A company runs a real-time data ingestion solution on AWS. The solution consists of the most recent version of Amazon Managed Streaming for Apache Kafka (Amazon MSK). The solution is deployed in a VPC in private subnets across three Availability Zones.
A solutions architect needs to redesign the data ingestion solution to be publicly available over the internet. The data in transit must also be encrypted.
Which solution will meet these requirements with the MOST operational efficiency?
A. Configure public subnets in the existing VPC. Deploy an MSK cluster in the public subnets. Update the MSK cluster security settings to enable mutual TLS authentication.
B. Create a new VPC that has public subnets. Deploy an MSK cluster in the public subnets. Update the MSK cluster security settings to enable mutual TLS authentication.
C. Deploy an Application Load Balancer (ALB) that uses private subnets. Configure an ALB security group inbound rule to allow inbound traffic from the VPC CIDR block for HTTPS protocol.
D. Deploy a Network Load Balancer (NLB) that uses private subnets. Configure an NLB listener for HTTPS communication over the internet.
Show Answer
Correct Answer: A
Explanation: Amazon MSK supports public access by placing brokers in public subnets and enabling an authenticated/encrypted access method such as mutual TLS. Creating a new VPC is unnecessary and adds operational overhead. ALB/NLB are not the recommended mechanism to expose MSK publicly, and the options shown keep the load balancers in private subnets, which would not provide internet access to the brokers.
Question 308
A company uses Amazon EC2, AWS Fargate, and AWS Lambda to run multiple workloads in the company's AWS account. The company wants to fully make use of its Compute Savings Plans. The company wants to receive notification when coverage of the Compute Savings Plans drops.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a daily budget for the Savings Plans by using AWS Budgets. Configure the budget with a coverage threshold to send notifications to the appropriate email message recipients.
B. Create a Lambda function that runs a coverage report against the Savings Plans. Use Amazon Simple Email Service (Amazon SES) to email the report to the appropriate email message recipients.
C. Create an AWS Budgets report for the Savings Plans budget. Set the frequency to daily.
D. Create a Savings Plans alert subscription. Enable all notification options. Enter an email address to receive notifications.
Show Answer
Correct Answer: A
Explanation: AWS Budgets supports Savings Plans coverage and utilization budgets, including notifications when coverage drops below a defined threshold. This directly meets the requirement with minimal operational overhead. The Lambda/SES option is custom and less efficient, a budget report alone does not provide threshold-based alerts, and Savings Plans alert subscriptions are for expiration and queued purchases, not coverage drops.
Question 309
A company runs a highly available web application on Amazon EC2 instances behind an Application Load Balancer. The company uses Amazon CloudWatch metrics.
As the traffic to the web application increases, some EC2 instances become overloaded with many outstanding requests. The CloudWatch metrics show that the number of requests processed and the time to receive the responses from some EC2 instances are both higher compared to other EC2 instances. The company does not want new requests to be forwarded to the EC2 instances that are already overloaded.
Which solution will meet these requirements?
A. Use the round robin routing algorithm based on the RequestCountPerTarget and ActiveConnectionCount CloudWatch metrics.
B. Use the least outstanding requests algorithm based on the RequestCountPerTarget and ActiveConnectionCount CloudWatch metrics.
C. Use the round robin routing algorithm based on the RequestCount and TargetResponseTime CloudWatch metrics.
D. Use the least outstanding requests algorithm based on the RequestCount and TargetResponseTime CloudWatch metrics.
Show Answer
Correct Answer: B
Explanation: The requirement is to stop sending new requests to overloaded EC2 targets. Application Load Balancer's least outstanding requests routing algorithm is designed for this by routing new requests to the target with the fewest in-progress requests. Among the metric pairings, RequestCountPerTarget is target-specific, whereas RequestCount is load balancer-wide. ActiveConnectionCount is also more relevant than overall RequestCount for identifying load distribution characteristics. Therefore, the best match is least outstanding requests with RequestCountPerTarget and ActiveConnectionCount.
Question 310
A company is running a photo hosting service in the us-east-1 Region. The service enables users across multiple countries to upload and view photos. Some photos are heavily viewed for months, and others are viewed for less than a week. The application allows uploads of up to 20 MB for each photo. The service uses the photo metadata to determine which photos to display to each user.
Which solution provides the appropriate user access MOST cost-effectively?
