A company is deploying a new application to Amazon Elastic Kubernetes Service (Amazon EKS) with an AWS Fargate cluster. The application needs a storage solution for data persistence. The solution must be highly available and fault tolerant. The solution also must be shared between multiple application containers.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create Amazon Elastic Block Store (Amazon EBS) volumes in the same Availability Zones where EKS worker nodes are placed. Register the volumes in a StorageClass object on an EKS cluster. Use EBS Multi-Attach to share the data between containers.
B. Create an Amazon Elastic File System (Amazon EFS) file system. Register the file system in a StorageClass object on an EKS cluster. Use the same file system for all containers.
C. Create an Amazon Elastic Block Store (Amazon EBS) volume. Register the volume in a StorageClass object on an EKS cluster. Use the same volume for all containers.
D. Create Amazon Elastic File System (Amazon EFS) file systems in the same Availability Zones where EKS worker nodes are placed. Register the file systems in a StorageClass object on an EKS cluster. Create an AWS Lambda function to synchronize the data between file systems.
Show Answer
Correct Answer: B
Explanation: Amazon EFS is the supported shared, highly available, and fault-tolerant persistent storage solution for Amazon EKS on AWS Fargate. EFS can be mounted concurrently by multiple pods/containers and integrates with Kubernetes through the EFS CSI driver and StorageClass. EBS volumes are AZ-scoped block storage, are not appropriate for shared file storage across multiple Fargate pods, and EKS on Fargate does not use worker nodes. Creating multiple EFS file systems with Lambda synchronization adds unnecessary operational overhead.
Question 324
A solutions architect creates a VPC that includes two public subnets and two private subnets. A corporate security mandate requires the solutions architect to launch all Amazon EC2 instances in a private subnet. However, when the solutions architect launches an EC2 instance that runs a web server on ports 80 and 443 in a private subnet, no external internet traffic can connect to the server.
What should the solutions architect do to resolve this issue?
A. Attach the EC2 instance to an Auto Scaling group in a private subnet. Ensure that the DNS record for the website resolves to the Auto Scaling group identifier.
B. Provision an internet-facing Application Load Balancer (ALB) in a public subnet. Add the EC2 instance to the target group that is associated with the ALEnsure that the DNS record for the website resolves to the AL
C. Launch a NAT gateway in a private subnet. Update the route table for the private subnets to add a default route to the NAT gateway. Attach a public Elastic IP address to the NAT gateway.
D. Ensure that the security group that is attached to the EC2 instance allows HTTP traffic on port 80 and HTTPS traffic on port 443. Ensure that the DNS record for the website resolves to the public IP address of the EC2 instance.
Show Answer
Correct Answer: B
Explanation: Instances in private subnets cannot receive direct inbound internet traffic because they do not have a route for internet ingress via an internet gateway. The standard AWS architecture is to place an internet-facing Application Load Balancer in public subnets and register the private EC2 instances as targets. The ALB receives HTTP/HTTPS traffic from the internet and forwards it to the instances in the private subnets. Auto Scaling does not provide internet access, a NAT gateway is for outbound connectivity from private subnets (and is deployed in a public subnet), and private instances should not be addressed via a public IP.
Question 325
A company needs to provide customers with secure access to its data. The company processes customer data and stores the results in an Amazon S3 bucket.
All the data is subject to strong regulations and security requirements. The data must be encrypted at rest. Each customer must be able to access only their data from their AWS account. Company employees must not be able to access the data.
Which solution will meet these requirements?
A. Provision an AWS Certificate Manager (ACM) certificate for each customer. Encrypt the data client-side. In the private certificate policy, deny access to the certificate for all principals except an IAM role that the customer provides.
B. Provision a separate AWS Key Management Service (AWS KMS) key for each customer. Encrypt the data server-side. In the S3 bucket policy, deny decryption of data for all principals except an IAM role that the customer provides.
C. Provision a separate AWS Key Management Service (AWS KMS) key for each customer. Encrypt the data server-side. In each KMS key policy, deny decryption of data for all principals except an IAM role that the customer provides.
D. Provision an AWS Certificate Manager (ACM) certificate for each customer. Encrypt the data client-side. In the public certificate policy, deny access to the certificate for all principals except an IAM role that the customer provides.
