A company manages AWS accounts in AWS Organizations. AWS IAM Identity Center (AWS Single Sign-On) and AWS Control Tower are configured for the accounts. The company wants to manage multiple user permissions across all the accounts.
The permissions will be used by multiple IAM users and must be split between the developer and administrator teams. Each team requires different permissions. The company wants a solution that includes new users that are hired on both teams.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create individual users in IAM Identity Center for each account. Create separate developer and administrator groups in IAM Identity Center. Assign the users to the appropriate groups. Create a custom IAM policy for each group to set fine-grained permissions.
B. Create individual users in IAM Identity Center for each account. Create separate developer and administrator groups in IAM Identity Center. Assign the users to the appropriate groups. Attach AWS managed IAM policies to each user as needed for fine-grained permissions.
C. Create individual users in IAM Identity Center. Create new developer and administrator groups in IAM Identity Center. Create new permission sets that include the appropriate IAM policies for each group. Assign the new groups to the appropriate accounts. Assign the new permission sets to the new groups. When new users are hired, add them to the appropriate group.
D. Create individual users in IAM Identity Center. Create new permission sets that include the appropriate IAM policies for each user. Assign the users to the appropriate accounts. Grant additional IAM permissions to the users from within specific accounts. When new users are hired, add them to IAM Identity Center and assign them to the accounts.
Show Answer
Correct Answer: C
Explanation: AWS IAM Identity Center is designed to manage access centrally using users, groups, and permission sets. The lowest-overhead approach is to create developer and administrator groups, define permission sets with the required IAM policies, assign those permission sets to the groups for the appropriate AWS accounts, and simply add new hires to the correct group so they automatically inherit access. Options A and B incorrectly suggest creating Identity Center users per account and attaching policies directly to users. Option D manages permissions per user, increasing operational overhead.
Question 335
A company is creating an application. The company stores data from tests of the application in multiple on-premises locations.
The company needs to connect the on-premises locations to VPCs in an AWS Region in the AWS Cloud. The number of accounts and VPCs will increase during the next year. The network architecture must simplify the administration of new connections and must provide the ability to scale.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Create a peering connection between the VPCs. Create a VPN connection between the VPCs and the on-premises locations.
B. Launch an Amazon EC2 instance. On the instance, include VPN software that uses a VPN connection to connect all VPCs and on-premises locations.
C. Create a transit gateway. Create VPC attachments for the VPC connections. Create VPN attachments for the on-premises connections.
D. Create an AWS Direct Connect connection between the on-premises locations and a central VPC. Connect the central VPC to other VPCs by using peering connections.
Show Answer
Correct Answer: C
Explanation: AWS Transit Gateway is designed for scalable hub-and-spoke connectivity between multiple VPCs and on-premises networks. As the number of VPCs and accounts grows, Transit Gateway minimizes administrative overhead by using VPC and VPN attachments instead of managing many VPC peering connections. EC2-based VPN appliances add operational burden, and Direct Connect to a central VPC with peering does not scale as cleanly for expanding environments.
Question 336
A company is developing an application that will run on a production Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster has managed node groups that are provisioned with On-Demand Instances.
The company needs a dedicated EKS cluster for development work. The company will use the development cluster infrequently to test the resiliency of the application. The EKS cluster must manage all the nodes.
Which solution will meet these requirements MOST cost-effectively?
A. Create a managed node group that contains only Spot Instances.
B. Create two managed node groups. Provision one node group with On-Demand Instances. Provision the second node group with Spot Instances.
C. Create an Auto Scaling group that has a launch configuration that uses Spot Instances. Configure the user data to add the nodes to the EKS cluster.
D. Create a managed node group that contains only On-Demand Instances.
Show Answer
Correct Answer: A
Explanation: The question asks for a separate development EKS cluster that is used infrequently and requires that Amazon EKS manage the worker nodes. An EKS managed node group satisfies the management requirement, and using only Spot Instances minimizes cost for interruption-tolerant development and resiliency testing. Option B adds unnecessary On-Demand capacity, increasing cost. Option C uses self-managed nodes. Option D is more expensive than necessary.
