A company wants to improve the availability and performance of its hybrid application. The application consists of a stateful TCP-based workload hosted on Amazon EC2 instances in different AWS Regions and a stateless UDP-based workload hosted on premises.
Which combination of actions should a solutions architect take to improve availability and performance? (Choose two.)
A. Create an accelerator using AWS Global Accelerator. Add the load balancers as endpoints.
B. Create an Amazon CloudFront distribution with an origin that uses Amazon Route 53 latency-based routing to route requests to the load balancers.
C. Configure two Application Load Balancers in each Region. The first will route to the EC2 endpoints, and the second will route to the on-premises endpoints.
D. Configure a Network Load Balancer in each Region to address the EC2 endpoints. Configure a Network Load Balancer in each Region that routes to the on-premises endpoints.
E. Configure a Network Load Balancer in each Region to address the EC2 endpoints. Configure an Application Load Balancer in each Region that routes to the on-premises endpoints.
Show Answer
Correct Answer: A, D
Explanation: The solution must handle a stateful TCP workload across multiple AWS Regions and a stateless UDP workload on premises while improving availability and performance.
• AWS Global Accelerator (A) is designed for non-HTTP/S traffic (TCP and UDP). It provides static anycast IPs, intelligent routing over the AWS global network, and fast regional failover, which improves both availability and performance for hybrid, multi-Region applications.
• Network Load Balancer (D) is the correct load balancer for both TCP and UDP workloads. NLB operates at Layer 4, supports high performance and static IPs, and can front EC2-based TCP workloads as well as route traffic to on‑premises UDP endpoints via IP targets. Deploying NLBs in multiple Regions aligns with Global Accelerator endpoints and ensures regional resilience.
The other options are incorrect because:
• CloudFront (B) and Application Load Balancers (C, E) are HTTP/HTTPS–focused and do not support UDP or generic TCP workloads.
• ALB cannot handle UDP traffic or non‑HTTP protocols.
Question 114
A company is migrating an application from an on-premises environment to AWS. The application will store sensitive data in Amazon S3. The company must encrypt the data before storing the data in Amazon S3.
Which solution will meet these requirements?
A. Encrypt the data by using client-side encryption with customer managed keys.
B. Encrypt the data by using server-side encryption with AWS KMS keys (SSE-KMS).
C. Encrypt the data by using server-side encryption with customer-provided keys (SSE-C).
D. Encrypt the data by using client-side encryption with Amazon S3 managed keys.
Show Answer
Correct Answer: A
Explanation: The requirement states that the data must be encrypted **before** it is stored in Amazon S3. This explicitly points to client-side encryption, where encryption happens in the application prior to uploading the data to S3. Server-side options such as SSE-KMS or SSE-C encrypt data only after it reaches S3, so they do not meet the requirement. Client-side encryption with customer-managed keys ensures the company controls the encryption keys and that data is already encrypted when sent to AWS.
Question 115
A company is migrating its databases to Amazon RDS for PostgreSQL. The company is migrating its applications to Amazon EC2 instances. The company wants to optimize costs for long-running workloads.
Which solution will meet this requirement MOST cost-effectively?
A. Use On-Demand Instances for the Amazon RDS for PostgreSQL workloads. Purchase a 1 year Compute Savings Plan with the No Upfront option for the EC2 instances.
B. Purchase Reserved Instances for a 1 year term with the No Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 1 year EC2 Instance Savings Plan with the No Upfront option for the EC2 instances.
C. Purchase Reserved Instances for a 1 year term with the Partial Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 1 year EC2 Instance Savings Plan with the Partial Upfront option for the EC2 instances.
D. Purchase Reserved Instances for a 3 year term with the All Upfront option for the Amazon RDS for PostgreSQL workloads. Purchase a 3 year EC2 Instance Savings Plan with the All Upfront option for the EC2 instances.
Show Answer
Correct Answer: D
Explanation: The requirement is to optimize costs for long‑running, predictable workloads. The greatest cost savings on AWS come from the longest commitment and highest upfront payment. A 3‑year term provides more discount than a 1‑year term, and All Upfront provides more savings than Partial or No Upfront. Amazon RDS supports Reserved Instances, and EC2 workloads are best optimized with EC2 Instance Savings Plans. Therefore, purchasing 3‑year RDS Reserved Instances with All Upfront payment and a 3‑year EC2 Instance Savings Plan with All Upfront payment is the MOST cost‑effective solution.
