A company runs its application on Oracle Database Enterprise Edition. The company needs to migrate the application and the database to AWS. The company can use the Bring Your Own License (BYOL) model while migrating to AWS. The application uses third-party database features that require privileged access.
A solutions architect must design a solution for the database migration.
Which solution will meet these requirements MOST cost-effectively?
A. Migrate the database to Amazon RDS for Oracle by using native tools. Replace the third-party features with AWS Lambda.
B. Migrate the database to Amazon RDS Custom for Oracle by using native tools. Customize the new database settings to support the third-party features.
C. Migrate the database to Amazon DynamoDB by using AWS Database Migration Service (AWS DMS). Customize the new database settings to support the third-party features.
D. Migrate the database to Amazon RDS for PostgreSQL by using AWS Database Migration Service (AWS DMS). Rewrite the application code to remove the dependency on third-party features.
Show Answer
Correct Answer: B
Explanation: Amazon RDS Custom for Oracle is designed for workloads that require operating system and database-level privileged access, including third-party agents and customizations that are not supported on standard Amazon RDS for Oracle. It supports the BYOL licensing model and native Oracle migration tools, making it the most cost-effective option that preserves Oracle compatibility without requiring application rewrites or database engine changes.
Question 152
A company uses Amazon RDS for PostgreSQL databases for its data tier. The company must implement password rotation for the databases.
Which solution meets this requirement with the LEAST operational overhead?
A. Store the password in AWS Secrets Manager. Enable automatic rotation on the secret.
B. Store the password in AWS Systems Manager Parameter Store. Enable automatic rotation on the parameter.
C. Store the password in AWS Systems Manager Parameter Store. Write an AWS Lambda function that rotates the password.
D. Store the password in AWS Key Management Service (AWS KMS). Enable automatic rotation on the AWS KMS key.
Show Answer
Correct Answer: A
Explanation: AWS Secrets Manager natively supports automatic rotation of Amazon RDS database credentials, including Amazon RDS for PostgreSQL, using built-in rotation integration with minimal operational effort. Systems Manager Parameter Store does not provide native automatic secret rotation, and KMS key rotation rotates encryption keys, not database passwords.
Question 153
A company wants to restrict access to the content of its web application. The company needs to protect the content by using authorization techniques that are available on AWS. The company also wants to implement a serverless architecture for authorization and authentication that has low login latency.
The solution must integrate with the web application and serve web content globally. The application currently has a small user base, but the company expects the application's user base to increase.
Which solution will meet these requirements?
A. Configure Amazon Cognito for authentication. Implement Lambda@Edge for authorization. Configure Amazon CloudFront to serve the web application globally.
B. Configure AWS Directory Service for Microsoft Active Directory for authentication. Implement AWS Lambda for authorization. Use an Application Load Balancer to serve the web application globally.
C. Configure Amazon Cognito for authentication. Implement AWS Lambda for authorization. Use Amazon S3 Transfer Acceleration to serve the web application globally.
D. Configure AWS Directory Service for Microsoft Active Directory for authentication. Implement Lambda@Edge for authorization. Use AWS Elastic Beanstalk to serve the web application globally.
Show Answer
Correct Answer: A
Explanation: Amazon Cognito provides a fully managed, serverless authentication service with low-latency sign-in and scales as the user base grows. Lambda@Edge can perform authorization checks at CloudFront edge locations, reducing login/authorization latency globally. CloudFront serves web content worldwide with low latency. The other options either rely on AWS Directory Service (not serverless and unnecessary for internet-scale user authentication), use services that do not provide global web content delivery (S3 Transfer Acceleration is for file transfers, not web serving), or use Elastic Beanstalk/ALB, which do not satisfy the global edge-serving requirement as effectively.
Question 154
A company runs its application by using Amazon EC2 instances and AWS Lambda functions. The EC2 instances run in private subnets of a VPC. The Lambda functions need direct network access to the EC2 instances for the application to work.
The application will run for 1 year. The number of Lambda functions that the application uses will increase during the 1-year period. The company must minimize costs on all application resources.
Which solution will meet these requirements?
A. Purchase an EC2 Instance Savings Plan. Connect the Lambda functions to the private subnets that contain the EC2 instances.
