SNS topic uses that has the necessary AWS KMS permissions.
D. Specify the Lambda function's Amazon Resource Name (ARN) in the SNS topic's resource policy.
E. Associate an Amazon API Gateway HTTP API with the SNS topic to control access to the topic by using API Gateway resource policies.
F. Configure a Lambda execution role that has the necessary IAM permissions to use a customer managed key in AWS KMS.
Show Answer
Correct Answer: A, C, F
Explanation: The Lambda function needs permission to publish to the SNS topic, which can be granted through the SNS topic resource policy (A). Because the topic is encrypted with a customer managed KMS key, the KMS key policy must allow the required use of the key (by SNS and the authorized principal as appropriate), making the KMS key policy/resource policy necessary (C). The Lambda execution role also needs the appropriate IAM permissions to use the customer managed KMS key where required and to interact with the encrypted resource (F). Option D is effectively an implementation detail of A because the Lambda principal would be identified within the SNS topic policy rather than being a separate required step. B changes the stated architecture, and E is unrelated.
Question 100
A company runs its customer-facing web application on containers. The workload uses Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The web application is resource intensive.
The web application needs to be available 24 hours a day, 7 days a week for customers. The company expects the application to experience short bursts of high traffic. The workload must be highly available.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an ECS capacity provider with Fargate. Conduct load testing by using a third-party tool. Rightsize the Fargate tasks in Amazon CloudWatch.
B. Configure an ECS capacity provider with Fargate for steady state and Fargate Spot for burst traffic.
C. Configure an ECS capacity provider with Fargate Spot for steady state and Fargate for burst traffic.
D. Configure an ECS capacity provider with Fargate. Use AWS Compute Optimizer to rightsize the Fargate task.
Show Answer
Correct Answer: B
Explanation: Use ECS capacity providers with standard AWS Fargate for the always-on baseline service and Fargate Spot for additional capacity during traffic bursts. This preserves high availability because the steady-state tasks run on non-interruptible Fargate, while burst capacity can take advantage of lower-cost Spot capacity. Using Spot for the baseline (C) risks interruptions. Options A and D only focus on rightsizing and do not provide the most cost-effective approach for burst traffic. Compute Optimizer can help with sizing, but it does not replace the savings from mixing Fargate and Fargate Spot for elastic scaling.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.