A solutions architect creates a VPC that includes two public subnets and two private subnets. A corporate security mandate requires the solutions architect to launch all Amazon EC2 instances in a private subnet. However, when the solutions architect launches an EC2 instance that runs a web server on ports 80 and 443 in a private subnet, no external internet traffic can connect to the server.
What should the solutions architect do to resolve this issue?
A. Attach the EC2 instance to an Auto Scaling group in a private subnet. Ensure that the DNS record for the website resolves to the Auto Scaling group identifier.
B. Provision an internet-facing Application Load Balancer (ALB) in a public subnet. Add the EC2 instance to the target group that is associated with the ALEnsure that the DNS record for the website resolves to the AL
C. Launch a NAT gateway in a private subnet. Update the route table for the private subnets to add a default route to the NAT gateway. Attach a public Elastic IP address to the NAT gateway.
D. Ensure that the security group that is attached to the EC2 instance allows HTTP traffic on port 80 and HTTPS traffic on port 443. Ensure that the DNS record for the website resolves to the public IP address of the EC2 instance.
Show Answer
Correct Answer: B
Explanation: EC2 instances in private subnets do not have direct internet access and cannot receive inbound traffic from the internet. To expose a web application while keeping instances private, an internet-facing Application Load Balancer must be placed in public subnets. The ALB receives HTTP/HTTPS traffic from the internet and forwards it to targets (EC2 instances) in private subnets. NAT gateways are only for outbound traffic, security groups alone cannot make private instances publicly reachable, and Auto Scaling does not address inbound connectivity.
Question 325
A company needs to provide customers with secure access to its data. The company processes customer data and stores the results in an Amazon S3 bucket.
All the data is subject to strong regulations and security requirements. The data must be encrypted at rest. Each customer must be able to access only their data from their AWS account. Company employees must not be able to access the data.
Which solution will meet these requirements?
A. Provision an AWS Certificate Manager (ACM) certificate for each customer. Encrypt the data client-side. In the private certificate policy, deny access to the certificate for all principals except an IAM role that the customer provides.
B. Provision a separate AWS Key Management Service (AWS KMS) key for each customer. Encrypt the data server-side. In the S3 bucket policy, deny decryption of data for all principals except an IAM role that the customer provides.
C. Provision a separate AWS Key Management Service (AWS KMS) key for each customer. Encrypt the data server-side. In each KMS key policy, deny decryption of data for all principals except an IAM role that the customer provides.
D. Provision an AWS Certificate Manager (ACM) certificate for each customer. Encrypt the data client-side. In the public certificate policy, deny access to the certificate for all principals except an IAM role that the customer provides.
Show Answer
Correct Answer: C
Explanation: The data must be encrypted at rest, customers must access only their own data from their own AWS accounts, and company employees must not have access. AWS KMS is the correct service for encryption at rest in S3; ACM certificates are for TLS, not data-at-rest encryption, so A and D are incorrect. Between B and C, access to encrypted S3 objects is ultimately controlled by permission to use the KMS key for decryption. KMS key policies are the primary and authoritative mechanism for controlling who can decrypt data with a customer-specific key. By creating a separate KMS key per customer and allowing only the customer-provided IAM role in the key policy, decryption is cryptographically enforced regardless of S3 permissions, preventing company employee access. Therefore, C best meets the security and regulatory requirements.
Question 326
A company is building a microservices-based application that will be deployed on Amazon Elastic Kubernetes Service (Amazon EKS). The microservices will interact with each other. The company wants to ensure that the application is observable to identify performance issues in the future.
Which solution will meet these requirements?
A. Configure the application to use Amazon ElastiCache to reduce the number of requests that are sent to the microservices.
B. Configure Amazon CloudWatch Container Insights to collect metrics from the EKS clusters. Configure AWS X-Ray to trace the requests between the microservices.
C. Configure AWS CloudTrail to review the API calls. Build an Amazon QuickSight dashboard to observe the microservice interactions.
D. Use AWS Trusted Advisor to understand the performance of the application.
Show Answer
Correct Answer: B
Explanation: Amazon CloudWatch Container Insights provides metrics and logs for Amazon EKS clusters and containers, enabling visibility into microservice performance and resource usage. AWS X-Ray provides distributed tracing to follow requests across microservices, which is essential for identifying latency and performance bottlenecks. Together, they deliver the required observability.
Question 327
A company is building a shopping application on AWS. The application offers a catalog that changes once each month and needs to scale with traffic volume. The company wants the lowest possible latency from the application. Data from each user's shopping cart needs to be highly available. User session data must be available even if the user is disconnected and reconnects.