B. Purchase an EC2 Instance Savings Plan. Connect the Lambda functions to new public subnets in the same VPC where the EC2 instances run.
C. Purchase a Compute Savings Plan. Connect the Lambda functions to the private subnets that contain the EC2 instances.
D. Purchase a Compute Savings Plan. Keep the Lambda functions in the Lambda service VPC.
Show Answer
Correct Answer: C
Explanation: Compute Savings Plans apply to both Amazon EC2 and AWS Lambda, making them the most cost-effective choice when Lambda usage is expected to grow over a 1-year commitment. Because the Lambda functions require direct network access to EC2 instances running in private subnets, the Lambda functions must be configured to run in the same VPC and attached to the private subnets (with appropriate security groups). Keeping Lambda in the default Lambda service VPC would not provide direct private connectivity to the VPC resources.
Question 155
A company is running a highly sensitive application on Amazon EC2 backed by an Amazon RDS database. Compliance regulations mandate that all personally identifiable information (PII) be encrypted at rest.
Which solution should a solutions architect recommend to meet this requirement with the LEAST amount of changes to the infrastructure?
A. Deploy AWS Certificate Manager to generate certificates. Use the certificates to encrypt the database volume.
B. Deploy AWS CloudHSM, generate encryption keys, and use the keys to encrypt database volumes.
C. Configure SSL encryption using AWS Key Management Service (AWS KMS) keys to encrypt database volumes.
D. Configure Amazon Elastic Block Store (Amazon EBS) encryption and Amazon RDS encryption with AWS Key Management Service (AWS KMS) keys to encrypt instance and database volumes.
Show Answer
Correct Answer: D
Explanation: Encryption at rest for EC2 and RDS is achieved by enabling Amazon EBS encryption for EC2 instance volumes and Amazon RDS encryption using AWS KMS keys. ACM certificates and SSL protect data in transit, not at rest. CloudHSM can manage keys but is unnecessary and requires more infrastructure changes than native KMS-based encryption.
Question 156
A company wants to relocate its on-premises MySQL database to AWS. The database accepts regular imports from a client-facing application, which causes a high volume of write operations. The company is concerned that the amount of traffic might be causing performance issues within the application.
How should a solutions architect design the architecture on AWS?
A. Provision an Amazon RDS for MySQL DB instance with Provisioned IOPS SSD storage. Monitor write operation metrics by using Amazon CloudWatch. Adjust the provisioned IOPS if necessary.
B. Provision an Amazon RDS for MySQL DB instance with General Purpose SSD storage. Place an Amazon ElastiCache cluster in front of the DB instance. Configure the application to query ElastiCache instead.
C. Provision an Amazon DocumentDB (with MongoDB compatibility) instance with a memory optimized instance type. Monitor Amazon CloudWatch for performance-related issues. Change the instance class if necessary.
D. Provision an Amazon Elastic File System (Amazon EFS) file system in General Purpose performance mode. Monitor Amazon CloudWatch for IOPS bottlenecks. Change to Provisioned Throughput performance mode if necessary.
Show Answer
Correct Answer: A
Explanation: The workload is write-intensive due to frequent imports into a MySQL database. Amazon RDS for MySQL with Provisioned IOPS SSD storage is designed for consistent, high-performance I/O and is the appropriate choice for sustained heavy write workloads. Monitoring CloudWatch metrics and adjusting provisioned IOPS as needed is standard operational practice. ElastiCache primarily improves read performance and does not address write bottlenecks. Amazon DocumentDB is not a MySQL-compatible relational database replacement, and Amazon EFS is a shared file system, not a database solution.
Question 157
A company runs an application on Amazon EC2 instances in a private subnet. The application needs to store and retrieve data in Amazon S3 buckets. According to regulatory requirements, the data must not travel across the public internet.
What should a solutions architect do to meet these requirements MOST cost-effectively?
