A company wants to analyze and generate reports to track the usage of its mobile app. The app is popular and has a global user base. The company uses a custom report building program to analyze application usage.
The program generates multiple reports during the last week of each month. The program takes less than 10 minutes to produce each report. The company rarely uses the program to generate reports outside of the last week of each month The company wants to generate reports in the least amount of time when the reports are requested.
Which solution will meet these requirements MOST cost-effectively?
A. Run the program by using Amazon EC2 On-Demand Instances. Create an Amazon EventBridge rule to start the EC2 instances when reports are requested. Run the EC2 instances continuously during the last week of each month.
B. Run the program in AWS Lambda. Create an Amazon EventBridge rule to run a Lambda function when reports are requested.
C. Run the program in Amazon Elastic Container Service (Amazon ECS). Schedule Amazon ECS to run the program when reports are requested.
D. Run the program by using Amazon EC2 Spot Instances. Create an Amazon EventBndge rule to start the EC2 instances when reports are requested. Run the EC2 instances continuously during the last week of each month.
Show Answer
Correct Answer: B
Explanation: AWS Lambda is the most cost-effective and fastest option for this workload. Each report takes less than 10 minutes, which fits within Lambda’s 15-minute maximum execution time. The program is used infrequently (mostly during the last week of each month), so a serverless, pay-per-execution model avoids paying for idle resources. Lambda can be triggered on demand by Amazon EventBridge and scales automatically to generate multiple reports in parallel, minimizing total report generation time. EC2 or ECS would incur higher costs and operational overhead for short, sporadic workloads.
Question 234
A company has a mobile app for customers. The app’s data is sensitive and must be encrypted at rest. The company uses AWS Key Management Service (AWS KMS).
The company needs a solution that prevents the accidental deletion of KMS keys. The solution must use Amazon Simple Notification Service (Amazon SNS) to send an email notification to administrators when a user attempts to delete a KMS key.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an Amazon EventBridge rule that reacts when a user tries to delete a KMS key. Configure an AWS Config rule that cancels any deletion of a KMS key. Add the AWS Config rule as a target of the EventBridge rule. Create an SNS topic that notifies the administrators.
B. Create an AWS Lambda function that has custom logic to prevent KMS key deletion. Create an Amazon CloudWatch alarm that is activated when a user tries to delete a KMS key. Create an Amazon EventBridge rule that invokes the Lambda function when the DeleteKey operation is performed. Create an SNS topic. Configure the EventBridge rule to publish an SNS message that notifies the administrators.
C. Create an Amazon EventBridge rule that reacts when the KMS DeleteKey operation is performed. Configure the rule to initiate an AWS Systems Manager Automation runbook. Configure the runbook to cancel the deletion of the KMS key. Create an SNS topic. Configure the EventBridge rule to publish an SNS message that notifies the administrators.
D. Create an AWS CloudTrail trail. Configure the trail to deliver logs to a new Amazon CloudWatch log group. Create a CloudWatch alarm based on the metric filter for the CloudWatch log group. Configure the alarm to use Amazon SNS to notify the administrators when the KMS DeleteKey operation is performed.
Show Answer
Correct Answer: C
Explanation: The requirement is to both prevent accidental deletion of KMS keys and notify administrators via SNS, with the least operational overhead. KMS key deletion is a scheduled action, not immediate, which allows remediation. An Amazon EventBridge rule can natively detect the KMS DeleteKey (scheduled deletion) event. Using an AWS Systems Manager Automation runbook avoids custom code and can automatically cancel the scheduled deletion. The same EventBridge rule can publish to SNS for email notifications. This approach uses managed services, no custom Lambda logic, and directly supports prevention plus notification, resulting in the lowest operational overhead.
Question 235
An analytics company uses Amazon VPC to run its multi-tier services. The company wants to use RESTful APIs to offer a web analytics service to millions of users. Users must be verified by using an authentication service to access the APIs.
Which solution will meet these requirements with the MOST operational efficiency?
A. Configure an Amazon Cognito user pool for user authentication. Implement Amazon API Gateway REST APIs with a Cognito authorizer.
B. Configure an Amazon Cognito identity pool for user authentication. Implement Amazon API Gateway HTTP APIs with a Cognito authorizer.
C. Configure an AWS Lambda function to handle user authentication. Implement Amazon API Gateway REST APIs with a Lambda authorizer.
D. Configure an IAM user to handle user authentication. Implement Amazon API Gateway HTTP APIs with an IAM authorizer.
Show Answer
Correct Answer: A
Explanation: Amazon Cognito user pools are purpose-built for authenticating and managing application users at scale. Amazon API Gateway REST APIs natively integrate with Cognito user pool authorizers, providing a fully managed, highly scalable authentication mechanism with minimal operational overhead. Identity pools are for authorization to AWS resources (not primary user authentication), Lambda authorizers add unnecessary operational complexity, and IAM users are not suitable for authenticating millions of external users.
