A company has a multi-tier payment processing application that is based on virtual machines (VMs). The communication between the tiers occurs asynchronously through a third-party middleware solution that guarantees exactly-once delivery.
The company needs a solution that requires the least amount of infrastructure management. The solution must guarantee exactly-once delivery for application messaging.
Which combination of actions will meet these requirements? (Choose two.)
A. Use AWS Lambda for the compute layers in the architecture.
B. Use Amazon EC2 instances for the compute layers in the architecture.
C. Use Amazon Simple Notification Service (Amazon SNS) as the messaging component between the compute layers.
D. Use Amazon Simple Queue Service (Amazon SQS) FIFO queues as the messaging component between the compute layers.
E. Use containers that are based on Amazon Elastic Kubernetes Service (Amazon EKS) for the compute layers in the architecture.
Show Answer
Correct Answer: A, D
Explanation: The requirement is exactly-once message delivery with the least infrastructure management. Amazon SQS FIFO queues provide exactly-once message processing and ordering guarantees, which SNS does not. For compute, AWS Lambda is fully managed and requires less infrastructure management than EC2 or EKS. Therefore, using Lambda for compute and SQS FIFO for messaging best meets both requirements.
Question 224
A company needs to use its on-premises LDAP directory service to authenticate its users to the AWS Management Console. The directory service is not compatible with Security Assertion Markup Language (SAML).
Which solution meets these requirements?
A. Enable AWS IAM Identity Center (AWS Single Sign-On) between AWS and the on-premises LDAP.
B. Create an IAM policy that uses AWS credentials, and integrate the policy into LDAP.
C. Set up a process that rotates the IAM credentials whenever LDAP credentials are updated.
D. Develop an on-premises custom identity broker application or process that uses AWS Security Token Service (AWS STS) to get short-lived credentials.
Show Answer
Correct Answer: D
Explanation: The on-premises LDAP directory is not compatible with SAML, so solutions that rely on SAML federation (such as AWS IAM Identity Center with an external IdP) cannot be used. A custom identity broker can authenticate users against LDAP and then call AWS Security Token Service (STS) to obtain short-lived AWS credentials for console access. This is the recommended AWS pattern for federating non-SAML identity stores.
Question 225
A company’s ecommerce website has unpredictable traffic and uses AWS Lambda functions to directly access a private Amazon RDS for PostgreSQL DB instance. The company wants to maintain predictable database performance and ensure that the Lambda invocations do not overload the database with too many connections.
What should a solutions architect do to meet these requirements?
A. Point the client driver at an RDS custom endpoint. Deploy the Lambda functions inside a VPC.
B. Point the client driver at an RDS proxy endpoint. Deploy the Lambda functions inside a VPC.
C. Point the client driver at an RDS custom endpoint. Deploy the Lambda functions outside a VP
D. Point the client driver at an RDS proxy endpoint. Deploy the Lambda functions outside a VPC.
Show Answer
Correct Answer: B
Explanation: AWS Lambda can create a large number of concurrent database connections during traffic spikes, which can overwhelm an RDS PostgreSQL instance. Amazon RDS Proxy pools and manages database connections, providing predictable performance and protecting the database from connection storms. Because the RDS instance is private, the Lambda functions must run inside the same VPC to access it. Therefore, pointing the client driver to an RDS Proxy endpoint and deploying the Lambda functions inside a VPC best meets the requirements.
Question 226
A company hosts a database that runs on an Amazon RDS instance that is deployed to multiple Availability Zones. The company periodically runs a script against the database to report new entries that are added to the database. The script that runs against the database negatively affects the performance of a critical application. The company needs to improve application performance with minimal costs.
Which solution will meet these requirements with the LEAST operational overhead?
A. Add functionality to the script to identify the instance that has the fewest active connections. Configure the script to read from that instance to report the total new entries.
B. Create a read replica of the database. Configure the script to query only the read replica to report the total new entries.
C. Instruct the development team to manually export the new entries for the day in the database at the end of each day.
D. Use Amazon ElastiCache to cache the common queries that the script runs against the database.
Show Answer
Correct Answer: B
Explanation: The reporting script is causing load on the primary RDS instance and degrading application performance. Creating an RDS read replica allows the script to run read-only queries on a separate instance, offloading work from the primary without changing application logic. This is a managed feature with minimal operational overhead and cost-effective compared to redesigning scripts or adding caching layers. Other options either add complexity, manual effort, or do not properly isolate the read workload.
Question 227
A company is running a legacy system on an Amazon EC2 instance. The application code cannot be modified, and the system cannot run on more than one instance. A solutions architect must design a resilient solution that can improve the recovery time for the system.
What should the solutions architect recommend to meet these requirements?
A. Enable termination protection for the EC2 instance.
B. Configure the EC2 instance for Multi-AZ deployment.
C. Create an Amazon CloudWatch alarm to recover the EC2 instance in case of failure.
D. Launch the EC2 instance with two Amazon Elastic Block Store (Amazon EBS) volumes that use RAID configurations for storage redundancy.
Show Answer
Correct Answer: C
Explanation: The system must run on a single EC2 instance and the application cannot be modified, so high-availability patterns like Multi-AZ or multiple instances are not possible. The goal is to improve recovery time if the instance fails. Configuring an Amazon CloudWatch alarm to trigger EC2 instance recovery allows AWS to automatically recover the instance onto healthy underlying hardware when a system or hardware impairment occurs. This preserves the instance ID, attached EBS volumes, IP addresses, and metadata, resulting in a much faster and more transparent recovery. Other options either do not improve recovery time (termination protection), are not supported for single-instance workloads (Multi-AZ), or only address storage-level redundancy rather than instance recovery (EBS RAID).
