A company runs all its business applications in the AWS Cloud. The company uses AWS Organizations to manage multiple AWS accounts.
A solutions architect needs to review all permissions that are granted to IAM users to determine which IAM users have more permissions than required.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Use Network Access Analyzer to review all access permissions in the company's AWS accounts.
B. Create an AWS CloudWatch alarm that activates when an IAM user creates or modifies resources in an AWS account.
C. Use AWS Identity and Access Management (IAM) Access Analyzer to review all the company’s resources and accounts.
D. Use Amazon Inspector to find vulnerabilities in existing IAM policies.
Show Answer
Correct Answer: C
Explanation: IAM Access Analyzer helps identify unused and excessive permissions through policy analysis and provides organization-wide visibility across AWS Organizations with minimal administrative overhead. Network Access Analyzer analyzes network paths, CloudWatch alarms do not assess least privilege, and Amazon Inspector does not review IAM policies for excessive permissions.
Question 102
A company runs an application that stores and shares photos. Users upload the photos to an Amazon S3 bucket. Every day, users upload approximately 150 photos. The company wants to design a solution that creates a thumbnail of each new photo and stores the thumbnail in a second S3 bucket.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an Amazon EventBridge scheduled rule to invoke a script every minute on a long-running Amazon EMR cluster. Configure the script to generate thumbnails for the photos that do not have thumbnails. Configure the script to upload the thumbnails to the second S3 bucket.
B. Configure an Amazon EventBridge scheduled rule to invoke a script every minute on a memory-optimized Amazon EC2 instance that is always on. Configure the script to generate thumbnails for the photos that do not have thumbnails. Configure the script to upload the thumbnails to the second S3 bucket.
C. Configure an S3 event notification to invoke an AWS Lambda function each time a user uploads a new photo to the application. Configure the Lambda function to generate a thumbnail and to upload the thumbnail to the second S3 bucket.
D. Configure S3 Storage Lens to invoke an AWS Lambda function each time a user uploads a new photo to the application. Configure the Lambda function to generate a thumbnail and to upload the thumbnail to a second S3 bucket.
Show Answer
Correct Answer: C
Explanation: Amazon S3 event notifications can directly invoke an AWS Lambda function whenever a new object is uploaded. Lambda can generate the thumbnail and store it in a second S3 bucket. This is event-driven, serverless, and highly cost-effective for a workload of only about 150 uploads per day. The EMR and always-on EC2 options incur unnecessary continuous compute costs, and S3 Storage Lens is an analytics feature, not an event source for object uploads.
Question 103
A company hosts its multi-tier, public web application in the AWS Cloud. The web application runs on Amazon EC2 instances, and its database runs on Amazon RDS. The company is anticipating a large increase in sales during an upcoming holiday weekend. A solutions architect needs to build a solution to analyze the performance of the web application with a granularity of no more than 2 minutes.
What should the solutions architect do to meet this requirement?
A. Send Amazon CloudWatch logs to Amazon Redshift. Use Amazon QuickS ght to perform further analysis.
B. Enable detailed monitoring on all EC2 instances. Use Amazon CloudWatch metrics to perform further analysis.
C. Create an AWS Lambda function to fetch EC2 logs from Amazon CloudWatch Logs. Use Amazon CloudWatch metrics to perform further analysis.
D. Send EC2 logs to Amazon S3. Use Amazon Redshift to fetch logs from the S3 bucket to process raw data for further analysis with Amazon QuickSight.
Show Answer
Correct Answer: B
Explanation: EC2 basic monitoring publishes CloudWatch metrics every 5 minutes, which does not meet the required granularity of no more than 2 minutes. Enabling detailed monitoring publishes EC2 metrics at 1-minute intervals, satisfying the requirement. CloudWatch metrics are the appropriate source for performance analysis. The other options focus on logs and analytics pipelines rather than providing the required near-real-time performance metrics.
Question 104
A company runs a self-managed Microsoft SQL Server on Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS). Daily snapshots are taken of the EBS volumes.
Recently, all the company’s EBS snapshots were accidentally deleted while running a snapshot cleaning script that deletes all expired EBS snapshots. A solutions architect needs to update the architecture to prevent data loss without retaining EBS snapshots indefinitely.
Which solution will meet these requirements with the LEAST development effort?