What should a solutions architect do to ensure that the shopping cart data is preserved at all times?
A. Configure an Application Load Balancer to enable the sticky sessions feature (session affinity) for access to the catalog in Amazon Aurora.
B. Configure Amazon ElastiCache for Redis to cache catalog data from Amazon DynamoDB and shopping cart data from the user's session.
C. Configure Amazon OpenSearch Service to cache catalog data from Amazon DynamoDB and shopping cart data from the user's session.
D. Configure an Amazon EC2 instance with Amazon Elastic Block Store (Amazon EBS) storage for the catalog and shopping cart. Configure automated snapshots.
Show Answer
Correct Answer: B
Explanation: Shopping cart and session data must be highly available, low-latency, and persist across user disconnects in a scalable architecture. Amazon ElastiCache for Redis is designed for distributed session management and shopping cart use cases, offering sub-millisecond latency, replication, and high availability. Caching the mostly static monthly catalog data reduces load and latency, while Redis reliably stores per-user session and cart data independently of application instances. Sticky sessions (A) do not preserve data across disconnects or failures, OpenSearch (C) is for search/analytics, and EC2 with EBS snapshots (D) does not provide the required scalability or low latency.
Question 328
A company has a web application that includes an embedded NoSQL database. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Amazon EC2 Auto Scaling group in a single Availability Zone.
A recent increase in traffic requires the application to be highly available and for the database to be eventually consistent.
Which solution will meet these requirements with the LEAST operational overhead?
A. Replace the ALB with a Network Load Balancer. Maintain the embedded NoSQL database with its replication service on the EC2 instances.
B. Replace the ALB with a Network Load Balancer. Migrate the embedded NoSQL database to Amazon DynamoDB by using AWS Database Migration Service (AWS DMS).
C. Modify the Auto Scaling group to use EC2 instances across three Availability Zones. Maintain the embedded NoSQL database with its replication service on the EC2 instances.
D. Modify the Auto Scaling group to use EC2 instances across three Availability Zones. Migrate the embedded NoSQL database to Amazon DynamoDB by using AWS Database Migration Service (AWS DMS).
Show Answer
Correct Answer: D
Explanation: High availability requires distributing the application across multiple Availability Zones, which is achieved by modifying the Auto Scaling group. Maintaining an embedded NoSQL database with replication across instances and AZs would add significant operational complexity. Migrating to Amazon DynamoDB provides built-in multi-AZ high availability and eventual consistency with minimal ongoing operational overhead. ALB remains appropriate for web traffic, so the optimal low-overhead solution is to use multi-AZ ASG with DynamoDB.
Question 329
A company is deploying an application in three AWS Regions using an Application Load Balancer. Amazon Route 53 will be used to distribute traffic between these Regions.
Which Route 53 configuration should a solutions architect use to provide the MOST high-performing experience?
A. Create an A record with a latency policy.
B. Create an A record with a geolocation policy.
C. Create a CNAME record with a failover policy.
D. Create a CNAME record with a geoproximity policy.
Show Answer
Correct Answer: A
Explanation: To provide the MOST high-performing experience, Route 53 should route users to the AWS Region with the lowest network latency from their location. Latency-based routing is specifically designed for this purpose and is commonly used with multi-Region Application Load Balancers. An A record (implemented as an Alias record in Route 53) can directly point to ALBs and supports latency-based routing. Geolocation and geoproximity focus on location rules rather than performance, and failover is for disaster recovery rather than optimal performance.
Question 330
A solutions architect is designing a shared storage solution for a web application that is deployed across multiple Availability Zones. The web application runs on Amazon EC2 instances that are in an Auto Scaling group. The company plans to make frequent changes to the content. The solution must have strong consistency in returning the new content as soon as the changes occur.
Which solutions meet these requirements? (Choose two.)
A. Use AWS Storage Gateway Volume Gateway Internet Small Computer Systems Interface (iSCSI) block storage that is mounted to the individual EC2 instances.
B. Create an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system on the individual EC2 instances.
C. Create a shared Amazon Elastic Block Store (Amazon EBS) volume. Mount the EBS volume on the individual EC2 instances.
D. Use AWS DataSync to perform continuous synchronization of data between EC2 hosts in the Auto Scaling group.
E. Create an Amazon S3 bucket to store the web content. Set the metadata for the Cache-Control header to no-cache. Use Amazon CloudFront to deliver the content.
