A company migrated millions of archival files to Amazon S3. A solutions architect needs to implement a solution that will encrypt all the archival data by using a customer-provided key. The solution must encrypt existing unencrypted objects and future objects.
Which solution will meet these requirements?
A. Create a list of unencrypted objects by filtering an Amazon S3 Inventory report. Configure an S3 Batch Operations job to encrypt the objects from the list with a server-side encryption with a customer-provided key (SSE-C). Configure the S3 default encryption feature to use a server-side encryption with a customer-provided key (SSE-C).
B. Use S3 Storage Lens metrics to identify unencrypted S3 buckets. Configure the S3 default encryption feature to use a server-side encryption with AWS KMS keys (SSE-KMS).
C. Create a list of unencrypted objects by filtering the AWS usage report for Amazon S3. Configure an AWS Batch job to encrypt the objects from the list with a server-side encryption with AWS KMS keys (SSE-KMS). Configure the S3 default encryption feature to use a server-side encryption with AWS KMS keys (SSE-KMS).
D. Create a list of unencrypted objects by filtering the AWS usage report for Amazon S3. Configure the S3 default encryption feature to use a server-side encryption with a customer-provided key (SSE-C).
Show Answer
Correct Answer: A
Explanation: The requirement explicitly specifies a customer-provided key, which means SSE-C. For existing objects at scale, use an S3 Inventory report (which includes encryption status) to identify unencrypted objects, then use S3 Batch Operations to copy/rewrite and encrypt them with SSE-C. For future uploads, configure S3 default encryption to use SSE-C as stated in the option. The other options either use SSE-KMS instead of customer-provided keys or rely on AWS usage reports, which do not identify object-level encryption status.
Question 284
A company is building a new application that uses serverless architecture. The architecture will consist of an Amazon API Gateway REST API and AWS Lambda functions to manage incoming requests.
The company wants to add a service that can send messages received from the API Gateway REST API to multiple target Lambda functions for processing. The service must offer message filtering that gives the target Lambda functions the ability to receive only the messages the functions need.
Which solution will meet these requirements with the LEAST operational overhead?
A. Send the requests from the API Gateway REST API to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe Amazon Simple Queue Service (Amazon SQS) queues to the SNS topic. Configure the target Lambda functions to poll the different SQS queues.
B. Send the requests from the API Gateway REST API to Amazon EventBridge. Configure EventBridge to invoke the target Lambda functions.
C. Send the requests from the API Gateway REST API to Amazon Managed Streaming for Apache Kafka (Amazon MSK). Configure Amazon MSK to publish the messages to the target Lambda functions.
D. Send the requests from the API Gateway REST API to multiple Amazon Simple Queue Service (Amazon SQS) queues. Configure the target Lambda functions to poll the different SQS queues.
Show Answer
Correct Answer: B
Explanation: Amazon EventBridge provides native event routing and content-based filtering with rules, and can invoke multiple Lambda functions directly without requiring intermediary queues. This satisfies fan-out and filtering while minimizing operational overhead compared with SNS+SQS, which requires managing topics, subscriptions, and queues. MSK is unnecessary operationally, and sending directly to multiple SQS queues requires custom routing logic.
Sources:
https://docs.aws.amazon.com/apigateway/latest/developerguide/welcome.html
https://docs.aws.amazon.com/lambda/latest/dg/welcome.html
Question 285
A company has a new mobile app. Anywhere in the world, users can see local news on topics they choose. Users also can post photos and videos from inside the app.
Users access content often in the first minutes after the content is posted. New content quickly replaces older content, and then the older content disappears. The local nature of the news means that users consume 90% of the content within the AWS Region where it is uploaded.
Which solution will optimize the user experience by providing the LOWEST latency for content uploads?
A. Upload and store content in Amazon S3. Use Amazon CloudFront for the uploads.
B. Upload and store content in Amazon S3. Use S3 Transfer Acceleration for the uploads.
C. Upload content to Amazon EC2 instances in the Region that is closest to the user. Copy the data to Amazon S3.
D. Upload and store content in Amazon S3 in the Region that is closest to the user. Use multiple distributions of Amazon CloudFront.
Show Answer
Correct Answer: B
Explanation: Amazon S3 Transfer Acceleration is specifically designed to minimize upload latency by routing uploads through the nearest AWS edge location onto the AWS global network before delivering them to the target S3 bucket. CloudFront primarily optimizes content delivery, and while it supports HTTP methods such as PUT/POST, it is not the purpose-built upload acceleration feature. The question asks specifically for the lowest latency for uploads.