Question 236
A company has AWS Lambda functions that use environment variables. The company does not want its developers to see environment variables in plaintext.
Which solution will meet these requirements?
A. Deploy code to Amazon EC2 instances instead of using Lambda functions.
B. Configure SSL encryption on the Lambda functions to use AWS CloudHSM to store and encrypt the environment variables.
C. Create a certificate in AWS Certificate Manager (ACM). Configure the Lambda functions to use the certificate to encrypt the environment variables.
D. Create an AWS Key Management Service (AWS KMS) key. Enable encryption helpers on the Lambda functions to use the KMS key to store and encrypt the environment variables.
Show Answer
Correct Answer: D
Explanation: AWS Lambda environment variables are encrypted at rest using AWS KMS. By creating a customer-managed KMS key and enabling Lambda encryption helpers, the variables are stored encrypted and only decrypted at runtime by Lambda, preventing developers from viewing them in plaintext. Other options (EC2, ACM certificates, CloudHSM/SSL) are not applicable to Lambda environment variable encryption.
Question 237
A company's web application that is hosted in the AWS Cloud recently increased in popularity. The web application currently exists on a single Amazon EC2 instance in a single public subnet. The web application has not been able to meet the demand of the increased web traffic.
The company needs a solution that will provide high availability and scalability to meet the increased user demand without rewriting the web application.
Which combination of steps will meet these requirements? (Choose two.)
A. Replace the EC2 instance with a larger compute optimized instance.
B. Configure Amazon EC2 Auto Scaling with multiple Availability Zones in private subnets.
C. Configure a NAT gateway in a public subnet to handle web requests.
D. Replace the EC2 instance with a larger memory optimized instance.
E. Configure an Application Load Balancer in a public subnet to distribute web traffic.
Show Answer
Correct Answer: B, E
Explanation: High availability and scalability without rewriting the application require horizontal scaling and traffic distribution. An Application Load Balancer in a public subnet distributes incoming web traffic across multiple instances. Amazon EC2 Auto Scaling across multiple Availability Zones (typically using private subnets behind the load balancer) automatically adds or removes instances based on demand and provides fault tolerance. Simply resizing a single instance only provides vertical scaling and no high availability, and a NAT gateway is not used to accept inbound web traffic.
Question 238
A company needs a solution to prevent AWS CloudFormation stacks from deploying AWS Identity and Access Management (IAM) resources that include an inline policy or “*” in the statement. The solution must also prohibit deployment of Amazon EC2 instances with public IP addresses. The company has AWS Control Tower enabled in its organization in AWS Organizations.
Which solution will meet these requirements?
A. Use AWS Control Tower proactive controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or “*”.
B. Use AWS Control Tower detective controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or “*”.
C. Use AWS Config to create rules for EC2 and IAM compliance. Configure the rules to run an AWS Systems Manager Session Manager automation to delete a resource when it is not compliant.
D. Use a service control policy (SCP) to block actions for the EC2 instances and IAM resources if the actions lead to noncompliance.
Show Answer
Correct Answer: A
Explanation: The requirement is to prevent noncompliant resources from being deployed through AWS CloudFormation. AWS Control Tower proactive controls are designed for this exact use case: they use CloudFormation hooks to evaluate templates before deployment and block stacks that attempt to create disallowed configurations, such as IAM inline policies with "*" permissions or EC2 instances with public IP addresses. Detective controls cannot block deployment, AWS Config with remediation is reactive, and SCPs are broader permission controls that apply beyond CloudFormation and are less precise for template-level validation.
Question 239
A company has an organization in AWS Organizations that has all features enabled. The company requires that all API calls and logins in any existing or new AWS account must be audited. The company needs a managed solution to prevent additional work and to minimize costs. The company also needs to know when any AWS account is not compliant with the AWS Foundational Security Best Practices (FSBP) standard.
Which solution will meet these requirements with the LEAST operational overhead?
A. Deploy an AWS Control Tower environment in the Organizations management account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment.
B. Deploy an AWS Control Tower environment in a dedicated Organizations member account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment.
C. Use AWS Managed Services (AMS) Accelerate to build a multi-account landing zone (MALZ). Submit an RFC to self-service provision Amazon GuardDuty in the MALZ.
D. Use AWS Managed Services (AMS) Accelerate to build a multi-account landing zone (MALZ). Submit an RFC to self-service provision AWS Security Hub in the MALZ.
