A company runs an application that stores and shares photos. Users upload the photos to an Amazon S3 bucket. Every day, users upload approximately 150 photos. The company wants to design a solution that creates a thumbnail of each new photo and stores the thumbnail in a second S3 bucket.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an Amazon EventBridge scheduled rule to invoke a script every minute on a long-running Amazon EMR cluster. Configure the script to generate thumbnails for the photos that do not have thumbnails. Configure the script to upload the thumbnails to the second S3 bucket.
B. Configure an Amazon EventBridge scheduled rule to invoke a script every minute on a memory-optimized Amazon EC2 instance that is always on. Configure the script to generate thumbnails for the photos that do not have thumbnails. Configure the script to upload the thumbnails to the second S3 bucket.
C. Configure an S3 event notification to invoke an AWS Lambda function each time a user uploads a new photo to the application. Configure the Lambda function to generate a thumbnail and to upload the thumbnail to the second S3 bucket.
D. Configure S3 Storage Lens to invoke an AWS Lambda function each time a user uploads a new photo to the application. Configure the Lambda function to generate a thumbnail and to upload the thumbnail to a second S3 bucket.
Show Answer
Correct Answer: C
Explanation: Amazon S3 event notifications can directly invoke an AWS Lambda function whenever a new object is uploaded. Lambda can generate the thumbnail and store it in a second S3 bucket. This is event-driven, serverless, and highly cost-effective for a workload of only about 150 uploads per day. The EMR and always-on EC2 options incur unnecessary continuous compute costs, and S3 Storage Lens is an analytics feature, not an event source for object uploads.
Question 103
A company hosts its multi-tier, public web application in the AWS Cloud. The web application runs on Amazon EC2 instances, and its database runs on Amazon RDS. The company is anticipating a large increase in sales during an upcoming holiday weekend. A solutions architect needs to build a solution to analyze the performance of the web application with a granularity of no more than 2 minutes.
What should the solutions architect do to meet this requirement?
A. Send Amazon CloudWatch logs to Amazon Redshift. Use Amazon QuickS ght to perform further analysis.
B. Enable detailed monitoring on all EC2 instances. Use Amazon CloudWatch metrics to perform further analysis.
C. Create an AWS Lambda function to fetch EC2 logs from Amazon CloudWatch Logs. Use Amazon CloudWatch metrics to perform further analysis.
D. Send EC2 logs to Amazon S3. Use Amazon Redshift to fetch logs from the S3 bucket to process raw data for further analysis with Amazon QuickSight.
Show Answer
Correct Answer: B
Explanation: EC2 basic monitoring publishes CloudWatch metrics every 5 minutes, which does not meet the required granularity of no more than 2 minutes. Enabling detailed monitoring publishes EC2 metrics at 1-minute intervals, satisfying the requirement. CloudWatch metrics are the appropriate source for performance analysis. The other options focus on logs and analytics pipelines rather than providing the required near-real-time performance metrics.
Question 104
A company runs a self-managed Microsoft SQL Server on Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS). Daily snapshots are taken of the EBS volumes.
Recently, all the company’s EBS snapshots were accidentally deleted while running a snapshot cleaning script that deletes all expired EBS snapshots. A solutions architect needs to update the architecture to prevent data loss without retaining EBS snapshots indefinitely.
Which solution will meet these requirements with the LEAST development effort?
A. Change the IAM policy of the user to deny EBS snapshot deletion.
B. Copy the EBS snapshots to another AWS Region after completing the snapshots daily.
C. Create a 7-day EBS snapshot retention rule in Recycle Bin and apply the rule for all snapshots.
D. Copy EBS snapshots to Amazon S3 Standard-Infrequent Access (S3 Standard-IA).
Show Answer
Correct Answer: C
Explanation: Amazon EBS Recycle Bin provides a retention window for deleted EBS snapshots. If snapshots are accidentally deleted, they are retained for the configured period and can be restored, preventing data loss without keeping snapshots indefinitely. Denying deletion prevents legitimate cleanup, copying to another Region can also be deleted by faulty automation if applied there and adds cost/complexity, and EBS snapshots cannot simply be copied to S3 Standard-IA.
Question 105
A company hosts an application on AWS. The application gives users the ability to upload photos and store the photos in an Amazon S3 bucket. The company wants to use Amazon CloudFront and a custom domain name to upload the photo files to the S3 bucket in the eu-west-1 Region.
Which solution will meet these requirements? (Choose two.)
A. Use AWS Certificate Manager (ACM) to create a public certificate in the us-east-1 Region. Use the certificate in CloudFront.
