A company sets up an organization in AWS Organizations that contains 10 AWS accounts. A solutions architect must design a solution to provide access to the accounts for several thousand employees. The company has an existing identity provider (IdP). The company wants to use the existing IdP for authentication to AWS.
Which solution will meet these requirements?
A. Create IAM users for the employees in the required AWS accounts. Connect IAM users to the existing IdP. Configure federated authentication for the IAM users.
B. Set up AWS account root users with user email addresses and passwords that are synchronized from the existing IdP.
C. Configure AWS IAM Identity Center (AWS Single Sign-On). Connect IAM Identity Center to the existing IdP. Provision users and groups from the existing IdP.
D. Use AWS Resource Access Manager (AWS RAM) to share access to the AWS accounts with the users in the existing IdP.
Show Answer
Correct Answer: C
Explanation: AWS IAM Identity Center (formerly AWS SSO) is the recommended service for centrally managing workforce access across multiple AWS accounts in AWS Organizations. It integrates with an existing external identity provider for authentication and supports provisioning users and groups (for example, via SCIM), then assigns permission sets across accounts. IAM users per account do not scale to thousands of employees, root users must never be used for workforce access, and AWS RAM is for sharing AWS resources, not user authentication or account access.
Question 274
A company’s website is used to sell products to the public. The site runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). There is also an Amazon CloudFront distribution, and AWS WAF is being used to protect against SQL injection attacks. The ALB is the origin for the CloudFront distribution. A recent review of security logs revealed an external malicious IP that needs to be blocked from accessing the website.
What should a solutions architect do to protect the application?
A. Modify the network ACL on the CloudFront distribution to add a deny rule for the malicious IP address.
B. Modify the configuration of AWS WAF to add an IP match condition to block the malicious IP address.
C. Modify the network ACL for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.
D. Modify the security groups for the EC2 instances in the target groups behind the ALB to deny the malicious IP address.
Show Answer
Correct Answer: B
Explanation: AWS WAF is already associated with the application (via CloudFront/ALB) and is designed to block requests based on source IP using an IP set (IP match statement). CloudFront does not have network ACLs, VPC network ACLs apply only to subnets, and EC2 security groups do not support explicit deny rules. Blocking at WAF stops the malicious requests before they reach the origin.
Question 275
A company uses an organization in AWS Organizations to manage AWS accounts that contain applications. The company sets up a dedicated monitoring member account in the organization. The company wants to query and visualize observability data across the accounts by using Amazon CloudWatch.
Which solution will meet these requirements?
A. Enable CloudWatch cross-account observability for the monitoring account. Deploy an AWS CloudFormation template provided by the monitoring account in each AWS account to share the data with the monitoring account.
B. Set up service control policies (SCPs) to provide access to CloudWatch in the monitoring account under the Organizations root organizational unit (OU).
C. Configure a new IAM user in the monitoring account. In each AWS account, configure an IAM policy to have access to query and visualize the CloudWatch data in the account. Attach the new IAM policy to the new IAM user.
D. Create a new IAM user in the monitoring account. Create cross-account IAM policies in each AWS account. Attach the IAM policies to the new IAM user.
Show Answer
Correct Answer: A
Explanation: Amazon CloudWatch cross-account observability is the AWS-native feature designed for a monitoring account to query, search, and visualize metrics, logs, and traces across multiple AWS accounts. The monitoring account can generate and provide a CloudFormation template that is deployed in source accounts to establish the required sharing. SCPs do not grant service access, and creating IAM users with cross-account policies is not the recommended or required architecture for CloudWatch cross-account observability.
Question 276
A financial services company wants to shut down two data centers and migrate more than 100 TB of data to AWS. The data has an intricate directory structure with millions of small files stored in deep hierarchies of subfolders. Most of the data is unstructured, and the company’s file storage consists of SMB-based storage types from multiple vendors. The company does not want to change its applications to access the data after migration.
What should a solutions architect do to meet these requirements with the LEAST operational overhead?
A. Use AWS Direct Connect to migrate the data to Amazon S3.
B. Use AWS DataSync to migrate the data to Amazon FSx for Lustre.
C. Use AWS DataSync to migrate the data to Amazon FSx for Windows File Server.
D. Use AWS Direct Connect to migrate the data on-premises file storage to an AWS Storage Gateway volume gateway.
Show Answer
Correct Answer: C
Explanation: AWS DataSync is designed to efficiently migrate large datasets with millions of files while preserving metadata. The source uses SMB-based storage and the applications should continue accessing data via SMB without changes. Amazon FSx for Windows File Server provides a managed SMB file system compatible with Windows file shares, minimizing application changes and operational overhead. FSx for Lustre is optimized for high-performance compute workloads rather than SMB application compatibility. Direct Connect provides network connectivity, not a migration solution by itself, and Storage Gateway is intended for hybrid access rather than replacing on-premises file storage in this scenario.
Question 277
A company is deploying an application that processes streaming data in near-real time. The company plans to use Amazon EC2 instances for the workload. The network architecture must be configurable to provide the lowest possible latency between nodes.
Which combination of network solutions will meet these requirements? (Choose two.)
A. Enable and configure enhanced networking on each EC2 instance.
B. Group the EC2 instances in separate accounts.
C. Run the EC2 instances in a cluster placement group.
D. Attach multiple elastic network interfaces to each EC2 instance.
E. Use Amazon Elastic Block Store (Amazon EBS) optimized instance types.
Show Answer
Correct Answer: A, C
Explanation: Enhanced networking (ENA/SR-IOV) reduces network latency and increases packet processing performance between EC2 instances. A cluster placement group places instances physically close together within a single Availability Zone to provide the lowest possible network latency and highest throughput. Separate accounts do not improve latency, multiple ENIs increase interface flexibility rather than reducing inter-instance latency, and EBS optimization affects storage I/O, not inter-instance networking.
