A company needs to optimize its Amazon S3 storage costs for an application that generates many files that cannot be recreated. Each file is approximately 5 MB and is stored in Amazon S3 Standard storage.
The company must store the files for 4 years before the files can be deleted. The files must be immediately accessible. The files are frequently accessed in the first 30 days of object creation, but they are rarely accessed after the first 30 days.
Which solution will meet these requirements MOST cost-effectively?
A. Create an S3 Lifecycle policy to move the files to S3 Glacier Instant Retrieval 30 days after object creation. Delete the files 4 years after object creation.
B. Create an S3 Lifecycle policy to move the files to S3 One Zone-Infrequent Access (S3 One Zone-IA) 30 days after object creation. Delete the files 4 years after object creation.
C. Create an S3 Lifecycle policy to move the files to S3 Standard-Infrequent Access (S3 Standard-IA) 30 days after object creation. Delete the files 4 years after object creation.
D. Create an S3 Lifecycle policy to move the files to S3 Standard-Infrequent Access (S3 Standard-IA) 30 days after object creation. Move the files to S3 Glacier Flexible Retrieval 4 years after object creation.
Show Answer
Correct Answer: A
Explanation: S3 Glacier Instant Retrieval is designed for long-lived, rarely accessed data that still requires millisecond (immediate) access. The workload is frequently accessed for the first 30 days, then rarely accessed for the remaining ~4 years, making a lifecycle transition after 30 days the most cost-effective. S3 One Zone-IA is inappropriate because the data cannot be recreated and stores data in a single AZ. S3 Standard-IA is more expensive than Glacier Instant Retrieval for storage. Transitioning to Glacier Flexible Retrieval at 4 years is unnecessary because the objects are to be deleted at that point.
Question 132
A global company runs its workloads on AWS. The company's application uses Amazon S3 buckets across AWS Regions for sensitive data storage and analysis. The company stores millions of objects in multiple S3 buckets daily. The company wants to identify all S3 buckets that are not versioning-enabled.
Which solution will meet these requirements?
A. Set up an AWS CloudTrail event that has a rule to identify all S3 buckets that are not versioning-enabled across Regions.
B. Use Amazon S3 Storage Lens to identify all S3 buckets that are not versioning-enabled across Regions.
C. Enable IAM Access Analyzer for S3 to identify all S3 buckets that are not versioning-enabled across Regions.
D. Create an S3 Multi-Region Access Point to identify all S3 buckets that are not versioning-enabled across Regions.
Show Answer
Correct Answer: B
Explanation: Amazon S3 Storage Lens provides organization-wide and cross-Region visibility into S3 storage and data protection metrics, including versioning. It includes metrics and recommendations that identify buckets without S3 Versioning enabled. CloudTrail records API activity but does not inventory bucket versioning status, IAM Access Analyzer for S3 analyzes access policies rather than versioning, and Multi-Region Access Points provide global access routing rather than compliance reporting.
Question 133
An ecommerce company wants to collect user clickstream data from the company's website for real-time analysis. The website experiences fluctuating traffic patterns throughout the day. The company needs a scalable solution that can adapt to varying levels of traffic.
Which solution will meet these requirements?
A. Use a data stream in Amazon Kinesis Data Streams in on-demand mode to capture the clickstream data. Use AWS Lambda to process the data in real time.
B. Use Amazon Kinesis Data Firehose to capture the clickstream data. Use AWS Glue to process the data in real time.
C. Use Amazon Kinesis Video Streams to capture the clickstream data. Use AWS Glue to process the data in real time.
D. Use Amazon Managed Service for Apache Flink (previously known as Amazon Kinesis Data Analytics) to capture the clickstream data. Use AWS Lambda to process the data in real time.
Show Answer
Correct Answer: A
Explanation: Amazon Kinesis Data Streams in on-demand mode is designed for real-time streaming ingestion and automatically adapts to fluctuating throughput without capacity planning. AWS Lambda can consume Kinesis Data Streams records for real-time processing. Kinesis Data Firehose is primarily for near-real-time delivery to destinations rather than interactive stream processing, Kinesis Video Streams is for video data, and Managed Service for Apache Flink processes streams but is not the service used to capture the clickstream itself.
Question 134
A company uses a Microsoft SQL Server database. The company's applications are connected to the database. The company wants to migrate to an Amazon Aurora PostgreSQL database with minimal changes to the application code.
Which combination of steps will meet these requirements? (Choose two.)
