A company that uses AWS Organizations runs 150 applications across 30 different AWS accounts. The company used AWS Cost and Usage Report to create a new report in the management account. The report is delivered to an Amazon S3 bucket that is replicated to a bucket in the data collection account.
The company’s senior leadership wants to view a custom dashboard that provides NAT gateway costs each day starting at the beginning of the current month.
Which solution will meet these requirements?
A. Share an Amazon QuickSight dashboard that includes the requested table visual. Configure QuickSight to use AWS DataSync to query the new report.
B. Share an Amazon QuickSight dashboard that includes the requested table visual. Configure QuickSight to use Amazon Athena to query the new report.
C. Share an Amazon CloudWatch dashboard that includes the requested table visual. Configure CloudWatch to use AWS DataSync to query the new report.
D. Share an Amazon CloudWatch dashboard that includes the requested table visual. Configure CloudWatch to use Amazon Athena to query the new report.
Show Answer
Correct Answer: B
Explanation: AWS Cost and Usage Reports are delivered to Amazon S3 and are commonly queried with Amazon Athena. Amazon QuickSight can directly use Athena as a data source to build and share custom dashboards suitable for senior leadership. This combination supports daily cost breakdowns (such as NAT gateway costs) starting from the beginning of the current month. CloudWatch does not query CUR data from S3, and AWS DataSync is for data transfer, not querying.
Question 164
A company wants to build a map of its IT infrastructure to identify and enforce policies on resources that pose security risks. The company's security team must be able to query data in the IT infrastructure map and quickly identify security risks.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon RDS to store the data. Use SQL to query the data to identify security risks.
B. Use Amazon Neptune to store the data. Use SPARQL to query the data to identify security risks.
C. Use Amazon Redshift to store the data. Use SQL to query the data to identify security risks.
D. Use Amazon DynamoDB to store the data. Use PartiQL to query the data to identify security risks.
Show Answer
Correct Answer: B
Explanation: The requirement is to model an IT infrastructure map and efficiently query relationships to identify security risks with the least operational overhead. This is inherently a graph problem, where resources and their relationships must be traversed. Amazon Neptune is a fully managed graph database purpose-built for such use cases, and SPARQL is designed for querying graph relationships efficiently. RDS, Redshift, and DynamoDB are not optimized for complex relationship traversal and would require more schema design, joins, or custom logic, increasing operational overhead.
Question 165
A company's web application consists of multiple Amazon EC2 instances that run behind an Application Load Balancer in a VPC. An Amazon RDS for MySQL DB instance contains the data. The company needs the ability to automatically detect and respond to suspicious or unexpected behavior in its AWS environment. The company already has added AWS WAF to its architecture.
What should a solutions architect do next to protect against threats?
A. Use Amazon GuardDuty to perform threat detection. Configure Amazon EventBridge to filter for GuardDuty findings and to invoke an AWS Lambda function to adjust the AWS WAF rules.
B. Use AWS Firewall Manager to perform threat detection. Configure Amazon EventBridge to filter for Firewall Manager findings and to invoke an AWS Lambda function to adjust the AWS WAF web ACL.
C. Use Amazon Inspector to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.
D. Use Amazon Macie to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.
Show Answer
Correct Answer: A
Explanation: The requirement is to automatically detect and respond to suspicious or unexpected behavior. Amazon GuardDuty is AWS’s managed threat detection service designed for this purpose, analyzing VPC Flow Logs, DNS logs, and CloudTrail events. GuardDuty findings can be sent to Amazon EventBridge to trigger an AWS Lambda function that automatically updates AWS WAF rules, enabling real-time response. Firewall Manager is for centralized policy management, Inspector focuses on vulnerability scanning, and Macie is for sensitive data discovery, not runtime threat detection.
Question 166
A company runs a web application on multiple Amazon EC2 instances in a VPC. The application needs to write sensitive data to an Amazon S3 bucket. The data cannot be sent over the public internet.
Which solution will meet these requirements?
