A news company that has reporters all over the world is hosting its broadcast system on AWS. The reporters send live broadcasts to the broadcast system. The reporters use software on their phones to send live streams through the Real Time Messaging Protocol (RTMP).
A solutions architect must design a solution that gives the reporters the ability to send the highest quality streams. The solution must provide accelerated TCP connections back to the broadcast system.
What should the solutions architect use to meet these requirements?
A. Amazon CloudFront
B. AWS Global Accelerator
C. AWS Client VPN
D. Amazon EC2 instances and AWS Elastic IP addresses
Show Answer
Correct Answer: B
Explanation: AWS Global Accelerator is designed to improve the performance and availability of TCP and UDP applications by routing traffic over the AWS global network. Because the reporters are sending RTMP streams (which use TCP) and the requirement explicitly calls for accelerated TCP connections, Global Accelerator is the appropriate choice. CloudFront is a CDN primarily for HTTP/HTTPS content delivery and is not the service for accelerating RTMP ingest connections. AWS Client VPN and EC2 with Elastic IPs do not provide global TCP acceleration.
Question 196
A company is planning to deploy its application on an Amazon Aurora PostgreSQL Serverless v2 cluster. The application will receive large amounts of traffic. The company wants to optimize the storage performance of the cluster as the load on the application increases.
Which solution will meet these requirements MOST cost-effectively?
A. Configure the cluster to use the Aurora Standard storage configuration.
B. Configure the cluster storage type as Provisioned IOPS.
C. Configure the cluster storage type as General Purpose.
D. Configure the cluster to use the Aurora I/O-Optimized storage configuration.
Show Answer
Correct Answer: D
Explanation: Amazon Aurora supports two storage configurations: Aurora Standard and Aurora I/O-Optimized; Provisioned IOPS and General Purpose are RDS storage types, not Aurora storage configuration options. For an Aurora Serverless v2 cluster expected to handle heavy traffic with increasing I/O, Aurora I/O-Optimized eliminates charges for read/write I/O operations and is designed for I/O-intensive workloads, making it the most cost-effective choice under the stated requirements.
Question 197
A company is migrating applications from an on-premises Microsoft Active Directory that the company manages to AWS. The company deploys the applications in multiple AWS accounts. The company uses AWS Organizations to manage the accounts centrally.
The company's security team needs a single sign-on solution across all the company's AWS accounts. The company must continue to manage users and groups that are in the on-premises Active Directory.
Which solution will meet these requirements?
A. Create an Enterprise Edition Active Directory in AWS Directory Service for Microsoft Active Directory. Configure the Active Directory to be the identity source for AWS IAM Identity Center.
B. Enable AWS IAM Identity Center. Configure a two-way forest trust relationship to connect the company's self-managed Active Directory with IAM Identity Center by using AWS Directory Service for Microsoft Active Directory.
C. Use AWS Directory Service and create a two-way trust relationship with the company's self-managed Active Directory.
D. Deploy an identity provider (IdP) on Amazon EC2. Link the IdP as an identity source within AWS IAM Identity Center.
Show Answer
Correct Answer: B
Explanation: AWS IAM Identity Center is the AWS service that provides centralized SSO across multiple AWS accounts in an AWS Organization. To continue managing users and groups in the existing on-premises Microsoft Active Directory, configure AWS Managed Microsoft AD (AWS Directory Service for Microsoft Active Directory) with a two-way forest trust to the self-managed AD and use it as the identity source for IAM Identity Center. Option A creates a separate directory without preserving on-premises AD as the primary identity source. Option C lacks IAM Identity Center, so it does not provide centralized AWS account SSO. Option D adds unnecessary self-managed IdP infrastructure and does not satisfy the requirement as directly as native integration.
Question 198
A company is planning to migrate data to an Amazon S3 bucket. The data must be encrypted at rest within the S3 bucket. The encryption key must be rotated automatically every year.
Which solution will meet these requirements with the LEAST operational overhead?
A. Migrate the data to the S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3). Use the built-in key rotation behavior of SSE-S3 encryption keys.
B. Create an AWS Key Management Service (AWS KMS) customer managed key. Enable automatic key rotation. Set the S3 bucket's default encryption behavior to use the customer managed KMS key. Migrate the data to the S3 bucket.
C. Create an AWS Key Management Service (AWS KMS) customer managed key. Set the S3 bucket's default encryption behavior to use the customer managed KMS key. Migrate the data to the S3 bucket. Manually rotate the KMS key every year.
D. Use customer key material to encrypt the data. Migrate the data to the S3 bucket. Create an AWS Key Management Service (AWS KMS) key without key material. Import the customer key material into the KMS key. Enable automatic key rotation.