Question 116
A company that runs its application on AWS uses an Amazon Aurora DB cluster as its database. During peak usage hours when multiple users access and read the data, the monitoring system shows degradation of database performance for the write queries. The company wants to increase the scalability of the application to meet peak usage demands.
Which solution will meet these requirements MOST cost-effectively?
A. Create a second Aurora DB cluster. Configure a copy job to replicate the users’ data to the new database. Update the application to use the second database to read the data.
B. Create an Amazon DynamoDB Accelerator (DAX) cluster in front of the existing Aurora DB cluster. Update the application to use the DAX cluster for read-only queries. Write data directly to the Aurora DB cluster.
C. Create an Aurora read replica in the existing Aurora DB cluster. Update the application to use the replica endpoint for read-only queries and to use the cluster endpoint for write queries.
D. Create an Amazon Redshift cluster. Copy the users' data to the Redshift cluster. Update the application to connect to the Redshift cluster and to perform read-only queries on the Redshift cluster.
Show Answer
Correct Answer: C
Explanation: The performance issue occurs because heavy read traffic is contending with write operations on the Aurora writer instance. The most cost‑effective and native way to scale reads in Amazon Aurora is to add Aurora read replicas. By directing read‑only queries to the reader endpoint and keeping writes on the cluster (writer) endpoint, read load is offloaded from the writer, improving write performance without architectural changes. Other options are either incompatible (DAX works only with DynamoDB), overly complex and costly (separate cluster or Redshift), or not designed for transactional workloads.
Question 117
A company has primary and secondary data centers that are 500 miles (804.7 km) apart and interconnected with high-speed fiber-optic cable. The company needs a highly available and secure network connection between its data centers and a VPC on AWS for a mission-critical workload. A solutions architect must choose a connection solution that provides maximum resiliency.
Which solution meets these requirements?
A. Two AWS Direct Connect connections from the primary data center terminating at two Direct Connect locations on two separate devices
B. A single AWS Direct Connect connection from each of the primary and secondary data centers terminating at one Direct Connect location on the same device
C. Two AWS Direct Connect connections from each of the primary and secondary data centers terminating at two Direct Connect locations on two separate devices
D. A single AWS Direct Connect connection from each of the primary and secondary data centers terminating at one Direct Connect location on two separate devices
Show Answer
Correct Answer: C
Explanation: Maximum resiliency requires redundancy across data centers, Direct Connect locations, and physical devices. Option C provides two Direct Connect connections from each data center, terminates them at two separate Direct Connect locations, and uses separate devices, eliminating single points of failure at the link, location, and device levels. This aligns with AWS best practices for highly available, mission-critical connectivity.
Question 118
A company plans to rehost an application to Amazon EC2 instances that use Amazon Elastic Block Store (Amazon EBS) as the attached storage.
A solutions architect must design a solution to ensure that all newly created Amazon EBS volumes are encrypted by default. The solution must also prevent the creation of unencrypted EBS volumes.
Which solution will meet these requirements?
A. Configure the EC2 account attributes to always encrypt new EBS volumes.
B. Use AWS Config. Configure the encrypted-volumes identifier. Apply the default AWS Key Management Service (AWS KMS) key.
C. Configure AWS Systems Manager to create encrypted copies of the EBS volumes. Reconfigure the EC2 instances to use the encrypted volumes.
D. Create a customer managed key in AWS Key Management Service (AWS KMS). Configure AWS Migration Hub to use the key when the company migrates workloads.
Show Answer
Correct Answer: A
Explanation: Enabling EBS encryption by default at the EC2 account/Region level ensures that every newly created EBS volume is automatically encrypted using an AWS-managed or customer-managed KMS key. When this setting is enabled, AWS prevents the creation of unencrypted EBS volumes, fully satisfying both requirements. AWS Config can only detect and flag noncompliance after creation, not prevent it, and the other options do not enforce default encryption.
Question 119
A company is migrating five on-premises applications to VPCs in the AWS Cloud. Each application is currently deployed in isolated virtual networks on premises and should be deployed similarly in the AWS Cloud. The applications need to reach a shared services VPC. All the applications must be able to communicate with each other.
If the migration is successful, the company will repeat the migration process for more than 100 applications.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Deploy software VPN tunnels between the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets to the shared services VPC.
B. Deploy VPC peering connections between the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets to the shared services VPC through the peering connection.
C. Deploy an AWS Direct Connect connection between the application VPCs and the shared services VPAdd routes from the application VPCs in their subnets to the shared services VPC and the applications VPCs. Add routes from the shared services VPC subnets to the applications VPCs.
