Use Amazon Elastic Kubernetes Service (Amazon EKS) with Amazon EC2 worker nodes.
A company has deployed an application in an AWS account. The application consists of microservices that run on AWS Lambda and Amazon Elastic Kubernetes Service (Amazon EKS). A separate team supports each microservice. The company has multiple AWS accounts and wants to give each team its own account for its microservices.
A solutions architect needs to design a solution that will provide service-to-service communication over HTTPS (port 443). The solution also must provide a service registry for service discovery.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Create an inspection VPC. Deploy an AWS Network Firewall firewall to the inspection VPC. Attach the inspection VPC to a new transit gateway. Route VPC-to-VPC traffic to the inspection VPC. Apply firewall rules to allow only HTTPS communication.
B. Create a VPC Lattice service network. Associate the microservices with the service network. Define HTTPS listeners for each service. Register microservice compute resources as targets. Identify VPCs that need to communicate with the services. Associate those VPCs with the service network.
C. Create a Network Load Balancer (NLB) with an HTTPS listener and target groups for each microservice. Create an AWS PrivateLink endpoint service for each microservice. Create an interface VPC endpoint in each VPC that needs to consume that microservice.
D. Create peering connections between VPCs that contain microservices. Create a prefix list for each service that requires a connection to a client. Create route tables to route traffic to the appropriate VPC. Create security groups to allow only HTTPS communication.
Show Answer
Correct Answer: B
Explanation: Amazon VPC Lattice is purpose-built for service-to-service communication across multiple VPCs and AWS accounts. It provides a service network, built-in service discovery/registry, and HTTPS connectivity with IAM-based and network-level access controls, minimizing administrative overhead compared to transit gateways, PrivateLink per service, or extensive VPC peering.
Question 253
A solutions architect must provide an automated solution for a company's compliance policy that states security groups cannot include a rule that allows SSH from 0.0.0.0/0. The company needs to be notified if there is any breach in the policy. A solution is needed as soon as possible.
What should the solutions architect do to meet these requirements with the LEAST operational overhead?
A. Write an AWS Lambda script that monitors security groups for SSH being open to 0.0.0.0/0 addresses and creates a notification every time it finds one.
B. Enable the restricted-ssh AWS Config managed rule and generate an Amazon Simple Notification Service (Amazon SNS) notification when a noncompliant rule is created.
C. Create an IAM role with permissions to globally open security groups and network ACLs. Create an Amazon Simple Notification Service (Amazon SNS) topic to generate a notification every time the role is assumed by a user.
D. Configure a service control policy (SCP) that prevents non-administrative users from creating or editing security groups. Create a notification in the ticketing system when a user requests a rule that needs administrator permissions.
Show Answer
Correct Answer: B
Explanation: AWS Config provides the managed rule 'restricted-ssh', which automatically evaluates whether any security group allows inbound SSH (TCP port 22) from 0.0.0.0/0. By configuring AWS Config notifications through Amazon SNS for noncompliant resources, the company receives automated alerts with minimal operational overhead. This is a managed, purpose-built solution. Writing a custom Lambda function requires more maintenance, the IAM role option does not detect policy violations, and an SCP restricting edits does not monitor or notify on existing or administrator-created violations.
Question 254
An ecommerce company is running a seasonal online sale. The company hosts its website on Amazon EC2 instances spanning multiple Availability Zones. The company wants its website to manage sudden traffic increases during the sale.
Which solution will meet these requirements MOST cost-effectively?
A. Create an Auto Scaling group that is large enough to handle peak traffic load. Stop half of the Amazon EC2 instances. Configure the Auto Scaling group to use the stopped instances to scale out when traffic increases.
B. Create an Auto Scaling group for the website. Set the minimum size of the Auto Scaling group so that it can handle high traffic volumes without the need to scale out.
C. Use Amazon CloudFront and Amazon ElastiCache to cache dynamic content with an Auto Scaling group set as the origin. Configure the Auto Scaling group with the instances necessary to populate CloudFront and ElastiCache. Scale in after the cache is fully populated.
D. Configure an Auto Scaling group to scale out as traffic increases. Create a launch template to start new instances from a preconfigured Amazon Machine Image (AMI).
Show Answer
Correct Answer: D
Explanation: The most cost-effective approach is to use an Auto Scaling group that scales out only as demand increases and scales in when demand drops. A launch template with a preconfigured AMI enables new EC2 instances to be launched automatically with the required application configuration. Option A is invalid because Auto Scaling launches new instances rather than starting stopped ones. Option B keeps enough instances running for peak load at all times, increasing cost. Option C is not appropriate because CloudFront primarily caches static content (dynamic caching is limited), ElastiCache adds cost and complexity, and an Auto Scaling group is not configured as a CloudFront origin directly; the scenario is fundamentally about handling traffic spikes with EC2 Auto Scaling.
