A company is migrating a large amount of data from on-premises storage to AWS. Windows, Mac, and Linux based Amazon EC2 instances in the same AWS Region will access the data by using SMB and NFS storage protocols. The company will access a portion of the data routinely. The company will access the remaining data infrequently.
The company needs to design a solution to host the data.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an Amazon Elastic File System (Amazon EFS) volume that uses EFS Intelligent-Tiering. Use AWS DataSync to migrate the data to the EFS volume.
B. Create an Amazon FSx for ONTAP instance. Create an FSx for ONTAP file system with a root volume that uses the auto tiering policy. Migrate the data to the FSx for ONTAP volume.
C. Create an Amazon S3 bucket that uses S3 Intelligent-Tiering. Migrate the data to the S3 bucket by using an AWS Storage Gateway Amazon S3 File Gateway.
D. Create an Amazon FSx for OpenZFS file system. Migrate the data to the new volume.
Show Answer
Correct Answer: B
Explanation: The solution must support both SMB and NFS access from Windows, macOS, and Linux EC2 instances, provide automatic tiering for frequently and infrequently accessed data, and require minimal operational overhead. Amazon FSx for NetApp ONTAP natively supports multi-protocol access (SMB and NFS) from EC2, includes built-in automatic storage tiering to lower-cost capacity for infrequently accessed data, and is fully managed by AWS. EFS does not support SMB, S3 with File Gateway is intended for on‑premises access and adds gateway management overhead, and FSx for OpenZFS does not meet the multi‑protocol SMB/NFS requirement. Therefore, option B best meets all requirements.
Question 305
A company’s applications use Apache Hadoop and Apache Spark to process data on premises. The existing infrastructure is not scalable and is complex to manage.
A solutions architect must design a scalable solution that reduces operational complexity. The solution must keep the data processing on premises.
Which solution will meet these requirements?
A. Use AWS Site-to-Site VPN to access the on-premises Hadoop Distributed File System (HDFS) data and application. Use an Amazon EMR cluster to process the data.
B. Use AWS DataSync to connect to the on-premises Hadoop Distributed File System (HDFS) cluster. Create an Amazon EMR cluster to process the data.
C. Migrate the Apache Hadoop application and the Apache Spark application to Amazon EMR clusters on AWS Outposts. Use the EMR clusters to process the data.
D. Use an AWS Snowball device to migrate the data to an Amazon S3 bucket. Create an Amazon EMR cluster to process the data.
Show Answer
Correct Answer: C
Explanation: The requirement is to keep data processing on premises while improving scalability and reducing operational complexity. Amazon EMR on AWS Outposts allows Hadoop and Spark workloads to run on managed EMR clusters physically located on premises, providing cloud-managed scalability and simplified operations without moving processing off-site. Other options process data in AWS Regions or require data movement, which violates the on‑premises processing requirement.
Question 306
A company wants to migrate an on-premises legacy application to AWS. The application ingests customer order files from an on-premises enterprise resource planning (ERP) system. The application then uploads the files to an SFTP server. The application uses a scheduled job that checks for order files every hour.
The company already has an AWS account that has connectivity to the on-premises network. The new application on AWS must support integration with the existing ERP system. The new application must be secure and resilient and must use the SFTP protocol to process orders from the ERP system immediately.
Which solution will meet these requirements?
A. Create an AWS Transfer Family SFTP internet-facing server in two Availability Zones. Use Amazon S3 storage. Create an AWS Lambda function to process order files. Use S3 Event Notifications to send s3:ObjectCreated:* events to the Lambda function.
B. Create an AWS Transfer Family SFTP internet-facing server in one Availability Zone. Use Amazon Elastic File System (Amazon EFS) storage. Create an AWS Lambda function to process order files. Use a Transfer Family managed workflow to invoke the Lambda function.
C. Create an AWS Transfer Family SFTP internal server in two Availability Zones. Use Amazon Elastic File System (Amazon EFS) storage. Create an AWS Step Functions state machine to process order files. Use Amazon EventBridge Scheduler to invoke the state machine to periodically check Amazon EFS for order files.
D. Create an AWS Transfer Family SFTP internal server in two Availability Zones. Use Amazon S3 storage. Create an AWS Lambda function to process order files. Use a Transfer Family managed workflow to invoke the Lambda function.
Show Answer
Correct Answer: D
Explanation: The company already has private connectivity from on‑premises to AWS, so an AWS Transfer Family **internal** SFTP server is more secure than an internet‑facing one. Deploying it across two Availability Zones improves resilience. Using Amazon S3 as the storage backend provides durability and scalability. Transfer Family **managed workflows** can invoke a Lambda function immediately after a file is transferred, meeting the requirement to process orders right away (not on a schedule). Options with scheduled polling, single AZ, or public exposure do not best meet the security, resilience, and immediate‑processing requirements.
