A company plans to run a high performance computing (HPC) workload on Amazon EC2 Instances. The workload requires low-latency network performance and high network throughput with tightly coupled node-to-node communication.
Which solution will meet these requirements?
A. Configure the EC2 instances to be part of a cluster placement group.
B. Launch the EC2 instances with Dedicated Instance tenancy.
C. Launch the EC2 instances as Spot Instances.
D. Configure an On-Demand Capacity Reservation when the EC2 instances are launched.
Show Answer
Correct Answer: A
Explanation: Cluster placement groups place instances close together within a single Availability Zone to provide the lowest network latency and highest network throughput, making them the recommended choice for tightly coupled HPC workloads. Dedicated Instances affect tenancy, Spot Instances affect pricing, and Capacity Reservations guarantee capacity but do not improve network performance.
Question 182
A company wants to configure its Amazon CloudFront distribution to use SSL/TLS certificates. The company does not want to use the default domain name for the distribution. Instead, the company wants to use a different domain name for the distribution.
Which solution will deploy the certificate without incurring any additional costs?
A. Request an Amazon issued private certificate from AWS Certificate Manager (ACM) in the us-east-1 Region.
B. Request an Amazon issued private certificate from AWS Certificate Manager (ACM) in the us-west-1 Region.
C. Request an Amazon issued public certificate from AWS Certificate Manager (ACM) in the us-east-1 Region.
D. Request an Amazon issued public certificate from AWS Certificate Manager (ACM) in the us-west-1 Region.
Show Answer
Correct Answer: C
Explanation: Amazon CloudFront requires ACM certificates for custom domain names (alternate domain names/CNAMEs) to be requested or imported in the US East (N. Virginia) Region (us-east-1). Because the distribution uses a custom domain that must be trusted by browsers, the certificate must be a public ACM certificate. ACM-issued public certificates are free, whereas private certificates require AWS Private CA and incur additional costs.
Question 183
A company runs an AWS Lambda function in private subnets in a VPC. The subnets have a default route to the internet through an Amazon EC2 NAT instance. The Lambda function processes input data and saves its output as an object to Amazon S3.
Intermittently, the Lambda function times out while trying to upload the object because of saturated traffic on the NAT instance's network. The company wants to access Amazon S3 without traversing the internet.
Which solution will meet these requirements?
A. Replace the EC2 NAT instance with an AWS managed NAT gateway.
B. Increase the size of the EC2 NAT instance in the VPC to a network optimized instance type.
C. Provision a gateway endpoint for Amazon S3 in the VPUpdate the route tables of the subnets accordingly.
D. Provision a transit gateway. Place transit gateway attachments in the private subnets where the Lambda function is running.
Show Answer
Correct Answer: C
Explanation: An Amazon S3 gateway VPC endpoint allows resources in private subnets, including Lambda functions attached to a VPC, to access S3 over the AWS network without using a NAT instance, NAT gateway, or the public internet. Updating the subnet route tables to use the gateway endpoint removes the NAT bottleneck and satisfies the requirement to avoid traversing the internet.
Question 184
A company recently migrated its application to AWS. The application runs on Amazon EC2 Linux instances in an Auto Scaling group across multiple Availability Zones. The application stores data in an Amazon Elastic File System (Amazon EFS) file system that uses EFS Standard-Infrequent Access storage. The application indexes the company's files. The index is stored in an Amazon RDS database.
The company needs to optimize storage costs with some application and services changes.
Which solution will meet these requirements MOST cost-effectively?
A. Create an Amazon S3 bucket that uses an Intelligent-Tiering lifecycle policy. Copy all files to the S3 bucket. Update the application to use Amazon S3 API to store and retrieve files.
B. Deploy Amazon FSx for Windows File Server file shares. Update the application to use CIFS protocol to store and retrieve files.
C. Deploy Amazon FSx for OpenZFS file system shares. Update the application to use the new mount point to store and retrieve files.
D. Create an Amazon S3 bucket that uses S3 Glacier Flexible Retrieval. Copy all files to the S3 bucket. Update the application to use Amazon S3 API to store and retrieve files as standard retrievals.
