An ecommerce company wants to collect user clickstream data from the company's website for real-time analysis. The website experiences fluctuating traffic patterns throughout the day. The company needs a scalable solution that can adapt to varying levels of traffic.
Which solution will meet these requirements?
A. Use a data stream in Amazon Kinesis Data Streams in on-demand mode to capture the clickstream data. Use AWS Lambda to process the data in real time.
B. Use Amazon Kinesis Data Firehose to capture the clickstream data. Use AWS Glue to process the data in real time.
C. Use Amazon Kinesis Video Streams to capture the clickstream data. Use AWS Glue to process the data in real time.
D. Use Amazon Managed Service for Apache Flink (previously known as Amazon Kinesis Data Analytics) to capture the clickstream data. Use AWS Lambda to process the data in real time.
Show Answer
Correct Answer: A
Explanation: Amazon Kinesis Data Streams is designed for real-time ingestion and processing of streaming data such as clickstreams. Using on-demand mode allows the stream to automatically scale with fluctuating traffic without capacity planning. AWS Lambda can consume records from Kinesis Data Streams and process them in real time. Firehose delivers data in near–real time and AWS Glue is primarily for ETL/streaming jobs rather than low-latency real-time analysis; Kinesis Video Streams is not suitable for clickstream data; and Apache Flink is an analytics/processing service, not a data ingestion service by itself.
Question 134
A company uses a Microsoft SQL Server database. The company's applications are connected to the database. The company wants to migrate to an Amazon Aurora PostgreSQL database with minimal changes to the application code.
Which combination of steps will meet these requirements? (Choose two.)
A. Use the AWS Schema Conversion Tool (AWS SCT) to rewrite the SQL queries in the applications.
B. Enable Babelfish on Aurora PostgreSQL to run the SQL queries from the applications.
C. Migrate the database schema and data by using the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS).
D. Use Amazon RDS Proxy to connect the applications to Aurora PostgreSQL.
E. Use AWS Database Migration Service (AWS DMS) to rewrite the SQL queries in the applications.
Show Answer
Correct Answer: B, C
Explanation: To minimize application code changes when migrating from SQL Server to Aurora PostgreSQL, Babelfish allows Aurora PostgreSQL to understand SQL Server’s T-SQL language and protocol, enabling existing applications to run with little or no modification. In addition, AWS Schema Conversion Tool (SCT) together with AWS Database Migration Service (DMS) is the standard approach to convert the database schema and migrate the data from SQL Server to Aurora PostgreSQL. Other options do not address SQL Server compatibility or do not rewrite application SQL.
Question 135
A company has released a new version of its production application. The company's workload uses Amazon EC2, AWS Lambda, AWS Fargate, and Amazon SageMaker.
The company wants to cost optimize the workload now that usage is at a steady state. The company wants to cover the most services with the fewest savings plans.
Which combination of savings plans will meet these requirements? (Choose two.)
A. Purchase an EC2 Instance Savings Plan for Amazon EC2 and SageMaker.
B. Purchase a Compute Savings Plan for Amazon EC2, Lambda, and SageMaker.
C. Purchase a SageMaker Savings Plan.
D. Purchase a Compute Savings Plan for Lambda, Fargate, and Amazon EC2.
E. Purchase an EC2 Instance Savings Plan for Amazon EC2 and Fargate.
Show Answer
Correct Answer: C, D
Explanation: The goal is to cover the most services with the fewest Savings Plans. A Compute Savings Plan covers Amazon EC2, AWS Lambda, and AWS Fargate, which addresses all general compute services in the workload with a single plan (D). Amazon SageMaker is not covered by Compute or EC2 Instance Savings Plans, so a dedicated SageMaker Savings Plan is required (C). Together, these two plans cover all listed services with minimal overlap.
Question 136
A solutions architect is designing a three-tier web application. The architecture consists of an internet-facing Application Load Balancer (ALB) and a web tier that is hosted on Amazon EC2 instances in private subnets. The application tier with the business logic runs on EC2 instances in private subnets. The database tier consists of Microsoft SQL Server that runs on EC2 instances in private subnets. Security is a high priority for the company.
Which combination of security group configurations should the solutions architect use? (Choose three.)
A. Configure the security group for the web tier to allow inbound HTTPS traffic from the security group for the ALB.
B. Configure the security group for the web tier to allow outbound HTTPS traffic to 0.0.0.0/0.
C. Configure the security group for the database tier to allow inbound Microsoft SQL Server traffic from the security group for the application tier.
D. Configure the security group for the database tier to allow outbound HTTPS traffic and Microsoft SQL Server traffic to the security group for the web tier.
E. Configure the security group for the application tier to allow inbound HTTPS traffic from the security group for the web tier.
