A company runs multiple workloads in its on-premises data center. The company's data center cannot scale fast enough to meet the company's expanding business needs. The company wants to collect usage and configuration data about the on-premises servers and workloads to plan a migration to AWS.
Which solution will meet these requirements?
A. Set the home AWS Region in AWS Migration Hub. Use AWS Systems Manager to collect data about the on-premises servers.
B. Set the home AWS Region in AWS Migration Hub. Use AWS Application Discovery Service to collect data about the on-premises servers.
C. Use the AWS Schema Conversion Tool (AWS SCT) to create the relevant templates. Use AWS Trusted Advisor to collect data about the on-premises servers.
D. Use the AWS Schema Conversion Tool (AWS SCT) to create the relevant templates. Use AWS Database Migration Service (AWS DMS) to collect data about the on-premises servers.
Show Answer
Correct Answer: B
Explanation: AWS Application Discovery Service is specifically designed to collect usage and configuration data from on-premises servers to support migration planning. It integrates with AWS Migration Hub, where you set a home AWS Region to organize and track discovery and migration activities. AWS Systems Manager manages infrastructure but is not the service for migration discovery. AWS SCT and AWS DMS are focused on database schema conversion and database migration, not general on-premises server discovery.
Question 242
A solutions architect is designing a payment processing application that runs on AWS Lambda in private subnets across multiple Availability Zones. The application uses multiple Lambda functions and processes millions of transactions each day.
The architecture must ensure that the application does not process duplicate payments.
Which solution will meet these requirements?
A. Use Lambda to retrieve all due payments. Publish the due payments to an Amazon S3 bucket. Configure the S3 bucket with an event notification to invoke another Lambda function to process the due payments.
B. Use Lambda to retrieve all due payments. Publish the due payments to an Amazon Simple Queue Service (Amazon SQS) queue. Configure another Lambda function to poll the SQS queue and to process the due payments.
C. Use Lambda to retrieve all due payments. Publish the due payments to an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Configure another Lambda function to poll the FIFO queue and to process the due payments.
D. Use Lambda to retrieve all due payments. Store the due payments in an Amazon DynamoDB table. Configure streams on the DynamoDB table to invoke another Lambda function to process the due payments.
Show Answer
Correct Answer: C
Explanation: Amazon SQS FIFO queues are designed for exactly-once message deduplication (within the deduplication window) and ordered processing, making them the best fit for payment workflows where duplicate processing must be avoided. Standard SQS provides at-least-once delivery and can deliver duplicates. S3 event notifications are not appropriate for this guarantee. DynamoDB Streams invoked by Lambda do not guarantee exactly-once delivery; Lambda consumers can receive duplicate stream records, so idempotency is still required.
Question 243
A company's marketing data is uploaded from multiple sources to an Amazon S3 bucket. A series of data preparation jobs aggregate the data for reporting. The data preparation jobs need to run at regular intervals in parallel. A few jobs need to run in a specific order later.
The company wants to remove the operational overhead of job error handling, retry logic, and state management.
Which solution will meet these requirements?
A. Use an AWS Lambda function to process the data as soon as the data is uploaded to the S3 bucket. Invoke other Lambda functions at regularly scheduled intervals.
B. Use Amazon Athena to process the data. Use Amazon EventBridge Scheduler to invoke Athena on a regular internal.
C. Use AWS Glue DataBrew to process the data. Use an AWS Step Functions state machine to run the DataBrew data preparation jobs.
D. Use AWS Data Pipeline to process the data. Schedule Data Pipeline to process the data once at midnight.
Show Answer
Correct Answer: C
Explanation: AWS Step Functions is designed to orchestrate parallel and sequential workflows with built-in state management, retries, and error handling, which directly addresses the operational overhead requirement. AWS Glue DataBrew provides managed data preparation jobs that can be orchestrated by Step Functions. Lambda alone would require custom orchestration, Athena is a query service rather than a workflow orchestrator, and AWS Data Pipeline is an older service that is not the best fit for this modern serverless orchestration use case.
Question 244
A company maintains its accounting records in a custom application that runs on Amazon EC2 instances. The company needs to migrate the data to an AWS managed service for development and maintenance of the application data. The solution must require minimal operational support and provide immutable, cryptographically verifiable logs of data changes.
Which solution will meet these requirements MOST cost-effectively?
