A financial services company that runs on AWS has designed its security controls to meet industry standards. The industry standards include the National Institute of Standards and Technology (NIST) and the Payment Card Industry Data Security Standard (PCI DSS).
The company's third-party auditors need proof that the designed controls have been implemented and are functioning correctly. The company has hundreds of AWS accounts in a single organization in AWS Organizations. The company needs to monitor the current state of the controls across accounts.
Which solution will meet these requirements?
A. Designate one account as the Amazon Inspector delegated administrator account from the Organizations management account. Integrate Inspector with Organizations to discover and scan resources across all AWS accounts. Enable Inspector industry standards for NIST and PCI DSS.
B. Designate one account as the Amazon GuardDuty delegated administrator account from the Organizations management account. In the designated GuardDuty administrator account, enable GuardDuty to protect all member accounts. Enable GuardDuty industry standards for NIST and PCI DSS.
C. Configure an AWS CloudTrail organization trail in the Organizations management account. Designate one account as the compliance account. Enable CloudTrail security standards for NIST and PCI DSS in the compliance account.
D. Designate one account as the AWS Security Hub delegated administrator account from the Organizations management account. In the designated Security Hub administrator account, enable Security Hub for all member accounts. Enable Security Hub standards for NIST and PCI DSS.
Show Answer
Correct Answer: D
Explanation: AWS Security Hub supports centralized, multi-account security posture management through AWS Organizations and includes security standards such as NIST and PCI DSS. By designating a delegated administrator account and enabling Security Hub organization-wide, the company can continuously assess controls across hundreds of accounts and provide auditors with evidence of implementation and compliance status.
Question 192
A company uses Salesforce. The company needs to load existing data and ongoing data changes from Salesforce to Amazon Redshift for analysis. The company does not want the data to travel over the public internet.
Which solution will meet these requirements with the LEAST development effort?
A. Establish a VPN connection from the VPC to Salesforce. Use AWS Glue DataBrew to transfer data.
B. Establish an AWS Direct Connect connection from the VPC to Salesforce. Use AWS Glue DataBrew to transfer data.
C. Create an AWS PrivateLink connection in the VPC to Salesforce. Use Amazon AppFlow to transfer data.
D. Create a VPC peering connection to Salesforce. Use Amazon AppFlow to transfer data.
Show Answer
Correct Answer: C
Explanation: Amazon AppFlow is the managed service designed to move data between Salesforce and AWS services such as Amazon Redshift with minimal development effort, including ongoing data synchronization. AWS PrivateLink provides private connectivity to supported SaaS services without traversing the public internet. VPN uses the public internet, Direct Connect is not how you connect directly to Salesforce and adds unnecessary complexity, and VPC peering only connects AWS VPCs, not Salesforce.
Question 193
A company has 5 TB of datasets. The datasets consist of 1 million user profiles and 10 million connections. The user profiles have connections as many-to-many relationships. The company needs a performance efficient way to find mutual connections up to five levels.
Which solution will meet these requirements?
A. Use an Amazon S3 bucket to store the datasets. Use Amazon Athena to perform SQL JOIN queries to find connections.
B. Use Amazon Neptune to store the datasets with edges and vertices. Query the data to find connections.
C. Use an Amazon S3 bucket to store the datasets. Use Amazon QuickSight to visualize connections.
D. Use Amazon RDS to store the datasets with multiple tables. Perform SQL JOIN queries to find connections.
Show Answer
Correct Answer: B
Explanation: Amazon Neptune is a managed graph database optimized for highly connected data and graph traversal queries, such as finding mutual connections across multiple relationship levels. Modeling user profiles as vertices and connections as edges enables efficient traversal up to five hops. SQL JOINs in Athena or RDS are not efficient for deep many-to-many relationship traversal, and QuickSight is a visualization service rather than a graph query engine.
Question 194
A robotics company is designing a solution for medical surgery. The robots will use advanced sensors, cameras, and AI algorithms to perceive their environment and to complete surgeries.
The company needs a public load balancer in the AWS Cloud that will ensure seamless communication with backend services. The load balancer must be capable of routing traffic based on the query strings to different target groups. The traffic must also be encrypted.
Which solution will meet these requirements?
A. Use a Network Load Balancer with a certificate attached from AWS Certificate Manager (ACM). Use query parameter-based routing.
B. Use a Gateway Load Balancer. Import a generated certificate in AWS Identity and Access Management (IAM). Attach the certificate to the load balancer. Use HTTP path-based routing.
