A company needs to extract the names of ingredients from recipe records that are stored as text files in an Amazon S3 bucket. A web application will use the ingredient names to query an Amazon DynamoDB table and determine a nutrition score.
The application can handle non-food records and errors. The company does not have any employees who have machine learning knowledge to develop this solution.
Which solution will meet these requirements MOST cost-effectively?
A. Use S3 Event Notifications to invoke an AWS Lambda function when PutObject requests occur. Program the Lambda function to analyze the object and extract the ingredient names by using Amazon Comprehend. Store the Amazon Comprehend output in the DynamoDB table.
B. Use an Amazon EventBridge rule to invoke an AWS Lambda function when PutObject requests occur. Program the Lambda function to analyze the object by using Amazon Forecast to extract the ingredient names. Store the Forecast output in the DynamoDB table.
C. Use S3 Event Notifications to invoke an AWS Lambda function when PutObject requests occur. Use Amazon Polly to create audio recordings of the recipe records. Save the audio files in the S3 bucket. Use Amazon Simple Notification Service (Amazon SNS) to send a URL as a message to employees. Instruct the employees to listen to the audio files and calculate the nutrition score. Store the ingredient names in the DynamoDB table.
D. Use an Amazon EventBridge rule to invoke an AWS Lambda function when a PutObject request occurs. Program the Lambda function to analyze the object and extract the ingredient names by using Amazon SageMaker. Store the inference output from the SageMaker endpoint in the DynamoDB table.
Show Answer
Correct Answer: A
Explanation: Amazon Comprehend is a managed NLP service that can extract entities and key phrases from text without requiring machine learning expertise. S3 Event Notifications can directly invoke AWS Lambda on object uploads, making this a simple and cost-effective event-driven architecture. Amazon Forecast is for time-series forecasting, Amazon Polly is text-to-speech and does not solve the extraction problem, and Amazon SageMaker would require building or deploying ML models, which conflicts with the requirement for no ML expertise.
Question 222
A company’s website hosted on Amazon EC2 instances processes classified data stored in Amazon S3. Due to security concerns, the company requires a private and secure connection between its EC2 resources and Amazon S3.
Which solution meets these requirements?
A. Set up S3 bucket policies to allow access from a VPC endpoint.
B. Set up an IAM policy to grant read-write access to the S3 bucket.
C. Set up a NAT gateway to access resources outside the private subnet.
D. Set up an access key ID and a secret access key to access the S3 bucket.
Show Answer
Correct Answer: A
Explanation: A VPC endpoint for Amazon S3 (gateway endpoint) provides private connectivity between EC2 instances in a VPC and Amazon S3 without traversing the public internet. Restricting the S3 bucket policy to allow access only through the specified VPC endpoint satisfies the requirement for a private and secure connection. IAM policies control permissions but not network path, a NAT gateway provides internet egress rather than private S3 connectivity, and access keys are credentials, not a private network connection.
Question 223
A company has a multi-tier payment processing application that is based on virtual machines (VMs). The communication between the tiers occurs asynchronously through a third-party middleware solution that guarantees exactly-once delivery.
The company needs a solution that requires the least amount of infrastructure management. The solution must guarantee exactly-once delivery for application messaging.
Which combination of actions will meet these requirements? (Choose two.)
A. Use AWS Lambda for the compute layers in the architecture.
B. Use Amazon EC2 instances for the compute layers in the architecture.
C. Use Amazon Simple Notification Service (Amazon SNS) as the messaging component between the compute layers.
D. Use Amazon Simple Queue Service (Amazon SQS) FIFO queues as the messaging component between the compute layers.
E. Use containers that are based on Amazon Elastic Kubernetes Service (Amazon EKS) for the compute layers in the architecture.
Show Answer
Correct Answer: A, D
Explanation: AWS Lambda provides the least infrastructure management for the compute layer because it is fully serverless. Amazon SQS FIFO queues provide ordered messaging with exactly-once processing semantics (using FIFO features such as deduplication), making them the appropriate replacement for middleware that guarantees exactly-once delivery. Amazon SNS does not provide exactly-once delivery, and EC2 or EKS require more infrastructure management than Lambda.