Show Answer
Correct Answer: B, E
Explanation: The application runs across multiple Availability Zones and requires shared storage with strong consistency so that updates are visible immediately.
Amazon EFS is a managed, shared file system that can be mounted concurrently by multiple EC2 instances across AZs and provides strong read-after-write consistency, making it ideal for frequently changing web content.
Amazon S3 provides strong read-after-write consistency for new and updated objects. Using CloudFront with Cache-Control set to no-cache ensures that end users receive the latest content immediately after changes.
The other options do not meet the requirements: Storage Gateway is for hybrid/on-premises use cases, EBS volumes cannot be shared across multiple AZs, and DataSync is not designed for real-time continuous synchronization between EC2 instances.
Question 331
A company regularly uploads GB-sized files to Amazon S3. After the company uploads the files, the company uses a fleet of Amazon EC2 Spot Instances to transcode the file format. The company needs to scale throughput when the company uploads data from the on-premises data center to Amazon S3 and when the company downloads data from Amazon S3 to the EC2 instances.
Which solutions will meet these requirements? (Choose two.)
A. Use the S3 bucket access point instead of accessing the S3 bucket directly.
B. Upload the files into multiple S3 buckets.
C. Use S3 multipart uploads.
D. Fetch multiple byte-ranges of an object in parallel.
E. Add a random prefix to each object when uploading the files.
Show Answer
Correct Answer: C, D
Explanation: To scale throughput for large file transfers, Amazon S3 supports parallelism. Multipart uploads split large objects into parts that can be uploaded concurrently, significantly increasing upload throughput from on‑premises to S3. For downloads, EC2 instances can request multiple byte ranges of the same object in parallel, allowing higher aggregate download throughput compared to a single sequential download. The other options do not directly improve transfer throughput in this scenario.
Question 332
A company wants to standardize its Amazon Elastic Block Store (Amazon EBS) volume encryption strategy. The company also wants to minimize the cost and configuration effort required to operate the volume encryption check.
Which solution will meet these requirements?
A. Write API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Use Amazon EventBridge to schedule an AWS Lambda function to run the API calls.
B. Write API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Run the API calls on an AWS Fargate task.
C. Create an AWS Identity and Access Management (IAM) policy that requires the use of tags on EBS volumes. Use AWS Cost Explorer to display resources that are not properly tagged. Encrypt the untagged resources manually.
D. Create an AWS Config rule for Amazon EBS to evaluate if a volume is encrypted and to flag the volume if it is not encrypted.
Show Answer
Correct Answer: D
Explanation: AWS Config provides a managed rule that continuously evaluates whether Amazon EBS volumes are encrypted. This meets the requirement to standardize encryption checks while minimizing operational cost and configuration effort, since it avoids custom code, scheduled tasks, or manual reviews.
Question 333
A company manages AWS accounts in AWS Organizations. AWS IAM Identity Center (AWS Single Sign-On) and AWS Control Tower are configured for the accounts. The company wants to manage multiple user permissions across all the accounts.
The permissions will be used by multiple IAM users and must be split between the developer and administrator teams. Each team requires different permissions. The company wants a solution that includes new users that are hired on both teams.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create individual users in IAM Identity Center for each account. Create separate developer and administrator groups in IAM Identity Center. Assign the users to the appropriate groups. Create a custom IAM policy for each group to set fine-grained permissions.
B. Create individual users in IAM Identity Center for each account. Create separate developer and administrator groups in IAM Identity Center. Assign the users to the appropriate groups. Attach AWS managed IAM policies to each user as needed for fine-grained permissions.
C. Create individual users in IAM Identity Center. Create new developer and administrator groups in IAM Identity Center. Create new permission sets that include the appropriate IAM policies for each group. Assign the new groups to the appropriate accounts. Assign the new permission sets to the new groups. When new users are hired, add them to the appropriate group.
D. Create individual users in IAM Identity Center. Create new permission sets that include the appropriate IAM policies for each user. Assign the users to the appropriate accounts. Grant additional IAM permissions to the users from within specific accounts. When new users are hired, add them to IAM Identity Center and assign them to the accounts.
Show Answer
Correct Answer: C
Explanation: Using AWS IAM Identity Center permission sets assigned to groups provides centralized, scalable access management across all AWS accounts. Creating developer and administrator groups with corresponding permission sets allows permissions to be reused across accounts and automatically applied to new users by group membership. This aligns with AWS Control Tower best practices and minimizes ongoing operational overhead compared to managing per-user or per-account policies.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.