Show Answer
Correct Answer: C
Explanation: Use a separate AWS KMS key per customer with S3 server-side encryption (SSE-KMS). KMS key policies are the primary mechanism for controlling who can use a KMS key for decryption. By allowing only the customer-provided IAM role to use that customer's key, only that customer can decrypt their objects, while company employees are denied. ACM certificates are unrelated to encryption at rest, and S3 bucket policies do not control KMS decrypt permissions.
Question 326
A company is building a microservices-based application that will be deployed on Amazon Elastic Kubernetes Service (Amazon EKS). The microservices will interact with each other. The company wants to ensure that the application is observable to identify performance issues in the future.
Which solution will meet these requirements?
A. Configure the application to use Amazon ElastiCache to reduce the number of requests that are sent to the microservices.
B. Configure Amazon CloudWatch Container Insights to collect metrics from the EKS clusters. Configure AWS X-Ray to trace the requests between the microservices.
C. Configure AWS CloudTrail to review the API calls. Build an Amazon QuickSight dashboard to observe the microservice interactions.
D. Use AWS Trusted Advisor to understand the performance of the application.
Show Answer
Correct Answer: B
Explanation: Amazon CloudWatch Container Insights provides observability for Amazon EKS by collecting container, node, and cluster metrics. AWS X-Ray provides distributed tracing across microservices, allowing identification of latency bottlenecks and request flows. ElastiCache improves performance but not observability, CloudTrail is for auditing AWS API calls rather than application tracing, and Trusted Advisor provides best-practice recommendations rather than runtime observability.
Question 327
A company is building a shopping application on AWS. The application offers a catalog that changes once each month and needs to scale with traffic volume. The company wants the lowest possible latency from the application. Data from each user's shopping cart needs to be highly available. User session data must be available even if the user is disconnected and reconnects.
What should a solutions architect do to ensure that the shopping cart data is preserved at all times?
A. Configure an Application Load Balancer to enable the sticky sessions feature (session affinity) for access to the catalog in Amazon Aurora.
B. Configure Amazon ElastiCache for Redis to cache catalog data from Amazon DynamoDB and shopping cart data from the user's session.
C. Configure Amazon OpenSearch Service to cache catalog data from Amazon DynamoDB and shopping cart data from the user's session.
D. Configure an Amazon EC2 instance with Amazon Elastic Block Store (Amazon EBS) storage for the catalog and shopping cart. Configure automated snapshots.
Show Answer
Correct Answer: B
Explanation: Amazon ElastiCache for Redis is the best fit for highly available, low-latency session storage such as shopping cart data. The catalog changes only monthly and can be cached from DynamoDB to minimize latency. Sticky sessions only bind a client to a backend and do not preserve session state across failures or reconnects. OpenSearch is not a session cache, and storing shopping cart data on a single EC2 instance with EBS does not provide the required scalability and high availability.
Question 328
A company has a web application that includes an embedded NoSQL database. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Amazon EC2 Auto Scaling group in a single Availability Zone.
A recent increase in traffic requires the application to be highly available and for the database to be eventually consistent.
Which solution will meet these requirements with the LEAST operational overhead?
A. Replace the ALB with a Network Load Balancer. Maintain the embedded NoSQL database with its replication service on the EC2 instances.
B. Replace the ALB with a Network Load Balancer. Migrate the embedded NoSQL database to Amazon DynamoDB by using AWS Database Migration Service (AWS DMS).
C. Modify the Auto Scaling group to use EC2 instances across three Availability Zones. Maintain the embedded NoSQL database with its replication service on the EC2 instances.
D. Modify the Auto Scaling group to use EC2 instances across three Availability Zones. Migrate the embedded NoSQL database to Amazon DynamoDB by using AWS Database Migration Service (AWS DMS).
Show Answer
Correct Answer: D
Explanation: The application must be highly available and the database should be eventually consistent with the least operational overhead. The application tier achieves high availability by running the Auto Scaling group across three Availability Zones behind the existing ALB. Replacing the ALB with an NLB provides no benefit for a typical web application using HTTP/HTTPS. Migrating the embedded NoSQL database to Amazon DynamoDB offloads replication, scaling, and multi-AZ availability to a fully managed service that natively provides eventual consistency options, minimizing operational effort compared to managing database replication on EC2 instances.
Question 329
A company is deploying an application in three AWS Regions using an Application Load Balancer. Amazon Route 53 will be used to distribute traffic between these Regions.
