A company is creating an application. The company stores data from tests of the application in multiple on-premises locations.
The company needs to connect the on-premises locations to VPCs in an AWS Region in the AWS Cloud. The number of accounts and VPCs will increase during the next year. The network architecture must simplify the administration of new connections and must provide the ability to scale.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Create a peering connection between the VPCs. Create a VPN connection between the VPCs and the on-premises locations.
B. Launch an Amazon EC2 instance. On the instance, include VPN software that uses a VPN connection to connect all VPCs and on-premises locations.
C. Create a transit gateway. Create VPC attachments for the VPC connections. Create VPN attachments for the on-premises connections.
D. Create an AWS Direct Connect connection between the on-premises locations and a central VPC. Connect the central VPC to other VPCs by using peering connections.
Show Answer
Correct Answer: C
Explanation: AWS Transit Gateway is specifically designed to connect multiple VPCs and on-premises networks in a scalable, hub-and-spoke architecture. As the number of accounts and VPCs grows, new connections can be added by creating additional attachments rather than managing many individual peering or VPN connections. Transit Gateway is fully managed, highly available, and supports both VPN and Direct Connect attachments, resulting in the least administrative overhead compared to managing VPC peering, EC2-based VPN appliances, or complex Direct Connect plus peering designs.
Question 336
A company is developing an application that will run on a production Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster has managed node groups that are provisioned with On-Demand Instances.
The company needs a dedicated EKS cluster for development work. The company will use the development cluster infrequently to test the resiliency of the application. The EKS cluster must manage all the nodes.
Which solution will meet these requirements MOST cost-effectively?
A. Create a managed node group that contains only Spot Instances.
B. Create two managed node groups. Provision one node group with On-Demand Instances. Provision the second node group with Spot Instances.
C. Create an Auto Scaling group that has a launch configuration that uses Spot Instances. Configure the user data to add the nodes to the EKS cluster.
D. Create a managed node group that contains only On-Demand Instances.
Show Answer
Correct Answer: A
Explanation: The requirement is for a separate, dedicated development EKS cluster that is used infrequently and must be as cost‑effective as possible, while still using EKS‑managed nodes. Using a single managed node group with only Spot Instances minimizes compute cost and still satisfies the requirement that EKS manage all nodes. Adding On‑Demand Instances (option B) increases cost without a stated requirement for baseline availability in the development cluster.
Question 337
A company wants to migrate its web applications from on premises to AWS. The company is located close to the eu-central-1 Region. Because of regulations, the company cannot launch some of its applications in eu-central-1. The company wants to achieve single-digit millisecond latency.
Which solution will meet these requirements?
A. Deploy the applications in eu-central-1. Extend the company’s VPC from eu-central-1 to an edge location in Amazon CloudFront.
B. Deploy the applications in AWS Local Zones by extending the company's VPC from eu-central-1 to the chosen Local Zone.
C. Deploy the applications in eu-central-1. Extend the company’s VPC from eu-central-1 to the regional edge caches in Amazon CloudFront.
D. Deploy the applications in AWS Wavelength Zones by extending the company’s VPC from eu-central-1 to the chosen Wavelength Zone.
Show Answer
Correct Answer: B
Explanation: The company needs to avoid deploying in the eu-central-1 Region due to regulations while still achieving single-digit millisecond latency. AWS Local Zones are extensions of a parent Region that place compute and other services closer to end users and are specifically designed to deliver single-digit millisecond latency without running workloads directly in the parent Region. CloudFront edge locations and regional edge caches do not host full web applications, and AWS Wavelength Zones are intended for ultra-low-latency mobile/5G use cases, not general web application hosting. Therefore, deploying in AWS Local Zones best meets both regulatory and latency requirements.
Question 338
A company is migrating its multi-tier on-premises application to AWS. The application consists of a single-node MySQL database and a multi-node web tier. The company must minimize changes to the application during the migration. The company wants to improve application resiliency after the migration.
Which combination of steps will meet these requirements? (Choose two.)
