A company wants to set up Amazon Managed Grafana as its visualization tool. The company wants to visualize data from its Amazon RDS database as one data source. The company needs a secure solution that will not expose the data over the internet.
Which solution will meet these requirements?
A. Create an Amazon Managed Grafana workspace without a VPC. Create a public endpoint for the RDS database. Configure the public endpoint as a data source in Amazon Managed Grafana.
B. Create an Amazon Managed Grafana workspace in a VPC. Create a private endpoint for the RDS database. Configure the private endpoint as a data source in Amazon Managed Grafana.
C. Create an Amazon Managed Grafana workspace without a VPCreate an AWS PrivateLink endpoint to establish a connection between Amazon Managed Grafana and Amazon RDS. Set up Amazon RDS as a data source in Amazon Managed Grafana.
D. Create an Amazon Managed Grafana workspace in a VPC. Create a public endpoint for the RDS database. Configure the public endpoint as a data source in Amazon Managed Grafana.
Show Answer
Correct Answer: B
Explanation: The secure and supported approach is to connect the Amazon Managed Grafana workspace to the VPC that hosts the Amazon RDS database so traffic stays on private networking. Options A and D use a public RDS endpoint, violating the requirement. Option C is inaccurate because Amazon Managed Grafana is connected to a VPC for private data source access; you do not simply use a PrivateLink endpoint while leaving the workspace without VPC connectivity.
Question 202
A company uses an AWS Batch job to run its end-of-day sales process. The company needs a serverless solution that will invoke a third-party reporting application when the AWS Batch job is successful. The reporting application has an HTTP API interface that uses username and password authentication.
Which solution will meet these requirements?
A. Configure an Amazon EventBridge rule to match incoming AWS Batch job SUCCEEDED events. Configure the third-party API as an EventBridge API destination with a username and password. Set the API destination as the EventBridge rule target.
B. Configure Amazon EventBridge Scheduler to match incoming AWS Batch job SUCCEEDED events. Configure an AWS Lambda function to invoke the third-party API by using a username and password. Set the Lambda function as the EventBridge rule target.
C. Configure an AWS Batch job to publish job SUCCEEDED events to an Amazon API Gateway REST API. Configure an HTTP proxy integration on the API Gateway REST API to invoke the third-party API by using a username and password.
D. Configure an AWS Batch job to publish job SUCCEEDED events to an Amazon API Gateway REST API. Configure a proxy integration on the API Gateway REST API to an AWS Lambda function. Configure the Lambda function to invoke the third-party API by using a username and password.
Show Answer
Correct Answer: A
Explanation: AWS Batch emits job state change events to Amazon EventBridge. An EventBridge rule can match SUCCEEDED events and directly invoke an EventBridge API Destination, which is designed for calling external HTTP APIs and supports basic (username/password) authentication via connections. This is fully serverless and avoids unnecessary Lambda or API Gateway components. EventBridge Scheduler is for time-based scheduling, not event matching, so option B is incorrect as stated. Options C and D add unnecessary API Gateway complexity and do not fit the native event-driven pattern.
Question 203
A company uses high concurrency AWS Lambda functions to process a constantly increasing number of messages in a message queue during marketing events. The Lambda functions use CPU intensive code to process the messages. The company wants to reduce the compute costs and to maintain service latency for its customers.
Which solution will meet these requirements?
A. Configure reserved concurrency for the Lambda functions. Decrease the memory allocated to the Lambda functions.
B. Configure reserved concurrency for the Lambda functions. Increase the memory according to AWS Compute Optimizer recommendations.
C. Configure provisioned concurrency for the Lambda functions. Decrease the memory allocated to the Lambda functions.
D. Configure provisioned concurrency for the Lambda functions. Increase the memory according to AWS Compute Optimizer recommendations.
Show Answer
Correct Answer: B
Explanation: For CPU-intensive Lambda functions, increasing memory also increases allocated CPU, which often reduces execution time enough to lower overall compute cost. AWS Compute Optimizer provides memory right-sizing recommendations for this optimization. Provisioned concurrency reduces cold starts but adds ongoing cost. The workload is driven by a queue with increasing messages, where Lambda scales with demand; reserved concurrency can guarantee available concurrency without the additional charges of provisioned concurrency, helping maintain service behavior more cost-effectively.
Sources:
https://aws.amazon.com/blogs/compute/efficiently-processing-batched-data-using-parallelization-in-aws-lambda
Question 204
A company runs its workloads on Amazon Elastic Container Service (Amazon ECS). The container images that the ECS task definition uses need to be scanned for Common Vulnerabilities and Exposures (CVEs). New container images that are created also need to be scanned.
Which solution will meet these requirements with the FEWEST changes to the workloads?
