A company wants to restrict access to the content of its web application. The company needs to protect the content by using authorization techniques that are available on AWS. The company also wants to implement a serverless architecture for authorization and authentication that has low login latency.
The solution must integrate with the web application and serve web content globally. The application currently has a small user base, but the company expects the application's user base to increase.
Which solution will meet these requirements?
A. Configure Amazon Cognito for authentication. Implement Lambda@Edge for authorization. Configure Amazon CloudFront to serve the web application globally.
B. Configure AWS Directory Service for Microsoft Active Directory for authentication. Implement AWS Lambda for authorization. Use an Application Load Balancer to serve the web application globally.
C. Configure Amazon Cognito for authentication. Implement AWS Lambda for authorization. Use Amazon S3 Transfer Acceleration to serve the web application globally.
D. Configure AWS Directory Service for Microsoft Active Directory for authentication. Implement Lambda@Edge for authorization. Use AWS Elastic Beanstalk to serve the web application globally.
Show Answer
Correct Answer: A
Explanation: The requirements call for a serverless, low-latency authentication and authorization solution that serves content globally and can scale with user growth. Amazon Cognito provides fully managed, serverless user authentication with low login latency and native integration with web applications. Lambda@Edge enables authorization logic to run at CloudFront edge locations, minimizing latency and avoiding centralized servers. Amazon CloudFront serves web content globally with high performance. The other options either are not fully serverless, do not serve content globally in the optimal way, or rely on heavier directory services that add latency and operational overhead.
Question 154
A company runs its application by using Amazon EC2 instances and AWS Lambda functions. The EC2 instances run in private subnets of a VPC. The Lambda functions need direct network access to the EC2 instances for the application to work.
The application will run for 1 year. The number of Lambda functions that the application uses will increase during the 1-year period. The company must minimize costs on all application resources.
Which solution will meet these requirements?
A. Purchase an EC2 Instance Savings Plan. Connect the Lambda functions to the private subnets that contain the EC2 instances.
B. Purchase an EC2 Instance Savings Plan. Connect the Lambda functions to new public subnets in the same VPC where the EC2 instances run.
C. Purchase a Compute Savings Plan. Connect the Lambda functions to the private subnets that contain the EC2 instances.
D. Purchase a Compute Savings Plan. Keep the Lambda functions in the Lambda service VPC.
Show Answer
Correct Answer: C
Explanation: The company needs to minimize costs across both EC2 and Lambda over a 1-year period while allowing Lambda functions to directly access EC2 instances in private subnets. A Compute Savings Plan provides discounts that apply to both EC2 and Lambda usage, which is ideal because Lambda usage will increase over time. An EC2 Instance Savings Plan would only discount EC2, not Lambda. For networking, Lambda functions must be attached to the VPC (private subnets) to directly access EC2 instances in private subnets; keeping Lambda in the Lambda service VPC would not provide direct private access. Therefore, purchasing a Compute Savings Plan and connecting Lambda functions to the private subnets is the correct solution.
Question 155
A company is running a highly sensitive application on Amazon EC2 backed by an Amazon RDS database. Compliance regulations mandate that all personally identifiable information (PII) be encrypted at rest.
Which solution should a solutions architect recommend to meet this requirement with the LEAST amount of changes to the infrastructure?
A. Deploy AWS Certificate Manager to generate certificates. Use the certificates to encrypt the database volume.
B. Deploy AWS CloudHSM, generate encryption keys, and use the keys to encrypt database volumes.
C. Configure SSL encryption using AWS Key Management Service (AWS KMS) keys to encrypt database volumes.
D. Configure Amazon Elastic Block Store (Amazon EBS) encryption and Amazon RDS encryption with AWS Key Management Service (AWS KMS) keys to encrypt instance and database volumes.
Show Answer
Correct Answer: D
Explanation: The requirement is encryption at rest with the least infrastructure changes. Amazon RDS storage is backed by Amazon EBS, and both EC2 instance volumes and RDS storage can be transparently encrypted using AWS KMS with minimal configuration. Options involving SSL or certificates address encryption in transit, not at rest, and CloudHSM adds significant complexity and changes. Therefore, enabling EBS and RDS encryption with KMS is the simplest and correct approach.
Question 156
A company wants to relocate its on-premises MySQL database to AWS. The database accepts regular imports from a client-facing application, which causes a high volume of write operations. The company is concerned that the amount of traffic might be causing performance issues within the application.