A. Migrate the web tier to Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer.
B. Migrate the database to Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer.
C. Migrate the database to an Amazon RDS Multi-AZ deployment.
D. Migrate the web tier to an AWS Lambda function.
E. Migrate the database to an Amazon DynamoDB table.
Show Answer
Correct Answer: A, C
Explanation: To minimize application changes, the migration should preserve the existing architecture while improving resiliency. Moving the web tier to EC2 instances in an Auto Scaling group behind an Application Load Balancer provides high availability and fault tolerance with minimal code changes. Migrating the single-node MySQL database to Amazon RDS in a Multi-AZ deployment improves database resiliency through managed replication and automatic failover, without requiring application redesign. Other options would require significant architectural or code changes.
Question 339
A company needs a solution to enforce data encryption at rest on Amazon EC2 instances. The solution must automatically identify noncompliant resources and enforce compliance policies on findings.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Use an IAM policy that allows users to create only encrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Config and AWS Systems Manager to automate the detection and remediation of unencrypted EBS volumes.
B. Use AWS Key Management Service (AWS KMS) to manage access to encrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Lambda and Amazon EventBridge to automate the detection and remediation of unencrypted EBS volumes.
C. Use Amazon Macie to detect unencrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Systems Manager Automation rules to automatically encrypt existing and new EBS volumes.
D. Use Amazon inspector to detect unencrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Systems Manager Automation rules to automatically encrypt existing and new EBS volumes.
Show Answer
Correct Answer: A
Explanation: The requirement is to enforce encryption at rest on EC2 EBS volumes, automatically identify noncompliant resources, and enforce compliance with the least administrative overhead. AWS Config provides managed rules to continuously evaluate EBS encryption compliance, and AWS Systems Manager Automation can remediate findings without custom code. An IAM policy can proactively prevent creation of unencrypted volumes. This combination is largely managed and minimizes operational effort. Option B requires custom Lambda/EventBridge logic, increasing overhead. Amazon Macie (C) focuses on sensitive data discovery, not EBS encryption, and Amazon Inspector (D) focuses on vulnerability management, not storage encryption compliance.
Question 340
A company uses Amazon EC2 instances and stores data on Amazon Elastic Block Store (Amazon EBS) volumes. The company must ensure that all data is encrypted at rest by using AWS Key Management Service (AWS KMS). The company must be able to control rotation of the encryption keys.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a customer managed key. Use the key to encrypt the EBS volumes.
B. Use an AWS managed key to encrypt the EBS volumes. Use the key to configure automatic key rotation.
C. Create an external KMS key with imported key material. Use the key to encrypt the EBS volumes.
D. Use an AWS owned key to encrypt the EBS volumes.
Show Answer
Correct Answer: A
Explanation: The requirement to control key rotation rules out AWS owned keys and AWS managed keys, because AWS manages rotation for those keys. External keys with imported key material introduce additional operational overhead. A customer managed KMS key allows the company to enable, disable, and schedule rotation while still integrating natively with EBS, meeting the requirements with the least operational overhead.
Question 341
A solutions architect needs to copy files from an Amazon S3 bucket to an Amazon Elastic File System (Amazon EFS) file system and another S3 bucket. The files must be copied continuously. New files are added to the original S3 bucket consistently. The copied files should be overwritten only if the source file changes.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an AWS DataSync location for both the destination S3 bucket and the EFS file system. Create a task for the destination S3 bucket and the EFS file system. Set the transfer mode to transfer only data that has changed.
B. Create an AWS Lambda function. Mount the file system to the function. Set up an S3 event notification to invoke the function when files are created and changed in Amazon S3. Configure the function to copy files to the file system and the destination S3 bucket.
C. Create an AWS DataSync location for both the destination S3 bucket and the EFS file system. Create a task for the destination S3 bucket and the EFS file system. Set the transfer mode to transfer all data.
D. Launch an Amazon EC2 instance in the same VPC as the file system. Mount the file system. Create a script to routinely synchronize all objects that changed in the origin S3 bucket to the destination S3 bucket and the mounted file system.
Show Answer
Correct Answer: A
Explanation: AWS DataSync is a fully managed service designed for continuous, incremental data transfers between storage services with minimal operational overhead. By creating DataSync locations for the source S3 bucket and both destinations (S3 and EFS) and using a task configured to transfer only data that has changed, DataSync performs an initial comparison and copy, then subsequently transfers only new or modified files. This meets the requirement for continuous copying and overwriting files only when the source changes, while avoiding custom code or infrastructure management required by Lambda or EC2-based solutions.