Question 255
A company built an application with Docker containers and needs to run the application in the AWS Cloud. The company wants to use a managed service to host the application.
The solution must scale in and out appropriately according to demand on the individual container services. The solution also must not result in additional operational overhead or infrastructure to manage.
Which solutions will meet these requirements? (Choose two.)
A. Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate.
B. Use Amazon Elastic Kubernetes Service (Amazon EKS) with AWS Fargate.
C. Provision an Amazon API Gateway API. Connect the API to AWS Lambda to run the containers.
D. Use Amazon Elastic Container Service (Amazon ECS) with Amazon EC2 worker nodes.
E. Use Amazon Elastic Kubernetes Service (Amazon EKS) with Amazon EC2 worker nodes.
Show Answer
Correct Answer: A, B
Explanation: The requirements call for a managed container hosting service that automatically scales container services and avoids managing infrastructure. ECS with AWS Fargate and EKS with AWS Fargate are serverless container options that eliminate EC2 worker node management while supporting container autoscaling. ECS/EKS with EC2 require managing instances, increasing operational overhead. API Gateway with Lambda is not a managed container orchestration solution for long-running containerized applications; Lambda can use container images as deployment packages but is intended for function execution, not hosting container services.
Question 256
A company stores data in an on-premises Oracle relational database. The company needs to make the data available in Amazon Aurora PostgreSQL for analysis. The company uses an AWS Site-to-Site VPN connection to connect its on-premises network to AWS.
The company must capture the changes that occur to the source database during the migration to Aurora PostgreSQL.
Which solution will meet these requirements?
A. Use the AWS Schema Conversion Tool (AWS SCT) to convert the Oracle schema to Aurora PostgreSQL schema. Use the AWS Database Migration Service (AWS DMS) full-load migration task to migrate the data.
B. Use AWS DataSync to migrate the data to an Amazon S3 bucket. Import the S3 data to Aurora PostgreSQL by using the Aurora PostgreSQL aws_s3 extension.
C. Use the AWS Schema Conversion Tool (AWS SCT) to convert the Oracle schema to Aurora PostgreSQL schema. Use AWS Database Migration Service (AWS DMS) to migrate the existing data and replicate the ongoing changes.
D. Use an AWS Snowball device to migrate the data to an Amazon S3 bucket. Import the S3 data to Aurora PostgreSQL by using the Aurora PostgreSQL aws_s3 extension.
Show Answer
Correct Answer: C
Explanation: Migrating from Oracle to Aurora PostgreSQL requires schema conversion because the database engines differ, making AWS Schema Conversion Tool (AWS SCT) appropriate. To capture ongoing changes during migration, AWS Database Migration Service (AWS DMS) must be configured for full load plus change data capture (CDC), which migrates existing data and continuously replicates source database changes until cutover. A full-load-only task would not capture ongoing changes, and DataSync or Snowball do not provide database CDC.
Question 257
A company’s application is deployed on Amazon EC2 instances and uses AWS Lambda functions for an event-driven architecture. The company uses nonproduction development environments in a different AWS account to test new features before the company deploys the features to production.
The production instances show constant usage because of customers in different time zones. The company uses nonproduction instances only during business hours on weekdays. The company does not use the nonproduction instances on the weekends. The company wants to optimize the costs to run its application on AWS.
Which solution will meet these requirements MOST cost-effectively?
A. Use On-Demand Instances for the production instances. Use Dedicated Hosts for the nonproduction instances on weekends only.
B. Use Reserved Instances for the production instances and the nonproduction instances. Shut down the nonproduction instances when not in use.
C. Use Compute Savings Plans for the production instances. Use On-Demand Instances for the nonproduction instances. Shut down the nonproduction instances when not in use.
D. Use Dedicated Hosts for the production instances. Use EC2 Instance Savings Plans for the nonproduction instances.
Show Answer
Correct Answer: C
Explanation: Production EC2 instances run continuously, making a Compute Savings Plan a strong cost-optimization choice because it provides savings while offering flexibility across instance families, sizes, Regions, and even Lambda usage. The nonproduction environment runs only during weekday business hours, so committing with Reserved Instances is not cost-effective; using On-Demand Instances and shutting them down when idle minimizes costs. Dedicated Hosts are unnecessary because there is no licensing or compliance requirement.
Question 258
A company hosts an application used to upload files to an Amazon S3 bucket. Once uploaded, the files are processed to extract metadata, which takes less than 5 seconds. The volume and frequency of the uploads varies from a few files each hour to hundreds of concurrent uploads. The company has asked a solutions architect to design a cost-effective architecture that will meet these requirements.
What should the solutions architect recommend?
A. Configure AWS CloudTrail trails to log S3 API calls. Use AWS AppSync to process the files.
B. Configure an object-created event notification within the S3 bucket to invoke an AWS Lambda function to process the files.
C. Configure Amazon Kinesis Data Streams to process and send data to Amazon S3. Invoke an AWS Lambda function to process the files.