A. Copy the records from the application into an Amazon Redshift cluster.
B. Copy the records from the application into an Amazon Neptune cluster.
C. Copy the records from the application into an Amazon Timestream database.
D. Copy the records from the application into an Amazon Quantum Ledger Database (Amazon QLDB) ledger.
Show Answer
Correct Answer: D
Explanation: Amazon QLDB is a fully managed ledger database designed for applications that require an immutable, cryptographically verifiable transaction log. It minimizes operational overhead compared with self-managed databases and is purpose-built for maintaining a complete, tamper-evident history of data changes. Redshift is a data warehouse, Neptune is a graph database, and Timestream is a time series database, none of which provide the required ledger capabilities.
Question 245
A company wants to deploy an internal web application on AWS. The web application must be accessible only from the company's office. The company needs to download security patches for the web application from the internet.
The company has created a VPC and has configured an AWS Site-to-Site VPN connection to the company's office. A solutions architect must design a secure architecture for the web application.
Which solution will meet these requirements?
A. Deploy the web application on Amazon EC2 instances in public subnets behind a public Application Load Balancer (ALB). Attach an internet gateway to the VPC. Set the inbound source of the ALB's security group to 0.0.0.0/0.
B. Deploy the web application on Amazon EC2 instances in private subnets behind an internal Application Load Balancer (ALB). Deploy NAT gateways in public subnets. Attach an internet gateway to the VPC. Set the inbound source of the ALB's security group to the company's office network CIDR block.
C. Deploy the web application on Amazon EC2 instances in public subnets behind an internal Application Load Balancer (ALB). Deploy NAT gateways in private subnets. Attach an internet gateway to the VPSet the outbound destination of the ALB’s security group to the company's office network CIDR block.
D. Deploy the web application on Amazon EC2 instances in private subnets behind a public Application Load Balancer (ALB). Attach an internet gateway to the VPC. Set the outbound destination of the ALB’s security group to 0.0.0.0/0.
Show Answer
Correct Answer: B
Explanation: The application should run on EC2 instances in private subnets behind an internal ALB so it is reachable only over the Site-to-Site VPN from the company's office. To download security patches from the internet, the private instances need outbound internet access through NAT gateways located in public subnets, and the VPC must have an internet gateway attached for the NAT gateways to reach the internet. Restricting the internal ALB's inbound security group to the company's office CIDR further limits access to the office network. Public ALB or public instances would violate the requirement that the application be accessible only from the company's office.
Question 246
A company wants to run its experimental workloads in the AWS Cloud. The company has a budget for cloud spending. The company's CFO is concerned about cloud spending accountability for each department. The CFO wants to receive notification when the spending threshold reaches 60% of the budget.
Which solution will meet these requirements?
A. Use cost allocation tags on AWS resources to label owners. Create usage budgets in AWS Budgets. Add an alert threshold to receive notification when spending exceeds 60% of the budget.
B. Use AWS Cost Explorer forecasts to determine resource owners. Use AWS Cost Anomaly Detection to create alert threshold notifications when spending exceeds 60% of the budget.
C. Use cost allocation tags on AWS resources to label owners. Use AWS Support API on AWS Trusted Advisor to create alert threshold notifications when spending exceeds 60% of the budget.
D. Use AWS Cost Explorer forecasts to determine resource owners. Create usage budgets in AWS Budgets. Add an alert threshold to receive notification when spending exceeds 60% of the budget.
Show Answer
Correct Answer: A
Explanation: AWS Budgets supports budget thresholds and notifications (such as alerts at 60% of budget). Cost allocation tags provide accountability by attributing costs to departments or owners. Cost Explorer is for analysis and forecasting, not assigning ownership, and Trusted Advisor/AWS Support API does not provide budget threshold alerting.
Question 247
A company has hired an external vendor to perform work in the company’s AWS account. The vendor uses an automated tool that is hosted in an AWS account that the vendor owns. The vendor does not have IAM access to the company’s AWS account. The company needs to grant the vendor access to the company’s AWS account.
Which solution will meet these requirements MOST securely?
A. Create an IAM role in the company’s account to delegate access to the vendor’s IAM role. Attach the appropriate IAM policies to the role for the permissions that the vendor requires.
B. Create an IAM user in the company’s account with a password that meets the password complexity requirements. Attach the appropriate IAM policies to the user for the permissions that the vendor requires.