Show Answer
Correct Answer: A
Explanation: AWS Control Tower is the managed, low‑overhead service designed to govern multi‑account AWS Organizations. Deploying it in the Organizations management account enables mandatory account‑level guardrails, centralized logging, and auditing of all API calls and logins through AWS CloudTrail across existing and newly created accounts. Control Tower natively integrates with AWS Security Hub, which continuously evaluates accounts against the AWS Foundational Security Best Practices (FSBP) standard and reports noncompliance. Using Account Factory ensures all new accounts are automatically enrolled with these controls. The other options either place Control Tower in an unsupported account, focus on threat detection rather than FSBP compliance, or rely on AWS Managed Services, which introduces higher cost and operational overhead.
Question 240
A company has stored 10 TB of log files in Apache Parquet format in an Amazon S3 bucket. The company occasionally needs to use SQL to analyze the log files.
Which solution will meet these requirements MOST cost-effectively?
A. Create an Amazon Aurora MySQL database. Migrate the data from the S3 bucket into Aurora by using AWS Database Migration Service (AWS DMS). Issue SQL statements to the Aurora database.
B. Create an Amazon Redshift cluster. Use Redshift Spectrum to run SQL statements directly on the data in the S3 bucket.
C. Create an AWS Glue crawler to store and retrieve table metadata from the S3 bucket. Use Amazon Athena to run SQL statements directly on the data in the S3 bucket.
D. Create an Amazon EMR cluster. Use Apache Spark SQL to run SQL statements directly on the data in the S3 bucket.
Show Answer
Correct Answer: C
Explanation: Amazon Athena is the most cost-effective option for occasional SQL analysis of data stored in Amazon S3. Athena is serverless, requires no infrastructure to manage, and charges only for the amount of data scanned by queries. Apache Parquet is a columnar format that Athena can query efficiently. An AWS Glue crawler can automatically infer the schema and store metadata in the Glue Data Catalog, enabling SQL queries directly on the S3 data without data movement. The other options incur higher costs due to data migration, cluster provisioning, or ongoing infrastructure.
Question 241
A company runs multiple workloads in its on-premises data center. The company's data center cannot scale fast enough to meet the company's expanding business needs. The company wants to collect usage and configuration data about the on-premises servers and workloads to plan a migration to AWS.
Which solution will meet these requirements?
A. Set the home AWS Region in AWS Migration Hub. Use AWS Systems Manager to collect data about the on-premises servers.
B. Set the home AWS Region in AWS Migration Hub. Use AWS Application Discovery Service to collect data about the on-premises servers.
C. Use the AWS Schema Conversion Tool (AWS SCT) to create the relevant templates. Use AWS Trusted Advisor to collect data about the on-premises servers.
D. Use the AWS Schema Conversion Tool (AWS SCT) to create the relevant templates. Use AWS Database Migration Service (AWS DMS) to collect data about the on-premises servers.
Show Answer
Correct Answer: B
Explanation: The requirement is to collect usage and configuration data from on-premises servers to plan a migration to AWS. AWS Application Discovery Service is designed specifically to discover on-premises servers and collect usage and configuration data, and it integrates with AWS Migration Hub for centralized tracking and planning. Systems Manager is primarily for managing already-registered systems, while AWS SCT and AWS DMS are for database schema conversion and data migration, not discovery and assessment. Therefore, using Migration Hub with Application Discovery Service is the correct solution.
Question 242
A solutions architect is designing a payment processing application that runs on AWS Lambda in private subnets across multiple Availability Zones. The application uses multiple Lambda functions and processes millions of transactions each day.
The architecture must ensure that the application does not process duplicate payments.
Which solution will meet these requirements?
A. Use Lambda to retrieve all due payments. Publish the due payments to an Amazon S3 bucket. Configure the S3 bucket with an event notification to invoke another Lambda function to process the due payments.
B. Use Lambda to retrieve all due payments. Publish the due payments to an Amazon Simple Queue Service (Amazon SQS) queue. Configure another Lambda function to poll the SQS queue and to process the due payments.
C. Use Lambda to retrieve all due payments. Publish the due payments to an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Configure another Lambda function to poll the FIFO queue and to process the due payments.
D. Use Lambda to retrieve all due payments. Store the due payments in an Amazon DynamoDB table. Configure streams on the DynamoDB table to invoke another Lambda function to process the due payments.
Show Answer
Correct Answer: C
Explanation: The requirement is to prevent duplicate payment processing at scale. Amazon SQS FIFO queues provide exactly-once message processing semantics with message deduplication and ordered delivery, which prevents duplicate messages from being introduced and processed. Lambda can poll FIFO queues across multiple Availability Zones and handle millions of transactions per day using batching and high-throughput FIFO configuration. Standard SQS, S3 events, and DynamoDB Streams all provide at-least-once delivery and can produce duplicates, requiring additional idempotency logic, which does not best meet the stated requirement.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.