C. Use an Application Load Balancer with a certificate attached from AWS Certificate Manager (ACM). Use query parameter-based routing.
D. Use a Network Load Balancer. Import a generated certificate in AWS Identity and Access Management (IAM). Attach the certificate to the load balancer. Use query parameter-based routing.
Show Answer
Correct Answer: C
Explanation: An Application Load Balancer (ALB) operates at Layer 7 and supports listener rules that route requests based on query strings, headers, paths, hosts, and other HTTP attributes. For HTTPS traffic, ALB integrates directly with AWS Certificate Manager (ACM) for TLS termination. Network Load Balancers do not support query string-based routing, and Gateway Load Balancers are intended for virtual appliances rather than HTTP request routing.
Question 195
A news company that has reporters all over the world is hosting its broadcast system on AWS. The reporters send live broadcasts to the broadcast system. The reporters use software on their phones to send live streams through the Real Time Messaging Protocol (RTMP).
A solutions architect must design a solution that gives the reporters the ability to send the highest quality streams. The solution must provide accelerated TCP connections back to the broadcast system.
What should the solutions architect use to meet these requirements?
A. Amazon CloudFront
B. AWS Global Accelerator
C. AWS Client VPN
D. Amazon EC2 instances and AWS Elastic IP addresses
Show Answer
Correct Answer: B
Explanation: AWS Global Accelerator is designed to improve the performance and availability of TCP and UDP applications by routing traffic over the AWS global network. Because the reporters are sending RTMP streams (which use TCP) and the requirement explicitly calls for accelerated TCP connections, Global Accelerator is the appropriate choice. CloudFront is a CDN primarily for HTTP/HTTPS content delivery and is not the service for accelerating RTMP ingest connections. AWS Client VPN and EC2 with Elastic IPs do not provide global TCP acceleration.
Question 196
A company is planning to deploy its application on an Amazon Aurora PostgreSQL Serverless v2 cluster. The application will receive large amounts of traffic. The company wants to optimize the storage performance of the cluster as the load on the application increases.
Which solution will meet these requirements MOST cost-effectively?
A. Configure the cluster to use the Aurora Standard storage configuration.
B. Configure the cluster storage type as Provisioned IOPS.
C. Configure the cluster storage type as General Purpose.
D. Configure the cluster to use the Aurora I/O-Optimized storage configuration.
Show Answer
Correct Answer: D
Explanation: Amazon Aurora supports two storage configurations: Aurora Standard and Aurora I/O-Optimized; Provisioned IOPS and General Purpose are RDS storage types, not Aurora storage configuration options. For an Aurora Serverless v2 cluster expected to handle heavy traffic with increasing I/O, Aurora I/O-Optimized eliminates charges for read/write I/O operations and is designed for I/O-intensive workloads, making it the most cost-effective choice under the stated requirements.
Question 197
A company is migrating applications from an on-premises Microsoft Active Directory that the company manages to AWS. The company deploys the applications in multiple AWS accounts. The company uses AWS Organizations to manage the accounts centrally.
The company's security team needs a single sign-on solution across all the company's AWS accounts. The company must continue to manage users and groups that are in the on-premises Active Directory.
Which solution will meet these requirements?
A. Create an Enterprise Edition Active Directory in AWS Directory Service for Microsoft Active Directory. Configure the Active Directory to be the identity source for AWS IAM Identity Center.
B. Enable AWS IAM Identity Center. Configure a two-way forest trust relationship to connect the company's self-managed Active Directory with IAM Identity Center by using AWS Directory Service for Microsoft Active Directory.
C. Use AWS Directory Service and create a two-way trust relationship with the company's self-managed Active Directory.
D. Deploy an identity provider (IdP) on Amazon EC2. Link the IdP as an identity source within AWS IAM Identity Center.
Show Answer
Correct Answer: B
Explanation: AWS IAM Identity Center is the AWS service that provides centralized SSO across multiple AWS accounts in an AWS Organization. To continue managing users and groups in the existing on-premises Microsoft Active Directory, configure AWS Managed Microsoft AD (AWS Directory Service for Microsoft Active Directory) with a two-way forest trust to the self-managed AD and use it as the identity source for IAM Identity Center. Option A creates a separate directory without preserving on-premises AD as the primary identity source. Option C lacks IAM Identity Center, so it does not provide centralized AWS account SSO. Option D adds unnecessary self-managed IdP infrastructure and does not satisfy the requirement as directly as native integration.