Which Route 53 configuration should a solutions architect use to provide the MOST high-performing experience?
A. Create an A record with a latency policy.
B. Create an A record with a geolocation policy.
C. Create a CNAME record with a failover policy.
D. Create a CNAME record with a geoproximity policy.
Show Answer
Correct Answer: A
Explanation: Latency-based routing directs users to the AWS Region that provides the lowest network latency, which is the Route 53 policy designed to maximize application performance across multiple Regions. For Application Load Balancers, Route 53 commonly uses Alias A records that target the ALB DNS name, so an A record is the appropriate choice. Geolocation and geoproximity route based on user location rather than measured latency, and failover is intended for disaster recovery rather than performance.
Question 330
A solutions architect is designing a shared storage solution for a web application that is deployed across multiple Availability Zones. The web application runs on Amazon EC2 instances that are in an Auto Scaling group. The company plans to make frequent changes to the content. The solution must have strong consistency in returning the new content as soon as the changes occur.
Which solutions meet these requirements? (Choose two.)
A. Use AWS Storage Gateway Volume Gateway Internet Small Computer Systems Interface (iSCSI) block storage that is mounted to the individual EC2 instances.
B. Create an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system on the individual EC2 instances.
C. Create a shared Amazon Elastic Block Store (Amazon EBS) volume. Mount the EBS volume on the individual EC2 instances.
D. Use AWS DataSync to perform continuous synchronization of data between EC2 hosts in the Auto Scaling group.
E. Create an Amazon S3 bucket to store the web content. Set the metadata for the Cache-Control header to no-cache. Use Amazon CloudFront to deliver the content.
Show Answer
Correct Answer: B, E
Explanation: Amazon EFS provides a shared, multi-AZ file system that can be mounted concurrently by all EC2 instances in the Auto Scaling group and offers strong read-after-write consistency, making updated content immediately visible. Amazon S3 also provides strong read-after-write consistency for PUT/DELETE operations, and using CloudFront with Cache-Control: no-cache ensures edge locations revalidate content so users receive updated objects promptly. Storage Gateway Volume Gateway is intended for hybrid environments, EBS volumes cannot be shared across multiple AZs, and DataSync is for data transfer/synchronization rather than real-time shared storage.
Question 331
A company regularly uploads GB-sized files to Amazon S3. After the company uploads the files, the company uses a fleet of Amazon EC2 Spot Instances to transcode the file format. The company needs to scale throughput when the company uploads data from the on-premises data center to Amazon S3 and when the company downloads data from Amazon S3 to the EC2 instances.
Which solutions will meet these requirements? (Choose two.)
A. Use the S3 bucket access point instead of accessing the S3 bucket directly.
B. Upload the files into multiple S3 buckets.
C. Use S3 multipart uploads.
D. Fetch multiple byte-ranges of an object in parallel.
E. Add a random prefix to each object when uploading the files.
Show Answer
Correct Answer: C, D
Explanation: For large (GB-sized) object uploads, S3 multipart upload allows parts to be uploaded in parallel, improving throughput and resiliency. For downloading large objects, retrieving multiple byte ranges in parallel increases aggregate download throughput to EC2 instances. Access Points simplify access management rather than increasing transfer throughput, multiple buckets are unnecessary, and random prefixes were historically used for request distribution but are no longer needed for S3 performance scaling.
Question 332
A company wants to standardize its Amazon Elastic Block Store (Amazon EBS) volume encryption strategy. The company also wants to minimize the cost and configuration effort required to operate the volume encryption check.
Which solution will meet these requirements?
A. Write API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Use Amazon EventBridge to schedule an AWS Lambda function to run the API calls.
B. Write API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Run the API calls on an AWS Fargate task.
C. Create an AWS Identity and Access Management (IAM) policy that requires the use of tags on EBS volumes. Use AWS Cost Explorer to display resources that are not properly tagged. Encrypt the untagged resources manually.
D. Create an AWS Config rule for Amazon EBS to evaluate if a volume is encrypted and to flag the volume if it is not encrypted.
Show Answer
Correct Answer: D
Explanation: AWS Config provides managed rules to continuously evaluate whether Amazon EBS volumes are encrypted and marks noncompliant resources. This is the lowest operational effort and avoids building and maintaining custom Lambda or Fargate-based checks. It is designed for configuration compliance monitoring.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.