A company’s website is used to sell products to the public. The site runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). There is also an Amazon CloudFront distribution, and AWS WAF is being used to protect against SQL injection attacks. The ALB is the origin for the CloudFront distribution. A recent review of security logs revealed an external malicious IP that needs to be blocked from accessing the website.
What should a solutions architect do to protect the application?
A. Modify the network ACL on the CloudFront distribution to add a deny rule for the malicious IP address.
B. Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address.
C. Modify the network ACL for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.
D. Modify the security groups for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.
Show Answer
Correct Answer: B
Explanation: AWS WAF is already in use with the CloudFront distribution and is the correct layer to block malicious client IP addresses. Adding an IP set (IP match condition) to the WAF web ACL will block the malicious IP at the edge before requests reach CloudFront, the ALB, or EC2 instances. CloudFront does not use network ACLs, security groups do not support deny rules, and blocking at the EC2 or subnet level is less effective and not appropriate for traffic coming through CloudFront.
Question 275
A company uses an organization in AWS Organizations to manage AWS accounts that contain applications. The company sets up a dedicated monitoring member account in the organization. The company wants to query and visualize observability data across the accounts by using Amazon CloudWatch.
Which solution will meet these requirements?
A. Enable CloudWatch cross-account observability for the monitoring account. Deploy an AWS CloudFormation template provided by the monitoring account in each AWS account to share the data with the monitoring account.
B. Set up service control policies (SCPs) to provide access to CloudWatch in the monitoring account under the Organizations root organizational unit (OU).
C. Configure a new IAM user in the monitoring account. In each AWS account, configure an IAM policy to have access to query and visualize the CloudWatch data in the account. Attach the new IAM policy to the new IAM user.
D. Create a new IAM user in the monitoring account. Create cross-account IAM policies in each AWS account. Attach the IAM policies to the new IAM user.
Show Answer
Correct Answer: A
Explanation: Amazon CloudWatch cross-account observability is designed for querying and visualizing metrics, logs, and traces across multiple AWS accounts in an AWS Organization from a central monitoring account. Enabling cross-account observability and deploying the provided CloudFormation template in each source account establishes the required resource sharing and permissions automatically. SCPs do not grant service-level access, and IAM users or custom cross-account IAM policies are not the recommended or scalable approach for unified CloudWatch observability.
Question 276
A financial services company wants to shut down two data centers and migrate more than 100 TB of data to AWS. The data has an intricate directory structure with millions of small files stored in deep hierarchies of subfolders. Most of the data is unstructured, and the company’s file storage consists of SMB-based storage types from multiple vendors. The company does not want to change its applications to access the data after migration.
What should a solutions architect do to meet these requirements with the LEAST operational overhead?
A. Use AWS Direct Connect to migrate the data to Amazon S3.
B. Use AWS DataSync to migrate the data to Amazon FSx for Lustre.
C. Use AWS DataSync to migrate the data to Amazon FSx for Windows File Server.
D. Use AWS Direct Connect to migrate the data on-premises file storage to an AWS Storage Gateway volume gateway.
Show Answer
Correct Answer: C
Explanation: The data uses SMB-based file storage with millions of small files and deep directory hierarchies, and applications must continue accessing data without changes. Amazon FSx for Windows File Server natively supports SMB and preserves Windows file system semantics. AWS DataSync efficiently migrates large datasets while preserving metadata (permissions, timestamps, ownership) with low operational overhead. Other options either require application changes (S3), are not appropriate for SMB workloads (FSx for Lustre), or introduce higher complexity and overhead (Storage Gateway with Direct Connect).
Question 277
A company is deploying an application that processes streaming data in near-real time. The company plans to use Amazon EC2 instances for the workload. The network architecture must be configurable to provide the lowest possible latency between nodes.
Which combination of network solutions will meet these requirements? (Choose two.)
A. Enable and configure enhanced networking on each EC2 instance.
B. Group the EC2 instances in separate accounts.
C. Run the EC2 instances in a cluster placement group.
D. Attach multiple elastic network interfaces to each EC2 instance.
E. Use Amazon Elastic Block Store (Amazon EBS) optimized instance types.
Show Answer
Correct Answer: A, C
Explanation: The requirement is the lowest possible network latency between EC2 instances processing streaming data. Enhanced networking (ENA or SR-IOV) provides higher bandwidth, higher packets per second, and consistently lower inter-instance latency. A cluster placement group places instances physically close together within the same Availability Zone, minimizing network hops and latency while maximizing throughput. The other options do not directly reduce inter-instance network latency.
Question 278
A company has established a new AWS account. The account is newly provisioned and no changes have been made to the default settings. The company is concerned about the security of the AWS account root user.
What should be done to secure the root user?
A. Create IAM users for daily administrative tasks. Disable the root user.
B. Create IAM users for daily administrative tasks. Enable multi-factor authentication on the root user.
C. Generate an access key for the root user. Use the access key for daily administration tasks instead of the AWS Management Console.
D. Provide the root user credentials to the most senior solutions architect. Have the solutions architect use the root user for daily administration tasks.
Show Answer
Correct Answer: B
Explanation: AWS best practice is to avoid using the root user for daily tasks. Instead, create IAM users for administration and secure the root user by enabling multi-factor authentication (MFA). The root user cannot be disabled, and using it or its access keys for routine work is insecure.
Question 279
A company is designing a new web service that will run on Amazon EC2 instances behind an Elastic Load Balancing (ELB) load balancer. However, many of the web service clients can only reach IP addresses authorized on their firewalls.
What should a solutions architect recommend to meet the clients’ needs?
