A company needs a solution to prevent photos with unwanted content from being uploaded to the company's web application. The solution must not involve training a machine learning (ML) model.
Which solution will meet these requirements?
A. Create and deploy a model by using Amazon SageMaker Autopilot. Create a real-time endpoint that the web application invokes when new photos are uploaded.
B. Create an AWS Lambda function that uses Amazon Rekognition to detect unwanted content. Create a Lambda function URL that the web application invokes when new photos are uploaded.
C. Create an Amazon CloudFront function that uses Amazon Comprehend to detect unwanted content. Associate the function with the web application.
D. Create an AWS Lambda function that uses Amazon Rekognition Video to detect unwanted content. Create a Lambda function URL that the web application invokes when new photos are uploaded.
Show Answer
Correct Answer: B
Explanation: The requirement is to prevent uploads of photos with unwanted content without training an ML model. Amazon Rekognition Image provides pre-trained image moderation capabilities (DetectModerationLabels) for detecting inappropriate content. An AWS Lambda function can invoke Rekognition when a photo is uploaded, and the web application can call the Lambda URL or integrate it into the upload workflow. SageMaker Autopilot requires creating/training a model, Amazon Comprehend is for text analysis rather than images, and Rekognition Video is intended for video analysis, not still photos.
Question 232
A company is designing a tightly coupled high performance computing (HPC) environment in the AWS Cloud. The company needs to include features that will optimize the HPC environment for networking and storage.
Which combination of solutions will meet these requirements? (Choose two.)
A. Create an accelerator in AWS Global Accelerator. Configure custom routing for the accelerator.
B. Create an Amazon FSx for Lustre file system. Configure the file system with scratch storage.
C. Create an Amazon CloudFront distribution. Configure the viewer protocol policy to be HTTP and HTTPS.
D. Launch Amazon EC2 instances. Attach an Elastic Fabric Adapter (EFA) to the instances.
E. Create an AWS Elastic Beanstalk deployment to manage the environment.
Show Answer
Correct Answer: B, D
Explanation: For tightly coupled HPC workloads, Amazon FSx for Lustre provides a high-performance parallel file system optimized for HPC, and using scratch storage is appropriate for temporary, high-throughput compute workloads. Elastic Fabric Adapter (EFA) provides low-latency, high-bandwidth inter-instance communication with OS bypass, enabling efficient MPI-based tightly coupled applications. Global Accelerator and CloudFront are edge networking services, not intra-cluster HPC optimizations, and Elastic Beanstalk is for application deployment rather than HPC infrastructure.
Question 233
A company wants to analyze and generate reports to track the usage of its mobile app. The app is popular and has a global user base. The company uses a custom report building program to analyze application usage.
The program generates multiple reports during the last week of each month. The program takes less than 10 minutes to produce each report. The company rarely uses the program to generate reports outside of the last week of each month The company wants to generate reports in the least amount of time when the reports are requested.
Which solution will meet these requirements MOST cost-effectively?
A. Run the program by using Amazon EC2 On-Demand Instances. Create an Amazon EventBridge rule to start the EC2 instances when reports are requested. Run the EC2 instances continuously during the last week of each month.
B. Run the program in AWS Lambda. Create an Amazon EventBridge rule to run a Lambda function when reports are requested.
C. Run the program in Amazon Elastic Container Service (Amazon ECS). Schedule Amazon ECS to run the program when reports are requested.
D. Run the program by using Amazon EC2 Spot Instances. Create an Amazon EventBndge rule to start the EC2 instances when reports are requested. Run the EC2 instances continuously during the last week of each month.
Show Answer
Correct Answer: B
Explanation: AWS Lambda is the most cost-effective fit for short, infrequent, event-driven workloads. Each report completes in under 10 minutes, which is within the Lambda maximum execution time. EventBridge can trigger the function on demand when reports are requested. Keeping EC2 instances running for an entire week each month is unnecessary cost, and ECS adds more operational overhead for this simple short-lived job.
Question 234
A company has a mobile app for customers. The app’s data is sensitive and must be encrypted at rest. The company uses AWS Key Management Service (AWS KMS).
The company needs a solution that prevents the accidental deletion of KMS keys. The solution must use Amazon Simple Notification Service (Amazon SNS) to send an email notification to administrators when a user attempts to delete a KMS key.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an Amazon EventBridge rule that reacts when a user tries to delete a KMS key. Configure an AWS Config rule that cancels any deletion of a KMS key. Add the AWS Config rule as a target of the EventBridge rule. Create an SNS topic that notifies the administrators.