B. Use AWS Certificate Manager (ACM) to create a public certificate in eu-west-1. Use the certificate in CloudFront.
C. Configure Amazon S3 to allow uploads from CloudFront. Configure S3 Transfer Acceleration.
D. Configure Amazon S3 to allow uploads from CloudFront origin access control (OAC).
E. Configure Amazon S3 to allow uploads from CloudFront. Configure an Amazon S3 website endpoint.
Show Answer
Correct Answer: A, D
Explanation: CloudFront requires ACM certificates for viewer HTTPS with custom domain names to be in us-east-1, regardless of the origin Region. To securely restrict S3 access so requests come through CloudFront, use Origin Access Control (OAC) with the S3 bucket policy. Certificates in eu-west-1 cannot be attached to CloudFront for viewer TLS. S3 website endpoints are for static website hosting and are not appropriate here.
Question 107
A solutions architect needs to connect a company's corporate network to its VPC to allow on-premises access to its AWS resources. The solution must provide encryption of all traffic between the corporate network and the VPC at the network layer and the session layer. The solution also must provide security controls to prevent unrestricted access between AWS and the on-premises systems.
Which solution meets these requirements?
A. Configure AWS Direct Connect to connect to the VPC. Configure the VPC route tables to allow and deny traffic between AWS and on premises as required.
B. Create an IAM policy to allow access to the AWS Management Console only from a defined set of corporate IP addresses. Restrict user access based on job responsibility by using an IAM policy and roles.
C. Configure AWS Site-to-Site VPN to connect to the VPConfigure route table entries to direct traffic from on premises to the VPConfigure instance security groups and network ACLs to allow only required traffic from on premises.
D. Configure AWS Transit Gateway to connect to the VPC. Configure route table entries to direct traffic from on premises to the VPC. Configure instance security groups and network ACLs to allow only required traffic from on premises.
Show Answer
Correct Answer: C
Explanation: AWS Site-to-Site VPN uses IPsec to encrypt traffic between the on-premises network and the VPC, satisfying the network-layer encryption requirement. Application sessions can additionally use TLS/SSL at the session layer, so traffic can be protected at both layers. Route tables, security groups, and network ACLs provide the required controls to restrict access between AWS and on-premises systems. Direct Connect alone does not provide encryption, IAM policies do not address network connectivity, and Transit Gateway is a routing hub rather than an encryption mechanism.
Question 108
A company has a multi-tier web application. The application's internal service components are deployed on Amazon EC2 instances. The internal service components need to access third-party software as a service (SaaS) APIs that are hosted on AWS.
The company needs to provide secure and private connectivity from the application's internal services to the third-party SaaS application. The company needs to ensure that there is minimal public internet exposure.
Which solution will meet these requirements?
A. Implement an AWS Site-to-Site VPN to establish a secure connection with the third-party SaaS provider.
B. Deploy AWS Transit Gateway to manage and route traffic between the application's VPC and the third-party SaaS provider.
C. Configure AWS PrivateLink to allow only outbound traffic from the VPC without enabling the third-party SaaS provider to establish.
D. Use AWS PrivateLink to create a private connection between the application's VPC and the third-party SaaS provider.
Show Answer
Correct Answer: D
Explanation: AWS PrivateLink is the AWS service designed to provide private connectivity from a consumer VPC to a supported SaaS provider or endpoint service over the AWS network, avoiding exposure to the public internet. It provides client-initiated, unidirectional access to the service. Option C is incorrect because it describes behavior as if it were a distinct configuration choice; PrivateLink already inherently prevents the service provider from initiating connections back to the consumer VPC, so the correct architectural solution is simply to use AWS PrivateLink to create the private connection.
Question 109
A company wants to replicate existing and ongoing data changes from an on-premises Oracle database to Amazon RDS for Oracle. The amount of data to replicate varies throughout each day. The company wants to use AWS Database Migration Service (AWS DMS) for data replication. The solution must allocate only the capacity that the replication instance requires.
Which solution will meet these requirements?
A. Configure the AWS DMS replication instance with a Multi-AZ deployment to provision instances across multiple Availability Zones.
B. Create an AWS DMS Serverless replication task to analyze and replicate the data while provisioning the required capacity.
C. Use Amazon EC2 Auto Scaling to scale the size of the AWS DMS replication instance up or down based on the amount of data toreplicate.
D. Provision AWS DMS replication capacity by using Amazon Elastic Container Service (Amazon ECS) with an AWS Fargate launch type to analyze and replicate the data while provisioning the required capacity.