Show Answer
Correct Answer: A
Explanation: Amazon S3 with Intelligent-Tiering is generally the most cost-effective storage option when the application can be modified to use the S3 API. It automatically moves objects between access tiers based on usage while maintaining millisecond access, reducing storage costs without the retrieval delays of Glacier. FSx for Windows is inappropriate for a Linux/NFS workload, and FSx for OpenZFS is not a lower-cost replacement for this use case. Glacier Flexible Retrieval is unsuitable because the application indexes and retrieves files and Glacier introduces retrieval latency and restore workflows.
Question 185
A company serves its website by using an Auto Scaling group of Amazon EC2 instances in a single AWS Region. The website does not require a database.
The company is expanding, and the company's engineering team deploys the website to a second Region. The company wants to distribute traffic across both Regions to accommodate growth and for disaster recovery purposes. The solution should not serve traffic from a Region in which the website is unhealthy.
Which policy or resource should the company use to meet these requirements?
A. An Amazon Route 53 simple routing policy
B. An Amazon Route 53 multivalue answer routing policy
C. An Application Load Balancer in one Region with a target group that specifies the EC2 instance IDs from both Regions
D. An Application Load Balancer in one Region with a target group that specifies the IP addresses of the EC2 instances from both Regions
Show Answer
Correct Answer: B
Explanation: Route 53 multivalue answer routing can return multiple healthy endpoints and uses health checks to stop returning unhealthy resources. This allows DNS-based distribution across Regions while avoiding traffic to an unhealthy Region. Simple routing does not provide this health-aware behavior, and an Application Load Balancer cannot have instance ID targets across Regions; cross-Region target groups are not supported in this manner.
Question 186
A company is expanding a secure on-premises network to the AWS Cloud by using an AWS Direct Connect connection. The on-premises network has no direct internet access. An application that runs on the on-premises network needs to use an Amazon S3 bucket.
Which solution will meet these requirements MOST cost-effectively?
A. Create a public virtual interface (VIF). Route the AWS traffic over the public VIF.
B. Create a VPC and a NAT gateway. Route the AWS traffic from the on-premises network to the NAT gateway.
C. Create a VPC and an Amazon S3 interface endpoint. Route the AWS traffic from the on-premises network to the S3 interface endpoint.
D. Create a VPC peering connection between the on-premises network and Direct Connect. Route the AWS traffic over the peering connection.
Show Answer
Correct Answer: A
Explanation: A public virtual interface (public VIF) on AWS Direct Connect is specifically designed to access AWS public services such as Amazon S3 over the Direct Connect connection without using the public internet path. It is the most cost-effective option because it does not require creating a VPC, NAT gateway, or AWS PrivateLink interface endpoint, which add hourly and data processing charges. A NAT gateway is unrelated to on-premises access to S3, an S3 interface endpoint requires additional VPC infrastructure and cost, and VPC peering cannot connect an on-premises network to Direct Connect.
Sources:
https://aws.amazon.com/blogs/networking-and-content-delivery/optimizing-amazon-s3-data-transfers-over-direct-connect
https://aws.amazon.com/directconnect/faqs
Question 187
A company is designing an event-driven order processing system. Each order requires multiple validation steps after the order is created. An idempotent AWS Lambda function performs each validation step. Each validation step is independent from the other validation steps. Individual validation steps need only a subset of the order event information.
The company wants to ensure that each validation step Lambda function has access to only the information from the order event that the function requires. The components of the order processing system should be loosely coupled to accommodate future business changes.
Which solution will meet these requirements?
A. Create an Amazon Simple Queue Service (Amazon SQS) queue for each validation step. Create a new Lambda function to transform the order data to the format that each validation step requires and to publish the messages to the appropriate SQS queues. Subscribe each validation step Lambda function to its corresponding SQS queue.
B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the validation step Lambda functions to the SNS topic. Use message body filtering to send only the required data to each subscribed Lambda function.
C. Create an Amazon EventBridge event bus. Create an event rule for each validation step. Configure the input transformer to send only the required data to each target validation step Lambda function.