Question 228
A solutions architect is designing an AWS Identity and Access Management (IAM) authorization model for a company's AWS account. The company has designated five specific employees to have full access to AWS services and resources in the AWS account.
The solutions architect has created an IAM user for each of the five designated employees and has created an IAM user group.
Which solution will meet these requirements?
A. Attach the AdministratorAccess resource-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
B. Attach the SystemAdministrator identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
C. Attach the AdministratorAccess identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
D. Attach the SystemAdministrator resource-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
Show Answer
Correct Answer: C
Explanation: To grant full access to all AWS services and resources, an AWS-managed AdministratorAccess policy is required. This policy is an identity-based policy that can be attached to IAM users, groups, or roles. Resource-based policies cannot be attached to IAM groups, eliminating options A and D. The SystemAdministrator policy does not provide full access to all services, eliminating option B. Therefore, attaching the AdministratorAccess identity-based policy to the IAM user group and adding the five users to that group meets the requirement.
Question 229
A social media company is creating a rewards program website for its users. The company gives users points when users create and upload videos to the website. Users redeem their points for gifts or discounts from the company's affiliated partners. A unique ID identifies users. The partners refer to this ID to verify user eligibility for rewards.
The partners want to receive notification of user IDs through an HTTP endpoint when the company gives users points. Hundreds of vendors are interested in becoming affiliated partners every day. The company wants to design an architecture that gives the website the ability to add partners rapidly in a scalable way.
Which solution will meet these requirements with the LEAST implementation effort?
A. Create an Amazon Timestream database to keep a list of affiliated partners. Implement an AWS Lambda function to read the list. Configure the Lambda function to send user IDs to each partner when the company gives users points.
B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Choose an endpoint protocol. Subscribe the partners to the topic. Publish user IDs to the topic when the company gives users points.
C. Create an AWS Step Functions state machine. Create a task for every affiliated partner. Invoke the state machine with user IDs as input when the company gives users points.
D. Create a data stream in Amazon Kinesis Data Streams. Implement producer and consumer applications. Store a list of affiliated partners in the data stream. Send user IDs when the company gives users points.
Show Answer
Correct Answer: B
Explanation: Amazon SNS is purpose-built for fan-out notifications with minimal setup. Partners can subscribe their HTTP endpoints directly to an SNS topic, and the company only needs to publish user IDs when points are awarded. SNS scales automatically to hundreds of subscribers and allows rapid partner onboarding without custom code, databases, or workflow management, resulting in the least implementation effort.
Question 230
A company uses AWS to run its ecommerce platform. The platform is critical to the company's operations and has a high volume of traffic and transactions. The company configures a multi-factor authentication (MFA) device to secure its AWS account root user credentials. The company wants to ensure that it will not lose access to the root user account if the MFA device is lost.
Which solution will meet these requirements?
A. Set up a backup administrator account that the company can use to log in if the company loses the MFA device.
B. Add multiple MFA devices for the root user account to handle the disaster scenario.
C. Create a new administrator account when the company cannot access the root account.
D. Attach the administrator policy to another IAM user when the company cannot access the root account.
Show Answer
Correct Answer: B
Explanation: AWS supports registering multiple MFA devices (up to eight) for the root user. Adding more than one MFA device ensures continued access to the root account if one device is lost, meeting the requirement without weakening security. Other options do not guarantee root account access recovery.
Question 231
A company needs a solution to prevent photos with unwanted content from being uploaded to the company's web application. The solution must not involve training a machine learning (ML) model.
Which solution will meet these requirements?
A. Create and deploy a model by using Amazon SageMaker Autopilot. Create a real-time endpoint that the web application invokes when new photos are uploaded.
B. Create an AWS Lambda function that uses Amazon Rekognition to detect unwanted content. Create a Lambda function URL that the web application invokes when new photos are uploaded.
C. Create an Amazon CloudFront function that uses Amazon Comprehend to detect unwanted content. Associate the function with the web application.
D. Create an AWS Lambda function that uses Amazon Rekognition Video to detect unwanted content. Create a Lambda function URL that the web application invokes when new photos are uploaded.
Show Answer
Correct Answer: B
Explanation: The requirement is to prevent unwanted content in photos without training an ML model. Amazon Rekognition provides pre-trained image moderation and content detection capabilities, so no model training is required. Invoking Rekognition from an AWS Lambda function when photos are uploaded is a straightforward and appropriate architecture. SageMaker Autopilot involves model training, Amazon Comprehend is for text (not images), and Amazon Rekognition Video is for video analysis, not photos.
Question 232
A company is designing a tightly coupled high performance computing (HPC) environment in the AWS Cloud. The company needs to include features that will optimize the HPC environment for networking and storage.
Which combination of solutions will meet these requirements? (Choose two.)
A. Create an accelerator in AWS Global Accelerator. Configure custom routing for the accelerator.
B. Create an Amazon FSx for Lustre file system. Configure the file system with scratch storage.
C. Create an Amazon CloudFront distribution. Configure the viewer protocol policy to be HTTP and HTTPS.
D. Launch Amazon EC2 instances. Attach an Elastic Fabric Adapter (EFA) to the instances.
E. Create an AWS Elastic Beanstalk deployment to manage the environment.
Show Answer
Correct Answer: B, D
Explanation: Tightly coupled HPC workloads require low-latency, high-throughput networking and parallel file systems optimized for compute clusters. Amazon FSx for Lustre provides a high-performance, POSIX-compliant file system designed for HPC workloads, with scratch storage ideal for temporary, high-speed data access. Elastic Fabric Adapter (EFA) enables ultra-low-latency, high-bandwidth inter-instance communication using MPI, which is essential for tightly coupled HPC applications. The other options are designed for web traffic acceleration, content delivery, or application management rather than HPC optimization.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.