Question 224
A company needs to use its on-premises LDAP directory service to authenticate its users to the AWS Management Console. The directory service is not compatible with Security Assertion Markup Language (SAML).
Which solution meets these requirements?
A. Enable AWS IAM Identity Center (AWS Single Sign-On) between AWS and the on-premises LDAP.
B. Create an IAM policy that uses AWS credentials, and integrate the policy into LDAP.
C. Set up a process that rotates the IAM credentials whenever LDAP credentials are updated.
D. Develop an on-premises custom identity broker application or process that uses AWS Security Token Service (AWS STS) to get short-lived credentials.
Show Answer
Correct Answer: D
Explanation: A non-SAML-compatible on-premises LDAP directory cannot federate directly with AWS using SAML-based mechanisms. In this scenario, the supported approach is to build a custom identity broker that authenticates users against LDAP and then uses AWS STS to obtain temporary credentials for AWS Management Console access. IAM policies cannot be integrated into LDAP for authentication, and rotating long-term IAM credentials is not the recommended federation model.
Question 225
A company’s ecommerce website has unpredictable traffic and uses AWS Lambda functions to directly access a private Amazon RDS for PostgreSQL DB instance. The company wants to maintain predictable database performance and ensure that the Lambda invocations do not overload the database with too many connections.
What should a solutions architect do to meet these requirements?
A. Point the client driver at an RDS custom endpoint. Deploy the Lambda functions inside a VPC.
B. Point the client driver at an RDS proxy endpoint. Deploy the Lambda functions inside a VPC.
C. Point the client driver at an RDS custom endpoint. Deploy the Lambda functions outside a VP
D. Point the client driver at an RDS proxy endpoint. Deploy the Lambda functions outside a VPC.
Show Answer
Correct Answer: B
Explanation: Amazon RDS Proxy is designed to pool and manage database connections, preventing bursts of AWS Lambda invocations from overwhelming an Amazon RDS for PostgreSQL instance and providing more predictable database performance. Because the RDS instance is private, the Lambda functions must be deployed in a VPC with network access to the database (or the proxy). An RDS custom endpoint is an Amazon Aurora feature and does not solve Lambda connection scaling for RDS PostgreSQL.
Question 226
A company hosts a database that runs on an Amazon RDS instance that is deployed to multiple Availability Zones. The company periodically runs a script against the database to report new entries that are added to the database. The script that runs against the database negatively affects the performance of a critical application. The company needs to improve application performance with minimal costs.
Which solution will meet these requirements with the LEAST operational overhead?
A. Add functionality to the script to identify the instance that has the fewest active connections. Configure the script to read from that instance to report the total new entries.
B. Create a read replica of the database. Configure the script to query only the read replica to report the total new entries.
C. Instruct the development team to manually export the new entries for the day in the database at the end of each day.
D. Use Amazon ElastiCache to cache the common queries that the script runs against the database.
Show Answer
Correct Answer: B
Explanation: A Multi-AZ Amazon RDS standby cannot be used for read traffic, so choosing the instance with the fewest connections is not applicable. Creating a read replica offloads reporting/read queries from the primary database, improving application performance with minimal operational overhead. Manual exports increase operational effort, and ElastiCache is intended for caching repeated application queries rather than offloading reporting queries that need fresh database data.
Question 227
A company is running a legacy system on an Amazon EC2 instance. The application code cannot be modified, and the system cannot run on more than one instance. A solutions architect must design a resilient solution that can improve the recovery time for the system.
What should the solutions architect recommend to meet these requirements?
A. Enable termination protection for the EC2 instance.
B. Configure the EC2 instance for Multi-AZ deployment.
C. Create an Amazon CloudWatch alarm to recover the EC2 instance in case of failure.
D. Launch the EC2 instance with two Amazon Elastic Block Store (Amazon EBS) volumes that use RAID configurations for storage redundancy.
