A solutions architect must provide an automated solution for a company's compliance policy that states security groups cannot include a rule that allows SSH from 0.0.0.0/0. The company needs to be notified if there is any breach in the policy. A solution is needed as soon as possible.
What should the solutions architect do to meet these requirements with the LEAST operational overhead?
A. Write an AWS Lambda script that monitors security groups for SSH being open to 0.0.0.0/0 addresses and creates a notification every time it finds one.
B. Enable the restricted-ssh AWS Config managed rule and generate an Amazon Simple Notification Service (Amazon SNS) notification when a noncompliant rule is created.
C. Create an IAM role with permissions to globally open security groups and network ACLs. Create an Amazon Simple Notification Service (Amazon SNS) topic to generate a notification every time the role is assumed by a user.
D. Configure a service control policy (SCP) that prevents non-administrative users from creating or editing security groups. Create a notification in the ticketing system when a user requests a rule that needs administrator permissions.
Show Answer
Correct Answer: B
Explanation: AWS Config provides a managed rule, restricted-ssh, that automatically evaluates security groups to ensure SSH (port 22) is not open to 0.0.0.0/0. It requires minimal setup, no custom code, and integrates natively with Amazon SNS for notifications when noncompliance occurs. This meets the requirement for fast implementation, automated compliance monitoring, and least operational overhead compared to custom Lambda scripts, IAM-based monitoring, or restrictive SCP workflows.
Question 254
An ecommerce company is running a seasonal online sale. The company hosts its website on Amazon EC2 instances spanning multiple Availability Zones. The company wants its website to manage sudden traffic increases during the sale.
Which solution will meet these requirements MOST cost-effectively?
A. Create an Auto Scaling group that is large enough to handle peak traffic load. Stop half of the Amazon EC2 instances. Configure the Auto Scaling group to use the stopped instances to scale out when traffic increases.
B. Create an Auto Scaling group for the website. Set the minimum size of the Auto Scaling group so that it can handle high traffic volumes without the need to scale out.
C. Use Amazon CloudFront and Amazon ElastiCache to cache dynamic content with an Auto Scaling group set as the origin. Configure the Auto Scaling group with the instances necessary to populate CloudFront and ElastiCache. Scale in after the cache is fully populated.
D. Configure an Auto Scaling group to scale out as traffic increases. Create a launch template to start new instances from a preconfigured Amazon Machine Image (AMI).
Show Answer
Correct Answer: D
Explanation: The most cost-effective way to handle sudden traffic increases is to use an Auto Scaling group that dynamically scales out and in based on demand. Option D allows the company to run only the baseline capacity during normal traffic and automatically launch additional EC2 instances during the sale, then terminate them afterward, minimizing cost. Using a launch template with a preconfigured AMI ensures fast, consistent instance provisioning across Availability Zones.
Option A is not valid because stopped instances cannot be used directly by Auto Scaling for scale-out. Option B is costly because it requires paying for peak capacity at all times. Option C adds unnecessary services (CloudFront and ElastiCache) and complexity for a general scaling requirement, making it less cost-effective for this scenario.
Question 255
A company built an application with Docker containers and needs to run the application in the AWS Cloud. The company wants to use a managed service to host the application.
The solution must scale in and out appropriately according to demand on the individual container services. The solution also must not result in additional operational overhead or infrastructure to manage.
Which solutions will meet these requirements? (Choose two.)
A. Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate.
B. Use Amazon Elastic Kubernetes Service (Amazon EKS) with AWS Fargate.
C. Provision an Amazon API Gateway API. Connect the API to AWS Lambda to run the containers.
D. Use Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 worker nodes.
E. Use Amazon Elastic Kubernetes Service (Amazon EKS) with Amazon EC2 worker nodes.
Show Answer
Correct Answer: A, B
Explanation: The requirements call for a fully managed container hosting service that automatically scales individual container services and minimizes operational overhead. Amazon ECS with AWS Fargate (A) and Amazon EKS with AWS Fargate (B) are serverless container options where AWS manages the underlying compute, scaling, and infrastructure. Options using EC2 worker nodes (D, E) introduce infrastructure management overhead. API Gateway with Lambda (C) is designed for event-driven functions and short-lived workloads, not for hosting and scaling long-running containerized applications.
Question 256
A company stores data in an on-premises Oracle relational database. The company needs to make the data available in Amazon Aurora PostgreSQL for analysis. The company uses an AWS Site-to-Site VPN connection to connect its on-premises network to AWS.
The company must capture the changes that occur to the source database during the migration to Aurora PostgreSQL.
Which solution will meet these requirements?