A. Create a gateway VPC endpoint for Amazon S3. Create a route in the VPC route table to the endpoint.
B. Create an internal Network Load Balancer that has the S3 bucket as the target.
C. Deploy the S3 bucket inside the VPCreate a route in the VPC route table to the bucket.
D. Create an AWS Direct Connect connection between the VPC and an S3 regional endpoint.
Show Answer
Correct Answer: A
Explanation: Amazon S3 supports gateway VPC endpoints that allow EC2 instances in a VPC to access S3 privately over the AWS network without traversing the public internet. By creating a gateway VPC endpoint and adding the appropriate route table entry, traffic to S3 stays within AWS, meeting the requirement for sensitive data. Other options are invalid because S3 cannot be placed in a VPC, cannot be a load balancer target, and Direct Connect is unnecessary for VPC-to-S3 private access.
Question 167
A company runs its production workload on Amazon EC2 instances with Amazon Elastic Block Store (Amazon EBS) volumes. A solutions architect needs to analyze the current EBS volume cost and to recommend optimizations. The recommendations need to include estimated monthly saving opportunities.
Which solution will meet these requirements?
A. Use Amazon Inspector reporting to generate EBS volume recommendations for optimization.
B. Use AWS Systems Manager reporting to determine EBS volume recommendations for optimization.
C. Use Amazon CloudWatch metrics reporting to determine EBS volume recommendations for optimization.
D. Use AWS Compute Optimizer to generate EBS volume recommendations for optimization.
Show Answer
Correct Answer: D
Explanation: AWS Compute Optimizer analyzes historical utilization of EBS volumes and provides right-sizing recommendations, including estimated monthly cost savings. It is specifically designed to identify overprovisioned or underutilized EBS volumes and quantify potential savings, which meets both the optimization and cost-estimation requirements.
Question 168
A company has migrated a fleet of hundreds of on-premises virtual machines (VMs) to Amazon EC2 instances. The instances run a diverse fleet of Windows Server versions along with several Linux distributions. The company wants a solution that will automate inventory and updates of the operating systems. The company also needs a summary of common vulnerabilities of each instance for regular monthly reviews.
What should a solutions architect recommend to meet these requirements?
A. Set up AWS Systems Manager Patch Manager to manage all the EC2 instances. Configure AWS Security Hub to produce monthly reports.
B. Set up AWS Systems Manager Patch Manager to manage all the EC2 instances. Deploy Amazon Inspector, and configure monthly reports.
C. Set up AWS Shield Advanced, and configure monthly reports. Deploy AWS Config to automate patch installations on the EC2 instances.
D. Set up Amazon GuardDuty in the account to monitor all EC2 instances. Deploy AWS Config to automate patch installations on the EC2 instances.
Show Answer
Correct Answer: B
Explanation: AWS Systems Manager Patch Manager automates OS inventory and patching across heterogeneous Windows and Linux EC2 fleets. Amazon Inspector continuously assesses EC2 instances for common vulnerabilities (CVEs) and can generate findings and reports suitable for regular monthly reviews. Other options either lack automated patching or focus on threat detection/DDOS rather than vulnerability assessment.
Question 169
A company hosts its application in the AWS Cloud. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Elastic Load Balancing (ELB) load balancer. The application connects to an Amazon DynamoDB table.
For disaster recovery (DR) purposes, the company wants to ensure that the application is available from another AWS Region with minimal downtime.
Which solution will meet these requirements with the LEAST downtime?
A. Create an Auto Scaling group and an ELB in the DR Region. Configure the DynamoDB table as a global table. Configure DNS failover to point to the new DR Region's ELB.
B. Create an AWS CloudFormation template to create EC2 instances, ELBs, and DynamoDB tables to be launched when necessary. Configure DNS failover to point to the new DR Region's EL
C. Create an AWS CloudFormation template to create EC2 instances and an ELB to be launched when necessary. Configure the DynamoDB table as a global table. Configure DNS failover to point to the new DR Region's ELB.
D. Create an Auto Scaling group and an ELB in the DR Region. Configure the DynamoDB table as a global table. Create an Amazon CloudWatch alarm with an evaluation period of 10 minutes to invoke an AWS Lambda function that updates Amazon Route 53 to point to the DR Region's ELB.
