A company's marketing data is uploaded from multiple sources to an Amazon S3 bucket. A series of data preparation jobs aggregate the data for reporting. The data preparation jobs need to run at regular intervals in parallel. A few jobs need to run in a specific order later.
The company wants to remove the operational overhead of job error handling, retry logic, and state management.
Which solution will meet these requirements?
A. Use an AWS Lambda function to process the data as soon as the data is uploaded to the S3 bucket. Invoke other Lambda functions at regularly scheduled intervals.
B. Use Amazon Athena to process the data. Use Amazon EventBridge Scheduler to invoke Athena on a regular internal.
C. Use AWS Glue DataBrew to process the data. Use an AWS Step Functions state machine to run the DataBrew data preparation jobs.
D. Use AWS Data Pipeline to process the data. Schedule Data Pipeline to process the data once at midnight.
Show Answer
Correct Answer: C
Explanation: The requirements include running data preparation jobs on a schedule, executing many jobs in parallel with some later jobs in a defined sequence, and eliminating operational overhead for retries, error handling, and state management. AWS Step Functions natively provides orchestration with parallel and sequential states, built-in retry and error handling, and state tracking. AWS Glue DataBrew is a fully managed, serverless service purpose-built for data preparation on data stored in Amazon S3. Together, they meet all requirements with minimal operational overhead. Other options lack robust orchestration, ordering, or managed error handling, or rely on outdated services.
Question 244
A company maintains its accounting records in a custom application that runs on Amazon EC2 instances. The company needs to migrate the data to an AWS managed service for development and maintenance of the application data. The solution must require minimal operational support and provide immutable, cryptographically verifiable logs of data changes.
Which solution will meet these requirements MOST cost-effectively?
A. Copy the records from the application into an Amazon Redshift cluster.
B. Copy the records from the application into an Amazon Neptune cluster.
C. Copy the records from the application into an Amazon Timestream database.
D. Copy the records from the application into an Amazon Quantum Ledger Database (Amazon QLDB) ledger.
Show Answer
Correct Answer: D
Explanation: The requirements call for a fully managed service with minimal operational overhead and immutable, cryptographically verifiable logs of data changes. Amazon QLDB is specifically designed as a ledger database that provides an append-only, immutable journal with cryptographic verification of history, making it ideal for accounting records. Redshift is an analytics data warehouse, Neptune is a graph database, and Timestream is a time-series database—none provide built-in immutable, verifiable transaction logs. QLDB is also cost-effective because it is serverless and fully managed.
Question 245
A company wants to deploy an internal web application on AWS. The web application must be accessible only from the company's office. The company needs to download security patches for the web application from the internet.
The company has created a VPC and has configured an AWS Site-to-Site VPN connection to the company's office. A solutions architect must design a secure architecture for the web application.
Which solution will meet these requirements?
A. Deploy the web application on Amazon EC2 instances in public subnets behind a public Application Load Balancer (ALB). Attach an internet gateway to the VPC. Set the inbound source of the ALB's security group to 0.0.0.0/0.
B. Deploy the web application on Amazon EC2 instances in private subnets behind an internal Application Load Balancer (ALB). Deploy NAT gateways in public subnets. Attach an internet gateway to the VPC. Set the inbound source of the ALB's security group to the company's office network CIDR block.
C. Deploy the web application on Amazon EC2 instances in public subnets behind an internal Application Load Balancer (ALB). Deploy NAT gateways in private subnets. Attach an internet gateway to the VPSet the outbound destination of the ALB’s security group to the company's office network CIDR block.
D. Deploy the web application on Amazon EC2 instances in private subnets behind a public Application Load Balancer (ALB). Attach an internet gateway to the VPC. Set the outbound destination of the ALB’s security group to 0.0.0.0/0.
Show Answer
Correct Answer: B
Explanation: The application must be reachable only from the company office over the Site-to-Site VPN and must still access the internet to download patches. Placing EC2 instances in private subnets behind an internal ALB ensures the application is not publicly accessible. Restricting the ALB’s inbound security group to the company office CIDR allows access only from the office network via the VPN. NAT gateways in public subnets, together with an internet gateway, provide outbound-only internet access for the private instances so they can download security patches without exposing inbound access from the internet.
Question 246
A company wants to run its experimental workloads in the AWS Cloud. The company has a budget for cloud spending. The company's CFO is concerned about cloud spending accountability for each department. The CFO wants to receive notification when the spending threshold reaches 60% of the budget.
Which solution will meet these requirements?
A. Use cost allocation tags on AWS resources to label owners. Create usage budgets in AWS Budgets. Add an alert threshold to receive notification when spending exceeds 60% of the budget.
