A company wants to use NAT gateways in its AWS environment. The company's Amazon EC2 instances in private subnets must be able to connect to the public internet through the NAT gateways.
Which solution will meet these requirements?
A. Create public NAT gateways in the same private subnets as the EC2 instances.
B. Create private NAT gateways in the same private subnets as the EC2 instances.
C. Create public NAT gateways in public subnets in the same VPCs as the EC2 instances.
D. Create private NAT gateways in public subnets in the same VPCs as the EC2 instances.
Show Answer
Correct Answer: C
Explanation: For EC2 instances in private subnets to access the public internet, a NAT gateway must have a route to an Internet Gateway. Only a **public NAT gateway**, placed in a **public subnet** with an attached Internet Gateway and an Elastic IP, can provide outbound internet access. Private NAT gateways do not support internet access, and NAT gateways cannot function if placed in private subnets.
Question 315
A company is using an Application Load Balancer (ALB) to present its application to the internet. The company finds abnormal traffic access patterns across the application. A solutions architect needs to improve visibility into the infrastructure to help the company understand these abnormalities better.
What is the MOST operationally efficient solution that meets these requirements?
A. Create a table in Amazon Athena for AWS CloudTrail logs. Create a query for the relevant information.
B. Enable ALB access logging to Amazon S3. Create a table in Amazon Athena, and query the logs.
C. Enable ALB access logging to Amazon S3. Open each file in a text editor, and search each line for the relevant information.
D. Use Amazon EMR on a dedicated Amazon EC2 instance to directly query the ALB to acquire traffic access log information.
Show Answer
Correct Answer: B
Explanation: To analyze abnormal traffic patterns on an Application Load Balancer with minimal operational overhead, the ALB’s own access logs provide the most relevant data (client IPs, request paths, response codes, latencies). Enabling ALB access logging to Amazon S3 and querying those logs with Amazon Athena allows scalable, serverless, SQL-based analysis without managing infrastructure. CloudTrail logs API calls, not request traffic (A). Manually opening log files is inefficient (C). Using EMR and EC2 adds unnecessary operational complexity (D).
Question 316
A company runs a three-tier application in a VPC. The database tier uses an Amazon RDS for MySQL DB instance.
The company plans to migrate the RDS for MySQL DB instance to an Amazon Aurora PostgreSQL DB cluster. The company needs a solution that replicates the data changes that happen during the migration to the new database.
Which combination of steps will meet these requirements? (Choose two.)
A. Use AWS Database Migration Service (AWS DMS) Schema Conversion to transform the database objects.
B. Use AWS Database Migration Service (AWS DMS) Schema Conversion to create an Aurora PostgreSQL read replica on the RDS for MySQL DB instance.
C. Configure an Aurora MySQL read replica for the RDS for MySQL DB instance.
D. Define an AWS Database Migration Service (AWS DMS) task with change data capture (CDC) to migrate the data.
E. Promote the Aurora PostgreSQL read replica to a standalone Aurora PostgreSQL DB cluster when the replica lag is zero.
Show Answer
Correct Answer: A, D
Explanation: Migrating from MySQL to Aurora PostgreSQL requires schema and object conversion because the engines differ; AWS DMS Schema Conversion handles this transformation. To keep the target database in sync during migration, an AWS DMS task with change data capture (CDC) is required to replicate ongoing data changes from the source to the target.
Question 317
An online video game company must maintain ultra-low latency for its game servers. The game servers run on Amazon EC2 instances. The company needs a solution that can handle millions of UDP internet traffic requests each second.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an Application Load Balancer with the required protocol and ports for the internet traffic. Specify the EC2 instances as the targets.
B. Configure a Gateway Load Balancer for the internet traffic. Specify the EC2 instances as the targets.
C. Configure a Network Load Balancer with the required protocol and ports for the internet traffic. Specify the EC2 instances as the targets.
D. Launch an identical set of game servers on EC2 instances in separate AWS Regions. Route internet traffic to both sets of EC2 instances.
Show Answer
Correct Answer: C
Explanation: Ultra-low latency and millions of UDP requests per second require a Layer 4 load balancer. A Network Load Balancer supports UDP, offers very high throughput and low latency, and is more cost-effective for this use case. Application Load Balancers do not support UDP, Gateway Load Balancers are intended for virtual appliances, and multi-Region deployment is unnecessary and more expensive.