A. Use the AWS Schema Conversion Tool (AWS SCT) to rewrite the SQL queries in the applications.
B. Enable Babelfish on Aurora PostgreSQL to run the SQL queries from the applications.
C. Migrate the database schema and data by using the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS).
D. Use Amazon RDS Proxy to connect the applications to Aurora PostgreSQL.
E. Use AWS Database Migration Service (AWS DMS) to rewrite the SQL queries in the applications.
Show Answer
Correct Answer: B, C
Explanation: Babelfish for Aurora PostgreSQL allows applications written for Microsoft SQL Server to continue using the TDS protocol and much of T-SQL with minimal application code changes. For the migration itself, AWS Schema Conversion Tool converts the schema and AWS Database Migration Service migrates the data. AWS SCT does not rewrite application SQL, AWS DMS does not rewrite application queries, and RDS Proxy is unrelated to SQL Server compatibility.
Question 135
A company has released a new version of its production application. The company's workload uses Amazon EC2, AWS Lambda, AWS Fargate, and Amazon SageMaker.
The company wants to cost optimize the workload now that usage is at a steady state. The company wants to cover the most services with the fewest savings plans.
Which combination of savings plans will meet these requirements? (Choose two.)
A. Purchase an EC2 Instance Savings Plan for Amazon EC2 and SageMaker.
B. Purchase a Compute Savings Plan for Amazon EC2, Lambda, and SageMaker.
C. Purchase a SageMaker Savings Plan.
D. Purchase a Compute Savings Plan for Lambda, Fargate, and Amazon EC2.
E. Purchase an EC2 Instance Savings Plan for Amazon EC2 and Fargate.
Show Answer
Correct Answer: C, D
Explanation: Compute Savings Plans cover Amazon EC2 (regardless of instance family, size, AZ, Region), AWS Fargate, and AWS Lambda. SageMaker requires its own SageMaker (Machine Learning) Savings Plan and is not covered by Compute Savings Plans. EC2 Instance Savings Plans do not cover Fargate or SageMaker.
Question 136
A solutions architect is designing a three-tier web application. The architecture consists of an internet-facing Application Load Balancer (ALB) and a web tier that is hosted on Amazon EC2 instances in private subnets. The application tier with the business logic runs on EC2 instances in private subnets. The database tier consists of Microsoft SQL Server that runs on EC2 instances in private subnets. Security is a high priority for the company.
Which combination of security group configurations should the solutions architect use? (Choose three.)
A. Configure the security group for the web tier to allow inbound HTTPS traffic from the security group for the ALB.
B. Configure the security group for the web tier to allow outbound HTTPS traffic to 0.0.0.0/0.
C. Configure the security group for the database tier to allow inbound Microsoft SQL Server traffic from the security group for the application tier.
D. Configure the security group for the database tier to allow outbound HTTPS traffic and Microsoft SQL Server traffic to the security group for the web tier.
E. Configure the security group for the application tier to allow inbound HTTPS traffic from the security group for the web tier.
F. Configure the security group for the application tier to allow outbound HTTPS traffic and Microsoft SQL Server traffic to the security group for the web tier.
Show Answer
Correct Answer: A, C, E
Explanation: Use security groups to allow only the required inbound traffic between adjacent tiers by referencing the source security group. The web tier should accept HTTPS only from the ALB security group. The application tier should accept HTTPS only from the web tier security group. The database tier should accept Microsoft SQL Server traffic only from the application tier security group. Because security groups are stateful, return traffic is automatically allowed, so the additional outbound rules described in the other options are unnecessary or incorrect.
Question 137
A company has deployed a multi-account strategy on AWS by using AWS Control Tower. The company has provided individual AWS accounts to each of its developers. The company wants to implement controls to limit AWS resource costs that the developers incur.
Which solution will meet these requirements with the LEAST operational overhead?
A. Instruct each developer to tag all their resources with a tag that has a key of CostCenter and a value of the developer's name. Use the required-tags AWS Config managed rule to check for the tag. Create an AWS Lambda function to terminate resources that do not have the tag. Configure AWS Cost Explorer to send a daily report to each developer to monitor their spending.
B. Use AWS Budgets to establish budgets for each developer account. Set up budget alerts for actual and forecast values to notify developers when they exceed or expect to exceed their assigned budget. Use AWS Budgets actions to apply a DenyAll policy to the developer's IAM role to prevent additional resources from being launched when the assigned budget is reached.