A. Store the photos in Amazon DynamoDB. Turn on DynamoDB Accelerator (DAX) to cache frequently viewed items.
B. Store the photos in the Amazon S3 Intelligent-Tiering storage class. Store the photo metadata and its S3 location in DynamoD
C. Store the photos in the Amazon S3 Standard storage class. Set up an S3 Lifecycle policy to move photos older than 30 days to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class. Use the object tags to keep track of metadata.
D. Store the photos in the Amazon S3 Glacier storage class. Set up an S3 Lifecycle policy to move photos older than 30 days to the S3 Glacier Deep Archive storage class. Store the photo metadata and its S3 location in Amazon OpenSearch Service.
Show Answer
Correct Answer: B
Explanation: Amazon S3 is the appropriate storage for photo objects up to 20 MB. Because access patterns are unpredictable (some photos remain popular for months while others are rarely accessed after a week), S3 Intelligent-Tiering automatically optimizes storage costs without requiring lifecycle rules based on age. Storing photo metadata and the S3 object location in DynamoDB provides low-latency lookups for the application. DynamoDB is not suitable for storing large photo objects, lifecycle-by-age to Standard-IA can move frequently accessed older objects too early, and Glacier classes are inappropriate for interactive photo viewing.
Question 311
A company is designing a web application on AWS. The application will use a VPN connection between the company’s existing data centers and the company's VPCs.
The company uses Amazon Route 53 as its DNS service. The application must use private DNS records to communicate with the on-premises services from a VPC.
Which solution will meet these requirements in the MOST secure manner?
A. Create a Route 53 Resolver outbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC.
B. Create a Route 53 Resolver inbound endpoint. Create a resolver rule. Associate the resolver rule with the VPC.
C. Create a Route 53 private hosted zone. Associate the private hosted zone with the VP
D. Create a Route 53 public hosted zone. Create a record for each service to allow service communication
Show Answer
Correct Answer: A
Explanation: To allow resources in a VPC to resolve private DNS names for on-premises services over a VPN, configure a Route 53 Resolver outbound endpoint and a forwarding (resolver) rule for the relevant domain, then associate the rule with the VPC. Outbound endpoints forward DNS queries from the VPC to the on-premises DNS servers. Inbound endpoints are for queries originating on premises toward AWS. Private hosted zones host AWS-managed private records and do not by themselves resolve names served by on-premises DNS.
Question 312
An ecommerce company runs its application on AWS. The application uses an Amazon Aurora PostgreSQL cluster in Multi-AZ mode for the underlying database. During a recent promotional campaign, the application experienced heavy read load and write load. Users experienced timeout issues when they attempted to access the application.
A solutions architect needs to make the application architecture more scalable and highly available.
Which solution will meet these requirements with the LEAST downtime?
A. Create an Amazon EventBridge rule that has the Aurora cluster as a source. Create an AWS Lambda function to log the state change events of the Aurora cluster. Add the Lambda function as a target for the EventBridge rule. Add additional reader nodes to fail over to.
B. Modify the Aurora cluster and activate the zero-downtime restart (ZDR) feature. Use Database Activity Streams on the cluster to track the cluster status.
C. Add additional reader instances to the Aurora cluster. Create an Amazon RDS Proxy target group for the Aurora cluster.
D. Create an Amazon ElastiCache for Redis cache. Replicate data from the Aurora cluster to Redis by using AWS Database Migration Service (AWS DMS) with a write-around approach.
Show Answer
Correct Answer: C
Explanation: Adding Aurora reader instances scales read traffic, and Amazon RDS Proxy reduces connection management overhead and mitigates connection exhaustion that can cause application timeouts during traffic spikes. The other options do not directly improve scalability for the observed workload: EventBridge/Lambda logging does not increase capacity, zero-downtime restart is unrelated to sustained read/write scaling, and using DMS to populate Redis is not an appropriate caching architecture for this scenario and would not address database write load or connection pressure.
Question 313
A company has an organization in AWS Organizations. The company runs Amazon EC2 instances across four AWS accounts in the root organizational unit (OU). There are three nonproduction accounts and one production account. The company wants to prohibit users from launching EC2 instances of a certain size in the nonproduction accounts. The company has created a service control policy (SCP) to deny access to launch instances that use the prohibited types.
Which solutions to deploy the SCP will meet these requirements? (Choose two.)