A. Change the IAM policy of the user to deny EBS snapshot deletion.
B. Copy the EBS snapshots to another AWS Region after completing the snapshots daily.
C. Create a 7-day EBS snapshot retention rule in Recycle Bin and apply the rule for all snapshots.
D. Copy EBS snapshots to Amazon S3 Standard-Infrequent Access (S3 Standard-IA).
Show Answer
Correct Answer: C
Explanation: Amazon EBS Recycle Bin provides a retention window for deleted EBS snapshots. If snapshots are accidentally deleted, they are retained for the configured period and can be restored, preventing data loss without keeping snapshots indefinitely. Denying deletion prevents legitimate cleanup, copying to another Region can also be deleted by faulty automation if applied there and adds cost/complexity, and EBS snapshots cannot simply be copied to S3 Standard-IA.
Question 105
A company hosts an application on AWS. The application gives users the ability to upload photos and store the photos in an Amazon S3 bucket. The company wants to use Amazon CloudFront and a custom domain name to upload the photo files to the S3 bucket in the eu-west-1 Region.
Which solution will meet these requirements? (Choose two.)
A. Use AWS Certificate Manager (ACM) to create a public certificate in the us-east-1 Region. Use the certificate in CloudFront.
B. Use AWS Certificate Manager (ACM) to create a public certificate in eu-west-1. Use the certificate in CloudFront.
C. Configure Amazon S3 to allow uploads from CloudFront. Configure S3 Transfer Acceleration.
D. Configure Amazon S3 to allow uploads from CloudFront origin access control (OAC).
E. Configure Amazon S3 to allow uploads from CloudFront. Configure an Amazon S3 website endpoint.
Show Answer
Correct Answer: A, D
Explanation: CloudFront requires ACM certificates for viewer HTTPS with custom domain names to be in us-east-1, regardless of the origin Region. To securely restrict S3 access so requests come through CloudFront, use Origin Access Control (OAC) with the S3 bucket policy. Certificates in eu-west-1 cannot be attached to CloudFront for viewer TLS. S3 website endpoints are for static website hosting and are not appropriate here.
Question 106
A company wants to move its application to a serverless solution. The serverless solution needs to analyze existing data and new data by using SQL. The company stores the data in an Amazon S3 bucket. The data must be encrypted at rest and replicated to a different AWS Region.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a new S3 bucket that uses server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon Athena to query the data.
B. Create a new S3 bucket that uses server-side encryption with Amazon S3 managed keys (SSE-S3). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon RDS to query the data.
C. Configure Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3). Use Amazon Athena to query the data.
D. Configure S3 Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use Amazon RDS to query the data.
Show Answer
Correct Answer: C
Explanation: Amazon Athena is the serverless SQL query service for data in Amazon S3. Amazon RDS is not serverless in the context of the requirement. For encryption at rest, SSE-S3 satisfies the stated requirement with less operational overhead than managing KMS keys. Cross-Region Replication can be configured on the existing bucket, avoiding unnecessary migration to a new bucket.
Question 107
A solutions architect needs to connect a company's corporate network to its VPC to allow on-premises access to its AWS resources. The solution must provide encryption of all traffic between the corporate network and the VPC at the network layer and the session layer. The solution also must provide security controls to prevent unrestricted access between AWS and the on-premises systems.
Which solution meets these requirements?
A. Configure AWS Direct Connect to connect to the VPC. Configure the VPC route tables to allow and deny traffic between AWS and on premises as required.
B. Create an IAM policy to allow access to the AWS Management Console only from a defined set of corporate IP addresses. Restrict user access based on job responsibility by using an IAM policy and roles.
C. Configure AWS Site-to-Site VPN to connect to the VPConfigure route table entries to direct traffic from on premises to the VPConfigure instance security groups and network ACLs to allow only required traffic from on premises.
D. Configure AWS Transit Gateway to connect to the VPC. Configure route table entries to direct traffic from on premises to the VPC. Configure instance security groups and network ACLs to allow only required traffic from on premises.
Show Answer
Correct Answer: C
Explanation: AWS Site-to-Site VPN uses IPsec to encrypt traffic between the on-premises network and the VPC, satisfying the network-layer encryption requirement. Application sessions can additionally use TLS/SSL at the session layer, so traffic can be protected at both layers. Route tables, security groups, and network ACLs provide the required controls to restrict access between AWS and on-premises systems. Direct Connect alone does not provide encryption, IAM policies do not address network connectivity, and Transit Gateway is a routing hub rather than an encryption mechanism.