C. Use AWS Cost Explorer to monitor and report on costs for each developer account. Configure Cost Explorer to send a daily report to each developer to monitor their spending. Use AWS Cost Anomaly Detection to detect anomalous spending and provide alerts.
D. Use AWS Service Catalog to allow developers to launch resources within a limited cost range. Create AWS Lambda functions in each AWS account to stop running resources at the end of each work day. Configure the Lambda functions to resume the resources at the start of each work day.
Show Answer
Correct Answer: B
Explanation: AWS Budgets provides native per-account budgets, alerts on actual and forecasted spend, and Budget Actions that can automatically apply restrictive IAM policies (or SCPs in Organizations scenarios) to limit additional resource creation once thresholds are reached. This directly implements cost controls with minimal operational overhead compared to custom tagging/Lambda automation, monitoring-only approaches, or scheduled resource management.
Question 138
A company creates dedicated AWS accounts in AWS Organizations for its business units. Recently, an important notification was sent to the root user email address of a business unit account instead of the assigned account owner. The company wants to ensure that all future notifications can be sent to different employees based on the notification categories of billing, operations, or security.
Which solution will meet these requirements MOST securely?
A. Configure each AWS account to use a single email address that the company manages. Ensure that all account owners can access the email account to receive notifications. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
B. Configure each AWS account to use a different email distribution list for each business unit that the company manages. Configure each distribution list with administrator email addresses that can respond to alerts. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
C. Configure each AWS account root user email address to be the individual company managed email address of one person from each business unit. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
D. Configure each AWS account root user to use email aliases that go to a centralized mailbox. Configure alternate contacts for each account by using a single business managed email distribution list each for the billing team, the security team, and the operations team.
Show Answer
Correct Answer: D
Explanation: Using centrally managed root email aliases that route to a controlled mailbox avoids tying the root account to an individual and preserves access. AWS alternate contacts should then be configured for billing, operations, and security so notifications are sent to the appropriate role-based distribution lists. This best satisfies the requirement to route notifications by category while keeping root account access centrally controlled.
Question 139
A company wants to isolate its workloads by creating an AWS account for each workload. The company needs a solution that centrally manages networking components for the workloads. The solution also must create accounts with automatic security controls (guardrails).
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS Control Tower to deploy accounts. Create a networking account that has a VPC with private subnets and public subnets. Use AWS Resource Access Manager (AWS RAM) to share the subnets with the workload accounts.
B. Use AWS Organizations to deploy accounts. Create a networking account that has a VPC with private subnets and public subnets. Use AWS Resource Access Manager (AWS RAM) to share the subnets with the workload accounts.
C. Use AWS Control Tower to deploy accounts. Deploy a VPC in each workload account. Configure each VPC to route through an inspection VPC by using a transit gateway attachment.
D. Use AWS Organizations to deploy accounts. Deploy a VPC in each workload account. Configure each VPC to route through an inspection VPC by using a transit gateway attachment.
Show Answer
Correct Answer: A
Explanation: AWS Control Tower is the key requirement because it automates multi-account provisioning and applies built-in security guardrails. For centralized networking with the least operational overhead, a shared VPC model using AWS RAM allows workload accounts to use centrally managed subnets from a networking account. Options using only AWS Organizations do not provide automatic guardrails, and transit gateway with inspection VPC adds unnecessary operational complexity.
Question 140
A company runs its critical storage application in the AWS Cloud. The application uses Amazon S3 in two AWS Regions. The company wants the application to send remote user data to the nearest S3 bucket with no public network congestion. The company also wants the application to fail over with the least amount of management of Amazon S3.
Which solution will meet these requirements?
A. Implement an active-active design between the two Regions. Configure the application to use the regional S3 endpoints closest to the user.
B. Use an active-passive configuration with S3 Multi-Region Access Points. Create a global endpoint for each of the Regions.
C. Send user data to the regional S3 endpoints closest to the user. Configure an S3 cross-account replication rule to keep the S3 buckets synchronized.
D. Set up Amazon S3 to use Multi-Region Access Points in an active-active configuration with a single global endpoint. Configure S3 Cross-Region Replication.
Show Answer
Correct Answer: D
Explanation: Amazon S3 Multi-Region Access Points provide a single global endpoint that routes requests over the AWS global network to the closest healthy bucket, minimizing public internet congestion and simplifying failover. Cross-Region Replication keeps the buckets synchronized in an active-active design. This best satisfies low latency, resilience, and minimal management.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.