A company is designing the architecture for a new mobile app that uses the AWS Cloud. The company uses organizational units (OUs) in AWS Organizations to manage its accounts. The company wants to tag Amazon EC2 instances with data sensitivity by using values of sensitive and nonsensitive. IAM identities must not be able to delete a tag or create instances without a tag.
Which combination of steps will meet these requirements? (Choose two.)
A. In Organizations, create a new tag policy that specifies the data sensitivity tag key and the required values. Enforce the tag values for the EC2 instances. Attach the tag policy to the appropriate OU.
B. In Organizations, create a new service control policy (SCP) that specifies the data sensitivity tag key and the required tag values. Enforce the tag values for the EC2 instances. Attach the SCP to the appropriate OU.
C. Create a tag policy to deny running instances when a tag key is not specified. Create another tag policy that prevents identities from deleting tags. Attach the tag policies to the appropriate OU.
D. Create a service control policy (SCP) to deny creating instances when a tag key is not specified. Create another SCP that prevents identities from deleting tags. Attach the SCPs to the appropriate OU.
E. Create an AWS Config rule to check if EC2 instances use the data sensitivity tag and the specified values. Configure an AWS Lambda function to delete the resource if a noncompliant resource is found.
Show Answer
Correct Answer: A, D
Explanation: Tag policies in AWS Organizations are used to define and enforce allowed tag keys and values, so a tag policy is required to restrict the data sensitivity tag to the values sensitive and nonsensitive. However, tag policies alone cannot prevent resource creation without tags or stop tag deletion. Service control policies (SCPs) are needed to explicitly deny EC2 instance creation when the required tag is missing and to deny actions that remove tags. Therefore, combining a tag policy (A) with SCPs to enforce tag presence and prevent deletion (D) satisfies all requirements.
Question 22
A medical company wants to perform transformations on a large amount of clinical trial data that comes from several customers. The company must extract the data from a relational database that contains the customer data. Then the company will transform the data by using a series of complex rules. The company will load the data to Amazon S3 when the transformations are complete.
All data must be encrypted where it is processed before the company stores the data in Amazon S3. All data must be encrypted by using customer-specific keys.
Which solution will meet these requirements with the LEAST amount of operational effort?
A. Create one AWS Glue job for each customer. Attach a security configuration to each job that uses server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data.
B. Create one Amazon EMR cluster for each customer. Attach a security configuration to each cluster that uses client-side encryption with a custom client-side root key (CSE-Custom) to encrypt the data.
C. Create one AWS Glue job for each customer. Attach a security configuration to each job that uses client-side encryption with AWS KMS managed keys (CSE-KMS) to encrypt the data.
D. Create one Amazon EMR cluster for each customer. Attach a security configuration to each cluster that uses server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the data.
Show Answer
Correct Answer: C
Explanation: AWS Glue is a fully managed, serverless ETL service, which minimizes operational effort compared to managing Amazon EMR clusters. The requirement states that data must be encrypted where it is processed, before being stored in Amazon S3, and must use customer-specific keys. Client-side encryption with AWS KMS (CSE-KMS) ensures the data is encrypted during processing and in transit using distinct KMS keys per customer. Options using server-side encryption only encrypt data after it reaches S3, which does not meet the requirement, and EMR-based options require significantly more operational management.
Question 23
A company recently launched a new application for its customers. The application runs on multiple Amazon EC2 instances across two Availability Zones. End users use TCP to communicate with the application.
The application must be highly available and must automatically scale as the number of users increases.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
A. Add a Network Load Balancer in front of the EC2 instances.
B. Configure an Auto Scaling group for the EC2 instances.
C. Add an Application Load Balancer in front of the EC2 instances.
D. Manually add more EC2 instances for the application.
E. Add a Gateway Load Balancer in front of the EC2 instances.
Show Answer
Correct Answer: A, B
Explanation: The application requires high availability, automatic scaling, and uses TCP. An Auto Scaling group is required to automatically add and remove EC2 instances as demand changes. To distribute TCP traffic across instances in multiple Availability Zones, a Network Load Balancer is the most appropriate and cost‑effective choice because it operates at Layer 4, natively supports TCP, scales automatically, and is optimized for high throughput and large numbers of connections. Application Load Balancers are Layer 7 and are intended for HTTP/HTTPS use cases, while manual scaling and Gateway Load Balancers do not meet the requirements.
