A company has an organization in AWS Organizations. The company runs Amazon EC2 instances across four AWS accounts in the root organizational unit (OU). There are three nonproduction accounts and one production account. The company wants to prohibit users from launching EC2 instances of a certain size in the nonproduction accounts. The company has created a service control policy (SCP) to deny access to launch instances that use the prohibited types.
Which solutions to deploy the SCP will meet these requirements? (Choose two.)
A. Attach the SCP to the root OU for the organization.
B. Attach the SCP to the three nonproduction Organizations member accounts.
C. Attach the SCP to the Organizations management account.
D. Create an OU for the production account. Attach the SCP to the OU. Move the production member account into the new OU.
E. Create an OU for the required accounts. Attach the SCP to the OU. Move the nonproduction member accounts into the new OU.
Show Answer
Correct Answer: B, E
Explanation: Service control policies (SCPs) can be attached to roots, OUs, or individual member accounts. To restrict only the three nonproduction accounts, either attach the SCP directly to those three member accounts (B) or create a dedicated OU for the nonproduction accounts, move those accounts into it, and attach the SCP to that OU (E). Attaching the SCP to the root (A) would also affect the production account. SCPs do not apply to the management account (C), and attaching the SCP to a production OU (D) would restrict the production account instead of the nonproduction accounts.
Question 314
A company wants to use NAT gateways in its AWS environment. The company's Amazon EC2 instances in private subnets must be able to connect to the public internet through the NAT gateways.
Which solution will meet these requirements?
A. Create public NAT gateways in the same private subnets as the EC2 instances.
B. Create private NAT gateways in the same private subnets as the EC2 instances.
C. Create public NAT gateways in public subnets in the same VPCs as the EC2 instances.
D. Create private NAT gateways in public subnets in the same VPCs as the EC2 instances.
Show Answer
Correct Answer: C
Explanation: EC2 instances in private subnets that need outbound internet access should route traffic to a public NAT gateway. A public NAT gateway must be deployed in a public subnet and use an Elastic IP, with the public subnet having a route to an internet gateway. Private NAT gateways are for connectivity to other VPCs or on-premises networks, not direct internet access.
Question 315
A company is using an Application Load Balancer (ALB) to present its application to the internet. The company finds abnormal traffic access patterns across the application. A solutions architect needs to improve visibility into the infrastructure to help the company understand these abnormalities better.
What is the MOST operationally efficient solution that meets these requirements?
A. Create a table in Amazon Athena for AWS CloudTrail logs. Create a query for the relevant information.
B. Enable ALB access logging to Amazon S3. Create a table in Amazon Athena, and query the logs.
C. Enable ALB access logging to Amazon S3. Open each file in a text editor, and search each line for the relevant information.
D. Use Amazon EMR on a dedicated Amazon EC2 instance to directly query the ALB to acquire traffic access log information.
Show Answer
Correct Answer: B
Explanation: Application Load Balancer access logs contain detailed request and traffic information needed to analyze abnormal access patterns. Enabling ALB access logging to Amazon S3 and querying the logs with Amazon Athena provides a scalable, serverless, and operationally efficient solution. CloudTrail records AWS API activity rather than end-user HTTP requests to the ALB. Manually inspecting log files is inefficient, and using EMR is unnecessary overhead for this use case.
Question 316
A company runs a three-tier application in a VPC. The database tier uses an Amazon RDS for MySQL DB instance.
The company plans to migrate the RDS for MySQL DB instance to an Amazon Aurora PostgreSQL DB cluster. The company needs a solution that replicates the data changes that happen during the migration to the new database.
Which combination of steps will meet these requirements? (Choose two.)
A. Use AWS Database Migration Service (AWS DMS) Schema Conversion to transform the database objects.
B. Use AWS Database Migration Service (AWS DMS) Schema Conversion to create an Aurora PostgreSQL read replica on the RDS for MySQL DB instance.