How should a solutions architect design the architecture on AWS?
A. Provision an Amazon RDS for MySQL DB instance with Provisioned IOPS SSD storage. Monitor write operation metrics by using Amazon CloudWatch. Adjust the provisioned IOPS if necessary.
B. Provision an Amazon RDS for MySQL DB instance with General Purpose SSD storage. Place an Amazon ElastiCache cluster in front of the DB instance. Configure the application to query ElastiCache instead.
C. Provision an Amazon DocumentDB (with MongoDB compatibility) instance with a memory optimized instance type. Monitor Amazon CloudWatch for performance-related issues. Change the instance class if necessary.
D. Provision an Amazon Elastic File System (Amazon EFS) file system in General Purpose performance mode. Monitor Amazon CloudWatch for IOPS bottlenecks. Change to Provisioned Throughput performance mode if necessary.
Show Answer
Correct Answer: A
Explanation: The workload is write-intensive due to frequent imports, so the primary concern is sustained write throughput and consistent disk performance. Amazon RDS for MySQL with Provisioned IOPS SSD storage is specifically designed for high and predictable I/O workloads and allows tuning IOPS independently of storage size. Monitoring with CloudWatch and adjusting provisioned IOPS directly addresses the performance concern. ElastiCache mainly benefits read-heavy workloads, and the other options do not align with a MySQL write-intensive database migration.
Question 157
A company runs an application on Amazon EC2 instances in a private subnet. The application needs to store and retrieve data in Amazon S3 buckets. According to regulatory requirements, the data must not travel across the public internet.
What should a solutions architect do to meet these requirements MOST cost-effectively?
A. Deploy a NAT gateway to access the S3 buckets.
B. Deploy AWS Storage Gateway to access the S3 buckets.
C. Deploy an S3 interface endpoint to access the S3 buckets.
D. Deploy an S3 gateway endpoint to access the S3 buckets.
Show Answer
Correct Answer: D
Explanation: The application runs in a private subnet and must access Amazon S3 without traffic traversing the public internet. An S3 gateway endpoint keeps traffic entirely on the AWS network, satisfies regulatory requirements, and is the most cost-effective option because gateway endpoints have no hourly or data processing charges. NAT gateways would use the public internet and add cost, Storage Gateway is unnecessary for EC2-to-S3 access, and S3 interface endpoints meet the requirement but incur additional hourly and data processing costs.
Question 158
An ecommerce company is migrating its on-premises workload to the AWS Cloud. The workload currently consists of a web application and a backend Microsoft SQL database for storage.
The company expects a high volume of customers during a promotional event. The new infrastructure in the AWS Cloud must be highly available and scalable.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Migrate the web application to two Amazon EC2 instances across two Availability Zones behind an Application Load Balancer. Migrate the database to Amazon RDS for Microsoft SQL Server with read replicas in both Availability Zones.
B. Migrate the web application to an Amazon EC2 instance that runs in an Auto Scaling group across two Availability Zones behind an Application Load Balancer. Migrate the database to two EC2 instances across separate AWS Regions with database replication.
C. Migrate the web application to Amazon EC2 instances that run in an Auto Scaling group across two Availability Zones behind an Application Load Balancer. Migrate the database to Amazon RDS with Multi-AZ deployment.
D. Migrate the web application to three Amazon EC2 instances across three Availability Zones behind an Application Load Balancer. Migrate the database to three EC2 instances across three Availability Zones.
Show Answer
Correct Answer: C
Explanation: Option C provides high availability and scalability with the least administrative overhead by using managed AWS services. An Auto Scaling group across multiple Availability Zones behind an Application Load Balancer ensures the web tier scales automatically during traffic spikes. Amazon RDS with Multi-AZ deployment (including support for Microsoft SQL Server) provides built-in high availability and automated failover without managing database servers. Other options either lack Auto Scaling, use self-managed databases on EC2, or introduce unnecessary complexity.
Question 159
A company has an on-premises business application that generates hundreds of files each day. These files are stored on an SMB file share and require a low-latency connection to the application servers. A new company policy states all application-generated files must be copied to AWS. There is already a VPN connection to AWS.
The application development team does not have time to make the necessary code modifications to move the application to AWS.
Which service should a solutions architect recommend to allow the application to copy files to AWS?