A. Use Amazon Elastic Container Registry (Amazon ECR) as a private image repository to store the container images. Specify scan on push filters for the ECR basic scan.
B. Store the container images in an Amazon S3 bucket. Use Amazon Macie to scan the images. Use an S3 Event Notification to initiate a Macie scan for every event with an s3:ObjectCreated:Put event type.
C. Deploy the workloads to Amazon Elastic Kubernetes Service (Amazon EKS). Use Amazon Elastic Container Registry (Amazon ECR) as a private image repository. Specify scan on push filters for the ECR enhanced scan.
D. Store the container images in an Amazon S3 bucket that has versioning enabled. Configure an S3 Event Notification for s3:ObjectCreated:* events to invoke an AWS Lambda function. Configure the Lambda function to initiate an Amazon Inspector scan.
Show Answer
Correct Answer: A
Explanation: Amazon ECR is the native container image registry for Amazon ECS and supports automatic image vulnerability scanning on push with basic scanning for CVEs. Using ECR with scan-on-push meets the requirement to scan existing and newly created container images with minimal changes to the existing ECS workloads. Amazon Macie is for sensitive data discovery, not container vulnerability scanning. Migrating to EKS is a major workload change and unnecessary. Storing images in S3 with Lambda and Inspector is not the standard architecture for container images and adds unnecessary complexity.
Question 205
A solutions architect is designing a user authentication solution for a company. The solution must invoke two-factor authentication for users that log in from inconsistent geographical locations, IP addresses, or devices. The solution must also be able to scale up to accommodate millions of users.
Which solution will meet these requirements?
A. Configure Amazon Cognito user pools for user authentication. Enable the risk-based adaptive authentication feature with multifactor authentication (MFA).
B. Configure Amazon Cognito identity pools for user authentication. Enable multi-factor authentication (MFA).
C. Configure AWS Identity and Access Management (IAM) users for user authentication. Attach an IAM policy that allows the AllowManageOwnUserMFA action.
D. Configure AWS IAM Identity Center (AWS Single Sign-On) authentication for user authentication. Configure the permission sets to require multi-factor authentication (MFA).
Show Answer
Correct Answer: A
Explanation: Amazon Cognito user pools provide user authentication and support advanced security with risk-based adaptive authentication. This feature evaluates sign-in context such as geographical location, IP address, and device, and can require MFA only for suspicious or high-risk logins. User pools are designed to scale to millions of users. Identity pools are for AWS credential federation rather than authentication, IAM users are not appropriate for millions of application users, and IAM Identity Center does not provide this adaptive risk-based authentication behavior for application users.
Question 206
A company’s application is receiving data from multiple data sources. The size of the data varies and is expected to increase over time. The current maximum size is 700 KB. The data volume and data size continue to grow as more data sources are added.
The company decides to use Amazon DynamoDB as the primary database for the application. A solutions architect needs to identify a solution that handles the large data sizes.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Create an AWS Lambda function to filter the data that exceeds DynamoDB item size limits. Store the larger data in an Amazon DocumentDB (with MongoDB compatibility) database.
B. Store the large data as objects in an Amazon S3 bucket. In a DynamoDB table, create an item that has an attribute that points to the S3 URL of the data.
C. Split all incoming large data into a collection of items that have the same partition key. Write the data to a DynamoDB table in a single operation by using the BatchWriteItem API operation.
D. Create an AWS Lambda function that uses gzip compression to compress the large objects as they are written to a DynamoDB table.
Show Answer
Correct Answer: B
Explanation: DynamoDB has a maximum item size of 400 KB, while the application already has items up to 700 KB and expects further growth. The AWS-recommended pattern is to store large objects in Amazon S3 and keep a pointer (such as the S3 object key or URL) in DynamoDB. This is the most operationally efficient approach because it avoids introducing another database, avoids complex item-splitting logic, and does not rely on compression that cannot guarantee items will fit within the size limit.
Question 207
A company is migrating a legacy application from an on-premises data center to AWS. The application relies on hundreds of cron jobs that run between 1 and 20 minutes on different recurring schedules throughout the day.
The company wants a solution to schedule and run the cron jobs on AWS with minimal refactoring. The solution must support running the cron jobs in response to an event in the future.
Which solution will meet these requirements?
A. Create a container image for the cron jobs. Use Amazon EventBridge Scheduler to create a recurring schedule. Run the cron job tasks as AWS Lambda functions.
B. Create a container image for the cron jobs. Use AWS Batch on Amazon Elastic Container Service (Amazon ECS) with a scheduling policy to run the cron jobs.
C. Create a container image for the cron jobs. Use Amazon EventBridge Scheduler to create a recurring schedule. Run the cron job tasks on AWS Fargate.