Show Answer
Correct Answer: C
Explanation: Amazon EC2 instance recovery can be triggered by a CloudWatch alarm when system status checks fail. This automatically recovers the instance onto healthy hardware while preserving the instance ID, attached EBS volumes, IP addresses, and instance metadata, improving recovery time without requiring multiple instances. Termination protection does not aid recovery, EC2 does not support a 'Multi-AZ deployment' for a single instance, and EBS RAID improves storage characteristics but does not recover a failed EC2 instance.
Question 228
A solutions architect is designing an AWS Identity and Access Management (IAM) authorization model for a company's AWS account. The company has designated five specific employees to have full access to AWS services and resources in the AWS account.
The solutions architect has created an IAM user for each of the five designated employees and has created an IAM user group.
Which solution will meet these requirements?
A. Attach the AdministratorAccess resource-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
B. Attach the SystemAdministrator identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
C. Attach the AdministratorAccess identity-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
D. Attach the SystemAdministrator resource-based policy to the IAM user group. Place each of the five designated employee IAM users in the IAM user group.
Show Answer
Correct Answer: C
Explanation: IAM groups have identity-based policies attached, not resource-based policies. The AWS managed policy AdministratorAccess grants full access to AWS services and resources (*:*), whereas SystemAdministrator is more limited and does not grant unrestricted access. Therefore, attach the AdministratorAccess identity-based policy to the IAM group and add the five IAM users to that group.
Question 229
A social media company is creating a rewards program website for its users. The company gives users points when users create and upload videos to the website. Users redeem their points for gifts or discounts from the company's affiliated partners. A unique ID identifies users. The partners refer to this ID to verify user eligibility for rewards.
The partners want to receive notification of user IDs through an HTTP endpoint when the company gives users points. Hundreds of vendors are interested in becoming affiliated partners every day. The company wants to design an architecture that gives the website the ability to add partners rapidly in a scalable way.
Which solution will meet these requirements with the LEAST implementation effort?
A. Create an Amazon Timestream database to keep a list of affiliated partners. Implement an AWS Lambda function to read the list. Configure the Lambda function to send user IDs to each partner when the company gives users points.
B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Choose an endpoint protocol. Subscribe the partners to the topic. Publish user IDs to the topic when the company gives users points.
C. Create an AWS Step Functions state machine. Create a task for every affiliated partner. Invoke the state machine with user IDs as input when the company gives users points.
D. Create a data stream in Amazon Kinesis Data Streams. Implement producer and consumer applications. Store a list of affiliated partners in the data stream. Send user IDs when the company gives users points.
Show Answer
Correct Answer: B
Explanation: Amazon SNS is designed for pub/sub messaging. Partners can subscribe their HTTP endpoints to an SNS topic, and the application only needs to publish the user ID message when points are awarded. This scales to large numbers of partners with minimal implementation effort. The other options require custom partner management or are intended for different use cases (Timestream for time-series data, Step Functions for workflows, and Kinesis for streaming data processing).
Question 230
A company uses AWS to run its ecommerce platform. The platform is critical to the company's operations and has a high volume of traffic and transactions. The company configures a multi-factor authentication (MFA) device to secure its AWS account root user credentials. The company wants to ensure that it will not lose access to the root user account if the MFA device is lost.
Which solution will meet these requirements?
A. Set up a backup administrator account that the company can use to log in if the company loses the MFA device.
B. Add multiple MFA devices for the root user account to handle the disaster scenario.
C. Create a new administrator account when the company cannot access the root account.
D. Attach the administrator policy to another IAM user when the company cannot access the root account.
Show Answer
Correct Answer: B
Explanation: AWS supports registering multiple MFA devices for the AWS account root user (up to eight supported MFA devices). This provides resilience if one MFA device is lost or unavailable. The other options do not solve root user MFA recovery: a backup administrator or IAM administrator cannot replace root access, and you cannot create or elevate users after losing access if you cannot sign in.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.