A company uses a Microsoft SQL Server database. The company's applications are connected to the database. The company wants to migrate to an Amazon Aurora PostgreSQL database with minimal changes to the application code.
Which combination of steps will meet these requirements? (Choose two.)
A. Use the AWS Schema Conversion Tool (AWS SCT) to rewrite the SQL queries in the applications.
B. Enable Babelfish on Aurora PostgreSQL to run the SQL queries from the applications.
C. Migrate the database schema and data by using the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS).
D. Use Amazon RDS Proxy to connect the applications to Aurora PostgreSQL.
E. Use AWS Database Migration Service (AWS DMS) to rewrite the SQL queries in the applications.
Show Answer
Correct Answer: B, C
Explanation: Babelfish for Aurora PostgreSQL allows applications written for Microsoft SQL Server to continue using the TDS protocol and much of T-SQL with minimal application code changes. For the migration itself, AWS Schema Conversion Tool converts the schema and AWS Database Migration Service migrates the data. AWS SCT does not rewrite application SQL, AWS DMS does not rewrite application queries, and RDS Proxy is unrelated to SQL Server compatibility.
Question 135
A company has released a new version of its production application. The company's workload uses Amazon EC2, AWS Lambda, AWS Fargate, and Amazon SageMaker.
The company wants to cost optimize the workload now that usage is at a steady state. The company wants to cover the most services with the fewest savings plans.
Which combination of savings plans will meet these requirements? (Choose two.)
A. Purchase an EC2 Instance Savings Plan for Amazon EC2 and SageMaker.
B. Purchase a Compute Savings Plan for Amazon EC2, Lambda, and SageMaker.
C. Purchase a SageMaker Savings Plan.
D. Purchase a Compute Savings Plan for Lambda, Fargate, and Amazon EC2.
E. Purchase an EC2 Instance Savings Plan for Amazon EC2 and Fargate.
Show Answer
Correct Answer: C, D
Explanation: Compute Savings Plans cover Amazon EC2 (regardless of instance family, size, AZ, Region), AWS Fargate, and AWS Lambda. SageMaker requires its own SageMaker (Machine Learning) Savings Plan and is not covered by Compute Savings Plans. EC2 Instance Savings Plans do not cover Fargate or SageMaker.
Question 136
A solutions architect is designing a three-tier web application. The architecture consists of an internet-facing Application Load Balancer (ALB) and a web tier that is hosted on Amazon EC2 instances in private subnets. The application tier with the business logic runs on EC2 instances in private subnets. The database tier consists of Microsoft SQL Server that runs on EC2 instances in private subnets. Security is a high priority for the company.
Which combination of security group configurations should the solutions architect use? (Choose three.)
A. Configure the security group for the web tier to allow inbound HTTPS traffic from the security group for the ALB.
B. Configure the security group for the web tier to allow outbound HTTPS traffic to 0.0.0.0/0.
C. Configure the security group for the database tier to allow inbound Microsoft SQL Server traffic from the security group for the application tier.
D. Configure the security group for the database tier to allow outbound HTTPS traffic and Microsoft SQL Server traffic to the security group for the web tier.
E. Configure the security group for the application tier to allow inbound HTTPS traffic from the security group for the web tier.
F. Configure the security group for the application tier to allow outbound HTTPS traffic and Microsoft SQL Server traffic to the security group for the web tier.
Show Answer
Correct Answer: A, C, E
Explanation: Use security groups to allow only the required inbound traffic between adjacent tiers by referencing the source security group. The web tier should accept HTTPS only from the ALB security group. The application tier should accept HTTPS only from the web tier security group. The database tier should accept Microsoft SQL Server traffic only from the application tier security group. Because security groups are stateful, return traffic is automatically allowed, so the additional outbound rules described in the other options are unnecessary or incorrect.
Question 137
A company has deployed a multi-account strategy on AWS by using AWS Control Tower. The company has provided individual AWS accounts to each of its developers. The company wants to implement controls to limit AWS resource costs that the developers incur.
Which solution will meet these requirements with the LEAST operational overhead?
A. Instruct each developer to tag all their resources with a tag that has a key of CostCenter and a value of the developer's name. Use the required-tags AWS Config managed rule to check for the tag. Create an AWS Lambda function to terminate resources that do not have the tag. Configure AWS Cost Explorer to send a daily report to each developer to monitor their spending.
B. Use AWS Budgets to establish budgets for each developer account. Set up budget alerts for actual and forecast values to notify developers when they exceed or expect to exceed their assigned budget. Use AWS Budgets actions to apply a DenyAll policy to the developer's IAM role to prevent additional resources from being launched when the assigned budget is reached.