D. Create a container image for the cron jobs. Create a workflow in AWS Step Functions that uses a Wait state to run the cron jobs at a specified time. Use the RunTask action to run the cron job tasks on AWS Fargate.
Show Answer
Correct Answer: C
Explanation: EventBridge Scheduler is purpose-built for recurring schedules and one-time future invocations. The jobs run up to 20 minutes, which exceeds AWS Lambda's 15-minute maximum execution time, eliminating option A. Running containerized cron jobs on AWS Fargate triggered by EventBridge Scheduler requires minimal refactoring and avoids managing EC2 capacity. AWS Batch scheduling policies are for batch job prioritization/fair-share rather than cron scheduling, and Step Functions with Wait states is not an appropriate solution for managing hundreds of recurring cron schedules.
Question 208
A company's application runs on Amazon EC2 instances that are in multiple Availability Zones. The application needs to ingest real-time data from third-party applications.
The company needs a data ingestion solution that places the ingested raw data in an Amazon S3 bucket.
Which solution will meet these requirements?
A. Create Amazon Kinesis data streams for data ingestion. Create Amazon Kinesis Data Firehose delivery streams to consume the Kinesis data streams. Specify the S3 bucket as the destination of the delivery streams.
B. Create database migration tasks in AWS Database Migration Service (AWS DMS). Specify replication instances of the EC2 instances as the source endpoints. Specify the S3 bucket as the target endpoint. Set the migration type to migrate existing data and replicate ongoing changes.
C. Create and configure AWS DataSync agents on the EC2 instances. Configure DataSync tasks to transfer data from the EC2 instances to the S3 bucket.
D. Create an AWS Direct Connect connection to the application for data ingestion. Create Amazon Kinesis Data Firehose delivery streams to consume direct PUT operations from the application. Specify the S3 bucket as the destination of the delivery streams.
Show Answer
Correct Answer: A
Explanation: Amazon Kinesis Data Streams is designed for real-time data ingestion from applications. Amazon Kinesis Data Firehose can consume data from Kinesis Data Streams and reliably deliver the raw data to an Amazon S3 bucket. AWS DMS is for database migration/replication, AWS DataSync is for bulk file transfers rather than streaming ingestion, and AWS Direct Connect is a network connectivity service, not a data ingestion service.
Question 209
A marketing team wants to build a campaign for an upcoming multi-sport event. The team has news reports from the past five years in PDF format. The team needs a solution to extract insights about the content and the sentiment of the news reports. The solution must use Amazon Textract to process the news reports.
Which solution will meet these requirements with the LEAST operational overhead?
A. Provide the extracted insights to Amazon Athena for analysis. Store the extracted insights and analysis in an Amazon S3 bucket.
B. Store the extracted insights in an Amazon DynamoDB table. Use Amazon SageMaker to build a sentiment model.
C. Provide the extracted insights to Amazon Comprehend for analysis. Save the analysis to an Amazon S3 bucket.
D. Store the extracted insights in an Amazon S3 bucket. Use Amazon QuickSight to visualize and analyze the data.
Show Answer
Correct Answer: C
Explanation: Amazon Textract extracts text from the PDF news reports, and Amazon Comprehend is the managed NLP service designed to analyze document content, including sentiment, entities, and key phrases, with minimal operational overhead. Storing the analysis results in Amazon S3 is a simple, managed storage option. Athena is for querying data, QuickSight is for visualization rather than sentiment analysis, and SageMaker would require building and managing a custom model, increasing operational overhead.
Question 210
A company has an on-premises application that uses SFTP to collect financial data from multiple vendors. The company is migrating to the AWS Cloud. The company has created an application that uses Amazon S3 APIs to upload files from vendors.
Some vendors run their systems on legacy applications that do not support S3 APIs. The vendors want to continue to use SFTP-based applications to upload data. The company wants to use managed services for the needs of the vendors that use legacy applications.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an AWS Database Migration Service (AWS DMS) instance to replicate data from the storage of the vendors that use legacy applications to Amazon S3. Provide the vendors with the credentials to access the AWS DMS instance.
B. Create an AWS Transfer Family endpoint for vendors that use legacy applications.
C. Configure an Amazon EC2 instance to run an SFTP server. Instruct the vendors that use legacy applications to use the SFTP server to upload data.
D. Configure an Amazon S3 File Gateway for vendors that use legacy applications to upload files to an SMB file share.
Show Answer
Correct Answer: B
Explanation: AWS Transfer Family is a fully managed service that provides SFTP endpoints backed by Amazon S3 or Amazon EFS. It allows legacy vendors to continue using SFTP while storing uploaded files directly in S3, minimizing operational overhead. AWS DMS is for database migration rather than SFTP file ingestion, running an EC2-hosted SFTP server requires ongoing management, and S3 File Gateway exposes SMB/NFS rather than SFTP.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.