Question 24
A company is testing an application that runs on an Amazon EC2 Linux instance. A single 500 GB Amazon Elastic Block Store (Amazon EBS) General Purpose SSO (gp2) volume is attached to the EC2 instance.
The company will deploy the application on multiple EC2 instances in an Auto Scaling group. All instances require access to the data that is stored in the EBS volume. The company needs a highly available and resilient solution that does not introduce significant changes to the application's code.
Which solution will meet these requirements?
A. Provision an EC2 instance that uses NFS server software. Attach a single 500 GB gp2 EBS volume to the instance.
B. Provision an Amazon FSx for Windows File Server file system. Configure the file system as an SMB file store within a single Availability Zone.
C. Provision an EC2 instance with two 250 GB Provisioned IOPS SSD EBS volumes.
D. Provision an Amazon Elastic File System (Amazon EFS) file system. Configure the file system to use General Purpose performance mode.
Show Answer
Correct Answer: D
Explanation: Multiple EC2 instances in an Auto Scaling group need concurrent access to the same data with high availability and minimal application changes. Amazon EFS is a fully managed, highly available, regional network file system that can be mounted simultaneously by many Linux EC2 instances using standard NFS, requiring little to no code modification. EBS volumes cannot be shared by multiple instances, and self-managed NFS or single-AZ file systems reduce availability and resilience.
Question 25
A company stores user data in AWS. The data is used continuously with peak usage during business hours. Access patterns vary, with some data not being used for months at a time. A solutions architect must choose a cost-effective solution that maintains the highest level of durability while maintaining high availability.
Which storage solution meets these requirements?
A. Amazon S3 Standard
B. Amazon S3 Intelligent-Tiering
C. Amazon S3 Glacier Deep Archive
D. Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)
Show Answer
Correct Answer: B
Explanation: Amazon S3 Intelligent-Tiering is designed for data with unpredictable or changing access patterns. It automatically moves objects between frequent and infrequent access tiers to optimize cost while maintaining the same high durability (11 9s) and high availability as S3 Standard. This meets the requirement for continuous access with variable usage, peak business-hour demand, and long periods of inactivity, without sacrificing durability or availability.
Question 26
A company hosts its main public web application in one AWS Region across multiple Availability Zones. The application uses an Amazon EC2 Auto Scaling group and an Application Load Balancer (ALB).
A web development team needs a cost-optimized compute solution to improve the company’s ability to serve dynamic content globally to millions of customers.
Which solution will meet these requirements?
A. Create an Amazon CloudFront distribution. Configure the existing ALB as the origin.
B. Use Amazon Route 53 to serve traffic to the ALB and EC2 instances based on the geographic location of each customer.
C. Create an Amazon S3 bucket with public read access enabled. Migrate the web application to the S3 bucket. Configure the S3 bucket for website hosting.
D. Use AWS Direct Connect to directly serve content from the web application to the location of each customer.
Show Answer
Correct Answer: A
Explanation: Amazon CloudFront is a global content delivery network that improves performance and scalability for both static and dynamic content by serving users from nearby edge locations. Using the existing Application Load Balancer as the origin allows CloudFront to forward dynamic requests efficiently to the EC2 Auto Scaling group while reducing latency and offloading traffic from the origin. This is the most cost-optimized and appropriate solution for serving dynamic content globally at scale. Route 53 geolocation routing does not provide caching or edge acceleration, S3 static hosting cannot support a dynamic EC2-based application, and Direct Connect is not intended for global content delivery to end users.
Question 27
A company hosts its core network services, including directory services and DNS, in its on-premises data center. The data center is connected to the AWS Cloud using AWS Direct Connect (DX). Additional AWS accounts are planned that will require quick, cost-effective, and consistent access to these network services.
What should a solutions architect implement to meet these requirements with the LEAST amount of operational overhead?
A. Create a DX connection in each new account. Route the network traffic to the on-premises servers.
B. Configure VPC endpoints in the DX VPC for all required services. Route the network traffic to the on-premises servers.
C. Create a VPN connection between each new account and the DX VPRoute the network traffic to the on-premises servers.
D. Configure AWS Transit Gateway between the accounts. Assign DX to the transit gateway and route network traffic to the on-premises servers.