B. Create an AWS Lambda function that has custom logic to prevent KMS key deletion. Create an Amazon CloudWatch alarm that is activated when a user tries to delete a KMS key. Create an Amazon EventBridge rule that invokes the Lambda function when the DeleteKey operation is performed. Create an SNS topic. Configure the EventBridge rule to publish an SNS message that notifies the administrators.
C. Create an Amazon EventBridge rule that reacts when the KMS DeleteKey operation is performed. Configure the rule to initiate an AWS Systems Manager Automation runbook. Configure the runbook to cancel the deletion of the KMS key. Create an SNS topic. Configure the EventBridge rule to publish an SNS message that notifies the administrators.
D. Create an AWS CloudTrail trail. Configure the trail to deliver logs to a new Amazon CloudWatch log group. Create a CloudWatch alarm based on the metric filter for the CloudWatch log group. Configure the alarm to use Amazon SNS to notify the administrators when the KMS DeleteKey operation is performed.
Show Answer
Correct Answer: C
Explanation: AWS KMS key deletion is scheduled rather than immediate, allowing remediation. An EventBridge rule can detect the ScheduleKeyDeletion/DeleteKey event, trigger an AWS Systems Manager Automation runbook to cancel the scheduled deletion, and publish to Amazon SNS for email notifications. This avoids custom Lambda code and provides the required prevention and notification with the least operational overhead.
Question 235
An analytics company uses Amazon VPC to run its multi-tier services. The company wants to use RESTful APIs to offer a web analytics service to millions of users. Users must be verified by using an authentication service to access the APIs.
Which solution will meet these requirements with the MOST operational efficiency?
A. Configure an Amazon Cognito user pool for user authentication. Implement Amazon API Gateway REST APIs with a Cognito authorizer.
B. Configure an Amazon Cognito identity pool for user authentication. Implement Amazon API Gateway HTTP APIs with a Cognito authorizer.
C. Configure an AWS Lambda function to handle user authentication. Implement Amazon API Gateway REST APIs with a Lambda authorizer.
D. Configure an IAM user to handle user authentication. Implement Amazon API Gateway HTTP APIs with an IAM authorizer.
Show Answer
Correct Answer: A
Explanation: Amazon Cognito user pools provide managed user authentication for application users, and API Gateway REST APIs support native Cognito user pool authorizers. This is the most operationally efficient solution because it uses fully managed authentication without custom Lambda authorizers. Identity pools are for granting AWS credentials to authenticated users, not for primary user authentication. IAM users are not appropriate for authenticating millions of application users.
Question 236
A company has AWS Lambda functions that use environment variables. The company does not want its developers to see environment variables in plaintext.
Which solution will meet these requirements?
A. Deploy code to Amazon EC2 instances instead of using Lambda functions.
B. Configure SSL encryption on the Lambda functions to use AWS CloudHSM to store and encrypt the environment variables.
C. Create a certificate in AWS Certificate Manager (ACM). Configure the Lambda functions to use the certificate to encrypt the environment variables.
D. Create an AWS Key Management Service (AWS KMS) key. Enable encryption helpers on the Lambda functions to use the KMS key to store and encrypt the environment variables.
Show Answer
Correct Answer: D
Explanation: AWS Lambda supports encrypting environment variables with AWS KMS. Using a customer managed KMS key and enabling Lambda encryption helpers prevents developers without KMS decrypt permissions from viewing plaintext environment variables. EC2 does not address the requirement, CloudHSM is not the standard mechanism for Lambda environment variable encryption, and ACM certificates are for TLS/SSL, not encrypting Lambda environment variables.
Question 237
A company's web application that is hosted in the AWS Cloud recently increased in popularity. The web application currently exists on a single Amazon EC2 instance in a single public subnet. The web application has not been able to meet the demand of the increased web traffic.
The company needs a solution that will provide high availability and scalability to meet the increased user demand without rewriting the web application.
Which combination of steps will meet these requirements? (Choose two.)
A. Replace the EC2 instance with a larger compute optimized instance.
B. Configure Amazon EC2 Auto Scaling with multiple Availability Zones in private subnets.
C. Configure a NAT gateway in a public subnet to handle web requests.
D. Replace the EC2 instance with a larger memory optimized instance.
E. Configure an Application Load Balancer in a public subnet to distribute web traffic.
Show Answer
Correct Answer: B, E
Explanation: Use an Application Load Balancer in public subnets to distribute incoming traffic across multiple EC2 instances, and place the EC2 instances in an Auto Scaling group spanning multiple Availability Zones (typically in private subnets) to provide horizontal scalability and high availability. Simply resizing a single instance does not provide high availability or sufficient scalability, and a NAT gateway is for outbound internet access from private subnets, not for handling inbound web requests.
