A company runs an AWS Lambda function in private subnets in a VPC. The subnets have a default route to the internet through an Amazon EC2 NAT instance. The Lambda function processes input data and saves its output as an object to Amazon S3.
Intermittently, the Lambda function times out while trying to upload the object because of saturated traffic on the NAT instance's network. The company wants to access Amazon S3 without traversing the internet.
Which solution will meet these requirements?
A. Replace the EC2 NAT instance with an AWS managed NAT gateway.
B. Increase the size of the EC2 NAT instance in the VPC to a network optimized instance type.
C. Provision a gateway endpoint for Amazon S3 in the VPUpdate the route tables of the subnets accordingly.
D. Provision a transit gateway. Place transit gateway attachments in the private subnets where the Lambda function is running.
Show Answer
Correct Answer: C
Explanation: The requirement is to access Amazon S3 without traversing the internet and to avoid congestion on the NAT instance. An Amazon S3 gateway VPC endpoint allows private connectivity to S3 directly over the AWS network, bypassing NAT instances and the public internet. Updating the subnet route tables to use the gateway endpoint removes the NAT bottleneck and resolves the timeout issue. NAT instances or gateways (A, B) still use internet routing, and a transit gateway (D) is unnecessary and does not provide direct private access to S3.
Question 184
A company recently migrated its application to AWS. The application runs on Amazon EC2 Linux instances in an Auto Scaling group across multiple Availability Zones. The application stores data in an Amazon Elastic File System (Amazon EFS) file system that uses EFS Standard-Infrequent Access storage. The application indexes the company's files. The index is stored in an Amazon RDS database.
The company needs to optimize storage costs with some application and services changes.
Which solution will meet these requirements MOST cost-effectively?
A. Create an Amazon S3 bucket that uses an Intelligent-Tiering lifecycle policy. Copy all files to the S3 bucket. Update the application to use Amazon S3 API to store and retrieve files.
B. Deploy Amazon FSx for Windows File Server file shares. Update the application to use CIFS protocol to store and retrieve files.
C. Deploy Amazon FSx for OpenZFS file system shares. Update the application to use the new mount point to store and retrieve files.
D. Create an Amazon S3 bucket that uses S3 Glacier Flexible Retrieval. Copy all files to the S3 bucket. Update the application to use Amazon S3 API to store and retrieve files as standard retrievals.
Show Answer
Correct Answer: A
Explanation: The requirement is to optimize storage costs and the company is open to application and service changes. Amazon S3 provides significantly lower cost per GB than Amazon EFS and is designed for durable, scalable object storage. Using S3 Intelligent-Tiering automatically moves objects between access tiers based on usage without retrieval delays or manual lifecycle management, making it cost‑effective for data with unpredictable access patterns. The application can be updated to use S3 APIs, eliminating the need for a shared file system. FSx options are more expensive and unnecessary for simple file indexing, and Glacier introduces retrieval delays that are unsuitable for an actively indexed application.
Question 185
A company serves its website by using an Auto Scaling group of Amazon EC2 instances in a single AWS Region. The website does not require a database.
The company is expanding, and the company's engineering team deploys the website to a second Region. The company wants to distribute traffic across both Regions to accommodate growth and for disaster recovery purposes. The solution should not serve traffic from a Region in which the website is unhealthy.
Which policy or resource should the company use to meet these requirements?
A. An Amazon Route 53 simple routing policy
B. An Amazon Route 53 multivalue answer routing policy
C. An Application Load Balancer in one Region with a target group that specifies the EC2 instance IDs from both Regions
D. An Application Load Balancer in one Region with a target group that specifies the IP addresses of the EC2 instances from both Regions
Show Answer
Correct Answer: B
Explanation: The company needs to distribute traffic across two AWS Regions and ensure that traffic is not sent to an unhealthy Region. Amazon Route 53 multivalue answer routing can return multiple IP addresses (for endpoints in different Regions) and associate health checks with each one, so Route 53 responds only with healthy endpoints. Simple routing does not provide health-based filtering, and an Application Load Balancer cannot target resources across Regions. Therefore, Route 53 multivalue answer routing best meets the requirements.
Question 186
A company is expanding a secure on-premises network to the AWS Cloud by using an AWS Direct Connect connection. The on-premises network has no direct internet access. An application that runs on the on-premises network needs to use an Amazon S3 bucket.
Which solution will meet these requirements MOST cost-effectively?