Show Answer
Correct Answer: B
Explanation: A customer managed AWS KMS key supports configurable automatic annual key rotation. By enabling automatic rotation and configuring the S3 bucket's default encryption to use that KMS key (SSE-KMS), all newly migrated objects are encrypted at rest with the CMK while meeting the explicit yearly rotation requirement with minimal ongoing operational effort. SSE-S3 manages keys internally but does not provide a customer-configurable annual rotation guarantee. Manual rotation (C) adds operational overhead, and imported key material (D) does not support automatic rotation.
Question 199
A company has an application that runs on a single Amazon EC2 instance. The application uses a MySQL database that runs on the same EC2 instance. The company needs a highly available and automatically scalable solution to handle increased traffic.
Which solution will meet these requirements?
A. Deploy the application to EC2 instances that run in an Auto Scaling group behind an Application Load Balancer. Create an Amazon Redshift cluster that has multiple MySQL-compatible nodes.
B. Deploy the application to EC2 instances that are configured as a target group behind an Application Load Balancer. Create an Amazon RDS for MySQL cluster that has multiple instances.
C. Deploy the application to EC2 instances that run in an Auto Scaling group behind an Application Load Balancer. Create an Amazon Aurora Serverless MySQL cluster for the database layer.
D. Deploy the application to EC2 instances that are configured as a target group behind an Application Load Balancer. Create an Amazon ElastiCache for Redis cluster that uses the MySQL connector.
Show Answer
Correct Answer: C
Explanation: The application tier should be placed behind an Application Load Balancer in an Auto Scaling group to provide high availability and automatic scaling. For the database, Amazon Aurora Serverless (MySQL-compatible) provides a highly available managed database with automatic capacity scaling. Option B lacks EC2 Auto Scaling, A incorrectly uses Redshift for an OLTP MySQL workload, and D replaces the database with ElastiCache, which is not a relational database.
Question 200
A solutions architect runs a web application on multiple Amazon EC2 instances that are in individual target groups behind an Application Load Balancer (ALB). Users can reach the application through a public website.
The solutions architect wants to allow engineers to use a development version of the website to access one specific development EC2 instance to test new features for the application. The solutions architect wants to use an Amazon Route 53 hosted zone to give the engineers access to the development instance. The solution must automatically route to the development instance even if the development instance is replaced.
Which solution will meet these requirements?
A. Create an A Record for the development website that has the value set to the ALB. Create a listener rule on the ALB that forwards requests for the development website to the target group that contains the development instance.
B. Recreate the development instance with a public IP address. Create an A Record for the development website that has the value set to the public IP address of the development instance.
C. Create an A Record for the development website that has the value set to the ALB. Create a listener rule on the ALB to redirect requests for the development website to the public IP address of the development instance.
D. Place all the instances in the same target group. Create an A Record for the development website. Set the value to the ALB. Create a listener rule on the ALB that forwards requests for the development website to the target group.
Show Answer
Correct Answer: A
Explanation: Use a Route 53 alias A record pointing to the ALB, and configure an ALB listener rule (for example, based on the Host header for the development subdomain) to forward traffic to a dedicated target group containing the development EC2 instance. If the instance is replaced, the target group membership can be updated automatically (such as by an Auto Scaling group), so DNS does not need to change. Options B and C depend on a specific instance public IP, which is not durable across replacement. Option D places all instances in one target group, preventing isolation of the development instance.
Question 201
A company wants to set up Amazon Managed Grafana as its visualization tool. The company wants to visualize data from its Amazon RDS database as one data source. The company needs a secure solution that will not expose the data over the internet.
Which solution will meet these requirements?
A. Create an Amazon Managed Grafana workspace without a VPC. Create a public endpoint for the RDS database. Configure the public endpoint as a data source in Amazon Managed Grafana.
B. Create an Amazon Managed Grafana workspace in a VPC. Create a private endpoint for the RDS database. Configure the private endpoint as a data source in Amazon Managed Grafana.
C. Create an Amazon Managed Grafana workspace without a VPCreate an AWS PrivateLink endpoint to establish a connection between Amazon Managed Grafana and Amazon RDS. Set up Amazon RDS as a data source in Amazon Managed Grafana.
D. Create an Amazon Managed Grafana workspace in a VPC. Create a public endpoint for the RDS database. Configure the public endpoint as a data source in Amazon Managed Grafana.
Show Answer
Correct Answer: B
Explanation: The secure and supported approach is to connect the Amazon Managed Grafana workspace to the VPC that hosts the Amazon RDS database so traffic stays on private networking. Options A and D use a public RDS endpoint, violating the requirement. Option C is inaccurate because Amazon Managed Grafana is connected to a VPC for private data source access; you do not simply use a PrivateLink endpoint while leaving the workspace without VPC connectivity.