Question 278
A company has established a new AWS account. The account is newly provisioned and no changes have been made to the default settings. The company is concerned about the security of the AWS account root user.
What should be done to secure the root user?
A. Create IAM users for daily administrative tasks. Disable the root user.
B. Create IAM users for daily administrative tasks. Enable multi-factor authentication on the root user.
C. Generate an access key for the root user. Use the access key for daily administration tasks instead of the AWS Management Console.
D. Provide the root user credentials to the most senior solutions architect. Have the solutions architect use the root user for daily administration tasks.
Show Answer
Correct Answer: B
Explanation: AWS best practice is to avoid using the root user for everyday administrative tasks. Instead, create IAM users (or, more commonly today, use IAM Identity Center/federation) for administration and enable multi-factor authentication (MFA) on the root user. The root user cannot be disabled, making option A incorrect. Creating root access keys or using the root user for daily administration is strongly discouraged, making C and D incorrect.
Question 279
A company is designing a new web service that will run on Amazon EC2 instances behind an Elastic Load Balancing (ELB) load balancer. However, many of the web service clients can only reach IP addresses authorized on their firewalls.
What should a solutions architect recommend to meet the clients’ needs?
A. A Network Load Balancer with an associated Elastic IP address.
B. An Application Load Balancer with an associated Elastic IP address.
C. An A record in an Amazon Route 53 hosted zone pointing to an Elastic IP address.
D. An EC2 instance with a public IP address running as a proxy in front of the load balancer.
Show Answer
Correct Answer: A
Explanation: A Network Load Balancer supports static IP addresses by associating Elastic IP addresses with its subnets, allowing clients to whitelist fixed IPs in their firewalls. Application Load Balancers do not support associating Elastic IPs. Route 53 A records do not make an ELB use an Elastic IP, and placing a proxy EC2 instance in front of the load balancer adds unnecessary complexity and a potential bottleneck.
Question 280
To meet security requirements, a company needs to encrypt all of its application data in transit while communicating with an Amazon RDS MySQL DB instance. A recent security audit revealed that encryption at rest is enabled using AWS Key Management Service (AWS KMS), but data in transit is not enabled.
What should a solutions architect do to satisfy the security requirements?
A. Enable IAM database authentication on the database.
B. Provide self-signed certificates. Use the certificates in all connections to the RDS instance.
C. Take a snapshot of the RDS instance. Restore the snapshot to a new instance with encryption enabled.
D. Download AWS-provided root certificates. Provide the certificates in all connections to the RDS instance.
Show Answer
Correct Answer: D
Explanation: To encrypt data in transit for Amazon RDS MySQL, clients should connect using SSL/TLS and trust the AWS RDS server certificate by using the AWS-provided root CA certificates. IAM database authentication is an authentication mechanism, not the required step to enable transport encryption. Self-signed certificates are not the RDS approach, and snapshot/restore relates to encryption at rest, which is already enabled.
Question 281
A company is building an application on AWS that connects to an Amazon RDS database. The company wants to manage the application configuration and to securely store and retrieve credentials for the database and other services.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Use AWS AppConfig to store and manage the application configuration. Use AWS Secrets Manager to store and retrieve the credentials.
B. Use AWS Lambda to store and manage the application configuration. Use AWS Systems Manager Parameter Store to store and retrieve the credentials.
C. Use an encrypted application configuration file. Store the file in Amazon S3 for the application configuration. Create another S3 file to store and retrieve the credentials.
D. Use AWS AppConfig to store and manage the application configuration. Use Amazon RDS to store and retrieve the credentials.
Show Answer
Correct Answer: A
Explanation: AWS AppConfig is designed to manage and deploy application configuration with minimal operational overhead. AWS Secrets Manager is the recommended service for securely storing, retrieving, and rotating database credentials and other secrets. The other options misuse services (Lambda or RDS) or store secrets in S3, which is not the managed best practice for secrets.
Question 282
The DNS provider that hosts a company's domain name records is experiencing outages that cause service disruption for a website running on AWS. The company needs to migrate to a more resilient managed DNS service and wants the service to run on AWS.
What should a solutions architect do to rapidly migrate the DNS hosting service?
A. Create an Amazon Route 53 public hosted zone for the domain name. Import the zone file containing the domain records hosted by the previous provider.
B. Create an Amazon Route 53 private hosted zone for the domain name. Import the zone file containing the domain records hosted by the previous provider.
C. Create a Simple AD directory in AWS. Enable zone transfer between the DNS provider and AWS Directory Service for Microsoft Active Directory for the domain records.
D. Create an Amazon Route 53 Resolver inbound endpoint in the VPC. Specify the IP addresses that the provider's DNS will forward DNS queries to. Configure the provider's DNS to forward DNS queries for the domain to the IP addresses that are specified in the inbound endpoint.
Show Answer
Correct Answer: A
Explanation: A public website requires public DNS hosting. Amazon Route 53 public hosted zones are the managed AWS service for authoritative public DNS. To migrate quickly, create a Route 53 public hosted zone and import the existing zone file with the domain's DNS records, then update the domain's registrar to use the Route 53 name servers. A private hosted zone is only for VPC-internal DNS, AWS Directory Service is unrelated to public authoritative DNS hosting, and Route 53 Resolver inbound endpoints are for resolving DNS queries into a VPC rather than hosting a public DNS zone.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.