Question 286
A company has an application that delivers on-demand training videos to students around the world. The application also allows authorized content developers to upload videos. The data is stored in an Amazon S3 bucket in the us-east-2 Region.
The company has created an S3 bucket in the eu-west-2 Region and an S3 bucket in the ap-southeast-1 Region. The company wants to replicate the data to the new S3 buckets. The company needs to minimize latency for developers who upload videos and students who stream videos near eu-west-2 and ap-southeast-1.
Which combination of steps will meet these requirements with the FEWEST changes to the application? (Choose two.)
A. Configure one-way replication from the us-east-2 S3 bucket to the eu-west-2 S3 bucket. Configure one-way replication from the us-east-2 S3 bucket to the ap-southeast-1 S3 bucket.
B. Configure one-way replication from the us-east-2 S3 bucket to the eu-west-2 S3 bucket. Configure one-way replication from the eu-west-2 S3 bucket to the ap-southeast-1 S3 bucket.
C. Configure two-way (bidirectional) replication among the S3 buckets that are in all three Regions.
D. Create an S3 Multi-Region Access Point. Modify the application to use the Amazon Resource Name (ARN) of the Multi-Region Access Point for video streaming. Do not modify the application for video uploads.
E. Create an S3 Multi-Region Access Point. Modify the application to use the Amazon Resource Name (ARN) of the Multi-Region Access Point for video streaming and uploads.
Show Answer
Correct Answer: C, E
Explanation: To minimize latency for both uploads and streaming in multiple regions, developers and students should be routed to the nearest bucket. Bidirectional S3 replication keeps objects synchronized regardless of which regional bucket receives an upload. An S3 Multi-Region Access Point provides a single global endpoint that routes both read and write requests to the optimal region, requiring only the application endpoint to change while preserving low latency.
Question 287
A company has multiple AWS accounts with applications deployed in the us-west-2 Region. Application logs are stored within Amazon S3 buckets in each account. The company wants to build a centralized log analysis solution that uses a single S3 bucket. Logs must not leave us-west-2, and the company wants to incur minimal operational overhead.
Which solution meets these requirements and is MOST cost-effective?
A. Create an S3 Lifecycle policy that copies the objects from one of the application S3 buckets to the centralized S3 bucket.
B. Use S3 Same-Region Replication to replicate logs from the S3 buckets to another S3 bucket in us-west-2. Use this S3 bucket for log analysis.
C. Write a script that uses the PutObject API operation every day to copy the entire contents of the buckets to another S3 bucket in us-west-2. Use this S3 bucket for log analysis.
D. Write AWS Lambda functions in these accounts that are triggered every time logs are delivered to the S3 buckets (s3:ObjectCreated:* event). Copy the logs to another S3 bucket in us-west-2. Use this S3 bucket for log analysis.
Show Answer
Correct Answer: B
Explanation: S3 Same-Region Replication (SRR) is designed to automatically replicate objects between buckets in the same AWS Region, including across AWS accounts. It minimizes operational overhead because replication is managed by S3, keeps logs within us-west-2, and supports centralized log aggregation. S3 Lifecycle policies do not copy objects to another bucket, while custom scripts or Lambda-based copying add unnecessary operational overhead.
Question 288
A company is developing a mobile game that streams score updates to a backend processor and then posts results on a leaderboard. A solutions architect needs to design a solution that can handle large traffic spikes, process the mobile game updates in order of receipt, and store the processed updates in a highly available database. The company also wants to minimize the management overhead required to maintain the solution.
What should the solutions architect do to meet these requirements?
A. Push score updates to Amazon Kinesis Data Streams. Process the updates in Kinesis Data Streams with AWS Lambda. Store the processed updates in Amazon DynamoDB.
B. Push score updates to Amazon Kinesis Data Streams. Process the updates with a fleet of Amazon EC2 instances set up for Auto Scaling. Store the processed updates in Amazon Redshift.
C. Push score updates to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe an AWS Lambda function to the SNS topic to process the updates. Store the processed updates in a SQL database running on Amazon EC2.
D. Push score updates to an Amazon Simple Queue Service (Amazon SQS) queue. Use a fleet of Amazon EC2 instances with Auto Scaling to process the updates in the SQS queue. Store the processed updates in an Amazon RDS Multi-AZ DB instance.
Show Answer
Correct Answer: A
Explanation: Amazon Kinesis Data Streams is designed for high-throughput streaming and preserves ordering within a shard, making it suitable for processing score updates in order. AWS Lambda can process Kinesis stream records without managing servers, minimizing operational overhead. Amazon DynamoDB is a fully managed, highly available NoSQL database that scales automatically and is well suited for storing processed leaderboard updates. The other options either require managing EC2 instances, use databases that increase operational overhead, or do not provide ordered stream processing in the same way.