A. Create a public virtual interface (VIF). Route the AWS traffic over the public VIF.
B. Create a VPC and a NAT gateway. Route the AWS traffic from the on-premises network to the NAT gateway.
C. Create a VPC and an Amazon S3 interface endpoint. Route the AWS traffic from the on-premises network to the S3 interface endpoint.
D. Create a VPC peering connection between the on-premises network and Direct Connect. Route the AWS traffic over the peering connection.
Show Answer
Correct Answer: A
Explanation: An AWS Direct Connect public virtual interface (VIF) allows an on‑premises network to privately access AWS public services such as Amazon S3 without using the public internet. This meets the requirement of no internet access and avoids the extra hourly and data processing costs of running a VPC, NAT gateway, or S3 interface endpoint. Therefore, routing S3 traffic over a public VIF is the most cost‑effective solution.
Question 187
A company is designing an event-driven order processing system. Each order requires multiple validation steps after the order is created. An idempotent AWS Lambda function performs each validation step. Each validation step is independent from the other validation steps. Individual validation steps need only a subset of the order event information.
The company wants to ensure that each validation step Lambda function has access to only the information from the order event that the function requires. The components of the order processing system should be loosely coupled to accommodate future business changes.
Which solution will meet these requirements?
A. Create an Amazon Simple Queue Service (Amazon SQS) queue for each validation step. Create a new Lambda function to transform the order data to the format that each validation step requires and to publish the messages to the appropriate SQS queues. Subscribe each validation step Lambda function to its corresponding SQS queue.
B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the validation step Lambda functions to the SNS topic. Use message body filtering to send only the required data to each subscribed Lambda function.
C. Create an Amazon EventBridge event bus. Create an event rule for each validation step. Configure the input transformer to send only the required data to each target validation step Lambda function.
D. Create an Amazon Simple Queue Service (Amazon SQS) queue. Create a new Lambda function to subscribe to the SQS queue and to transform the order data to the format that each validation step requires. Use the new Lambda function to perform synchronous invocations of the validation step Lambda functions in parallel on separate threads.
Show Answer
Correct Answer: C
Explanation: Amazon EventBridge supports loosely coupled, event-driven architectures and allows defining separate rules per validation step. Using input transformers, each rule can deliver only the required subset of the order event to its target Lambda function, enforcing least-privilege data access. This avoids extra preprocessing Lambdas, keeps components independent, and accommodates future changes more cleanly than SNS (which cannot transform payloads) or synchronous orchestration approaches.
Question 188
A company has an on-premises SFTP file transfer solution. The company is migrating to the AWS Cloud to scale the file transfer solution and to optimize costs by using Amazon S3. The company's employees will use their credentials for the on-premises Microsoft Active Directory (AD) to access the new solution. The company wants to keep the current authentication and file access mechanisms.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure an S3 File Gateway. Create SMB file shares on the file gateway that use the existing Active Directory to authenticate.
B. Configure an Auto Scaling group with Amazon EC2 instances to run an SFTP solution. Configure the group to scale up at 60% CPU utilization.
C. Create an AWS Transfer Family server with SFTP endpoints. Choose the AWS Directory Service option as the identity provider. Use AD Connector to connect the on-premises Active Directory.
D. Create an AWS Transfer Family SFTP endpoint. Configure the endpoint to use the AWS Directory Service option as the identity provider to connect to the existing Active Directory.
Show Answer
Correct Answer: C
Explanation: AWS Transfer Family provides a fully managed SFTP service that directly integrates with Amazon S3, eliminating the need to manage servers. By using AWS Directory Service with an AD Connector, the solution can authenticate users against the existing on‑premises Microsoft Active Directory, preserving current credentials and access mechanisms. This meets the requirements for SFTP, AD-based authentication, scalability, and low operational overhead. Other options either do not provide SFTP, require managing EC2 instances, or do not correctly bridge to the on‑premises AD.
Question 189
A company needs a secure connection between its on-premises environment and AWS. This connection does not need high bandwidth and will handle a small amount of traffic. The connection should be set up quickly.
What is the MOST cost-effective method to establish this type of connection?
A. Implement a client VPN.
B. Implement AWS Direct Connect.
C. Implement a bastion host on Amazon EC2.
D. Implement an AWS Site-to-Site VPN connection.
Show Answer
Correct Answer: D
Explanation: An AWS Site-to-Site VPN provides a secure IPsec connection between an on-premises network and AWS over the internet. It is quick to set up, cost-effective, and well-suited for low bandwidth and small traffic requirements. AWS Direct Connect is more expensive and intended for high bandwidth and dedicated links, a client VPN is for individual users rather than network-to-network connectivity, and a bastion host is for administrative access, not full network integration.