Question 238
A company needs a solution to prevent AWS CloudFormation stacks from deploying AWS Identity and Access Management (IAM) resources that include an inline policy or “*” in the statement. The solution must also prohibit deployment of Amazon EC2 instances with public IP addresses. The company has AWS Control Tower enabled in its organization in AWS Organizations.
Which solution will meet these requirements?
A. Use AWS Control Tower proactive controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or “*”.
B. Use AWS Control Tower detective controls to block deployment of EC2 instances with public IP addresses and inline policies with elevated access or “*”.
C. Use AWS Config to create rules for EC2 and IAM compliance. Configure the rules to run an AWS Systems Manager Session Manager automation to delete a resource when it is not compliant.
D. Use a service control policy (SCP) to block actions for the EC2 instances and IAM resources if the actions lead to noncompliance.
Show Answer
Correct Answer: A
Explanation: AWS Control Tower proactive controls use AWS CloudFormation hooks to evaluate CloudFormation templates before resources are provisioned. They can prevent deployment of noncompliant IAM resources (such as overly permissive inline policies) and EC2 instances with public IP addresses. Detective controls only identify noncompliance after deployment, AWS Config with remediation is reactive, and SCPs are preventive at the API permission level but are not the CloudFormation-specific pre-deployment validation mechanism described in the requirements.
Question 239
A company has an organization in AWS Organizations that has all features enabled. The company requires that all API calls and logins in any existing or new AWS account must be audited. The company needs a managed solution to prevent additional work and to minimize costs. The company also needs to know when any AWS account is not compliant with the AWS Foundational Security Best Practices (FSBP) standard.
Which solution will meet these requirements with the LEAST operational overhead?
A. Deploy an AWS Control Tower environment in the Organizations management account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment.
B. Deploy an AWS Control Tower environment in a dedicated Organizations member account. Enable AWS Security Hub and AWS Control Tower Account Factory in the environment.
C. Use AWS Managed Services (AMS) Accelerate to build a multi-account landing zone (MALZ). Submit an RFC to self-service provision Amazon GuardDuty in the MALZ.
D. Use AWS Managed Services (AMS) Accelerate to build a multi-account landing zone (MALZ). Submit an RFC to self-service provision AWS Security Hub in the MALZ.
Show Answer
Correct Answer: A
Explanation: AWS Control Tower is deployed in the AWS Organizations management account and provides a managed multi-account landing zone with centralized governance, including organization-wide CloudTrail logging for auditing existing and new accounts. Enabling AWS Security Hub provides continuous assessment against the AWS Foundational Security Best Practices (FSBP) standard. Account Factory ensures newly created accounts are enrolled automatically with the required governance, minimizing operational overhead. Option B is incorrect because Control Tower is not deployed in a member account. Options C and D rely on AWS Managed Services Accelerate, which adds unnecessary operational/cost overhead for this requirement, and GuardDuty does not evaluate FSBP compliance.
Question 240
A company has stored 10 TB of log files in Apache Parquet format in an Amazon S3 bucket. The company occasionally needs to use SQL to analyze the log files.
Which solution will meet these requirements MOST cost-effectively?
A. Create an Amazon Aurora MySQL database. Migrate the data from the S3 bucket into Aurora by using AWS Database Migration Service (AWS DMS). Issue SQL statements to the Aurora database.
B. Create an Amazon Redshift cluster. Use Redshift Spectrum to run SQL statements directly on the data in the S3 bucket.
C. Create an AWS Glue crawler to store and retrieve table metadata from the S3 bucket. Use Amazon Athena to run SQL statements directly on the data in the S3 bucket.
D. Create an Amazon EMR cluster. Use Apache Spark SQL to run SQL statements directly on the data in the S3 bucket.
Show Answer
Correct Answer: C
Explanation: Amazon Athena is the most cost-effective choice for occasional SQL analysis of data stored in Amazon S3. Athena is serverless, can query Apache Parquet files directly, and charges per data scanned. An AWS Glue crawler can automatically discover the schema and populate the Glue Data Catalog for Athena. Aurora requires migrating 10 TB of data, Redshift Spectrum still requires a Redshift cluster, and EMR incurs cluster management and compute costs for infrequent queries.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.