Show Answer
Correct Answer: D
Explanation: AWS Transit Gateway provides a centralized hub-and-spoke networking model that allows multiple AWS accounts and VPCs to share a single Direct Connect attachment to the on-premises data center. This delivers quick, consistent, and cost-effective access to on-premises directory and DNS services while minimizing operational overhead. New accounts can be onboarded easily by attaching their VPCs to the transit gateway, avoiding the need for multiple DX connections or individual VPNs.
Question 28
A company has an Amazon S3 bucket that contains sensitive data files. The company has an application that runs on virtual machines in an on-premises data center. The company currently uses AWS IAM Identity Center.
The application requires temporary access to files in the S3 bucket. The company wants to grant the application secure access to the files in the S3 bucket.
Which solution will meet these requirements?
A. Create an S3 bucket policy that permits access to the bucket from the public IP address range of the company’s on-premises data center.
B. Use IAM Roles Anywhere to obtain security credentials in IAM Identity Center that grant access to the S3 bucket. Configure the virtual machines to assume the role by using the AWS CLI.
C. Install the AWS CLI on the virtual machine. Configure the AWS CLI with access keys from an IAM user that has access to the bucket.
D. Create an IAM user and policy that grants access to the bucket. Store the access key and secret key for the IAM user in AWS Secrets Manager. Configure the application to retrieve the access key and secret key at startup.
Show Answer
Correct Answer: B
Explanation: The application runs on on-premises virtual machines and needs temporary, secure access to Amazon S3 without using long-term credentials. IAM Roles Anywhere is designed for exactly this use case: it allows workloads running outside AWS to assume IAM roles and obtain temporary security credentials. This avoids static access keys, aligns with AWS security best practices, and integrates cleanly with the company’s existing IAM setup. Other options rely on IP-based controls or long-term credentials, which are less secure.
Question 29
A company currently stores 5 TB of data in on-premises block storage systems. The company's current storage solution provides limited space for additional data. The company runs applications on premises that must be able to retrieve frequently accessed data with low latency. The company requires a cloud-based storage solution.
Which solution will meet these requirements with the MOST operational efficiency?
A. Use Amazon S3 File Gateway. Integrate S3 File Gateway with the on-premises applications to store and directly retrieve files by using the SMB file system.
B. Use an AWS Storage Gateway Volume Gateway with cached volumes as iSCSI targets.
C. Use an AWS Storage Gateway Volume Gateway with stored volumes as iSCSI targets.
D. Use an AWS Storage Gateway Tape Gateway. Integrate Tape Gateway with the on-premises applications to store virtual tapes in Amazon S3.
Show Answer
Correct Answer: B
Explanation: The requirement is cloud-based block storage with low-latency access to frequently accessed data and limited on‑premises capacity. AWS Storage Gateway Volume Gateway with cached volumes keeps only hot data locally for low-latency access while storing the full dataset in Amazon S3, maximizing scalability and operational efficiency. Stored volumes require the entire dataset on premises, File Gateway is file-based not block, and Tape Gateway is for backup/archival use cases.
Question 30
A company is creating a prototype of an ecommerce website on AWS. The website consists of an Application Load Balancer, an Auto Scaling group of Amazon EC2 instances for web servers, and an Amazon RDS for MySQL DB instance that runs with the Single-AZ configuration.
The website is slow to respond during searches of the product catalog. The product catalog is a group of tables in the MySQL database that the company does not update frequently. A solutions architect has determined that the CPU utilization on the DB instance is high when product catalog searches occur.
What should the solutions architect recommend to improve the performance of the website during searches of the product catalog?
A. Migrate the product catalog to an Amazon Redshift database. Use the COPY command to load the product catalog tables.
B. Implement an Amazon ElastiCache for Redis cluster to cache the product catalog. Use lazy loading to populate the cache.
C. Add an additional scaling policy to the Auto Scaling group to launch additional EC2 instances when database response is slow.
D. Turn on the Multi-AZ configuration for the DB instance. Configure the EC2 instances to throttle the product catalog queries that are sent to the database.
Show Answer
Correct Answer: B
Explanation: The performance issue occurs because frequent product catalog searches are driving high CPU utilization on the MySQL DB instance. The catalog data is read-heavy and changes infrequently, making it an ideal candidate for caching. Using Amazon ElastiCache for Redis with lazy loading allows frequently accessed catalog data to be served from memory instead of the database, significantly reducing database load and improving response times. Other options do not directly address the database CPU bottleneck or are unsuitable for low-latency transactional queries.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.