D. Create an Amazon Simple Queue Service (Amazon SQS) queue. Create a new Lambda function to subscribe to the SQS queue and to transform the order data to the format that each validation step requires. Use the new Lambda function to perform synchronous invocations of the validation step Lambda functions in parallel on separate threads.
Show Answer
Correct Answer: C
Explanation: Amazon EventBridge is designed for loosely coupled event-driven architectures. An EventBridge rule can target each validation Lambda independently, and the rule's input transformer can pass only the subset of the event each Lambda requires. SNS message filtering only determines which subscribers receive a message; it does not transform the payload for each subscriber. The SQS-based options introduce unnecessary transformation/orchestration Lambdas and, in option D, create tighter coupling through synchronous Lambda invocations.
Question 188
A company has an on-premises SFTP file transfer solution. The company is migrating to the AWS Cloud to scale the file transfer solution and to optimize costs by using Amazon S3. The company's employees will use their credentials for the on-premises Microsoft Active Directory (AD) to access the new solution. The company wants to keep the current authentication and file access mechanisms.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure an S3 File Gateway. Create SMB file shares on the file gateway that use the existing Active Directory to authenticate.
B. Configure an Auto Scaling group with Amazon EC2 instances to run an SFTP solution. Configure the group to scale up at 60% CPU utilization.
C. Create an AWS Transfer Family server with SFTP endpoints. Choose the AWS Directory Service option as the identity provider. Use AD Connector to connect the on-premises Active Directory.
D. Create an AWS Transfer Family SFTP endpoint. Configure the endpoint to use the AWS Directory Service option as the identity provider to connect to the existing Active Directory.
Show Answer
Correct Answer: C
Explanation: AWS Transfer Family provides a managed SFTP service backed by Amazon S3, minimizing operational overhead. To keep existing on-premises Microsoft Active Directory credentials, AWS Directory Service with AD Connector bridges to the existing AD without requiring migration. Option D is incomplete because it omits the required AD Connector for an existing on-premises Active Directory.
Question 189
A company needs a secure connection between its on-premises environment and AWS. This connection does not need high bandwidth and will handle a small amount of traffic. The connection should be set up quickly.
What is the MOST cost-effective method to establish this type of connection?
A. Implement a client VPN.
B. Implement AWS Direct Connect.
C. Implement a bastion host on Amazon EC2.
D. Implement an AWS Site-to-Site VPN connection.
Show Answer
Correct Answer: D
Explanation: AWS Site-to-Site VPN is the most cost-effective and fastest way to securely connect an on-premises network to AWS for low-bandwidth, low-volume traffic. AWS Direct Connect is intended for dedicated, higher-bandwidth connectivity and takes longer to provision. A client VPN is for individual client access rather than network-to-network connectivity, and a bastion host provides administrative access rather than a secure site-to-site network connection.
Question 190
A company uses an Amazon S3 bucket as its data lake storage platform. The S3 bucket contains a massive amount of data that is accessed randomly by multiple teams and hundreds of applications. The company wants to reduce the S3 storage costs and provide immediate availability for frequently accessed objects.
What is the MOST operationally efficient solution that meets these requirements?
A. Create an S3 Lifecycle rule to transition objects to the S3 Intelligent-Tiering storage class.
B. Store objects in Amazon S3 Glacier. Use S3 Select to provide applications with access to the data.
C. Use data from S3 storage class analysis to create S3 Lifecycle rules to automatically transition objects to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class.
D. Transition objects to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class. Create an AWS Lambda function to transition objects to the S3 Standard storage class when they are accessed by an application.
Show Answer
Correct Answer: A
Explanation: S3 Intelligent-Tiering is designed for data with unknown or changing access patterns. It automatically moves objects between frequent and infrequent access tiers while maintaining immediate retrieval for frequently accessed objects, minimizing operational overhead. Glacier does not provide immediate access, Standard-IA based on storage class analysis is less adaptive for random access patterns, and using Lambda to move objects back to Standard adds unnecessary operational complexity.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.