F. Configure the security group for the application tier to allow outbound HTTPS traffic and Microsoft SQL Server traffic to the security group for the web tier.
Show Answer
Correct Answer: A, C, E
Explanation: In a three-tier architecture using security groups (which are stateful), you primarily need to allow inbound traffic for each tier from the immediately preceding tier. The ALB must be able to reach the web tier over HTTPS, so the web tier security group should allow inbound HTTPS from the ALB security group (A). The application tier must accept inbound HTTPS traffic from the web tier, so its security group should allow inbound HTTPS from the web tier security group (E). The database tier should allow inbound Microsoft SQL Server traffic only from the application tier security group (C). Outbound rules are unnecessary to specify for return traffic because security groups are stateful, and allowing broader outbound access would reduce security.
Question 137
A company has deployed a multi-account strategy on AWS by using AWS Control Tower. The company has provided individual AWS accounts to each of its developers. The company wants to implement controls to limit AWS resource costs that the developers incur.
Which solution will meet these requirements with the LEAST operational overhead?
A. Instruct each developer to tag all their resources with a tag that has a key of CostCenter and a value of the developer's name. Use the required-tags AWS Config managed rule to check for the tag. Create an AWS Lambda function to terminate resources that do not have the tag. Configure AWS Cost Explorer to send a daily report to each developer to monitor their spending.
B. Use AWS Budgets to establish budgets for each developer account. Set up budget alerts for actual and forecast values to notify developers when they exceed or expect to exceed their assigned budget. Use AWS Budgets actions to apply a DenyAll policy to the developer's IAM role to prevent additional resources from being launched when the assigned budget is reached.
C. Use AWS Cost Explorer to monitor and report on costs for each developer account. Configure Cost Explorer to send a daily report to each developer to monitor their spending. Use AWS Cost Anomaly Detection to detect anomalous spending and provide alerts.
D. Use AWS Service Catalog to allow developers to launch resources within a limited cost range. Create AWS Lambda functions in each AWS account to stop running resources at the end of each work day. Configure the Lambda functions to resume the resources at the start of each work day.
Show Answer
Correct Answer: B
Explanation: AWS Budgets can be centrally managed from the management account in an AWS Control Tower setup and supports budget alerts and automated budget actions. These actions can apply restrictive IAM policies or SCPs when actual or forecasted spend exceeds a defined threshold, directly preventing developers from launching additional resources. This approach enforces hard cost limits with minimal ongoing operational effort compared to tagging enforcement, reporting-only solutions, or custom automation.
Question 138
A company creates dedicated AWS accounts in AWS Organizations for its business units. Recently, an important notification was sent to the root user email address of a business unit account instead of the assigned account owner. The company wants to ensure that all future notifications can be sent to different employees based on the notification categories of billing, operations, or security.
Which solution will meet these requirements MOST securely?
A. Configure each AWS account to use a single email address that the company manages. Ensure that all account owners can access the email account to receive notifications. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
B. Configure each AWS account to use a different email distribution list for each business unit that the company manages. Configure each distribution list with administrator email addresses that can respond to alerts. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
C. Configure each AWS account root user email address to be the individual company managed email address of one person from each business unit. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
D. Configure each AWS account root user to use email aliases that go to a centralized mailbox. Configure alternate contacts for each account by using a single business managed email distribution list each for the billing team, the security team, and the operations team.
Show Answer
Correct Answer: D
Explanation: AWS sends certain critical notifications only to the root user email address, while category-specific notifications (billing, operations, security) can be routed using alternate contacts. The most secure approach is to avoid tying the root email to an individual and instead use centrally managed email aliases that route to a controlled mailbox. Then, configure alternate contacts with business-managed distribution lists for billing, operations, and security so notifications reach the correct teams. Option D uniquely addresses both problems: securing the root email and ensuring category-based notification routing. Options A, B, and C either expose the root email to multiple people or individuals, or fail to properly mitigate the root email notification risk.
Question 139
A company wants to isolate its workloads by creating an AWS account for each workload. The company needs a solution that centrally manages networking components for the workloads. The solution also must create accounts with automatic security controls (guardrails).
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS Control Tower to deploy accounts. Create a networking account that has a VPC with private subnets and public subnets. Use AWS Resource Access Manager (AWS RAM) to share the subnets with the workload accounts.
B. Use AWS Organizations to deploy accounts. Create a networking account that has a VPC with private subnets and public subnets. Use AWS Resource Access Manager (AWS RAM) to share the subnets with the workload accounts.
C. Use AWS Control Tower to deploy accounts. Deploy a VPC in each workload account. Configure each VPC to route through an inspection VPC by using a transit gateway attachment.
D. Use AWS Organizations to deploy accounts. Deploy a VPC in each workload account. Configure each VPC to route through an inspection VPC by using a transit gateway attachment.
