A company has 5 TB of datasets. The datasets consist of 1 million user profiles and 10 million connections. The user profiles have connections as many-to-many relationships. The company needs a performance efficient way to find mutual connections up to five levels.
Which solution will meet these requirements?
A. Use an Amazon S3 bucket to store the datasets. Use Amazon Athena to perform SQL JOIN queries to find connections.
B. Use Amazon Neptune to store the datasets with edges and vertices. Query the data to find connections.
C. Use an Amazon S3 bucket to store the datasets. Use Amazon QuickSight to visualize connections.
D. Use Amazon RDS to store the datasets with multiple tables. Perform SQL JOIN queries to find connections.
Show Answer
Correct Answer: B
Explanation: The problem involves highly connected, many-to-many relationships and requires efficient traversal to find mutual connections up to five levels deep. Graph databases are purpose-built for this type of workload. Amazon Neptune stores data as vertices and edges and is optimized for fast graph traversals (e.g., friends-of-friends queries) at scale. SQL-based solutions using S3/Athena or RDS would require complex, expensive JOIN operations and would not perform efficiently for multi-level relationship queries, while QuickSight is only for visualization, not querying relationships.
Question 194
A robotics company is designing a solution for medical surgery. The robots will use advanced sensors, cameras, and AI algorithms to perceive their environment and to complete surgeries.
The company needs a public load balancer in the AWS Cloud that will ensure seamless communication with backend services. The load balancer must be capable of routing traffic based on the query strings to different target groups. The traffic must also be encrypted.
Which solution will meet these requirements?
A. Use a Network Load Balancer with a certificate attached from AWS Certificate Manager (ACM). Use query parameter-based routing.
B. Use a Gateway Load Balancer. Import a generated certificate in AWS Identity and Access Management (IAM). Attach the certificate to the load balancer. Use HTTP path-based routing.
C. Use an Application Load Balancer with a certificate attached from AWS Certificate Manager (ACM). Use query parameter-based routing.
D. Use a Network Load Balancer. Import a generated certificate in AWS Identity and Access Management (IAM). Attach the certificate to the load balancer. Use query parameter-based routing.
Show Answer
Correct Answer: C
Explanation: The requirement is a public load balancer that can route traffic based on query strings and encrypt traffic. Query string–based routing is a Layer 7 feature supported only by an Application Load Balancer (ALB). ALB integrates directly with AWS Certificate Manager (ACM) for HTTPS/TLS termination. Network Load Balancers and Gateway Load Balancers do not support query parameter–based routing. Therefore, an Application Load Balancer with an ACM certificate and query parameter–based routing is the correct solution.
Question 195
A news company that has reporters all over the world is hosting its broadcast system on AWS. The reporters send live broadcasts to the broadcast system. The reporters use software on their phones to send live streams through the Real Time Messaging Protocol (RTMP).
A solutions architect must design a solution that gives the reporters the ability to send the highest quality streams. The solution must provide accelerated TCP connections back to the broadcast system.
What should the solutions architect use to meet these requirements?
A. Amazon CloudFront
B. AWS Global Accelerator
C. AWS Client VPN
D. Amazon EC2 instances and AWS Elastic IP addresses
Show Answer
Correct Answer: B
Explanation: The reporters use RTMP, which runs over TCP, and require accelerated TCP connections from global locations back to AWS. AWS Global Accelerator is designed to accelerate TCP and UDP traffic by using the AWS global network and Anycast IPs to route traffic to the nearest edge and then optimally to the backend. CloudFront primarily accelerates HTTP/HTTPS-based workloads, not generic TCP ingest. Therefore, AWS Global Accelerator best meets the requirement.
Question 196
A company is planning to deploy its application on an Amazon Aurora PostgreSQL Serverless v2 cluster. The application will receive large amounts of traffic. The company wants to optimize the storage performance of the cluster as the load on the application increases.
Which solution will meet these requirements MOST cost-effectively?
A. Configure the cluster to use the Aurora Standard storage configuration.
B. Configure the cluster storage type as Provisioned IOPS.
C. Configure the cluster storage type as General Purpose.
D. Configure the cluster to use the Aurora I/O-Optimized storage configuration.
Show Answer
Correct Answer: D
Explanation: Amazon Aurora supports two storage configurations: Standard and I/O-Optimized. For an Aurora PostgreSQL Serverless v2 cluster that will experience large and increasing traffic, storage I/O will grow significantly. Aurora I/O-Optimized is designed specifically for I/O‑intensive workloads: it eliminates per‑I/O charges and provides better price–performance as load increases. Although the per‑GB storage cost is higher, it becomes the most cost‑effective option at scale when I/O demand is high. Options referring to Provisioned IOPS or General Purpose storage apply to standard RDS, not Aurora.