C. Configure an Aurora MySQL read replica for the RDS for MySQL DB instance.
D. Define an AWS Database Migration Service (AWS DMS) task with change data capture (CDC) to migrate the data.
E. Promote the Aurora PostgreSQL read replica to a standalone Aurora PostgreSQL DB cluster when the replica lag is zero.
Show Answer
Correct Answer: A, D
Explanation: Migrating from Amazon RDS for MySQL to Amazon Aurora PostgreSQL requires schema conversion because the database engines differ. AWS DMS Schema Conversion is used to convert the MySQL schema and database objects to PostgreSQL-compatible objects. To keep the target synchronized during migration, create an AWS DMS migration task that uses change data capture (CDC) so ongoing changes on the source database are continuously replicated until cutover. The read replica options apply to Aurora MySQL or are otherwise incorrect for a cross-engine migration to Aurora PostgreSQL.
Question 317
An online video game company must maintain ultra-low latency for its game servers. The game servers run on Amazon EC2 instances. The company needs a solution that can handle millions of UDP internet traffic requests each second.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an Application Load Balancer with the required protocol and ports for the internet traffic. Specify the EC2 instances as the targets.
B. Configure a Gateway Load Balancer for the internet traffic. Specify the EC2 instances as the targets.
C. Configure a Network Load Balancer with the required protocol and ports for the internet traffic. Specify the EC2 instances as the targets.
D. Launch an identical set of game servers on EC2 instances in separate AWS Regions. Route internet traffic to both sets of EC2 instances.
Show Answer
Correct Answer: C
Explanation: A Network Load Balancer operates at Layer 4 and supports TCP and UDP traffic with very high performance and low latency, making it suitable for millions of UDP requests per second. An Application Load Balancer does not support generic UDP traffic, a Gateway Load Balancer is intended for deploying virtual network appliances rather than balancing application traffic, and deploying duplicate servers in multiple Regions does not by itself provide the required load balancing and is not the most cost-effective solution.
Question 318
A company has NFS servers in an on-premises data center that need to periodically back up small amounts of data to Amazon S3.
Which solution meets these requirements and is MOST cost-effective?
A. Set up AWS Glue to copy the data from the on-premises servers to Amazon S3.
B. Set up an AWS DataSync agent on the on-premises servers, and sync the data to Amazon S3.
C. Set up an SFTP sync using AWS Transfer for SFTP to sync data from on premises to Amazon S3.
D. Set up an AWS Direct Connect connection between the on-premises data center and a VPC, and copy the data to Amazon S3.
Show Answer
Correct Answer: B
Explanation: AWS DataSync is purpose-built for transferring data from on-premises NFS (and other storage) to Amazon S3. It uses an on-premises agent, supports scheduled and incremental transfers, and is a managed, cost-effective solution for periodic backups. AWS Glue is an ETL service rather than a file transfer tool, AWS Transfer Family is intended to provide managed SFTP/FTP/FTPS endpoints rather than sync NFS shares, and AWS Direct Connect has significant setup cost that is not justified for small periodic data transfers.
Question 319
A company copies 200 TB of data from a recent ocean survey onto AWS Snowball Edge Storage Optimized devices. The company has a high performance computing (HPC) cluster that is hosted on AWS to look for oil and gas deposits. A solutions architect must provide the cluster with consistent sub-millisecond latency and high-throughput access to the data on the Snowball Edge Storage Optimized devices. The company is sending the devices back to AWS.
Which solution will meet these requirements?
A. Create an Amazon S3 bucket. Import the data into the S3 bucket. Configure an AWS Storage Gateway file gateway to use the S3 bucket. Access the file gateway from the HPC cluster instances.
B. Create an Amazon S3 bucket. Import the data into the S3 bucket. Configure an Amazon FSx for Lustre file system, and integrate it with the S3 bucket. Access the FSx for Lustre file system from the HPC cluster instances.
C. Create an Amazon S3 bucket and an Amazon Elastic File System (Amazon EFS) file system. Import the data into the S3 bucket. Copy the data from the S3 bucket to the EFS file system. Access the EFS file system from the HPC cluster instances.
D. Create an Amazon FSx for Lustre file system. Import the data directly into the FSx for Lustre file system. Access the FSx for Lustre file system from the HPC cluster instances.