Show Answer
Correct Answer: B
Explanation: AWS DMS Serverless automatically provisions and scales the replication capacity based on workload, making it suitable for variable replication volumes while allocating only the capacity required. Multi-AZ improves availability but does not provide elastic capacity. EC2 Auto Scaling cannot scale DMS replication instances, and DMS replication capacity is not provisioned through ECS/Fargate.
Question 110
A software company needs to upgrade a critical web application. The application currently runs on a single Amazon EC2 instance that the company hosts in a public subnet. The EC2 instance runs a MySQL database. The application's DNS records are published in an Amazon Route 53 zone.
A solutions architect must reconfigure the application to be scalable and highly available. The solutions architect must also reduce MySQL read latency.
Which combination of solutions will meet these requirements? (Choose two.)
A. Launch a second EC2 instance in a second AWS Region. Use a Route 53 failover routing policy to redirect the traffic to the second EC2 instance.
B. Create and configure an Auto Scaling group to launch private EC2 instances in multiple Availability Zones. Add the instances to a target group behind a new Application Load Balancer.
C. Migrate the database to an Amazon Aurora MySQL cluster. Create the primary DB instance and reader DB instance in separate Availability Zones.
D. Create and configure an Auto Scaling group to launch private EC2 instances in multiple AWS Regions. Add the instances to a target group behind a new Application Load Balancer.
E. Migrate the database to an Amazon Aurora MySQL cluster with cross-Region read replicas.
Show Answer
Correct Answer: B, C
Explanation: Use an Auto Scaling group across multiple Availability Zones behind an Application Load Balancer to provide horizontal scalability and high availability for the web tier. Migrate MySQL to an Amazon Aurora MySQL cluster with a writer and a reader instance in separate Availability Zones to provide high availability and reduce read latency through read scaling. The multi-Region options are primarily for disaster recovery and are not required by the stated requirements; Auto Scaling groups do not span Regions.
Question 111
A finance company uses an on-premises search application to collect streaming data from various producers. The application provides real-time updates to search and visualization features.
The company is planning to migrate to AWS and wants to use an AWS native solution.
Which solution will meet these requirements?
A. Use Amazon EC2 instances to ingest and process the data streams to Amazon S3 buckets tor storage. Use Amazon Athena to search the data. Use Amazon Managed Grafana to create visualizations.
B. Use Amazon EMR to ingest and process the data streams to Amazon Redshift for storage. Use Amazon Redshift Spectrum to search the data. Use Amazon QuickSight to create visualizations.
C. Use Amazon Elastic Kubernetes Service (Amazon EKS) to ingest and process the data streams to Amazon DynamoDB for storage. Use Amazon CloudWatch to create graphical dashboards to search and visualize the data.
D. Use Amazon Kinesis Data Streams to ingest and process the data streams to Amazon OpenSearch Service. Use OpenSearch Service to search the data. Use Amazon QuickSight to create visualizations.
Show Answer
Correct Answer: D
Explanation: The requirements emphasize real-time streaming ingestion, search, and visualization using AWS-native services. Amazon Kinesis Data Streams is purpose-built for ingesting streaming data. Amazon OpenSearch Service provides near real-time indexing and search capabilities, making it a direct replacement for on-premises search applications. Amazon QuickSight can visualize data from OpenSearch. The other options rely on services that are not designed for low-latency search over streaming data (Athena/S3, Redshift/EMR) or misuse CloudWatch as a search/visualization platform for application data (EKS/DynamoDB/CloudWatch).
Question 112
A solutions architect is designing an application that helps users fill out and submit registration forms. The solutions architect plans to use a two-tier architecture that includes a web application server tier and a worker tier.
The application needs to process submitted forms quickly. The application needs to process each form exactly once. The solution must ensure that no data is lost.
Which solution will meet these requirements?
A. Use an Amazon Simple Queue Service (Amazon SQS) FIFO queue between the web application server tier and the worker tier to store and forward form data.
B. Use an Amazon API Gateway HTTP API between the web application server tier and the worker tier to store and forward form data.
C. Use an Amazon Simple Queue Service (Amazon SQS) standard queue between the web application server tier and the worker tier to store and forward form data.
D. Use an AWS Step Functions workflow. Create a synchronous workflow between the web application server tier and the worker tier that stores and forwards form data.
Show Answer
Correct Answer: A
Explanation: Amazon SQS FIFO queues provide ordered delivery, message deduplication, and are designed for exactly-once processing semantics when used correctly. They durably store messages between the web tier and worker tier, helping ensure no data is lost. API Gateway is not a message buffer, SQS standard queues provide at-least-once delivery (duplicates are possible), and synchronous Step Functions are not the appropriate durable queueing mechanism for this producer-consumer pattern.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.