C. Use AWS Cost Explorer to monitor and report on costs for each developer account. Configure Cost Explorer to send a daily report to each developer to monitor their spending. Use AWS Cost Anomaly Detection to detect anomalous spending and provide alerts.
D. Use AWS Service Catalog to allow developers to launch resources within a limited cost range. Create AWS Lambda functions in each AWS account to stop running resources at the end of each work day. Configure the Lambda functions to resume the resources at the start of each work day.
Show Answer
Correct Answer: B
Explanation: AWS Budgets provides native per-account budgets, alerts on actual and forecasted spend, and Budget Actions that can automatically apply restrictive IAM policies (or SCPs in Organizations scenarios) to limit additional resource creation once thresholds are reached. This directly implements cost controls with minimal operational overhead compared to custom tagging/Lambda automation, monitoring-only approaches, or scheduled resource management.
Question 138
A company creates dedicated AWS accounts in AWS Organizations for its business units. Recently, an important notification was sent to the root user email address of a business unit account instead of the assigned account owner. The company wants to ensure that all future notifications can be sent to different employees based on the notification categories of billing, operations, or security.
Which solution will meet these requirements MOST securely?
A. Configure each AWS account to use a single email address that the company manages. Ensure that all account owners can access the email account to receive notifications. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
B. Configure each AWS account to use a different email distribution list for each business unit that the company manages. Configure each distribution list with administrator email addresses that can respond to alerts. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
C. Configure each AWS account root user email address to be the individual company managed email address of one person from each business unit. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
D. Configure each AWS account root user to use email aliases that go to a centralized mailbox. Configure alternate contacts for each account by using a single business managed email distribution list each for the billing team, the security team, and the operations team.
Show Answer
Correct Answer: D
Explanation: Using centrally managed root email aliases that route to a controlled mailbox avoids tying the root account to an individual and preserves access. AWS alternate contacts should then be configured for billing, operations, and security so notifications are sent to the appropriate role-based distribution lists. This best satisfies the requirement to route notifications by category while keeping root account access centrally controlled.
Question 139
A company wants to isolate its workloads by creating an AWS account for each workload. The company needs a solution that centrally manages networking components for the workloads. The solution also must create accounts with automatic security controls (guardrails).
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS Control Tower to deploy accounts. Create a networking account that has a VPC with private subnets and public subnets. Use AWS Resource Access Manager (AWS RAM) to share the subnets with the workload accounts.
B. Use AWS Organizations to deploy accounts. Create a networking account that has a VPC with private subnets and public subnets. Use AWS Resource Access Manager (AWS RAM) to share the subnets with the workload accounts.
C. Use AWS Control Tower to deploy accounts. Deploy a VPC in each workload account. Configure each VPC to route through an inspection VPC by using a transit gateway attachment.
D. Use AWS Organizations to deploy accounts. Deploy a VPC in each workload account. Configure each VPC to route through an inspection VPC by using a transit gateway attachment.
Show Answer
Correct Answer: A
Explanation: AWS Control Tower is the key requirement because it automates multi-account provisioning and applies built-in security guardrails. For centralized networking with the least operational overhead, a shared VPC model using AWS RAM allows workload accounts to use centrally managed subnets from a networking account. Options using only AWS Organizations do not provide automatic guardrails, and transit gateway with inspection VPC adds unnecessary operational complexity.
Question 140
A company runs its critical storage application in the AWS Cloud. The application uses Amazon S3 in two AWS Regions. The company wants the application to send remote user data to the nearest S3 bucket with no public network congestion. The company also wants the application to fail over with the least amount of management of Amazon S3.
Which solution will meet these requirements?
A. Implement an active-active design between the two Regions. Configure the application to use the regional S3 endpoints closest to the user.
B. Use an active-passive configuration with S3 Multi-Region Access Points. Create a global endpoint for each of the Regions.
C. Send user data to the regional S3 endpoints closest to the user. Configure an S3 cross-account replication rule to keep the S3 buckets synchronized.
D. Set up Amazon S3 to use Multi-Region Access Points in an active-active configuration with a single global endpoint. Configure S3 Cross-Region Replication.
Show Answer
Correct Answer: D
Explanation: Amazon S3 Multi-Region Access Points provide a single global endpoint that routes requests over the AWS global network to the closest healthy bucket, minimizing public internet congestion and simplifying failover. Cross-Region Replication keeps the buckets synchronized in an active-active design. This best satisfies low latency, resilience, and minimal management.