D. Deploy a transit gateway with associations between the transit gateway and the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets and the application VPCs to the shared services VPC through the transit gateway.
Show Answer
Correct Answer: D
Explanation: The requirements call for isolated VPCs per application, full inter-VPC communication, access to a shared services VPC, and the ability to scale beyond 100 applications with the least administrative overhead. AWS Transit Gateway provides a hub-and-spoke model that centralizes routing and connectivity, allowing all application VPCs and the shared services VPC to communicate through a single managed gateway. This avoids the exponential growth and management complexity of VPC peering or VPN tunnels and is far more appropriate than Direct Connect for VPC-to-VPC connectivity within AWS.
Question 120
A company wants to use Amazon Elastic Container Service (Amazon ECS) to run its on-premises application in a hybrid environment. The application currently runs on containers on premises.
The company needs a single container solution that can scale in an on-premises, hybrid, or cloud environment. The company must run new application containers in the AWS Cloud and must use a load balancer for HTTP traffic.
Which combination of actions will meet these requirements? (Choose two.)
A. Set up an ECS cluster that uses the AWS Fargate launch type for the cloud application containers. Use an Amazon ECS Anywhere external launch type for the on-premises application containers.
B. Set up an Application Load Balancer for cloud ECS services.
C. Set up a Network Load Balancer for cloud ECS services.
D. Set up an ECS cluster that uses the AWS Fargate launch type. Use Fargate for the cloud application containers and the on-premises application containers.
E. Set up an ECS cluster that uses the Amazon EC2 launch type for the cloud application containers. Use Amazon ECS Anywhere with an AWS Fargate launch type for the on-premises application containers.
Show Answer
Correct Answer: A, B
Explanation: Amazon ECS Anywhere enables running the same ECS-managed containers on on‑premises infrastructure, while AWS Fargate is the appropriate launch type for running new containers in the AWS Cloud without managing servers. For HTTP traffic, an Application Load Balancer is required because it operates at Layer 7 and integrates natively with ECS services. This combination provides a single, scalable container solution across on‑premises, hybrid, and cloud environments.
Question 121
A company runs a critical data analysis job each week before the first day of the work week. The job requires at least 1 hour to complete the analysis. The job is stateful and cannot tolerate interruptions. The company needs a solution to run the job on AWS.
Which solution will meet these requirements?
A. Create a container for the job. Schedule the job to run as an AWS Fargate task on an Amazon Elastic Container Service (Amazon ECS) cluster by using Amazon EventBridge Scheduler.
B. Configure the job to run in an AWS Lambda function. Create a scheduled rule in Amazon EventBridge to invoke the Lambda function.
C. Configure an Auto Scaling group of Amazon EC2 Spot Instances that run Amazon Linux. Configure a crontab entry on the instances to run the analysis.
D. Configure an AWS DataSync task to run the job. Configure a cron expression to run the task on a schedule.
Show Answer
Correct Answer: A
Explanation: The job runs for at least 1 hour, is stateful, and cannot tolerate interruptions. AWS Lambda cannot run longer than 15 minutes, so B is invalid. EC2 Spot Instances can be interrupted at any time, which violates the no-interruption requirement, so C is invalid. AWS DataSync is designed for data transfer, not for running custom analysis jobs, so D is invalid. Running the job as an ECS task on AWS Fargate allows long-running, non-interrupted execution, and Amazon EventBridge Scheduler can reliably trigger it on a weekly schedule, meeting all requirements.
Question 122
A company is implementing a shared storage solution for a media application that the company hosts on AWS. The company needs the ability to use SMB clients to access stored data.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Create an AWS Storage Gateway Volume Gateway. Create a file share that uses the required client protocol. Connect the application server to the file share.
B. Create an AWS Storage Gateway Tape Gateway. Configure tapes to use Amazon S3. Connect the application server to the Tape Gateway.
C. Create an Amazon EC2 Windows instance. Install and configure a Windows file share role on the instance. Connect the application server to the file share.
D. Create an Amazon FSx for Windows File Server file system. Connect the application server to the file system.
Show Answer
Correct Answer: D
Explanation: The requirement is shared storage accessible via SMB with the least administrative overhead. Amazon FSx for Windows File Server is a fully managed AWS service that natively supports the SMB protocol, integrates with Windows-based workloads, and handles patching, backups, scaling, and high availability automatically. Storage Gateway options do not fit the use case (Volume Gateway does not provide SMB file shares; Tape Gateway is for backup), and running a Windows file server on EC2 would require significantly more manual administration. Therefore, FSx for Windows File Server is the best choice.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.