Question 197
A company is migrating applications from an on-premises Microsoft Active Directory that the company manages to AWS. The company deploys the applications in multiple AWS accounts. The company uses AWS Organizations to manage the accounts centrally.
The company's security team needs a single sign-on solution across all the company's AWS accounts. The company must continue to manage users and groups that are in the on-premises Active Directory.
Which solution will meet these requirements?
A. Create an Enterprise Edition Active Directory in AWS Directory Service for Microsoft Active Directory. Configure the Active Directory to be the identity source for AWS IAM Identity Center.
B. Enable AWS IAM Identity Center. Configure a two-way forest trust relationship to connect the company's self-managed Active Directory with IAM Identity Center by using AWS Directory Service for Microsoft Active Directory.
C. Use AWS Directory Service and create a two-way trust relationship with the company's self-managed Active Directory.
D. Deploy an identity provider (IdP) on Amazon EC2. Link the IdP as an identity source within AWS IAM Identity Center.
Show Answer
Correct Answer: B
Explanation: AWS IAM Identity Center provides centralized SSO across multiple AWS accounts in AWS Organizations. To continue managing users and groups in the existing on‑premises Active Directory, IAM Identity Center must use that AD as the identity source. This is achieved by deploying AWS Directory Service for Microsoft Active Directory and configuring a two‑way forest trust with the on‑premises AD. This allows authentication to remain in the on‑prem AD while enabling SSO access to all AWS accounts.
Question 198
A company is planning to migrate data to an Amazon S3 bucket. The data must be encrypted at rest within the S3 bucket. The encryption key must be rotated automatically every year.
Which solution will meet these requirements with the LEAST operational overhead?
A. Migrate the data to the S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3). Use the built-in key rotation behavior of SSE-S3 encryption keys.
B. Create an AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Set the S3 bucket's default encryption behavior to use the customer managed KMS key. Migrate the data to the S3 bucket.
C. Create an AWS Key Management Service (AWS KMS) customer managed key. Set the S3 bucket's default encryption behavior to use the customer managed KMS key. Migrate the data to the S3 bucket. Manually rotate the KMS key every year.
D. Use customer key material to encrypt the data. Migrate the data to the S3 bucket. Create an AWS Key Management Service (AWS KMS) key without key material. Import the customer key material into the KMS key. Enable automatic key rotation.
Show Answer
Correct Answer: B
Explanation: The requirement is encryption at rest in S3 with automatic annual key rotation and the least operational overhead. Automatic, configurable yearly rotation is an AWS KMS feature. Using an AWS KMS customer managed key with automatic rotation enabled and setting it as the bucket’s default encryption (SSE-KMS) meets the rotation requirement without manual processes. SSE-S3 does not provide a customer-controlled or explicitly defined yearly rotation schedule, so it does not clearly satisfy the requirement.
Question 199
A company has an application that runs on a single Amazon EC2 instance. The application uses a MySQL database that runs on the same EC2 instance. The company needs a highly available and automatically scalable solution to handle increased traffic.
Which solution will meet these requirements?
A. Deploy the application to EC2 instances that run in an Auto Scaling group behind an Application Load Balancer. Create an Amazon Redshift cluster that has multiple MySQL-compatible nodes.
B. Deploy the application to EC2 instances that are configured as a target group behind an Application Load Balancer. Create an Amazon RDS for MySQL cluster that has multiple instances.
C. Deploy the application to EC2 instances that run in an Auto Scaling group behind an Application Load Balancer. Create an Amazon Aurora Serverless MySQL cluster for the database layer.
D. Deploy the application to EC2 instances that are configured as a target group behind an Application Load Balancer. Create an Amazon ElastiCache for Redis cluster that uses the MySQL connector.
Show Answer
Correct Answer: C
Explanation: The requirement is for high availability and automatic scalability for both the application and the database. An Auto Scaling group of EC2 instances behind an Application Load Balancer provides automatic horizontal scaling and high availability for the application tier. Amazon Aurora Serverless for MySQL automatically scales database capacity based on load and is highly available by design. Other options either use services that are not appropriate for MySQL workloads (Redshift, ElastiCache) or do not explicitly provide automatic scaling for the compute layer.