B. Use AWS Cost Explorer forecasts to determine resource owners. Use AWS Cost Anomaly Detection to create alert threshold notifications when spending exceeds 60% of the budget.
C. Use cost allocation tags on AWS resources to label owners. Use AWS Support API on AWS Trusted Advisor to create alert threshold notifications when spending exceeds 60% of the budget.
D. Use AWS Cost Explorer forecasts to determine resource owners. Create usage budgets in AWS Budgets. Add an alert threshold to receive notification when spending exceeds 60% of the budget.
Show Answer
Correct Answer: A
Explanation: The requirements are departmental cost accountability and a notification when spending reaches 60% of a defined budget. Cost allocation tags are the correct way to track and attribute costs to departments. AWS Budgets is the service designed to define budgets and send alerts at specific thresholds, such as 60% of budget usage. Cost Explorer and Trusted Advisor do not provide budget enforcement or threshold notifications in this way. Therefore, option A fully meets all requirements.
Question 247
A company has hired an external vendor to perform work in the company’s AWS account. The vendor uses an automated tool that is hosted in an AWS account that the vendor owns. The vendor does not have IAM access to the company’s AWS account. The company needs to grant the vendor access to the company’s AWS account.
Which solution will meet these requirements MOST securely?
A. Create an IAM role in the company’s account to delegate access to the vendor’s IAM role. Attach the appropriate IAM policies to the role for the permissions that the vendor requires.
B. Create an IAM user in the company’s account with a password that meets the password complexity requirements. Attach the appropriate IAM policies to the user for the permissions that the vendor requires.
C. Create an IAM group in the company’s account. Add the automated tool’s IAM user from the vendor account to the group. Attach the appropriate IAM policies to the group for the permissions that the vendor requires.
D. Create an IAM user in the company’s account that has a permission boundary that allows the vendor’s account. Attach the appropriate IAM policies to the user for the permissions that the vendor requires.
Show Answer
Correct Answer: A
Explanation: The most secure approach is to use cross-account IAM role assumption. Creating an IAM role in the company’s account and allowing the vendor’s AWS account to assume that role enables temporary, auditable credentials with least-privilege permissions and no long-term credentials in the company account. This is the AWS-recommended pattern for third-party access. The other options involve creating IAM users or groups in the company account, which is less secure and not supported for cross-account users.
Question 248
A company has an Amazon Elastic File System (Amazon EFS) file system that contains a reference dataset. The company has applications on Amazon EC2 instances that need to read the dataset. However, the applications must not be able to change the dataset. The company wants to use IAM access control to prevent the applications from being able to modify or delete the dataset.
Which solution will meet these requirements?
A. Mount the EFS file system in read-only mode from within the EC2 instances.
B. Create a resource policy for the EFS file system that denies the elasticfilesystem:ClientWrite action to the IAM roles that are attached to the EC2 instances.
C. Create an identity policy for the EFS file system that denies the elasticfilesystem:ClientWrite action on the EFS file system.
D. Create an EFS access point for each application. Use Portable Operating System Interface (POSIX) file permissions to allow read-only access to files in the root directory.
Show Answer
Correct Answer: B
Explanation: The requirement explicitly states that the company wants to use IAM access control to prevent applications from modifying or deleting data in Amazon EFS. Amazon EFS supports IAM authorization for NFS clients, where access is enforced by evaluating the file system’s resource-based policy (file system policy) together with the IAM role used by the EC2 instance. Denying the elasticfilesystem:ClientWrite action in an EFS resource policy prevents write and delete operations while still allowing read access. Mount options or POSIX permissions do not satisfy the requirement to use IAM access control, and identity policies are attached to roles or users, not directly to the EFS resource.
Question 249
A data analytics company has 80 offices that are distributed globally. Each office hosts 1 PB of data and has between 1 and 2 Gbps of internet bandwidth.
The company needs to perform a one-time migration of a large amount of data from its offices to Amazon S3. The company must complete the migration within 4 weeks.
Which solution will meet these requirements MOST cost-effectively?
A. Establish a new 10 Gbps AWS Direct Connect connection to each office. Transfer the data to Amazon S3.
B. Use multiple AWS Snowball Edge storage-optimized devices to store and transfer the data to Amazon S3.
C. Use an AWS Snowmobile to store and transfer the data to Amazon S3.
D. Set up an AWS Storage Gateway Volume Gateway to transfer the data to Amazon S3.
Show Answer
Correct Answer: B
Explanation: Each of the 80 offices holds 1 PB of data with limited (1–2 Gbps) internet bandwidth, and the migration must finish within 4 weeks at lowest cost. Network-based options (Direct Connect or Storage Gateway) would be expensive and constrained by bandwidth over such a short timeline. AWS Snowmobile is designed for very large datasets (typically 10+ PB) concentrated in a single location, not many globally distributed offices. AWS Snowball Edge is specifically intended for one-time, large-scale data migrations from multiple locations with limited bandwidth and is far more cost-effective and operationally feasible in this scenario.