C. Create an IAM group in the company’s account. Add the automated tool’s IAM user from the vendor account to the group. Attach the appropriate IAM policies to the group for the permissions that the vendor requires.
D. Create an IAM user in the company’s account that has a permission boundary that allows the vendor’s account. Attach the appropriate IAM policies to the user for the permissions that the vendor requires.
Show Answer
Correct Answer: A
Explanation: The most secure approach for granting a third party access to resources in an AWS account is cross-account role assumption. Create an IAM role in the company's account with the required least-privilege permissions and a trust policy that allows the vendor's IAM role to assume it. This avoids creating long-lived IAM user credentials in the company's account and is the AWS-recommended pattern for third-party access.
Question 248
A company has an Amazon Elastic File System (Amazon EFS) file system that contains a reference dataset. The company has applications on Amazon EC2 instances that need to read the dataset. However, the applications must not be able to change the dataset. The company wants to use IAM access control to prevent the applications from being able to modify or delete the dataset.
Which solution will meet these requirements?
A. Mount the EFS file system in read-only mode from within the EC2 instances.
B. Create a resource policy for the EFS file system that denies the elasticfilesystem:ClientWrite action to the IAM roles that are attached to the EC2 instances.
C. Create an identity policy for the EFS file system that denies the elasticfilesystem:ClientWrite action on the EFS file system.
D. Create an EFS access point for each application. Use Portable Operating System Interface (POSIX) file permissions to allow read-only access to files in the root directory.
Show Answer
Correct Answer: B
Explanation: The requirement explicitly states to use IAM access control. Amazon EFS supports IAM authorization for NFS clients through file system resource policies and identity-based IAM policies. A resource policy on the EFS file system can deny the elasticfilesystem:ClientWrite action for the IAM roles used by the EC2 instances, preventing write and delete operations while still allowing read access. Option A relies on client mount configuration rather than IAM. Option C is incorrect because there is no identity policy attached to an EFS file system; identity policies are attached to IAM principals. Option D uses POSIX permissions rather than IAM access control.
Question 250
A company uses AWS Organizations for its multi-account AWS setup. The security organizational unit (OU) of the company needs to share approved Amazon Machine Images (AMIs) with the development OU. The AMIs are created by using AWS Key Management Service (AWS KMS) encrypted snapshots.
Which solution will meet these requirements? (Choose two.)
A. Add the development team's OU Amazon Resource Name (ARN) to the launch permission list for the AMIs.
B. Add the Organizations root Amazon Resource Name (ARN) to the launch permission list for the AMIs.
C. Update the key policy to allow the development team's OU to use the AWS KMS keys that are used to decrypt the snapshots.
D. Add the development team’s account Amazon Resource Name (ARN) to the launch permission list for the AMIs.
E. Recreate the AWS KMS key. Add a key policy to allow the Organizations root Amazon Resource Name (ARN) to use the AWS KMS key.
Show Answer
Correct Answer: A, C
Explanation: To share an AMI with an AWS Organizations organizational unit, you can grant AMI launch permissions directly to the OU. Because the AMI is backed by AWS KMS-encrypted snapshots, you must also update the KMS key policy to allow principals in the development OU to use the key for decryption. Granting permissions to the organization root is broader than required, adding individual account permissions is unnecessary when OU sharing is supported, and recreating the KMS key is not required.
Question 251
A company has a mobile game that reads most of its metadata from an Amazon RDS DB instance. As the game increased in popularity, developers noticed slowdowns related to the game's metadata load times. Performance metrics indicate that simply scaling the database will not help. A solutions architect must explore all options that include capabilities for snapshots, replication, and sub-millisecond response times.
What should the solutions architect recommend to solve these issues?
A. Migrate the database to Amazon Aurora with Aurora Replicas.
B. Migrate the database to Amazon DynamoDB with global tables.
C. Add an Amazon ElastiCache for Redis layer in front of the database.
D. Add an Amazon ElastiCache for Memcached layer in front of the database.
Show Answer
Correct Answer: C
Explanation: The workload is read-heavy and scaling the RDS instance alone will not solve the latency issue. Introducing ElastiCache in front of RDS offloads repeated metadata reads and provides sub-millisecond response times. Between the cache options, Redis supports replication and snapshots (persistence), while Memcached does not. Migrating to Aurora does not address the stated need that scaling the database is insufficient, and migrating to DynamoDB would require a major redesign not indicated by the scenario.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.