A. Attach the SCP to the root OU for the organization.
B. Attach the SCP to the three nonproduction Organizations member accounts.
C. Attach the SCP to the Organizations management account.
D. Create an OU for the production account. Attach the SCP to the OU. Move the production member account into the new OU.
E. Create an OU for the required accounts. Attach the SCP to the OU. Move the nonproduction member accounts into the new OU.
Show Answer
Correct Answer: B, E
Explanation: Service control policies (SCPs) can be attached to roots, OUs, or individual member accounts. To restrict only the three nonproduction accounts, either attach the SCP directly to those three member accounts (B) or create a dedicated OU for the nonproduction accounts, move those accounts into it, and attach the SCP to that OU (E). Attaching the SCP to the root (A) would also affect the production account. SCPs do not apply to the management account (C), and attaching the SCP to a production OU (D) would restrict the production account instead of the nonproduction accounts.
Question 314
A company wants to use NAT gateways in its AWS environment. The company's Amazon EC2 instances in private subnets must be able to connect to the public internet through the NAT gateways.
Which solution will meet these requirements?
A. Create public NAT gateways in the same private subnets as the EC2 instances.
B. Create private NAT gateways in the same private subnets as the EC2 instances.
C. Create public NAT gateways in public subnets in the same VPCs as the EC2 instances.
D. Create private NAT gateways in public subnets in the same VPCs as the EC2 instances.
Show Answer
Correct Answer: C
Explanation: EC2 instances in private subnets that need outbound internet access should route traffic to a public NAT gateway. A public NAT gateway must be deployed in a public subnet and use an Elastic IP, with the public subnet having a route to an internet gateway. Private NAT gateways are for connectivity to other VPCs or on-premises networks, not direct internet access.
Question 315
A company is using an Application Load Balancer (ALB) to present its application to the internet. The company finds abnormal traffic access patterns across the application. A solutions architect needs to improve visibility into the infrastructure to help the company understand these abnormalities better.
What is the MOST operationally efficient solution that meets these requirements?
A. Create a table in Amazon Athena for AWS CloudTrail logs. Create a query for the relevant information.
B. Enable ALB access logging to Amazon S3. Create a table in Amazon Athena, and query the logs.
C. Enable ALB access logging to Amazon S3. Open each file in a text editor, and search each line for the relevant information.
D. Use Amazon EMR on a dedicated Amazon EC2 instance to directly query the ALB to acquire traffic access log information.
Show Answer
Correct Answer: B
Explanation: Application Load Balancer access logs contain detailed request and traffic information needed to analyze abnormal access patterns. Enabling ALB access logging to Amazon S3 and querying the logs with Amazon Athena provides a scalable, serverless, and operationally efficient solution. CloudTrail records AWS API activity rather than end-user HTTP requests to the ALB. Manually inspecting log files is inefficient, and using EMR is unnecessary overhead for this use case.
Question 316
A company runs a three-tier application in a VPC. The database tier uses an Amazon RDS for MySQL DB instance.
The company plans to migrate the RDS for MySQL DB instance to an Amazon Aurora PostgreSQL DB cluster. The company needs a solution that replicates the data changes that happen during the migration to the new database.
Which combination of steps will meet these requirements? (Choose two.)
A. Use AWS Database Migration Service (AWS DMS) Schema Conversion to transform the database objects.
B. Use AWS Database Migration Service (AWS DMS) Schema Conversion to create an Aurora PostgreSQL read replica on the RDS for MySQL DB instance.
C. Configure an Aurora MySQL read replica for the RDS for MySQL DB instance.
D. Define an AWS Database Migration Service (AWS DMS) task with change data capture (CDC) to migrate the data.
E. Promote the Aurora PostgreSQL read replica to a standalone Aurora PostgreSQL DB cluster when the replica lag is zero.
Show Answer
Correct Answer: A, D
Explanation: Migrating from Amazon RDS for MySQL to Amazon Aurora PostgreSQL requires schema conversion because the database engines differ. AWS DMS Schema Conversion is used to convert the MySQL schema and database objects to PostgreSQL-compatible objects. To keep the target synchronized during migration, create an AWS DMS migration task that uses change data capture (CDC) so ongoing changes on the source database are continuously replicated until cutover. The read replica options apply to Aurora MySQL or are otherwise incorrect for a cross-engine migration to Aurora PostgreSQL.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.