Question 318
A company has NFS servers in an on-premises data center that need to periodically back up small amounts of data to Amazon S3.
Which solution meets these requirements and is MOST cost-effective?
A. Set up AWS Glue to copy the data from the on-premises servers to Amazon S3.
B. Set up an AWS DataSync agent on the on-premises servers, and sync the data to Amazon S3.
C. Set up an SFTP sync using AWS Transfer for SFTP to sync data from on premises to Amazon S3.
D. Set up an AWS Direct Connect connection between the on-premises data center and a VPC, and copy the data to Amazon S3.
Show Answer
Correct Answer: B
Explanation: AWS DataSync is designed for efficiently and securely transferring NFS data from on-premises environments to Amazon S3. It requires minimal setup, supports periodic syncs, and is cost-effective for small, incremental backups. AWS Glue is for ETL workloads, AWS Transfer for SFTP is unnecessary and more expensive for NFS backups, and Direct Connect has high setup and ongoing costs that are unjustified for small, periodic data transfers.
Question 319
A company copies 200 TB of data from a recent ocean survey onto AWS Snowball Edge Storage Optimized devices. The company has a high performance computing (HPC) cluster that is hosted on AWS to look for oil and gas deposits. A solutions architect must provide the cluster with consistent sub-millisecond latency and high-throughput access to the data on the Snowball Edge Storage Optimized devices. The company is sending the devices back to AWS.
Which solution will meet these requirements?
A. Create an Amazon S3 bucket. Import the data into the S3 bucket. Configure an AWS Storage Gateway file gateway to use the S3 bucket. Access the file gateway from the HPC cluster instances.
B. Create an Amazon S3 bucket. Import the data into the S3 bucket. Configure an Amazon FSx for Lustre file system, and integrate it with the S3 bucket. Access the FSx for Lustre file system from the HPC cluster instances.
C. Create an Amazon S3 bucket and an Amazon Elastic File System (Amazon EFS) file system. Import the data into the S3 bucket. Copy the data from the S3 bucket to the EFS file system. Access the EFS file system from the HPC cluster instances.
D. Create an Amazon FSx for Lustre file system. Import the data directly into the FSx for Lustre file system. Access the FSx for Lustre file system from the HPC cluster instances.
Show Answer
Correct Answer: B
Explanation: Snowball Edge Storage Optimized devices can import data only into Amazon S3 when returned to AWS. HPC workloads that require consistent sub-millisecond latency and very high throughput are best served by Amazon FSx for Lustre, which is purpose-built for HPC. FSx for Lustre integrates directly with S3, allowing the file system to lazily load or prefetch large datasets from S3 and provide POSIX access with sub-millisecond latency to the HPC cluster. There is no direct Snowball-to-FSx for Lustre import path, making the S3 + FSx for Lustre integration the correct and supported solution.
Question 320
A city has deployed a web application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The application's users have reported sporadic performance, which appears to be related to DDoS attacks originating from random IP addresses. The city needs a solution that requires minimal configuration changes and provides an audit trail for the DDoS sources.
Which solution meets these requirements?
A. Enable an AWS WAF web ACL on the ALB, and configure rules to block traffic from unknown sources.
B. Subscribe to Amazon Inspector. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service.
C. Subscribe to AWS Shield Advanced. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service.
D. Create an Amazon CloudFront distribution for the application, and set the ALB as the origin. Enable an AWS WAF web ACL on the distribution, and configure rules to block traffic from unknown sources
Show Answer
Correct Answer: C
Explanation: AWS Shield Advanced provides managed DDoS protection with minimal configuration changes for ALB-backed applications. It includes access to the AWS DDoS Response Team (DRT) for active mitigation and generates detailed logs and metrics that provide an audit trail of attack sources and events. Other options either require significant configuration (CloudFront/WAF), rely on manual rule creation without clear criteria (WAF alone), or are unrelated to DDoS protection (Amazon Inspector).
Question 321
A gaming company wants to launch a new internet-facing application in multiple AWS Regions. The application will use the TCP and UDP protocols for communication. The company needs to provide high availability and minimum latency for global users.
