A company runs an application in the AWS Cloud that generates sensitive archival data files. The company wants to rearchitect the application's data storage. The company wants to encrypt the data files and to ensure that third parties do not have access to the data before the data is encrypted and sent to AWS. The company has already created an Amazon S3 bucket.
Which solution will meet these requirements?
A. Configure the S3 bucket to use client-side encryption with an Amazon S3 managed encryption key. Configure the application to use the S3 bucket to store the archival files.
B. Configure the S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS). Configure the application to use the S3 bucket to store the archival files.
C. Configure the S3 bucket to use dual-layer server-side encryption with AWS KMS keys (SSE-KMS). Configure the application to use the S3 bucket to store the archival files.
D. Configure the application to use client-side encryption with a key stored in AWS Key Management Service (AWS KMS). Configure the application to store the archival files in the S3 bucket.
Show Answer
Correct Answer: D
Explanation: The requirement is that data must be protected before it is sent to AWS, which requires client-side encryption. Server-side encryption options (SSE-S3, SSE-KMS, and dual-layer SSE-KMS) encrypt data only after Amazon S3 receives it. Using client-side encryption with encryption keys managed in AWS KMS allows the application to encrypt the data locally before upload, ensuring AWS or intermediaries never see the plaintext.
Question 162
A large international university has deployed all of its compute services in the AWS Cloud. These services include Amazon EC2, Amazon RDS, and Amazon DynamoDB. The university currently relies on many custom scripts to back up its infrastructure. However, the university wants to centralize management and automate data backups as much as possible by using AWS native options.
Which solution will meet these requirements?
A. Use third-party backup software with an AWS Storage Gateway tape gateway virtual tape library.
B. Use AWS Backup to configure and monitor all backups for the services in use.
C. Use AWS Config to set lifecycle management to take snapshots of all data sources on a schedule.
D. Use AWS Systems Manager State Manager to manage the configuration and monitoring of backup tasks.
Show Answer
Correct Answer: B
Explanation: AWS Backup is the AWS-native centralized backup service that automates and manages backups across supported AWS services, including Amazon EC2 (via EBS), Amazon RDS, and Amazon DynamoDB. It provides centralized backup policies, scheduling, monitoring, and lifecycle management. The other options do not provide centralized native backup management for these services.
Question 163
A company that uses AWS Organizations runs 150 applications across 30 different AWS accounts. The company used AWS Cost and Usage Report to create a new report in the management account. The report is delivered to an Amazon S3 bucket that is replicated to a bucket in the data collection account.
The company’s senior leadership wants to view a custom dashboard that provides NAT gateway costs each day starting at the beginning of the current month.
Which solution will meet these requirements?
A. Share an Amazon QuickSight dashboard that includes the requested table visual. Configure QuickSight to use AWS DataSync to query the new report.
B. Share an Amazon QuickSight dashboard that includes the requested table visual. Configure QuickSight to use Amazon Athena to query the new report.
C. Share an Amazon CloudWatch dashboard that includes the requested table visual. Configure CloudWatch to use AWS DataSync to query the new report.
D. Share an Amazon CloudWatch dashboard that includes the requested table visual. Configure CloudWatch to use Amazon Athena to query the new report.
Show Answer
Correct Answer: B
Explanation: Amazon QuickSight is the appropriate service for creating and sharing custom business dashboards for senior leadership. AWS Cost and Usage Reports are delivered to Amazon S3, and Amazon Athena is the standard serverless query service used to query CUR data stored in S3. QuickSight can connect to Athena to visualize daily NAT gateway costs from the beginning of the current month. AWS DataSync is for data transfer, not querying, and CloudWatch dashboards are intended for operational metrics rather than CUR-based cost analytics.
Question 164
A company wants to build a map of its IT infrastructure to identify and enforce policies on resources that pose security risks. The company's security team must be able to query data in the IT infrastructure map and quickly identify security risks.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon RDS to store the data. Use SQL to query the data to identify security risks.