Question 342
A company wants to back up its on-premises virtual machines (VMs) to AWS. The company's backup solution exports on-premises backups to an Amazon S3 bucket as objects. The S3 backups must be retained for 30 days and must be automatically deleted after 30 days.
Which combination of steps will meet these requirements? (Choose three.)
A. Create an S3 bucket that has S3 Object Lock enabled.
B. Create an S3 bucket that has object versioning enabled.
C. Configure a default retention period of 30 days for the objects.
D. Configure an S3 Lifecycle policy to protect the objects for 30 days.
E. Configure an S3 Lifecycle policy to expire the objects after 30 days.
F. Configure the backup solution to tag the objects with a 30-day retention period
Show Answer
Correct Answer: A, C, E
Explanation: The requirement is to ensure backups cannot be deleted for 30 days and are then automatically deleted. Enabling S3 Object Lock (A) ensures objects are immutable during the retention period; Object Lock implicitly requires and enables versioning, so a separate versioning step is unnecessary. Configuring a default retention period of 30 days (C) enforces the 30‑day retention on all uploaded backup objects. Finally, an S3 Lifecycle policy to expire objects after 30 days (E) ensures the backups are automatically deleted once the retention period ends. Lifecycle policies do not provide protection themselves, and tagging is irrelevant.
Question 343
A company stores sensitive data in Amazon S3. A solutions architect needs to create an encryption solution. The company needs to fully control the ability of users to create, rotate, and disable encryption keys with minimal effort for any data that must be encrypted.
Which solution will meet these requirements?
A. Use default server-side encryption with Amazon S3 managed encryption keys (SSE-S3) to store the sensitive data.
B. Create a customer managed key by using AWS Key Management Service (AWS KMS). Use the new key to encrypt the S3 objects by using server-side encryption with AWS KMS keys (SSE-KMS).
C. Create an AWS managed key by using AWS Key Management Service (AWS KMS). Use the new key to encrypt the S3 objects by using server-side encryption with AWS KMS keys (SSE-KMS).
D. Download S3 objects to an Amazon EC2 instance. Encrypt the objects by using customer managed keys. Upload the encrypted objects back into Amazon S3.
Show Answer
Correct Answer: B
Explanation: The requirement is full control over creating, rotating, and disabling encryption keys with minimal effort. Customer managed KMS keys provide complete control over the key lifecycle and fine-grained permissions, and SSE-KMS integrates directly with S3 for server-side encryption. SSE-S3 and AWS managed KMS keys do not provide full customer control, and client-side encryption on EC2 requires significant operational effort.
Question 344
A company's application uses Network Load Balancers, Auto Scaling groups, Amazon EC2 instances, and databases that are deployed in an Amazon VPC. The company wants to capture information about traffic to and from the network interfaces in near real time in its Amazon VPC. The company wants to send the information to Amazon OpenSearch Service for analysis.
Which solution will meet these requirements?
A. Create a log group in Amazon CloudWatch Logs. Configure VPC Flow Logs to send the log data to the log group. Use Amazon Kinesis Data Streams to stream the logs from the log group to OpenSearch Service.
B. Create a log group in Amazon CloudWatch Logs. Configure VPC Flow Logs to send the log data to the log group. Use Amazon Kinesis Data Firehose to stream the logs from the log group to OpenSearch Service.
C. Create a trail in AWS CloudTrail. Configure VPC Flow Logs to send the log data to the trail. Use Amazon Kinesis Data Streams to stream the logs from the trail to OpenSearch Service.
D. Create a trail in AWS CloudTrail. Configure VPC Flow Logs to send the log data to the trail. Use Amazon Kinesis Data Firehose to stream the logs from the trail to OpenSearch Service.
Show Answer
Correct Answer: B
Explanation: VPC Flow Logs are the correct service to capture traffic to and from network interfaces in a VPC, and they can deliver logs directly to Amazon CloudWatch Logs. For near real-time analytics and minimal operational overhead, Amazon Kinesis Data Firehose is the appropriate choice to stream CloudWatch Logs data to Amazon OpenSearch Service because it provides native delivery to OpenSearch without requiring custom consumers or Lambda processing. CloudTrail is not suitable because it records API and administrative actions, not network traffic, and Kinesis Data Streams would require additional components to push data into OpenSearch.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.