Which combination of actions should a solutions architect take to meet these requirements? (Choose two.)
A. Create internal Network Load Balancers in front of the application in each Region.
B. Create external Application Load Balancers in front of the application in each Region.
C. Create an AWS Global Accelerator accelerator to route traffic to the load balancers in each Region.
D. Configure Amazon Route 53 to use a geolocation routing policy to distribute the traffic.
E. Configure Amazon CloudFront to handle the traffic and route requests to the application in each Region
Show Answer
Correct Answer: A, C
Explanation: The application uses TCP and UDP and must be internet-facing with low latency and high availability across multiple Regions. Network Load Balancers are required because they support both TCP and UDP and provide high performance at scale. Using AWS Global Accelerator in front of the regional load balancers provides a single set of anycast IP addresses, routes users to the closest healthy Region, and minimizes latency for global users. Application Load Balancers and CloudFront do not support UDP, and Route 53 geolocation routing alone does not provide the same latency optimization and fast failover as Global Accelerator.
Question 322
A company has an application that uses Docker containers in its local data center. The application runs on a container host that stores persistent data in a volume on the host. The container instances use the stored persistent data.
The company wants to move the application to a fully managed service because the company does not want to manage any servers or storage infrastructure.
Which solution will meet these requirements?
A. Use Amazon Elastic Kubernetes Service (Amazon EKS) with self-managed nodes. Create an Amazon Elastic Block Store (Amazon EBS) volume attached to an Amazon EC2 instance. Use the EBS volume as a persistent volume mounted in the containers.
B. Use Amazon Elastic Container Service (Amazon ECS) with an AWS Fargate launch type. Create an Amazon Elastic File System (Amazon EFS) volume. Add the EFS volume as a persistent storage volume mounted in the containers.
C. Use Amazon Elastic Container Service (Amazon ECS) with an AWS Fargate launch type. Create an Amazon S3 bucket. Map the S3 bucket as a persistent storage volume mounted in the containers.
D. Use Amazon Elastic Container Service (Amazon ECS) with an Amazon EC2 launch type. Create an Amazon Elastic File System (Amazon EFS) volume. Add the EFS volume as a persistent storage volume mounted in the containers.
Show Answer
Correct Answer: B
Explanation: The requirement is a fully managed service with no server or storage infrastructure to manage, while still supporting persistent data for containers. Amazon ECS with the AWS Fargate launch type is fully managed because AWS manages the underlying servers. Amazon EFS is natively supported with Fargate and provides shared, persistent file storage that can be mounted into containers.
Option A uses self-managed nodes and EBS, which requires managing EC2 instances. Option C is incorrect because Amazon S3 cannot be mounted as a filesystem volume in ECS/Fargate in a supported, native way. Option D uses the EC2 launch type, which still requires server management. Therefore, option B best meets all requirements.
Question 323
A company is deploying a new application to Amazon Elastic Kubernetes Service (Amazon EKS) with an AWS Fargate cluster. The application needs a storage solution for data persistence. The solution must be highly available and fault tolerant. The solution also must be shared between multiple application containers.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create Amazon Elastic Block Store (Amazon EBS) volumes in the same Availability Zones where EKS worker nodes are placed. Register the volumes in a StorageClass object on an EKS cluster. Use EBS Multi-Attach to share the data between containers.
B. Create an Amazon Elastic File System (Amazon EFS) file system. Register the file system in a StorageClass object on an EKS cluster. Use the same file system for all containers.
C. Create an Amazon Elastic Block Store (Amazon EBS) volume. Register the volume in a StorageClass object on an EKS cluster. Use the same volume for all containers.
D. Create Amazon Elastic File System (Amazon EFS) file systems in the same Availability Zones where EKS worker nodes are placed. Register the file systems in a StorageClass object on an EKS cluster. Create an AWS Lambda function to synchronize the data between file systems.
Show Answer
Correct Answer: B
Explanation: Amazon EKS on AWS Fargate does not support Amazon EBS volumes, and even with EC2-based nodes EBS is single-AZ and not suitable for shared, highly available access by multiple pods. Amazon EFS is a managed, regional, highly available and fault-tolerant file system that supports concurrent read/write access from multiple containers and integrates natively with EKS via a StorageClass, providing the required persistence with the least operational overhead.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.