Question 289
A company has an AWS Direct Connect connection from its corporate data center to its VPC in the us-east-1 Region. The company recently acquired a corporation that has several VPCs and a Direct Connect connection between its on-premises data center and the eu-west-2 Region. The CIDR blocks for the VPCs of the company and the corporation do not overlap. The company requires connectivity between two Regions and the data centers. The company needs a solution that is scalable while reducing operational overhead.
What should a solutions architect do to meet these requirements?
A. Set up inter-Region VPC peering between the VPC in us-east-1 and the VPCs in eu-west-2.
B. Create private virtual interfaces from the Direct Connect connection in us-east-1 to the VPCs in eu-west-2.
C. Establish VPN appliances in a fully meshed VPN network hosted by Amazon EC2. Use AWS VPN CloudHub to send and receive data between the data centers and each VP
D. Connect the existing Direct Connect connection to a Direct Connect gateway. Route traffic from the virtual private gateways of the VPCs in each Region to the Direct Connect gateway.
Show Answer
Correct Answer: D
Explanation: A Direct Connect gateway allows multiple VPCs across multiple AWS Regions to use existing Direct Connect connections, providing scalable connectivity with low operational overhead. By associating the VPCs' virtual private gateways (or transit gateways where applicable) with the Direct Connect gateway, both on-premises data centers can reach VPCs across Regions through Direct Connect. Inter-Region VPC peering does not connect the on-premises networks, private VIFs cannot directly terminate to VPCs in another Region as described, and VPN CloudHub relies on VPN over the internet rather than leveraging the existing Direct Connect architecture.
Question 290
An ecommerce company runs applications in AWS accounts that are part of an organization in AWS Organizations. The applications run on Amazon Aurora PostgreSQL databases across all the accounts. The company needs to prevent malicious activity and must identify abnormal failed and incomplete login attempts to the databases.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Attach service control policies (SCPs) to the root of the organization to identity the failed login attempts.
B. Enable the Amazon RDS Protection feature in Amazon GuardDuty for the member accounts of the organization.
C. Publish the Aurora general logs to a log group in Amazon CloudWatch Logs. Export the log data to a central Amazon S3 bucket.
D. Publish all the Aurora PostgreSQL database events in AWS CloudTrail to a central Amazon S3 bucket.
Show Answer
Correct Answer: B
Explanation: Amazon GuardDuty RDS Protection for Aurora continuously monitors database login activity and uses anomaly detection to identify suspicious, failed, and anomalous login attempts across accounts in an AWS Organization with minimal operational overhead. SCPs do not monitor activity, CloudWatch log exports require custom analysis, and CloudTrail does not capture Aurora database login events.
Question 291
A company has deployed its application on Amazon EC2 instances with an Amazon RDS database. The company used the principle of least privilege to configure the database access credentials. The company's security team wants to protect the application and the database from SQL injection and other web-based attacks.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use security groups and network ACLs to secure the database and application servers.
B. Use AWS WAF to protect the application. Use RDS parameter groups to configure the security settings.
C. Use AWS Network Firewall to protect the application and the database.
D. Use different database accounts in the application code for different functions. Avoid granting excessive privileges to the database users.
Show Answer
Correct Answer: B
Explanation: AWS WAF is the managed service designed to protect web applications from SQL injection and other common web exploits with minimal operational overhead. RDS parameter groups help configure database settings, while least-privilege database credentials are already in place. Security groups/NACLs and Network Firewall do not provide application-layer SQL injection protection, and using multiple database accounts is already aligned with least privilege but does not stop web attacks.
Question 292
A company has an application that uses an Amazon DynamoDB table for storage. A solutions architect discovers that many requests to the table are not returning the latest data. The company's users have not reported any other issues with database performance. Latency is in an acceptable range.
Which design change should the solutions architect recommend?
A. Add read replicas to the table.
B. Use a global secondary index (GSI).
C. Request strongly consistent reads for the table.
D. Request eventually consistent reads for the table.
Show Answer
Correct Answer: C
Explanation: DynamoDB uses eventually consistent reads by default, which can return stale data shortly after writes. If the application requires the latest committed data and latency is otherwise acceptable, enable strongly consistent reads (ConsistentRead=true) for supported read operations. Read replicas and GSIs do not solve stale-read consistency, and eventually consistent reads would preserve the issue.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.