B. Use Amazon Neptune to store the data. Use SPARQL to query the data to identify security risks.
C. Use Amazon Redshift to store the data. Use SQL to query the data to identify security risks.
D. Use Amazon DynamoDB to store the data. Use PartiQL to query the data to identify security risks.
Show Answer
Correct Answer: B
Explanation: Amazon Neptune is a managed graph database designed to model and query highly connected data such as IT infrastructure relationships. An infrastructure map is naturally represented as a graph, and SPARQL is a supported graph query language that enables efficient traversal of relationships to identify security risks. The other options are relational, data warehouse, or key-value databases that are less suitable for graph relationship analysis and would require more operational complexity for this use case.
Question 165
A company's web application consists of multiple Amazon EC2 instances that run behind an Application Load Balancer in a VPC. An Amazon RDS for MySQL DB instance contains the data. The company needs the ability to automatically detect and respond to suspicious or unexpected behavior in its AWS environment. The company already has added AWS WAF to its architecture.
What should a solutions architect do next to protect against threats?
A. Use Amazon GuardDuty to perform threat detection. Configure Amazon EventBridge to filter for GuardDuty findings and to invoke an AWS Lambda function to adjust the AWS WAF rules.
B. Use AWS Firewall Manager to perform threat detection. Configure Amazon EventBridge to filter for Firewall Manager findings and to invoke an AWS Lambda function to adjust the AWS WAF web ACL.
C. Use Amazon Inspector to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.
D. Use Amazon Macie to perform threat detection and to update the AWS WAF rules. Create a VPC network ACL to limit access to the web application.
Show Answer
Correct Answer: A
Explanation: Amazon GuardDuty is the AWS managed threat detection service that continuously monitors AWS accounts, workloads, and network activity for suspicious behavior. To automatically respond, Amazon EventBridge can match GuardDuty findings and invoke an AWS Lambda function that updates AWS WAF rules or web ACLs to block malicious sources. Firewall Manager manages security policies rather than performing threat detection, Inspector assesses vulnerabilities, and Macie discovers and protects sensitive data rather than detecting infrastructure threats.
Question 166
A company runs a web application on multiple Amazon EC2 instances in a VPC. The application needs to write sensitive data to an Amazon S3 bucket. The data cannot be sent over the public internet.
Which solution will meet these requirements?
A. Create a gateway VPC endpoint for Amazon S3. Create a route in the VPC route table to the endpoint.
B. Create an internal Network Load Balancer that has the S3 bucket as the target.
C. Deploy the S3 bucket inside the VPCreate a route in the VPC route table to the bucket.
D. Create an AWS Direct Connect connection between the VPC and an S3 regional endpoint.
Show Answer
Correct Answer: A
Explanation: A gateway VPC endpoint for Amazon S3 allows EC2 instances in a VPC to access S3 privately over the AWS network without traversing the public internet. Associating the endpoint with the appropriate route tables ensures traffic to S3 is routed through the endpoint. An NLB cannot target an S3 bucket, S3 buckets are not deployed inside a VPC, and AWS Direct Connect is for private connectivity from on-premises networks, not for VPC-to-S3 access.
Question 167
A company runs its production workload on Amazon EC2 instances with Amazon Elastic Block Store (Amazon EBS) volumes. A solutions architect needs to analyze the current EBS volume cost and to recommend optimizations. The recommendations need to include estimated monthly saving opportunities.
Which solution will meet these requirements?
A. Use Amazon Inspector reporting to generate EBS volume recommendations for optimization.
B. Use AWS Systems Manager reporting to determine EBS volume recommendations for optimization.
C. Use Amazon CloudWatch metrics reporting to determine EBS volume recommendations for optimization.
D. Use AWS Compute Optimizer to generate EBS volume recommendations for optimization.
Show Answer
Correct Answer: D
Explanation: AWS Compute Optimizer analyzes Amazon EBS volume utilization and provides rightsizing recommendations along with estimated monthly cost savings. Amazon Inspector is for security assessments, AWS Systems Manager does not generate EBS cost optimization recommendations, and CloudWatch provides metrics but not optimization recommendations with estimated savings.
Question 168
A company has migrated a fleet of hundreds of on-premises virtual machines (VMs) to Amazon EC2 instances. The instances run a diverse fleet of Windows Server versions along with several Linux distributions. The company wants a solution that will automate inventory and updates of the operating systems. The company also needs a summary of common vulnerabilities of each instance for regular monthly reviews.