Question 200
A solutions architect runs a web application on multiple Amazon EC2 instances that are in individual target groups behind an Application Load Balancer (ALB). Users can reach the application through a public website.
The solutions architect wants to allow engineers to use a development version of the website to access one specific development EC2 instance to test new features for the application. The solutions architect wants to use an Amazon Route 53 hosted zone to give the engineers access to the development instance. The solution must automatically route to the development instance even if the development instance is replaced.
Which solution will meet these requirements?
A. Create an A Record for the development website that has the value set to the ALB. Create a listener rule on the ALB that forwards requests for the development website to the target group that contains the development instance.
B. Recreate the development instance with a public IP address. Create an A Record for the development website that has the value set to the public IP address of the development instance.
C. Create an A Record for the development website that has the value set to the ALB. Create a listener rule on the ALB to redirect requests for the development website to the public IP address of the development instance.
D. Place all the instances in the same target group. Create an A Record for the development website. Set the value to the ALB. Create a listener rule on the ALB that forwards requests for the development website to the target group.
Show Answer
Correct Answer: A
Explanation: Option A meets all requirements by using Route 53 to route traffic to the ALB and an ALB listener rule to forward requests for the development website to a dedicated target group containing the development instance. This design automatically continues to work if the development instance is replaced, because the target group membership can be updated without changing DNS. Options B and C rely on a public IP address, which changes when an instance is replaced, and option D does not isolate the development instance from production traffic.
Question 201
A company wants to set up Amazon Managed Grafana as its visualization tool. The company wants to visualize data from its Amazon RDS database as one data source. The company needs a secure solution that will not expose the data over the internet.
Which solution will meet these requirements?
A. Create an Amazon Managed Grafana workspace without a VPC. Create a public endpoint for the RDS database. Configure the public endpoint as a data source in Amazon Managed Grafana.
B. Create an Amazon Managed Grafana workspace in a VPC. Create a private endpoint for the RDS database. Configure the private endpoint as a data source in Amazon Managed Grafana.
C. Create an Amazon Managed Grafana workspace without a VPCreate an AWS PrivateLink endpoint to establish a connection between Amazon Managed Grafana and Amazon RDS. Set up Amazon RDS as a data source in Amazon Managed Grafana.
D. Create an Amazon Managed Grafana workspace in a VPC. Create a public endpoint for the RDS database. Configure the public endpoint as a data source in Amazon Managed Grafana.
Show Answer
Correct Answer: B
Explanation: Amazon Managed Grafana must be connected to a VPC to securely access private data sources such as an Amazon RDS instance without exposing traffic to the internet. By configuring the workspace with VPC connectivity, Grafana creates ENIs in the VPC and can reach the RDS private endpoint directly. Options using public endpoints expose data to the internet, and a workspace without VPC connectivity cannot securely access private RDS resources even with PrivateLink.
Question 202
A company uses an AWS Batch job to run its end-of-day sales process. The company needs a serverless solution that will invoke a third-party reporting application when the AWS Batch job is successful. The reporting application has an HTTP API interface that uses username and password authentication.
Which solution will meet these requirements?
A. Configure an Amazon EventBridge rule to match incoming AWS Batch job SUCCEEDED events. Configure the third-party API as an EventBridge API destination with a username and password. Set the API destination as the EventBridge rule target.
B. Configure Amazon EventBridge Scheduler to match incoming AWS Batch job SUCCEEDED events. Configure an AWS Lambda function to invoke the third-party API by using a username and password. Set the Lambda function as the EventBridge rule target.
C. Configure an AWS Batch job to publish job SUCCEEDED events to an Amazon API Gateway REST API. Configure an HTTP proxy integration on the API Gateway REST API to invoke the third-party API by using a username and password.
D. Configure an AWS Batch job to publish job SUCCEEDED events to an Amazon API Gateway REST API. Configure a proxy integration on the API Gateway REST API to an AWS Lambda function. Configure the Lambda function to invoke the third-party API by using a username and password.
Show Answer
Correct Answer: A
Explanation: AWS Batch emits job state change events (including SUCCEEDED) to Amazon EventBridge. EventBridge rules can match these events and directly invoke external HTTP endpoints by using EventBridge API destinations. API destinations are serverless and natively support HTTP authentication using stored credentials (username and password via a connection backed by Secrets Manager). This allows direct invocation of the third‑party reporting API without introducing Lambda or API Gateway, meeting the requirement with the least complexity.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.