Question 141
A company runs an ecommerce application on AWS. Amazon EC2 instances process purchases and store the purchase details in an Amazon Aurora PostgreSQL DB cluster.
Customers are experiencing application timeouts during times of peak usage. A solutions architect needs to rearchitect the application so that the application can scale to meet peak usage demands.
Which combination of actions will meet these requirements MOST cost-effectively? (Choose two.)
A. Configure an Auto Scaling group of new EC2 instances to retry the purchases until the processing is complete. Update the applications to connect to the DB cluster by using Amazon RDS Proxy.
B. Configure the application to use an Amazon ElastiCache cluster in front of the Aurora PostgreSQL DB cluster.
C. Update the application to send the purchase requests to an Amazon Simple Queue Service (Amazon SQS) queue. Configure an Auto Scaling group of new EC2 instances that read from the SQS queue.
D. Configure an AWS Lambda function to retry the ticket purchases until the processing is complete.
E. Configure an Amazon AP! Gateway REST API with a usage plan.
Show Answer
Correct Answer: A, C
Explanation: Using Amazon SQS with an Auto Scaling group decouples request ingestion from processing, allowing the system to absorb traffic spikes and scale workers based on queue depth. Amazon RDS Proxy helps Aurora handle large numbers of concurrent application connections efficiently through connection pooling, reducing connection-related timeouts during peak load. ElastiCache primarily benefits read-heavy workloads and does not accelerate write-heavy purchase transactions.
Sources:
https://codingnconcepts.com/aws/aws-certified-solutions-architect-associate-exam-questions
Question 142
A company uses Amazon S3 to host its static website. The company wants to add a contact form to the webpage. The contact form will have dynamic server-side components for users to input their name, email address, phone number, and user message.
The company expects fewer than 100 site visits each month. The contact form must notify the company by email when a customer fills out the form.
Which solution will meet these requirements MOST cost-effectively?
A. Host the dynamic contact form in Amazon Elastic Container Service (Amazon ECS). Set up Amazon Simple Email Service (Amazon SES) to connect to a third-party email provider.
B. Create an Amazon API Gateway endpoint that returns the contact form from an AWS Lambda function. Configure another Lambda function on the API Gateway to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic.
C. Host the website by using AWS Amplify Hosting for static content and dynamic content. Use server-side scripting to build the contact form. Configure Amazon Simple Queue Service (Amazon SQS) to deliver the message to the company.
D. Migrate the website from Amazon S3 to Amazon EC2 instances that run Windows Server. Use Internet Information Services (IIS) for Windows Server to host the webpage. Use client-side scripting to build the contact form. Integrate the form with Amazon WorkMail.
Show Answer
Correct Answer: B
Explanation: For a static website with very low traffic, a serverless architecture is the most cost-effective. Amazon API Gateway can receive the form submission, AWS Lambda can process the request, and Amazon SNS can send an email notification to subscribers. This avoids always-on compute such as ECS or EC2. Amplify Hosting with SQS does not satisfy the email notification requirement by itself, and ECS/EC2 are unnecessarily expensive for fewer than 100 visits per month.
Question 143
A company has 15 employees. The company stores employee start dates in an Amazon DynamoDB table. The company wants to send an email message to each employee on the day of the employee's work anniversary.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a script that scans the DynamoDB table and uses Amazon Simple Notification Service (Amazon SNS) to send email messages to employees when necessary. Use a cron job to run this script every day on an Amazon EC2 instance.
B. Create a script that scans the DynamoDB table and uses Amazon Simple Queue Service (Amazon SQS) to send email messages to employees when necessary. Use a cron job to run this script every day on an Amazon EC2 instance.
C. Create an AWS Lambda function that scans the DynamoDB table and uses Amazon Simple Notification Service (Amazon SNS) to send email messages to employees when necessary. Schedule this Lambda function to run every day.
D. Create an AWS Lambda function that scans the DynamoDB table and uses Amazon Simple Queue Service (Amazon SQS) to send email messages to employees when necessary. Schedule this Lambda function to run every day.
Show Answer
Correct Answer: C
Explanation: AWS Lambda scheduled to run daily (typically via Amazon EventBridge) is the most operationally efficient because it is serverless and eliminates EC2 instance management. Amazon SNS supports sending email notifications, whereas Amazon SQS is a message queue and does not send emails. Therefore, a scheduled Lambda function that scans the DynamoDB table and publishes email notifications through SNS best meets the requirements.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.