Question 250
A company uses AWS Organizations for its multi-account AWS setup. The security organizational unit (OU) of the company needs to share approved Amazon Machine Images (AMIs) with the development OU. The AMIs are created by using AWS Key Management Service (AWS KMS) encrypted snapshots.
Which solution will meet these requirements? (Choose two.)
A. Add the development team's OU Amazon Resource Name (ARN) to the launch permission list for the AMIs.
B. Add the Organizations root Amazon Resource Name (ARN) to the launch permission list for the AMIs.
C. Update the key policy to allow the development team's OU to use the AWS KMS keys that are used to decrypt the snapshots.
D. Add the development team’s account Amazon Resource Name (ARN) to the launch permission list for the AMIs.
E. Recreate the AWS KMS key. Add a key policy to allow the Organizations root Amazon Resource Name (ARN) to use the AWS KMS key.
Show Answer
Correct Answer: A, C
Explanation: To share KMS-encrypted AMIs across OUs in AWS Organizations, two permissions are required. First, the development OU must have permission to launch the AMIs, which is done by adding the development OU ARN to the AMI launch permissions (A). Second, because the AMIs are backed by KMS-encrypted snapshots, the KMS key policy must allow principals in the development OU to use the key to decrypt the snapshots (C). Without both launch permission and KMS decrypt permission, the AMIs cannot be used by the development OU.
Question 251
A company has a mobile game that reads most of its metadata from an Amazon RDS DB instance. As the game increased in popularity, developers noticed slowdowns related to the game's metadata load times. Performance metrics indicate that simply scaling the database will not help. A solutions architect must explore all options that include capabilities for snapshots, replication, and sub-millisecond response times.
What should the solutions architect recommend to solve these issues?
A. Migrate the database to Amazon Aurora with Aurora Replicas.
B. Migrate the database to Amazon DynamoDB with global tables.
C. Add an Amazon ElastiCache for Redis layer in front of the database.
D. Add an Amazon ElastiCache for Memcached layer in front of the database.
Show Answer
Correct Answer: C
Explanation: The requirement is for sub-millisecond response times plus support for replication and snapshots. Scaling RDS alone will not help, so a caching layer is appropriate. Amazon ElastiCache for Redis provides in-memory performance with sub-millisecond latency, supports read replicas and Multi-AZ replication, and offers snapshotting for persistence and recovery. Memcached lacks snapshots and replication, and migrating to Aurora or DynamoDB would be larger architectural changes that do not directly address the read-latency problem as effectively as caching.
Question 252
Use Amazon Elastic Kubernetes Service (Amazon EKS) with Amazon EC2 worker nodes.
A company has deployed an application in an AWS account. The application consists of microservices that run on AWS Lambda and Amazon Elastic Kubernetes Service (Amazon EKS). A separate team supports each microservice. The company has multiple AWS accounts and wants to give each team its own account for its microservices.
A solutions architect needs to design a solution that will provide service-to-service communication over HTTPS (port 443). The solution also must provide a service registry for service discovery.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Create an inspection VPC. Deploy an AWS Network Firewall firewall to the inspection VPC. Attach the inspection VPC to a new transit gateway. Route VPC-to-VPC traffic to the inspection VPC. Apply firewall rules to allow only HTTPS communication.
B. Create a VPC Lattice service network. Associate the microservices with the service network. Define HTTPS listeners for each service. Register microservice compute resources as targets. Identify VPCs that need to communicate with the services. Associate those VPCs with the service network.
C. Create a Network Load Balancer (NLB) with an HTTPS listener and target groups for each microservice. Create an AWS PrivateLink endpoint service for each microservice. Create an interface VPC endpoint in each VPC that needs to consume that microservice.
D. Create peering connections between VPCs that contain microservices. Create a prefix list for each service that requires a connection to a client. Create route tables to route traffic to the appropriate VPC. Create security groups to allow only HTTPS communication.
Show Answer
Correct Answer: B
Explanation: Amazon VPC Lattice provides managed service-to-service connectivity across multiple AWS accounts and VPCs with built-in service discovery and HTTPS support. It works with both EKS and Lambda, eliminates the need for VPC peering, load balancers, PrivateLink, or custom routing, and centralizes service registration and access control. This results in the least administrative overhead while meeting the requirements for secure (port 443) communication and a service registry.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.