Question 337
A company wants to migrate its web applications from on premises to AWS. The company is located close to the eu-central-1 Region. Because of regulations, the company cannot launch some of its applications in eu-central-1. The company wants to achieve single-digit millisecond latency.
Which solution will meet these requirements?
A. Deploy the applications in eu-central-1. Extend the company’s VPC from eu-central-1 to an edge location in Amazon CloudFront.
B. Deploy the applications in AWS Local Zones by extending the company's VPC from eu-central-1 to the chosen Local Zone.
C. Deploy the applications in eu-central-1. Extend the company’s VPC from eu-central-1 to the regional edge caches in Amazon CloudFront.
D. Deploy the applications in AWS Wavelength Zones by extending the company’s VPC from eu-central-1 to the chosen Wavelength Zone.
Show Answer
Correct Answer: B
Explanation: AWS Local Zones extend a Region's VPC to infrastructure located closer to users while allowing workloads to run outside the parent Region. They are designed for applications requiring single-digit millisecond latency. Options A and C still require deploying the applications in eu-central-1, which conflicts with the regulatory constraint. AWS Wavelength Zones are intended for ultra-low-latency 5G mobile applications within telecom provider networks, which is not the stated use case.
Question 338
A company is migrating its multi-tier on-premises application to AWS. The application consists of a single-node MySQL database and a multi-node web tier. The company must minimize changes to the application during the migration. The company wants to improve application resiliency after the migration.
Which combination of steps will meet these requirements? (Choose two.)
A. Migrate the web tier to Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer.
B. Migrate the database to Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer.
C. Migrate the database to an Amazon RDS Multi-AZ deployment.
D. Migrate the web tier to an AWS Lambda function.
E. Migrate the database to an Amazon DynamoDB table.
Show Answer
Correct Answer: A, C
Explanation: Use Amazon EC2 Auto Scaling behind an Application Load Balancer for the multi-node web tier to improve availability and resiliency with minimal application changes. Migrate the single-node MySQL database to Amazon RDS for MySQL with a Multi-AZ deployment to gain managed high availability and automatic failover while remaining compatible with MySQL. Auto Scaling is not appropriate for a stateful MySQL database on EC2, and moving to Lambda or DynamoDB would require significant application changes.
Question 339
A company needs a solution to enforce data encryption at rest on Amazon EC2 instances. The solution must automatically identify noncompliant resources and enforce compliance policies on findings.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Use an IAM policy that allows users to create only encrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Config and AWS Systems Manager to automate the detection and remediation of unencrypted EBS volumes.
B. Use AWS Key Management Service (AWS KMS) to manage access to encrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Lambda and Amazon EventBridge to automate the detection and remediation of unencrypted EBS volumes.
C. Use Amazon Macie to detect unencrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Systems Manager Automation rules to automatically encrypt existing and new EBS volumes.
D. Use Amazon inspector to detect unencrypted Amazon Elastic Block Store (Amazon EBS) volumes. Use AWS Systems Manager Automation rules to automatically encrypt existing and new EBS volumes.
Show Answer
Correct Answer: A
Explanation: AWS Config provides managed rules to identify unencrypted EBS volumes, and AWS Systems Manager Automation can remediate findings with minimal custom code. An IAM policy can prevent creation of unencrypted EBS volumes, reducing future noncompliance. Option B requires custom Lambda/EventBridge automation, increasing operational overhead. Amazon Macie does not detect unencrypted EBS volumes, and Amazon Inspector does not provide this type of compliance check.
Question 340
A company uses Amazon EC2 instances and stores data on Amazon Elastic Block Store (Amazon EBS) volumes. The company must ensure that all data is encrypted at rest by using AWS Key Management Service (AWS KMS). The company must be able to control rotation of the encryption keys.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a customer managed key. Use the key to encrypt the EBS volumes.
B. Use an AWS managed key to encrypt the EBS volumes. Use the key to configure automatic key rotation.
C. Create an external KMS key with imported key material. Use the key to encrypt the EBS volumes.
D. Use an AWS owned key to encrypt the EBS volumes.
Show Answer
Correct Answer: A
Explanation: Customer managed AWS KMS keys allow the company to control key rotation settings while providing KMS encryption for EBS volumes. AWS managed keys have rotation managed by AWS and customers cannot control it. Imported key material adds significantly more operational overhead. AWS owned keys do not provide customer control.