D. Configure an Amazon Simple Notification Service (Amazon SNS) topic to process the files uploaded to Amazon S3. Invoke an AWS Lambda function to process the files.
Show Answer
Correct Answer: B
Explanation: Amazon S3 Event Notifications can directly invoke an AWS Lambda function when an object is created. Lambda scales automatically from a few events to hundreds of concurrent invocations, is cost-effective for short processing tasks (less than 5 seconds), and avoids unnecessary services. CloudTrail/AppSync are not intended for this workflow, Kinesis Data Streams is for streaming data rather than S3 object uploads, and SNS is optional fan-out but not needed for direct S3-to-Lambda processing.
Question 259
A pharmaceutical company is developing a new drug. The volume of data that the company generates has grown exponentially over the past few months. The company's researchers regularly require a subset of the entire dataset to be immediately available with minimal lag. However, the entire dataset does not need to be accessed on a daily basis. All the data currently resides in on-premises storage arrays, and the company wants to reduce ongoing capital expenses.
Which storage solution should a solutions architect recommend to meet these requirements?
A. Run AWS DataSync as a scheduled cron job to migrate the data to an Amazon S3 bucket on an ongoing basis.
B. Deploy an AWS Storage Gateway file gateway with an Amazon S3 bucket as the target storage. Migrate the data to the Storage Gateway appliance.
C. Deploy an AWS Storage Gateway volume gateway with cached volumes with an Amazon S3 bucket as the target storage. Migrate the data to the Storage Gateway appliance.
D. Configure an AWS Site-to-Site VPN connection from the on-premises environment to AWS. Migrate data to an Amazon Elastic File System (Amazon EFS) file system.
Show Answer
Correct Answer: C
Explanation: Cached volumes in AWS Storage Gateway store the primary dataset in Amazon S3 while keeping frequently accessed data cached locally for low-latency access. This matches the requirement that only a regularly used subset be immediately available while reducing on-premises storage costs. File Gateway is intended for file shares (NFS/SMB), whereas the question refers generally to storage arrays and emphasizes caching a subset of the dataset.
Question 260
A company has a business-critical application that runs on Amazon EC2 instances. The application stores data in an Amazon DynamoDB table. The company must be able to revert the table to any point within the last 24 hours.
Which solution meets these requirements with the LEAST operational overhead?
A. Configure point-in-time recovery for the table.
B. Use AWS Backup for the table.
C. Use an AWS Lambda function to make an on-demand backup of the table every hour.
D. Turn on streams on the table to capture a log of all changes to the table in the last 24 hours. Store a copy of the stream in an Amazon S3 bucket.
Show Answer
Correct Answer: A
Explanation: Point-in-time recovery (PITR) is the native DynamoDB feature designed to restore a table to any second within the retention window (up to 35 days, which includes the last 24 hours). It requires minimal operational overhead because AWS continuously maintains the recovery data automatically. AWS Backup and scheduled on-demand backups do not provide arbitrary point-in-time restoration within the last 24 hours, and DynamoDB Streams capture changes but are not a point-in-time restore mechanism.
Question 261
A company’s developers want a secure way to gain SSH access on the company's Amazon EC2 instances that run the latest version of Amazon Linux. The developers work remotely and in the corporate office.
The company wants to use AWS services as a part of the solution. The EC2 instances are hosted in a VPC private subnet and access the internet through a NAT gateway that is deployed in a public subnet.
What should a solutions architect do to meet these requirements MOST cost-effectively?
A. Create a bastion host in the same subnet as the EC2 instances. Grant the ec2:CreateVpnConnection IAM permission to the developers. Install EC2 Instance Connect so that the developers can connect to the EC2 instances.
B. Create an AWS Site-to-Site VPN connection between the corporate network and the VPC. Instruct the developers to use the Site-to-Site VPN connection to access the EC2 instances when the developers are on the corporate network. Instruct the developers to set up another VPN connection for access when they work remotely.
C. Create a bastion host in the public subnet of the VPConfigure the security groups and SSH keys of the bastion host to only allow connections and SSH authentication from the developers’ corporate and remote networks. Instruct the developers to connect through the bastion host by using SSH to reach the EC2 instances.
D. Attach the AmazonSSMManagedInstanceCore IAM policy to an IAM role that is associated with the EC2 instances. Instruct the developers to use AWS Systems Manager Session Manager to access the EC2 instances.
Show Answer
Correct Answer: D
Explanation: AWS Systems Manager Session Manager provides secure shell access to EC2 instances in private subnets without requiring a bastion host, inbound SSH ports, or VPN connectivity. Amazon Linux supports the SSM Agent, and attaching the AmazonSSMManagedInstanceCore policy to the instance IAM role enables Session Manager. Developers are granted IAM permissions to start sessions, making this both more secure and more cost-effective than maintaining bastion hosts or VPN infrastructure.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.