Show Answer
Correct Answer: B
Explanation: Snowball Edge Storage Optimized imports data into Amazon S3 when returned to AWS; it does not import directly into Amazon FSx for Lustre. For HPC workloads requiring consistent sub-millisecond latency and high throughput, Amazon FSx for Lustre is the appropriate shared file system and can be linked to an S3 bucket as its data repository. Storage Gateway is not intended for this HPC access pattern, and EFS does not provide the same HPC-optimized performance characteristics.
Question 320
A city has deployed a web application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The application's users have reported sporadic performance, which appears to be related to DDoS attacks originating from random IP addresses. The city needs a solution that requires minimal configuration changes and provides an audit trail for the DDoS sources.
Which solution meets these requirements?
A. Enable an AWS WAF web ACL on the ALB, and configure rules to block traffic from unknown sources.
B. Subscribe to Amazon Inspector. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service.
C. Subscribe to AWS Shield Advanced. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service.
D. Create an Amazon CloudFront distribution for the application, and set the ALB as the origin. Enable an AWS WAF web ACL on the distribution, and configure rules to block traffic from unknown sources
Show Answer
Correct Answer: C
Explanation: AWS Shield Advanced is designed to protect applications from DDoS attacks and includes access to the AWS DDoS Response Team (DRT) for assistance with mitigation. It also provides enhanced DDoS visibility and attack diagnostics, supporting auditing of attack sources. AWS WAF alone is not sufficient for large-scale DDoS protection, Amazon Inspector is unrelated to DDoS mitigation, and adding CloudFront plus WAF introduces additional configuration without addressing the requirement as directly.
Question 321
A gaming company wants to launch a new internet-facing application in multiple AWS Regions. The application will use the TCP and UDP protocols for communication. The company needs to provide high availability and minimum latency for global users.
Which combination of actions should a solutions architect take to meet these requirements? (Choose two.)
A. Create internal Network Load Balancers in front of the application in each Region.
B. Create external Application Load Balancers in front of the application in each Region.
C. Create an AWS Global Accelerator accelerator to route traffic to the load balancers in each Region.
D. Configure Amazon Route 53 to use a geolocation routing policy to distribute the traffic.
E. Configure Amazon CloudFront to handle the traffic and route requests to the application in each Region
Show Answer
Correct Answer: A, C
Explanation: The application requires both TCP and UDP with low latency across multiple AWS Regions. Network Load Balancers support TCP and UDP, whereas Application Load Balancers do not support UDP. AWS Global Accelerator provides two anycast static IPs, routes users to the optimal regional endpoint over the AWS global network, and performs health-based failover for high availability and low latency. CloudFront is for HTTP(S) content, and Route 53 geolocation routing does not optimize for lowest latency or provide the transport acceleration that Global Accelerator does.
Question 322
A company has an application that uses Docker containers in its local data center. The application runs on a container host that stores persistent data in a volume on the host. The container instances use the stored persistent data.
The company wants to move the application to a fully managed service because the company does not want to manage any servers or storage infrastructure.
Which solution will meet these requirements?
A. Use Amazon Elastic Kubernetes Service (Amazon EKS) with self-managed nodes. Create an Amazon Elastic Block Store (Amazon EBS) volume attached to an Amazon EC2 instance. Use the EBS volume as a persistent volume mounted in the containers.
B. Use Amazon Elastic Container Service (Amazon ECS) with an AWS Fargate launch type. Create an Amazon Elastic File System (Amazon EFS) volume. Add the EFS volume as a persistent storage volume mounted in the containers.
C. Use Amazon Elastic Container Service (Amazon ECS) with an AWS Fargate launch type. Create an Amazon S3 bucket. Map the S3 bucket as a persistent storage volume mounted in the containers.
D. Use Amazon Elastic Container Service (Amazon ECS) with an Amazon EC2 launch type. Create an Amazon Elastic File System (Amazon EFS) volume. Add the EFS volume as a persistent storage volume mounted in the containers.
Show Answer
Correct Answer: B
Explanation: AWS Fargate provides a fully managed compute environment for containers, satisfying the requirement to avoid managing servers. Amazon EFS integrates natively with ECS on Fargate and can be mounted into containers to provide shared persistent storage that outlives container instances. EKS with self-managed nodes and ECS with EC2 both require managing EC2 instances. Amazon S3 is object storage and cannot be mounted as a native persistent container volume for ECS/Fargate in the way described.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.