Question 307
A company runs a real-time data ingestion solution on AWS. The solution consists of the most recent version of Amazon Managed Streaming for Apache Kafka (Amazon MSK). The solution is deployed in a VPC in private subnets across three Availability Zones.
A solutions architect needs to redesign the data ingestion solution to be publicly available over the internet. The data in transit must also be encrypted.
Which solution will meet these requirements with the MOST operational efficiency?
A. Configure public subnets in the existing VPC. Deploy an MSK cluster in the public subnets. Update the MSK cluster security settings to enable mutual TLS authentication.
B. Create a new VPC that has public subnets. Deploy an MSK cluster in the public subnets. Update the MSK cluster security settings to enable mutual TLS authentication.
C. Deploy an Application Load Balancer (ALB) that uses private subnets. Configure an ALB security group inbound rule to allow inbound traffic from the VPC CIDR block for HTTPS protocol.
D. Deploy a Network Load Balancer (NLB) that uses private subnets. Configure an NLB listener for HTTPS communication over the internet.
Show Answer
Correct Answer: A
Explanation: Amazon MSK supports native public access when brokers are placed in public subnets and encrypted/authenticated access (such as mTLS) is enabled. Converting subnets in the existing VPC to public and enabling mTLS meets the requirements for internet accessibility and encryption with the least operational overhead. Creating a new VPC is unnecessary, and placing ALB/NLB in front of MSK is unsupported and adds complexity without benefit.
Question 308
A company uses Amazon EC2, AWS Fargate, and AWS Lambda to run multiple workloads in the company's AWS account. The company wants to fully make use of its Compute Savings Plans. The company wants to receive notification when coverage of the Compute Savings Plans drops.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a daily budget for the Savings Plans by using AWS Budgets. Configure the budget with a coverage threshold to send notifications to the appropriate email message recipients.
B. Create a Lambda function that runs a coverage report against the Savings Plans. Use Amazon Simple Email Service (Amazon SES) to email the report to the appropriate email message recipients.
C. Create an AWS Budgets report for the Savings Plans budget. Set the frequency to daily.
D. Create a Savings Plans alert subscription. Enable all notification options. Enter an email address to receive notifications.
Show Answer
Correct Answer: A
Explanation: The requirement is to receive notifications when Compute Savings Plans coverage drops, with the most operational efficiency. AWS Budgets natively supports Savings Plans coverage and utilization budgets and can send automated email or SNS notifications when coverage falls below a defined threshold. This is a managed, no-code solution. Savings Plans alert subscriptions (option D) only notify about expiration or queued purchases, not coverage drops. The other options require custom reporting or only generate reports without alerts.
Question 309
A company runs a highly available web application on Amazon EC2 instances behind an Application Load Balancer. The company uses Amazon CloudWatch metrics.
As the traffic to the web application increases, some EC2 instances become overloaded with many outstanding requests. The CloudWatch metrics show that the number of requests processed and the time to receive the responses from some EC2 instances are both higher compared to other EC2 instances. The company does not want new requests to be forwarded to the EC2 instances that are already overloaded.
Which solution will meet these requirements?
A. Use the round robin routing algorithm based on the RequestCountPerTarget and ActiveConnectionCount CloudWatch metrics.
B. Use the least outstanding requests algorithm based on the RequestCountPerTarget and ActiveConnectionCount CloudWatch metrics.
C. Use the round robin routing algorithm based on the RequestCount and TargetResponseTime CloudWatch metrics.
D. Use the least outstanding requests algorithm based on the RequestCount and TargetResponseTime CloudWatch metrics.
Show Answer
Correct Answer: B
Explanation: The requirement is to stop sending new requests to EC2 instances that already have many in-progress (outstanding) requests. Application Load Balancer supports the **least outstanding requests** routing algorithm, which routes traffic to the target with the fewest active requests, naturally avoiding overloaded instances. To identify load at the **per-target** level, metrics such as **RequestCountPerTarget** and **ActiveConnectionCount** are appropriate. Metrics like **RequestCount** are aggregated at the load balancer level and cannot distinguish overloaded individual instances. Therefore, using least outstanding requests with per-target metrics best meets the requirement.
Question 310
A company is running a photo hosting service in the us-east-1 Region. The service enables users across multiple countries to upload and view photos. Some photos are heavily viewed for months, and others are viewed for less than a week. The application allows uploads of up to 20 MB for each photo. The service uses the photo metadata to determine which photos to display to each user.
Which solution provides the appropriate user access MOST cost-effectively?
A. Store the photos in Amazon DynamoDB. Turn on DynamoDB Accelerator (DAX) to cache frequently viewed items.
B. Store the photos in the Amazon S3 Intelligent-Tiering storage class. Store the photo metadata and its S3 location in DynamoD
C. Store the photos in the Amazon S3 Standard storage class. Set up an S3 Lifecycle policy to move photos older than 30 days to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class. Use the object tags to keep track of metadata.