What should a solutions architect recommend to meet these requirements?
A. Set up AWS Systems Manager Patch Manager to manage all the EC2 instances. Configure AWS Security Hub to produce monthly reports.
B. Set up AWS Systems Manager Patch Manager to manage all the EC2 instances. Deploy Amazon Inspector, and configure monthly reports.
C. Set up AWS Shield Advanced, and configure monthly reports. Deploy AWS Config to automate patch installations on the EC2 instances.
D. Set up Amazon GuardDuty in the account to monitor all EC2 instances. Deploy AWS Config to automate patch installations on the EC2 instances.
Show Answer
Correct Answer: B
Explanation: AWS Systems Manager Patch Manager automates patching for supported Windows Server and Linux EC2 instances. Amazon Inspector provides automated vulnerability assessment, including CVE findings for EC2 instances, enabling vulnerability summaries suitable for regular reviews. Security Hub aggregates findings but does not perform vulnerability scanning itself, while Shield Advanced, GuardDuty, and AWS Config do not automate OS patching in the way required.
Question 169
A company hosts its application in the AWS Cloud. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Elastic Load Balancing (ELB) load balancer. The application connects to an Amazon DynamoDB table.
For disaster recovery (DR) purposes, the company wants to ensure that the application is available from another AWS Region with minimal downtime.
Which solution will meet these requirements with the LEAST downtime?
A. Create an Auto Scaling group and an ELB in the DR Region. Configure the DynamoDB table as a global table. Configure DNS failover to point to the new DR Region's ELB.
B. Create an AWS CloudFormation template to create EC2 instances, ELBs, and DynamoDB tables to be launched when necessary. Configure DNS failover to point to the new DR Region's EL
C. Create an AWS CloudFormation template to create EC2 instances and an ELB to be launched when necessary. Configure the DynamoDB table as a global table. Configure DNS failover to point to the new DR Region's ELB.
D. Create an Auto Scaling group and an ELB in the DR Region. Configure the DynamoDB table as a global table. Create an Amazon CloudWatch alarm with an evaluation period of 10 minutes to invoke an AWS Lambda function that updates Amazon Route 53 to point to the DR Region's ELB.
Show Answer
Correct Answer: A
Explanation: To achieve the least downtime, the DR infrastructure should already be provisioned. Pre-creating an Auto Scaling group and ELB in the secondary Region avoids the delay of launching infrastructure during a disaster. Using DynamoDB Global Tables keeps data replicated across Regions. Route 53 DNS failover can automatically direct traffic to the DR Region's ELB when the primary endpoint becomes unhealthy. Options B and C require provisioning infrastructure during failover, increasing recovery time. Option D introduces unnecessary delay with a 10-minute CloudWatch alarm evaluation and custom Lambda logic instead of built-in DNS failover.
Question 170
A company is hosting a high-traffic static website on Amazon S3 with an Amazon CloudFront distribution that has a default TTL of 0 seconds. The company wants to implement caching to improve performance for the website. However, the company also wants to ensure that stale content is not served for more than a few minutes after a deployment.
Which combination of caching methods should a solutions architect implement to meet these requirements? (Choose two.)
A. Set the CloudFront default TTL to 2 minutes.
B. Set a default TTL of 2 minutes on the S3 bucket.
C. Add a Cache-Control private directive to the objects in Amazon S3.
D. Create an AWS Lambda@Edge function to add an Expires header to HTTP responses. Configure the function to run on viewer response.
E. Add a Cache-Control max-age directive of 24 hours to the objects in Amazon S3. On deployment, create a CloudFront invalidation to clear any changed files from edge caches.
Show Answer
Correct Answer: A, E
Explanation: Set a short CloudFront default TTL to enable edge caching with frequent refreshes when origin objects do not specify cache headers. For stronger caching performance, use Cache-Control: max-age on S3 objects and invalidate changed objects during deployments so updated content is propagated quickly instead of waiting for the full max-age. S3 buckets do not have a bucket TTL setting, Cache-Control: private is not appropriate for shared caching through CloudFront, and Lambda@Edge is unnecessary for this use case.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.