A. Use the AWS Schema Conversion Tool (AWS SCT) to convert the Oracle schema to Aurora PostgreSQL schema. Use the AWS Database Migration Service (AWS DMS) full-load migration task to migrate the data.
B. Use AWS DataSync to migrate the data to an Amazon S3 bucket. Import the S3 data to Aurora PostgreSQL by using the Aurora PostgreSQL aws_s3 extension.
C. Use the AWS Schema Conversion Tool (AWS SCT) to convert the Oracle schema to Aurora PostgreSQL schema. Use AWS Database Migration Service (AWS DMS) to migrate the existing data and replicate the ongoing changes.
D. Use an AWS Snowball device to migrate the data to an Amazon S3 bucket. Import the S3 data to Aurora PostgreSQL by using the Aurora PostgreSQL aws_s3 extension.
Show Answer
Correct Answer: C
Explanation: The requirement includes capturing ongoing changes (CDC) from an on-premises Oracle database during migration to Aurora PostgreSQL over a VPN. AWS SCT converts the Oracle schema to PostgreSQL, and AWS DMS supports full load plus continuous replication (CDC) to migrate existing data and capture ongoing changes. Other options do not provide CDC or are unsuitable for relational database migration.
Question 257
A company’s application is deployed on Amazon EC2 instances and uses AWS Lambda functions for an event-driven architecture. The company uses nonproduction development environments in a different AWS account to test new features before the company deploys the features to production.
The production instances show constant usage because of customers in different time zones. The company uses nonproduction instances only during business hours on weekdays. The company does not use the nonproduction instances on the weekends. The company wants to optimize the costs to run its application on AWS.
Which solution will meet these requirements MOST cost-effectively?
A. Use On-Demand Instances for the production instances. Use Dedicated Hosts for the nonproduction instances on weekends only.
B. Use Reserved Instances for the production instances and the nonproduction instances. Shut down the nonproduction instances when not in use.
C. Use Compute Savings Plans for the production instances. Use On-Demand Instances for the nonproduction instances. Shut down the nonproduction instances when not in use.
D. Use Dedicated Hosts for the production instances. Use EC2 Instance Savings Plans for the nonproduction instances.
Show Answer
Correct Answer: C
Explanation: Production workloads have steady, predictable usage across time zones, making Compute Savings Plans the most flexible and cost-effective option with consistent discounts regardless of instance family or region. Nonproduction environments run only during business hours on weekdays and are shut down otherwise, so committing to Reserved Instances or Savings Plans for them would waste capacity. Using On-Demand Instances for nonproduction and stopping them when not in use minimizes cost. Dedicated Hosts are unnecessary and more expensive. Therefore, option C is the most cost-effective solution.
Question 258
A company hosts an application used to upload files to an Amazon S3 bucket. Once uploaded, the files are processed to extract metadata, which takes less than 5 seconds. The volume and frequency of the uploads varies from a few files each hour to hundreds of concurrent uploads. The company has asked a solutions architect to design a cost-effective architecture that will meet these requirements.
What should the solutions architect recommend?
A. Configure AWS CloudTrail trails to log S3 API calls. Use AWS AppSync to process the files.
B. Configure an object-created event notification within the S3 bucket to invoke an AWS Lambda function to process the files.
C. Configure Amazon Kinesis Data Streams to process and send data to Amazon S3. Invoke an AWS Lambda function to process the files.
D. Configure an Amazon Simple Notification Service (Amazon SNS) topic to process the files uploaded to Amazon S3. Invoke an AWS Lambda function to process the files.
Show Answer
Correct Answer: B
Explanation: An S3 object-created event notification can directly trigger an AWS Lambda function to process each uploaded file. Lambda easily handles sub-5-second processing, scales automatically from low to high concurrency, and is fully serverless and cost-effective. Other options introduce unnecessary services (CloudTrail, AppSync, Kinesis, or SNS) that add cost and complexity without benefits for simple file-based event processing.
Question 259
A pharmaceutical company is developing a new drug. The volume of data that the company generates has grown exponentially over the past few months. The company's researchers regularly require a subset of the entire dataset to be immediately available with minimal lag. However, the entire dataset does not need to be accessed on a daily basis. All the data currently resides in on-premises storage arrays, and the company wants to reduce ongoing capital expenses.
Which storage solution should a solutions architect recommend to meet these requirements?
A. Run AWS DataSync as a scheduled cron job to migrate the data to an Amazon S3 bucket on an ongoing basis.
B. Deploy an AWS Storage Gateway file gateway with an Amazon S3 bucket as the target storage. Migrate the data to the Storage Gateway appliance.