Question 198
A company is planning to migrate data to an Amazon S3 bucket. The data must be encrypted at rest within the S3 bucket. The encryption key must be rotated automatically every year.
Which solution will meet these requirements with the LEAST operational overhead?
A. Migrate the data to the S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3). Use the built-in key rotation behavior of SSE-S3 encryption keys.
B. Create an AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Set the S3 bucket's default encryption behavior to use the customer managed KMS key. Migrate the data to the S3 bucket.
C. Create an AWS Key Management Service (AWS KMS) customer managed key. Set the S3 bucket's default encryption behavior to use the customer managed KMS key. Migrate the data to the S3 bucket. Manually rotate the KMS key every year.
D. Use customer key material to encrypt the data. Migrate the data to the S3 bucket. Create an AWS Key Management Service (AWS KMS) key without key material. Import the customer key material into the KMS key. Enable automatic key rotation.
Show Answer
Correct Answer: B
Explanation: A customer managed AWS KMS key supports configurable automatic annual key rotation. By enabling automatic rotation and configuring the S3 bucket's default encryption to use that KMS key (SSE-KMS), all newly migrated objects are encrypted at rest with the CMK while meeting the explicit yearly rotation requirement with minimal ongoing operational effort. SSE-S3 manages keys internally but does not provide a customer-configurable annual rotation guarantee. Manual rotation (C) adds operational overhead, and imported key material (D) does not support automatic rotation.
Question 199
A company has an application that runs on a single Amazon EC2 instance. The application uses a MySQL database that runs on the same EC2 instance. The company needs a highly available and automatically scalable solution to handle increased traffic.
Which solution will meet these requirements?
A. Deploy the application to EC2 instances that run in an Auto Scaling group behind an Application Load Balancer. Create an Amazon Redshift cluster that has multiple MySQL-compatible nodes.
B. Deploy the application to EC2 instances that are configured as a target group behind an Application Load Balancer. Create an Amazon RDS for MySQL cluster that has multiple instances.
C. Deploy the application to EC2 instances that run in an Auto Scaling group behind an Application Load Balancer. Create an Amazon Aurora Serverless MySQL cluster for the database layer.
D. Deploy the application to EC2 instances that are configured as a target group behind an Application Load Balancer. Create an Amazon ElastiCache for Redis cluster that uses the MySQL connector.
Show Answer
Correct Answer: C
Explanation: The application tier should be placed behind an Application Load Balancer in an Auto Scaling group to provide high availability and automatic scaling. For the database, Amazon Aurora Serverless (MySQL-compatible) provides a highly available managed database with automatic capacity scaling. Option B lacks EC2 Auto Scaling, A incorrectly uses Redshift for an OLTP MySQL workload, and D replaces the database with ElastiCache, which is not a relational database.
Question 200
A solutions architect runs a web application on multiple Amazon EC2 instances that are in individual target groups behind an Application Load Balancer (ALB). Users can reach the application through a public website.
The solutions architect wants to allow engineers to use a development version of the website to access one specific development EC2 instance to test new features for the application. The solutions architect wants to use an Amazon Route 53 hosted zone to give the engineers access to the development instance. The solution must automatically route to the development instance even if the development instance is replaced.
Which solution will meet these requirements?
A. Create an A Record for the development website that has the value set to the ALB. Create a listener rule on the ALB that forwards requests for the development website to the target group that contains the development instance.
B. Recreate the development instance with a public IP address. Create an A Record for the development website that has the value set to the public IP address of the development instance.
C. Create an A Record for the development website that has the value set to the ALB. Create a listener rule on the ALB to redirect requests for the development website to the public IP address of the development instance.
D. Place all the instances in the same target group. Create an A Record for the development website. Set the value to the ALB. Create a listener rule on the ALB that forwards requests for the development website to the target group.
Show Answer
Correct Answer: A
Explanation: Use a Route 53 alias A record pointing to the ALB, and configure an ALB listener rule (for example, based on the Host header for the development subdomain) to forward traffic to a dedicated target group containing the development EC2 instance. If the instance is replaced, the target group membership can be updated automatically (such as by an Auto Scaling group), so DNS does not need to change. Options B and C depend on a specific instance public IP, which is not durable across replacement. Option D places all instances in one target group, preventing isolation of the development instance.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.