Question 190
A company uses an Amazon S3 bucket as its data lake storage platform. The S3 bucket contains a massive amount of data that is accessed randomly by multiple teams and hundreds of applications. The company wants to reduce the S3 storage costs and provide immediate availability for frequently accessed objects.
What is the MOST operationally efficient solution that meets these requirements?
A. Create an S3 Lifecycle rule to transition objects to the S3 Intelligent-Tiering storage class.
B. Store objects in Amazon S3 Glacier. Use S3 Select to provide applications with access to the data.
C. Use data from S3 storage class analysis to create S3 Lifecycle rules to automatically transition objects to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class.
D. Transition objects to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class. Create an AWS Lambda function to transition objects to the S3 Standard storage class when they are accessed by an application.
Show Answer
Correct Answer: A
Explanation: The workload accesses objects randomly with unpredictable patterns and requires immediate availability while reducing storage cost. Amazon S3 Intelligent-Tiering is designed for this scenario: it automatically monitors access patterns and moves objects between frequent, infrequent, and archive instant access tiers without performance impact or operational overhead. This is the most operationally efficient option. Glacier does not provide immediate access, Standard-IA requires manual or heuristic lifecycle management, and using Lambda to move objects back adds unnecessary complexity.
Question 191
A financial services company that runs on AWS has designed its security controls to meet industry standards. The industry standards include the National Institute of Standards and Technology (NIST) and the Payment Card Industry Data Security Standard (PCI DSS).
The company's third-party auditors need proof that the designed controls have been implemented and are functioning correctly. The company has hundreds of AWS accounts in a single organization in AWS Organizations. The company needs to monitor the current state of the controls across accounts.
Which solution will meet these requirements?
A. Designate one account as the Amazon Inspector delegated administrator account from the Organizations management account. Integrate Inspector with Organizations to discover and scan resources across all AWS accounts. Enable Inspector industry standards for NIST and PCI DSS.
B. Designate one account as the Amazon GuardDuty delegated administrator account from the Organizations management account. In the designated GuardDuty administrator account, enable GuardDuty to protect all member accounts. Enable GuardDuty industry standards for NIST and PCI DSS.
C. Configure an AWS CloudTrail organization trail in the Organizations management account. Designate one account as the compliance account. Enable CloudTrail security standards for NIST and PCI DSS in the compliance account.
D. Designate one account as the AWS Security Hub delegated administrator account from the Organizations management account. In the designated Security Hub administrator account, enable Security Hub for all member accounts. Enable Security Hub standards for NIST and PCI DSS.
Show Answer
Correct Answer: D
Explanation: AWS Security Hub is designed to aggregate, monitor, and report on the security posture across multiple AWS accounts and Regions. It supports industry standards and frameworks, including NIST and PCI DSS, and provides continuous compliance checks. By designating a Security Hub delegated administrator account and enabling it organization-wide, the company can centrally monitor whether controls are implemented and functioning correctly, and provide auditors with evidence of compliance across hundreds of accounts.
Question 192
A company uses Salesforce. The company needs to load existing data and ongoing data changes from Salesforce to Amazon Redshift for analysis. The company does not want the data to travel over the public internet.
Which solution will meet these requirements with the LEAST development effort?
A. Establish a VPN connection from the VPC to Salesforce. Use AWS Glue DataBrew to transfer data.
B. Establish an AWS Direct Connect connection from the VPC to Salesforce. Use AWS Glue DataBrew to transfer data.
C. Create an AWS PrivateLink connection in the VPC to Salesforce. Use Amazon AppFlow to transfer data.
D. Create a VPC peering connection to Salesforce. Use Amazon AppFlow to transfer data.
Show Answer
Correct Answer: C
Explanation: Amazon AppFlow is a fully managed service that natively supports Salesforce as a source and Amazon Redshift as a destination, handling both initial loads and ongoing data changes with minimal development effort. When combined with AWS PrivateLink, the data transfer remains on the AWS private network and does not traverse the public internet. VPN and Direct Connect require more setup and do not reduce development effort, AWS Glue DataBrew is not designed for continuous change data capture, and VPC peering cannot be used with an external SaaS provider like Salesforce.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.