A. A Network Load Balancer with an associated Elastic IP address.
B. An Application Load Balancer with an associated Elastic IP address.
C. An A record in an Amazon Route 53 hosted zone pointing to an Elastic IP address.
D. An EC2 instance with a public IP address running as a proxy in front of the load balancer.
Show Answer
Correct Answer: A
Explanation: Clients require a fixed, whitelisted IP address. Among ELB types, only a Network Load Balancer supports static IP addresses through Elastic IPs. Application Load Balancers cannot be assigned Elastic IPs, Route 53 DNS records do not provide a fixed underlying IP, and placing an EC2 proxy in front adds unnecessary complexity and scaling risk. Therefore, a Network Load Balancer with an associated Elastic IP best meets the requirement.
Question 280
To meet security requirements, a company needs to encrypt all of its application data in transit while communicating with an Amazon RDS MySQL DB instance. A recent security audit revealed that encryption at rest is enabled using AWS Key Management Service (AWS KMS), but data in transit is not enabled.
What should a solutions architect do to satisfy the security requirements?
A. Enable IAM database authentication on the database.
B. Provide self-signed certificates. Use the certificates in all connections to the RDS instance.
C. Take a snapshot of the RDS instance. Restore the snapshot to a new instance with encryption enabled.
D. Download AWS-provided root certificates. Provide the certificates in all connections to the RDS instance.
Show Answer
Correct Answer: D
Explanation: Encrypting data in transit to an Amazon RDS MySQL instance requires using SSL/TLS for database connections. Amazon RDS automatically installs a server certificate signed by an AWS-managed certificate authority. To enable and validate encrypted connections, applications must download the AWS-provided root certificates and configure their database clients to use them. IAM database authentication controls authentication, not transport encryption; self-signed certificates are not appropriate; and snapshot/restore only affects encryption at rest.
Question 281
A company is building an application on AWS that connects to an Amazon RDS database. The company wants to manage the application configuration and to securely store and retrieve credentials for the database and other services.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Use AWS AppConfig to store and manage the application configuration. Use AWS Secrets Manager to store and retrieve the credentials.
B. Use AWS Lambda to store and manage the application configuration. Use AWS Systems Manager Parameter Store to store and retrieve the credentials.
C. Use an encrypted application configuration file. Store the file in Amazon S3 for the application configuration. Create another S3 file to store and retrieve the credentials.
D. Use AWS AppConfig to store and manage the application configuration. Use Amazon RDS to store and retrieve the credentials.
Show Answer
Correct Answer: A
Explanation: The requirement is to manage application configuration and securely store and retrieve credentials with the least administrative overhead. AWS AppConfig is purpose-built for managing and deploying application configuration safely, and AWS Secrets Manager is the managed service designed specifically for secure storage, rotation, and retrieval of credentials. This combination minimizes custom code and operational effort. Other options involve custom solutions, misuse of services, or insecure practices.
Question 282
The DNS provider that hosts a company's domain name records is experiencing outages that cause service disruption for a website running on AWS. The company needs to migrate to a more resilient managed DNS service and wants the service to run on AWS.
What should a solutions architect do to rapidly migrate the DNS hosting service?
A. Create an Amazon Route 53 public hosted zone for the domain name. Import the zone file containing the domain records hosted by the previous provider.
B. Create an Amazon Route 53 private hosted zone for the domain name. Import the zone file containing the domain records hosted by the previous provider.
C. Create a Simple AD directory in AWS. Enable zone transfer between the DNS provider and AWS Directory Service for Microsoft Active Directory for the domain records.
D. Create an Amazon Route 53 Resolver inbound endpoint in the VPC. Specify the IP addresses that the provider's DNS will forward DNS queries to. Configure the provider's DNS to forward DNS queries for the domain to the IP addresses that are specified in the inbound endpoint.
Show Answer
Correct Answer: A
Explanation: To rapidly migrate public DNS hosting to a resilient managed service on AWS, the correct approach is to create an Amazon Route 53 public hosted zone and import the existing DNS records (zone file). Route 53 is AWS’s highly available managed public DNS service. Private hosted zones (B) are only for VPC-internal resolution, Simple AD (C) is unrelated to public DNS hosting, and Route 53 Resolver inbound endpoints (D) are for forwarding on‑premises DNS queries into AWS, not for hosting an internet-facing domain.
Question 283
A company migrated millions of archival files to Amazon S3. A solutions architect needs to implement a solution that will encrypt all the archival data by using a customer-provided key. The solution must encrypt existing unencrypted objects and future objects.
Which solution will meet these requirements?
A. Create a list of unencrypted objects by filtering an Amazon S3 Inventory report. Configure an S3 Batch Operations job to encrypt the objects from the list with a server-side encryption with a customer-provided key (SSE-C). Configure the S3 default encryption feature to use a server-side encryption with a customer-provided key (SSE-C).
B. Use S3 Storage Lens metrics to identify unencrypted S3 buckets. Configure the S3 default encryption feature to use a server-side encryption with AWS KMS keys (SSE-KMS).
C. Create a list of unencrypted objects by filtering the AWS usage report for Amazon S3. Configure an AWS Batch job to encrypt the objects from the list with a server-side encryption with AWS KMS keys (SSE-KMS). Configure the S3 default encryption feature to use a server-side encryption with AWS KMS keys (SSE-KMS).
D. Create a list of unencrypted objects by filtering the AWS usage report for Amazon S3. Configure the S3 default encryption feature to use a server-side encryption with a customer-provided key (SSE-C).
Show Answer
Correct Answer: A
Explanation: The requirement is to encrypt both existing and future S3 objects using a customer-provided key (SSE-C). Existing unencrypted objects can be identified via an S3 Inventory report (which includes encryption status) and encrypted at scale using S3 Batch Operations with SSE-C. Enabling S3 default encryption with SSE-C ensures all future objects are encrypted with a customer-provided key. Other options either use SSE-KMS or do not correctly address existing objects.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.