C. Deploy an AWS Storage Gateway volume gateway with cached volumes with an Amazon S3 bucket as the target storage. Migrate the data to the Storage Gateway appliance.
D. Configure an AWS Site-to-Site VPN connection from the on-premises environment to AWS. Migrate data to an Amazon Elastic File System (Amazon EFS) file system.
Show Answer
Correct Answer: C
Explanation: The requirement is to keep only a frequently accessed subset of data immediately available with low latency while moving the full, growing dataset off expensive on‑premises storage to reduce capital expenses. AWS Storage Gateway volume gateway with cached volumes stores the entire dataset durably in Amazon S3 and keeps only the most recently accessed data cached locally on‑premises, providing low‑latency access for active data. This directly matches the need for subset access, cloud-backed storage, and cost reduction. DataSync (A) is a migration/sync tool, not a live storage solution, and EFS over VPN (D) would incur latency and higher ongoing costs. File gateway (B) could work for file-based workloads, but the question references on‑premises storage arrays and emphasizes caching behavior best aligned with cached volumes.
Question 260
A company has a business-critical application that runs on Amazon EC2 instances. The application stores data in an Amazon DynamoDB table. The company must be able to revert the table to any point within the last 24 hours.
Which solution meets these requirements with the LEAST operational overhead?
A. Configure point-in-time recovery for the table.
B. Use AWS Backup for the table.
C. Use an AWS Lambda function to make an on-demand backup of the table every hour.
D. Turn on streams on the table to capture a log of all changes to the table in the last 24 hours. Store a copy of the stream in an Amazon S3 bucket.
Show Answer
Correct Answer: A
Explanation: DynamoDB point-in-time recovery (PITR) allows restoring a table to any second within the last 35 days, easily covering the 24-hour requirement. It is fully managed, requires minimal configuration, and avoids the operational overhead of managing backups, schedules, Lambda functions, or processing streams.
Question 261
A company’s developers want a secure way to gain SSH access on the company's Amazon EC2 instances that run the latest version of Amazon Linux. The developers work remotely and in the corporate office.
The company wants to use AWS services as a part of the solution. The EC2 instances are hosted in a VPC private subnet and access the internet through a NAT gateway that is deployed in a public subnet.
What should a solutions architect do to meet these requirements MOST cost-effectively?
A. Create a bastion host in the same subnet as the EC2 instances. Grant the ec2:CreateVpnConnection IAM permission to the developers. Install EC2 Instance Connect so that the developers can connect to the EC2 instances.
B. Create an AWS Site-to-Site VPN connection between the corporate network and the VPC. Instruct the developers to use the Site-to-Site VPN connection to access the EC2 instances when the developers are on the corporate network. Instruct the developers to set up another VPN connection for access when they work remotely.
C. Create a bastion host in the public subnet of the VPConfigure the security groups and SSH keys of the bastion host to only allow connections and SSH authentication from the developers’ corporate and remote networks. Instruct the developers to connect through the bastion host by using SSH to reach the EC2 instances.
D. Attach the AmazonSSMManagedInstanceCore IAM policy to an IAM role that is associated with the EC2 instances. Instruct the developers to use AWS Systems Manager Session Manager to access the EC2 instances.
Show Answer
Correct Answer: D
Explanation: AWS Systems Manager Session Manager provides secure, audited access to EC2 instances without opening inbound SSH ports, managing SSH keys, or deploying bastion hosts. It works with instances in private subnets using outbound access through the NAT gateway, integrates with IAM for fine-grained access control, and has no additional infrastructure cost. This makes it the most secure and most cost-effective solution compared to VPNs or bastion hosts.
Question 262
A development team is collaborating with another company to create an integrated product. The other company needs to access an Amazon Simple Queue Service (Amazon SQS) queue that is contained in the development team's account. The other company wants to poll the queue without giving up its own account permissions to do so.
How should a solutions architect provide access to the SQS queue?
A. Create an instance profile that provides the other company access to the SQS queue.
B. Create an IAM policy that provides the other company access to the SQS queue.
C. Create an SQS access policy that provides the other company access to the SQS queue.
D. Create an Amazon Simple Notification Service (Amazon SNS) access policy that provides the other company access to the SQS queue.
Show Answer
Correct Answer: C
Explanation: Amazon SQS supports resource-based (queue) access policies that allow you to grant cross-account permissions directly on the queue. By attaching an SQS access policy to the queue and specifying the other company’s AWS account as the principal, the other company can poll the queue without changing or exposing its own account permissions. Instance profiles are for EC2, IAM identity policies alone do not grant cross-account access to the resource, and SNS policies apply only to SNS topics.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.