Show Answer
Correct Answer: A
Explanation: The requirement for automatic security controls (guardrails) with the least operational overhead points directly to AWS Control Tower, which builds on AWS Organizations and provides preconfigured guardrails and automated account provisioning. Centralized networking can be achieved by using a dedicated networking account and sharing subnets with workload accounts via AWS RAM, avoiding the complexity of managing separate VPCs and transit gateways in every account. Using AWS Organizations alone would require manual setup of guardrails, and transit gateway designs introduce more operational complexity.
Question 140
A company runs its critical storage application in the AWS Cloud. The application uses Amazon S3 in two AWS Regions. The company wants the application to send remote user data to the nearest S3 bucket with no public network congestion. The company also wants the application to fail over with the least amount of management of Amazon S3.
Which solution will meet these requirements?
A. Implement an active-active design between the two Regions. Configure the application to use the regional S3 endpoints closest to the user.
B. Use an active-passive configuration with S3 Multi-Region Access Points. Create a global endpoint for each of the Regions.
C. Send user data to the regional S3 endpoints closest to the user. Configure an S3 cross-account replication rule to keep the S3 buckets synchronized.
D. Set up Amazon S3 to use Multi-Region Access Points in an active-active configuration with a single global endpoint. Configure S3 Cross-Region Replication.
Show Answer
Correct Answer: D
Explanation: Amazon S3 Multi-Region Access Points provide a single global endpoint that automatically routes requests over the AWS global network to the nearest healthy S3 bucket, avoiding public internet congestion. In an active-active setup with S3 Cross-Region Replication, data is synchronized between Regions and failover is automatic, minimizing management overhead while meeting low-latency and high-availability requirements.
Question 141
A company runs an ecommerce application on AWS. Amazon EC2 instances process purchases and store the purchase details in an Amazon Aurora PostgreSQL DB cluster.
Customers are experiencing application timeouts during times of peak usage. A solutions architect needs to rearchitect the application so that the application can scale to meet peak usage demands.
Which combination of actions will meet these requirements MOST cost-effectively? (Choose two.)
A. Configure an Auto Scaling group of new EC2 instances to retry the purchases until the processing is complete. Update the applications to connect to the DB cluster by using Amazon RDS Proxy.
B. Configure the application to use an Amazon ElastiCache cluster in front of the Aurora PostgreSQL DB cluster.
C. Update the application to send the purchase requests to an Amazon Simple Queue Service (Amazon SQS) queue. Configure an Auto Scaling group of new EC2 instances that read from the SQS queue.
D. Configure an AWS Lambda function to retry the ticket purchases until the processing is complete.
E. Configure an Amazon AP! Gateway REST API with a usage plan.
Show Answer
Correct Answer: A, C
Explanation: The timeouts occur during peak write traffic for purchase processing. The most cost‑effective way to scale is to decouple request ingestion from processing and protect the database from connection storms. Using Amazon SQS with an Auto Scaling group of EC2 workers (C) absorbs traffic spikes and allows processing to scale horizontally without overwhelming Aurora. Adding Amazon RDS Proxy (A) efficiently pools and manages database connections from scaling EC2 instances, improving availability and scalability under load. ElastiCache mainly helps read‑heavy workloads, and the other options do not address bursty write scaling as effectively.
Question 142
A company uses Amazon S3 to host its static website. The company wants to add a contact form to the webpage. The contact form will have dynamic server-side components for users to input their name, email address, phone number, and user message.
The company expects fewer than 100 site visits each month. The contact form must notify the company by email when a customer fills out the form.
Which solution will meet these requirements MOST cost-effectively?
A. Host the dynamic contact form in Amazon Elastic Container Service (Amazon ECS). Set up Amazon Simple Email Service (Amazon SES) to connect to a third-party email provider.
B. Create an Amazon API Gateway endpoint that returns the contact form from an AWS Lambda function. Configure another Lambda function on the API Gateway to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic.
C. Host the website by using AWS Amplify Hosting for static content and dynamic content. Use server-side scripting to build the contact form. Configure Amazon Simple Queue Service (Amazon SQS) to deliver the message to the company.
D. Migrate the website from Amazon S3 to Amazon EC2 instances that run Windows Server. Use Internet Information Services (IIS) for Windows Server to host the webpage. Use client-side scripting to build the contact form. Integrate the form with Amazon WorkMail.
Show Answer
Correct Answer: B
Explanation: For a low-traffic static website, a serverless approach is the most cost-effective. Amazon API Gateway with AWS Lambda incurs minimal cost at fewer than 100 requests per month and avoids managing servers or containers. Lambda can process the form submission, and Amazon SNS can send email notifications directly to the company. Other options involve higher fixed costs (ECS, EC2, Amplify) or unnecessary complexity for such low usage.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.