Question 202
A company uses an AWS Batch job to run its end-of-day sales process. The company needs a serverless solution that will invoke a third-party reporting application when the AWS Batch job is successful. The reporting application has an HTTP API interface that uses username and password authentication.
Which solution will meet these requirements?
A. Configure an Amazon EventBridge rule to match incoming AWS Batch job SUCCEEDED events. Configure the third-party API as an EventBridge API destination with a username and password. Set the API destination as the EventBridge rule target.
B. Configure Amazon EventBridge Scheduler to match incoming AWS Batch job SUCCEEDED events. Configure an AWS Lambda function to invoke the third-party API by using a username and password. Set the Lambda function as the EventBridge rule target.
C. Configure an AWS Batch job to publish job SUCCEEDED events to an Amazon API Gateway REST API. Configure an HTTP proxy integration on the API Gateway REST API to invoke the third-party API by using a username and password.
D. Configure an AWS Batch job to publish job SUCCEEDED events to an Amazon API Gateway REST API. Configure a proxy integration on the API Gateway REST API to an AWS Lambda function. Configure the Lambda function to invoke the third-party API by using a username and password.
Show Answer
Correct Answer: A
Explanation: AWS Batch emits job state change events to Amazon EventBridge. An EventBridge rule can match SUCCEEDED events and directly invoke an EventBridge API Destination, which is designed for calling external HTTP APIs and supports basic (username/password) authentication via connections. This is fully serverless and avoids unnecessary Lambda or API Gateway components. EventBridge Scheduler is for time-based scheduling, not event matching, so option B is incorrect as stated. Options C and D add unnecessary API Gateway complexity and do not fit the native event-driven pattern.
Question 203
A company uses high concurrency AWS Lambda functions to process a constantly increasing number of messages in a message queue during marketing events. The Lambda functions use CPU intensive code to process the messages. The company wants to reduce the compute costs and to maintain service latency for its customers.
Which solution will meet these requirements?
A. Configure reserved concurrency for the Lambda functions. Decrease the memory allocated to the Lambda functions.
B. Configure reserved concurrency for the Lambda functions. Increase the memory according to AWS Compute Optimizer recommendations.
C. Configure provisioned concurrency for the Lambda functions. Decrease the memory allocated to the Lambda functions.
D. Configure provisioned concurrency for the Lambda functions. Increase the memory according to AWS Compute Optimizer recommendations.
Show Answer
Correct Answer: B
Explanation: For CPU-intensive Lambda functions, increasing memory also increases allocated CPU, which often reduces execution time enough to lower overall compute cost. AWS Compute Optimizer provides memory right-sizing recommendations for this optimization. Provisioned concurrency reduces cold starts but adds ongoing cost. The workload is driven by a queue with increasing messages, where Lambda scales with demand; reserved concurrency can guarantee available concurrency without the additional charges of provisioned concurrency, helping maintain service behavior more cost-effectively.
Sources:
https://aws.amazon.com/blogs/compute/efficiently-processing-batched-data-using-parallelization-in-aws-lambda
Question 204
A company runs its workloads on Amazon Elastic Container Service (Amazon ECS). The container images that the ECS task definition uses need to be scanned for Common Vulnerabilities and Exposures (CVEs). New container images that are created also need to be scanned.
Which solution will meet these requirements with the FEWEST changes to the workloads?
A. Use Amazon Elastic Container Registry (Amazon ECR) as a private image repository to store the container images. Specify scan on push filters for the ECR basic scan.
B. Store the container images in an Amazon S3 bucket. Use Amazon Macie to scan the images. Use an S3 Event Notification to initiate a Macie scan for every event with an s3:ObjectCreated:Put event type.
C. Deploy the workloads to Amazon Elastic Kubernetes Service (Amazon EKS). Use Amazon Elastic Container Registry (Amazon ECR) as a private image repository. Specify scan on push filters for the ECR enhanced scan.
D. Store the container images in an Amazon S3 bucket that has versioning enabled. Configure an S3 Event Notification for s3:ObjectCreated:* events to invoke an AWS Lambda function. Configure the Lambda function to initiate an Amazon Inspector scan.
Show Answer
Correct Answer: A
Explanation: Amazon ECR is the native container image registry for Amazon ECS and supports automatic image vulnerability scanning on push with basic scanning for CVEs. Using ECR with scan-on-push meets the requirement to scan existing and newly created container images with minimal changes to the existing ECS workloads. Amazon Macie is for sensitive data discovery, not container vulnerability scanning. Migrating to EKS is a major workload change and unnecessary. Storing images in S3 with Lambda and Inspector is not the standard architecture for container images and adds unnecessary complexity.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.