A. Deploy a NAT gateway to access the S3 buckets.
B. Deploy AWS Storage Gateway to access the S3 buckets.
C. Deploy an S3 interface endpoint to access the S3 buckets.
D. Deploy an S3 gateway endpoint to access the S3 buckets.
Show Answer
Correct Answer: D
Explanation: The most cost-effective solution is an Amazon S3 gateway VPC endpoint. Gateway endpoints for S3 allow EC2 instances in private subnets to access S3 without traversing the public internet, keeping traffic on the AWS network. They have no hourly or data processing charges, unlike interface endpoints. A NAT gateway would route outbound internet traffic and incurs cost, and AWS Storage Gateway is intended for hybrid storage use cases, not VPC-to-S3 access.
Question 158
An ecommerce company is migrating its on-premises workload to the AWS Cloud. The workload currently consists of a web application and a backend Microsoft SQL database for storage.
The company expects a high volume of customers during a promotional event. The new infrastructure in the AWS Cloud must be highly available and scalable.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Migrate the web application to two Amazon EC2 instances across two Availability Zones behind an Application Load Balancer. Migrate the database to Amazon RDS for Microsoft SQL Server with read replicas in both Availability Zones.
B. Migrate the web application to an Amazon EC2 instance that runs in an Auto Scaling group across two Availability Zones behind an Application Load Balancer. Migrate the database to two EC2 instances across separate AWS Regions with database replication.
C. Migrate the web application to Amazon EC2 instances that run in an Auto Scaling group across two Availability Zones behind an Application Load Balancer. Migrate the database to Amazon RDS with Multi-AZ deployment.
D. Migrate the web application to three Amazon EC2 instances across three Availability Zones behind an Application Load Balancer. Migrate the database to three EC2 instances across three Availability Zones.
Show Answer
Correct Answer: C
Explanation: The web tier should scale automatically and remain highly available by using an Auto Scaling group across multiple Availability Zones behind an Application Load Balancer. For Microsoft SQL Server, Amazon RDS Multi-AZ provides managed high availability with automatic failover and minimal administrative overhead. Option A lacks Auto Scaling and incorrectly refers to SQL Server read replicas. Options B and D rely on self-managed EC2 databases, increasing operational burden.
Question 159
A company has an on-premises business application that generates hundreds of files each day. These files are stored on an SMB file share and require a low-latency connection to the application servers. A new company policy states all application-generated files must be copied to AWS. There is already a VPN connection to AWS.
The application development team does not have time to make the necessary code modifications to move the application to AWS.
Which service should a solutions architect recommend to allow the application to copy files to AWS?
A. Amazon Elastic File System (Amazon EFS)
B. Amazon FSx for Windows File Server
C. AWS Snowball
D. AWS Storage Gateway
Show Answer
Correct Answer: D
Explanation: AWS Storage Gateway (specifically File Gateway) presents an SMB file share to the on-premises application while asynchronously storing the files in AWS (typically Amazon S3). This preserves low-latency local access, works over the existing VPN, and requires no application code changes. Amazon EFS is NFS-based, Amazon FSx for Windows File Server is a managed SMB file system in AWS rather than the hybrid file transfer/caching service intended for this use case, and Snowball is for offline bulk data transfer.
Question 160
A company wants to enhance its ecommerce order-processing application that is deployed on AWS. The application must process each order exactly once without affecting the customer experience during unpredictable traffic surges.
Which solution will meet these requirements?
A. Create an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Put all the orders in the SQS queue. Configure an AWS Lambda function as the target to process the orders.
B. Create an Amazon Simple Notification Service (Amazon SNS) standard topic. Publish all the orders to the SNS standard topic. Configure the application as a notification target.
C. Create a flow by using Amazon AppFlow. Send the orders to the flow. Configure an AWS Lambda function as the target to process the orders.
D. Configure AWS X-Ray in the application to track the order requests. Configure the application to process the orders by pulling the orders from Amazon CloudWatch.
Show Answer
Correct Answer: A
Explanation: An Amazon SQS FIFO queue is designed for exactly-once message processing and preserves message order when used correctly. Pairing the FIFO queue with AWS Lambda decouples order ingestion from processing, allowing the application to absorb unpredictable traffic spikes without affecting the customer experience. SNS standard topics do not provide exactly-once delivery, AppFlow is not intended for this use case, and X-Ray/CloudWatch do not provide order queueing or exactly-once processing.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.