D. Store the photos in the Amazon S3 Glacier storage class. Set up an S3 Lifecycle policy to move photos older than 30 days to the S3 Glacier Deep Archive storage class. Store the photo metadata and its S3 location in Amazon OpenSearch Service.
Show Answer
Correct Answer: B
Explanation: Photos are up to 20 MB and accessed with highly variable and unpredictable patterns: some are viewed heavily for months, others briefly. Amazon S3 Intelligent-Tiering is designed specifically for this use case, automatically moving objects between frequent and infrequent access tiers without performance impact or the need to manage lifecycle rules, making it the most cost-effective option. Storing photo metadata and S3 object locations in DynamoDB allows efficient, scalable queries to decide which photos to display. Other options are either unsuitable for large objects (DynamoDB), require manual lifecycle assumptions (Standard to IA), or are incompatible with frequent access needs (Glacier).
Question 311
A company is designing a web application on AWS. The application will use a VPN connection between the company’s existing data centers and the company's VPCs.
The company uses Amazon Route 53 as its DNS service. The application must use private DNS records to communicate with the on-premises services from a VPC.
Which solution will meet these requirements in the MOST secure manner?
A. Create a Route 53 Resolver outbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC.
B. Create a Route 53 Resolver inbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC.
C. Create a Route 53 private hosted zone. Associate the private hosted zone with the VP
D. Create a Route 53 public hosted zone. Create a record for each service to allow service communication
Show Answer
Correct Answer: A
Explanation: The requirement is for resources in a VPC to resolve private DNS records for on‑premises services over a VPN. This is a hybrid DNS scenario where DNS queries must be forwarded from AWS to on‑premises DNS servers. A Route 53 Resolver outbound endpoint with a resolver rule enables conditional forwarding of DNS queries from the VPC to on‑premises resolvers securely over the VPN. Inbound endpoints are for the opposite direction, private hosted zones only serve DNS hosted in AWS, and public hosted zones are not secure for private service communication.
Question 312
An ecommerce company runs its application on AWS. The application uses an Amazon Aurora PostgreSQL cluster in Multi-AZ mode for the underlying database. During a recent promotional campaign, the application experienced heavy read load and write load. Users experienced timeout issues when they attempted to access the application.
A solutions architect needs to make the application architecture more scalable and highly available.
Which solution will meet these requirements with the LEAST downtime?
A. Create an Amazon EventBridge rule that has the Aurora cluster as a source. Create an AWS Lambda function to log the state change events of the Aurora cluster. Add the Lambda function as a target for the EventBridge rule. Add additional reader nodes to fail over to.
B. Modify the Aurora cluster and activate the zero-downtime restart (ZDR) feature. Use Database Activity Streams on the cluster to track the cluster status.
C. Add additional reader instances to the Aurora cluster. Create an Amazon RDS Proxy target group for the Aurora cluster.
D. Create an Amazon ElastiCache for Redis cache. Replicate data from the Aurora cluster to Redis by using AWS Database Migration Service (AWS DMS) with a write-around approach.
Show Answer
Correct Answer: C
Explanation: The primary issue is scalability under heavy read and write load with minimal downtime. Adding Aurora reader instances scales read capacity immediately without downtime. Using Amazon RDS Proxy improves connection management, reduces connection storms, and increases availability during load spikes and failovers. The other options do not address load scalability (A, B) or introduce unnecessary complexity and latency with data replication and caching that does not directly solve write pressure or minimize downtime (D).
Question 313
A company has an organization in AWS Organizations. The company runs Amazon EC2 instances across four AWS accounts in the root organizational unit (OU). There are three nonproduction accounts and one production account. The company wants to prohibit users from launching EC2 instances of a certain size in the nonproduction accounts. The company has created a service control policy (SCP) to deny access to launch instances that use the prohibited types.
Which solutions to deploy the SCP will meet these requirements? (Choose two.)
A. Attach the SCP to the root OU for the organization.
B. Attach the SCP to the three nonproduction Organizations member accounts.
C. Attach the SCP to the Organizations management account.
D. Create an OU for the production account. Attach the SCP to the OU. Move the production member account into the new OU.
E. Create an OU for the required accounts. Attach the SCP to the OU. Move the nonproduction member accounts into the new OU.
Show Answer
Correct Answer: B, E
Explanation: The requirement is to restrict only the nonproduction accounts, not the production account. SCPs can be attached at the account level or OU level. Attaching the SCP directly to the three nonproduction member accounts (B) limits only those accounts. Alternatively, creating an OU for the nonproduction accounts, attaching the SCP to that OU, and moving the nonproduction accounts into it (E) also limits only those accounts and scales better. Attaching to the root or production OU/account would incorrectly affect the production account.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.