Question 341
A solutions architect needs to copy files from an Amazon S3 bucket to an Amazon Elastic File System (Amazon EFS) file system and another S3 bucket. The files must be copied continuously. New files are added to the original S3 bucket consistently. The copied files should be overwritten only if the source file changes.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an AWS DataSync location for both the destination S3 bucket and the EFS file system. Create a task for the destination S3 bucket and the EFS file system. Set the transfer mode to transfer only data that has changed.
B. Create an AWS Lambda function. Mount the file system to the function. Set up an S3 event notification to invoke the function when files are created and changed in Amazon S3. Configure the function to copy files to the file system and the destination S3 bucket.
C. Create an AWS DataSync location for both the destination S3 bucket and the EFS file system. Create a task for the destination S3 bucket and the EFS file system. Set the transfer mode to transfer all data.
D. Launch an Amazon EC2 instance in the same VPC as the file system. Mount the file system. Create a script to routinely synchronize all objects that changed in the origin S3 bucket to the destination S3 bucket and the mounted file system.
Show Answer
Correct Answer: A
Explanation: AWS DataSync is the managed service designed for continuous data movement between Amazon S3 and Amazon EFS with minimal operational overhead. Configuring DataSync tasks with the transfer mode to transfer only data that has changed ensures that after the initial synchronization, only new or modified files are copied, and destination files are overwritten only when the source differs. Option C retransfers all data each run, while Lambda (B) and EC2 scripting (D) require significantly more operational management.
Question 342
A company wants to back up its on-premises virtual machines (VMs) to AWS. The company's backup solution exports on-premises backups to an Amazon S3 bucket as objects. The S3 backups must be retained for 30 days and must be automatically deleted after 30 days.
Which combination of steps will meet these requirements? (Choose three.)
A. Create an S3 bucket that has S3 Object Lock enabled.
B. Create an S3 bucket that has object versioning enabled.
C. Configure a default retention period of 30 days for the objects.
D. Configure an S3 Lifecycle policy to protect the objects for 30 days.
E. Configure an S3 Lifecycle policy to expire the objects after 30 days.
F. Configure the backup solution to tag the objects with a 30-day retention period
Show Answer
Correct Answer: A, C, E
Explanation: Use S3 Object Lock to prevent deletion/modification during the required retention period, configure a default Object Lock retention of 30 days for new objects, and use an S3 Lifecycle expiration rule to automatically expire/delete the objects after 30 days. Although Object Lock requires versioning, enabling Object Lock on bucket creation implicitly enables the required versioning, so selecting both bucket-creation options is redundant.
Question 343
A company stores sensitive data in Amazon S3. A solutions architect needs to create an encryption solution. The company needs to fully control the ability of users to create, rotate, and disable encryption keys with minimal effort for any data that must be encrypted.
Which solution will meet these requirements?
A. Use default server-side encryption with Amazon S3 managed encryption keys (SSE-S3) to store the sensitive data.
B. Create a customer managed key by using AWS Key Management Service (AWS KMS). Use the new key to encrypt the S3 objects by using server-side encryption with AWS KMS keys (SSE-KMS).
C. Create an AWS managed key by using AWS Key Management Service (AWS KMS). Use the new key to encrypt the S3 objects by using server-side encryption with AWS KMS keys (SSE-KMS).
D. Download S3 objects to an Amazon EC2 instance. Encrypt the objects by using customer managed keys. Upload the encrypted objects back into Amazon S3.
Show Answer
Correct Answer: B
Explanation: A customer managed AWS KMS key used with SSE-KMS gives the company control over key creation, rotation (automatic or manual where supported), disabling, deletion scheduling, key policies, and IAM permissions while keeping server-side encryption operational with minimal operational effort. SSE-S3 uses S3-managed keys, AWS managed KMS keys do not provide full customer control, and client-side encryption via EC2 is unnecessary and higher effort.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.