Show Answer
Correct Answer: A
Explanation: The requirement is disaster recovery with the LEAST downtime. The best approach is to have the DR infrastructure already running and data already replicated. Option A pre-provisions an Auto Scaling group and ELB in the DR Region and uses DynamoDB global tables for active-active data replication. In a failure, only DNS failover is required, which minimizes downtime. Options B and C rely on launching resources via CloudFormation at failure time, increasing recovery time. Option D introduces additional delay due to CloudWatch alarm evaluation and Lambda execution.
Question 170
A company is hosting a high-traffic static website on Amazon S3 with an Amazon CloudFront distribution that has a default TTL of 0 seconds. The company wants to implement caching to improve performance for the website. However, the company also wants to ensure that stale content is not served for more than a few minutes after a deployment.
Which combination of caching methods should a solutions architect implement to meet these requirements? (Choose two.)
A. Set the CloudFront default TTL to 2 minutes.
B. Set a default TTL of 2 minutes on the S3 bucket.
C. Add a Cache-Control private directive to the objects in Amazon S3.
D. Create an AWS Lambda@Edge function to add an Expires header to HTTP responses. Configure the function to run on viewer response.
E. Add a Cache-Control max-age directive of 24 hours to the objects in Amazon S3. On deployment, create a CloudFront invalidation to clear any changed files from edge caches.
Show Answer
Correct Answer: A, E
Explanation: The goal is to improve performance with caching while ensuring updated content is not served stale for more than a few minutes after deployment.
A short CloudFront default TTL (A) enables edge caching when objects do not specify cache headers, limiting how long stale content can be served.
Adding a long Cache-Control max-age on S3 objects combined with CloudFront invalidations on deployment (E) is a best practice: it maximizes cache efficiency for static content, and invalidations ensure updated files are removed from edge caches within minutes after deployment.
Options C and D either prevent shared caching or add unnecessary complexity, and B is invalid because TTL is not set at the S3 bucket level.
Question 171
A company hosts an application on Amazon EC2 instances that run in a single Availability Zone. The application is accessible by using the transport layer of the Open Systems Interconnection (OSI) model. The company needs the application architecture to have high availability.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
A. Configure new EC2 instances in a different Availability Zone. Use Amazon Route 53 to route traffic to all instances.
B. Configure a Network Load Balancer in front of the EC2 instances.
C. Configure a Network Load Balancer for TCP traffic to the instances. Configure an Application Load Balancer for HTTP and HTTPS traffic to the instances.
D. Create an Auto Scaling group for the EC2 instances. Configure the Auto Scaling group to use multiple Availability Zones. Configure the Auto Scaling group to run application health checks on the instances.
E. Create an Amazon CloudWatch alarm. Configure the alarm to restart EC2 instances that transition to a stopped state.
Show Answer
Correct Answer: B, D
Explanation: High availability requires eliminating the single–Availability Zone failure. Using an Auto Scaling group across multiple AZs (D) provides instance-level and AZ-level resilience in a cost-effective, managed way. Because the application is accessed at the transport layer (Layer 4/TCP), a Network Load Balancer (B) is the appropriate and lowest-cost load balancer to distribute TCP traffic and support high availability. ALB is unnecessary, and Route 53 alone does not provide load balancing or health-based traffic distribution at the instance level.
Question 172
A company has two AWS accounts: Production and Development. The company needs to push code changes in the Development account to the Production account. In the alpha phase, only two senior developers on the development team need access to the Production account. In the beta phase, more developers will need access to perform testing.
Which solution will meet these requirements?
A. Create two policy documents by using the AWS Management Console in each account. Assign the policy to developers who need access.
B. Create an IAM role in the Development account. Grant the IAM role access to the Production account. Allow developers to assume the role.
C. Create an IAM role in the Production account. Define a trust policy that specifies the Development account. Allow developers to assume the role.
D. Create an IAM group in the Production account. Add the group as a principal in a trust policy that specifies the Production account. Add developers to the group.
Show Answer
Correct Answer: C
Explanation: For secure cross-account access, AWS best practice is to create an IAM role in the account being accessed (Production) and define a trust policy that allows principals from the Development account to assume it. This enables temporary, controlled access via STS. During the alpha phase, only the two senior developers are granted permission in the Development account to call sts:AssumeRole; in the beta phase, additional developers can be added easily without changing the Production account role. Other options either do not enable cross-account access correctly or use unsupported principals (such as IAM groups in trust policies).
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.