Question 108
A company has a multi-tier web application. The application's internal service components are deployed on Amazon EC2 instances. The internal service components need to access third-party software as a service (SaaS) APIs that are hosted on AWS.
The company needs to provide secure and private connectivity from the application's internal services to the third-party SaaS application. The company needs to ensure that there is minimal public internet exposure.
Which solution will meet these requirements?
A. Implement an AWS Site-to-Site VPN to establish a secure connection with the third-party SaaS provider.
B. Deploy AWS Transit Gateway to manage and route traffic between the application's VPC and the third-party SaaS provider.
C. Configure AWS PrivateLink to allow only outbound traffic from the VPC without enabling the third-party SaaS provider to establish.
D. Use AWS PrivateLink to create a private connection between the application's VPC and the third-party SaaS provider.
Show Answer
Correct Answer: D
Explanation: AWS PrivateLink is the AWS service designed to provide private connectivity from a consumer VPC to a supported SaaS provider or endpoint service over the AWS network, avoiding exposure to the public internet. It provides client-initiated, unidirectional access to the service. Option C is incorrect because it describes behavior as if it were a distinct configuration choice; PrivateLink already inherently prevents the service provider from initiating connections back to the consumer VPC, so the correct architectural solution is simply to use AWS PrivateLink to create the private connection.
Question 109
A company wants to replicate existing and ongoing data changes from an on-premises Oracle database to Amazon RDS for Oracle. The amount of data to replicate varies throughout each day. The company wants to use AWS Database Migration Service (AWS DMS) for data replication. The solution must allocate only the capacity that the replication instance requires.
Which solution will meet these requirements?
A. Configure the AWS DMS replication instance with a Multi-AZ deployment to provision instances across multiple Availability Zones.
B. Create an AWS DMS Serverless replication task to analyze and replicate the data while provisioning the required capacity.
C. Use Amazon EC2 Auto Scaling to scale the size of the AWS DMS replication instance up or down based on the amount of data toreplicate.
D. Provision AWS DMS replication capacity by using Amazon Elastic Container Service (Amazon ECS) with an AWS Fargate launch type to analyze and replicate the data while provisioning the required capacity.
Show Answer
Correct Answer: B
Explanation: AWS DMS Serverless automatically provisions and scales the replication capacity based on workload, making it suitable for variable replication volumes while allocating only the capacity required. Multi-AZ improves availability but does not provide elastic capacity. EC2 Auto Scaling cannot scale DMS replication instances, and DMS replication capacity is not provisioned through ECS/Fargate.
Question 110
A software company needs to upgrade a critical web application. The application currently runs on a single Amazon EC2 instance that the company hosts in a public subnet. The EC2 instance runs a MySQL database. The application's DNS records are published in an Amazon Route 53 zone.
A solutions architect must reconfigure the application to be scalable and highly available. The solutions architect must also reduce MySQL read latency.
Which combination of solutions will meet these requirements? (Choose two.)
A. Launch a second EC2 instance in a second AWS Region. Use a Route 53 failover routing policy to redirect the traffic to the second EC2 instance.
B. Create and configure an Auto Scaling group to launch private EC2 instances in multiple Availability Zones. Add the instances to a target group behind a new Application Load Balancer.
C. Migrate the database to an Amazon Aurora MySQL cluster. Create the primary DB instance and reader DB instance in separate Availability Zones.
D. Create and configure an Auto Scaling group to launch private EC2 instances in multiple AWS Regions. Add the instances to a target group behind a new Application Load Balancer.
E. Migrate the database to an Amazon Aurora MySQL cluster with cross-Region read replicas.
Show Answer
Correct Answer: B, C
Explanation: Use an Auto Scaling group across multiple Availability Zones behind an Application Load Balancer to provide horizontal scalability and high availability for the web tier. Migrate MySQL to an Amazon Aurora MySQL cluster with a writer and a reader instance in separate Availability Zones to provide high availability and reduce read latency through read scaling. The multi-Region options are primarily for disaster recovery and are not required by the stated requirements; Auto Scaling groups do not span Regions.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.