A. Amazon Elastic File System (Amazon EFS)
B. Amazon FSx for Windows File Server
C. AWS Snowball
D. AWS Storage Gateway
Show Answer
Correct Answer: D
Explanation: The requirement is to keep the existing on‑premises SMB-based application unchanged, maintain low latency locally, and automatically copy all generated files to AWS over an existing VPN. AWS Storage Gateway (File Gateway) is designed exactly for this hybrid use case: it presents an SMB file share on‑premises, caches data locally for low latency, and asynchronously copies files to AWS (typically Amazon S3). Amazon FSx for Windows File Server is a managed file system that runs in AWS and would require the application to write directly to a cloud-hosted SMB share, which is not ideal for low-latency on‑premises workloads and does not inherently provide background copy semantics. EFS does not support SMB, and Snowball is for bulk offline data transfer, not continuous daily file generation.
Question 160
A company wants to enhance its ecommerce order-processing application that is deployed on AWS. The application must process each order exactly once without affecting the customer experience during unpredictable traffic surges.
Which solution will meet these requirements?
A. Create an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Put all the orders in the SQS queue. Configure an AWS Lambda function as the target to process the orders.
B. Create an Amazon Simple Notification Service (Amazon SNS) standard topic. Publish all the orders to the SNS standard topic. Configure the application as a notification target.
C. Create a flow by using Amazon AppFlow. Send the orders to the flow. Configure an AWS Lambda function as the target to process the orders.
D. Configure AWS X-Ray in the application to track the order requests. Configure the application to process the orders by pulling the orders from Amazon CloudWatch.
Show Answer
Correct Answer: A
Explanation: The requirement is to process each order exactly once and handle unpredictable traffic surges without impacting customer experience. Amazon SQS FIFO queues provide exactly-once message processing and message ordering. Coupling the FIFO queue with AWS Lambda enables automatic scaling during traffic spikes while decoupling order intake from processing. The other options do not guarantee exactly-once processing or are not designed for high-throughput, reliable order processing.
Question 161
A company runs an application in the AWS Cloud that generates sensitive archival data files. The company wants to rearchitect the application's data storage. The company wants to encrypt the data files and to ensure that third parties do not have access to the data before the data is encrypted and sent to AWS. The company has already created an Amazon S3 bucket.
Which solution will meet these requirements?
A. Configure the S3 bucket to use client-side encryption with an Amazon S3 managed encryption key. Configure the application to use the S3 bucket to store the archival files.
B. Configure the S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS). Configure the application to use the S3 bucket to store the archival files.
C. Configure the S3 bucket to use dual-layer server-side encryption with AWS KMS keys (SSE-KMS). Configure the application to use the S3 bucket to store the archival files.
D. Configure the application to use client-side encryption with a key stored in AWS Key Management Service (AWS KMS). Configure the application to store the archival files in the S3 bucket.
Show Answer
Correct Answer: D
Explanation: The requirement states that data must be encrypted before it is sent to AWS so that third parties cannot access plaintext data in transit. This requires client-side encryption performed by the application before upload. Using client-side encryption with keys stored in AWS KMS satisfies this requirement. Server-side encryption options (SSE-S3, SSE-KMS, or dual-layer SSE-KMS) encrypt data only after it reaches S3, which does not meet the requirement.
Question 162
A large international university has deployed all of its compute services in the AWS Cloud. These services include Amazon EC2, Amazon RDS, and Amazon DynamoDB. The university currently relies on many custom scripts to back up its infrastructure. However, the university wants to centralize management and automate data backups as much as possible by using AWS native options.
Which solution will meet these requirements?
A. Use third-party backup software with an AWS Storage Gateway tape gateway virtual tape library.
B. Use AWS Backup to configure and monitor all backups for the services in use.
C. Use AWS Config to set lifecycle management to take snapshots of all data sources on a schedule.
D. Use AWS Systems Manager State Manager to manage the configuration and monitoring of backup tasks.
Show Answer
Correct Answer: B
Explanation: AWS Backup is a fully managed, AWS-native service that centralizes and automates backups across multiple AWS services, including Amazon EC2 (EBS snapshots), Amazon RDS, and Amazon DynamoDB. It provides a single place to define backup plans, schedules, retention policies, and monitoring, which directly replaces custom scripts. The other options do not provide centralized, native backup management across all these services.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.