An online video game company must maintain ultra-low latency for its game servers. The game servers run on Amazon EC2 instances. The company needs a solution that can handle millions of UDP internet traffic requests each second.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an Application Load Balancer with the required protocol and ports for the internet traffic. Specify the EC2 instances as the targets.
B. Configure a Gateway Load Balancer for the internet traffic. Specify the EC2 instances as the targets.
C. Configure a Network Load Balancer with the required protocol and ports for the internet traffic. Specify the EC2 instances as the targets.
D. Launch an identical set of game servers on EC2 instances in separate AWS Regions. Route internet traffic to both sets of EC2 instances.
Show Answer
Correct Answer: C
Explanation: A Network Load Balancer operates at Layer 4 and supports TCP and UDP traffic with very high performance and low latency, making it suitable for millions of UDP requests per second. An Application Load Balancer does not support generic UDP traffic, a Gateway Load Balancer is intended for deploying virtual network appliances rather than balancing application traffic, and deploying duplicate servers in multiple Regions does not by itself provide the required load balancing and is not the most cost-effective solution.
Question 318
A company has NFS servers in an on-premises data center that need to periodically back up small amounts of data to Amazon S3.
Which solution meets these requirements and is MOST cost-effective?
A. Set up AWS Glue to copy the data from the on-premises servers to Amazon S3.
B. Set up an AWS DataSync agent on the on-premises servers, and sync the data to Amazon S3.
C. Set up an SFTP sync using AWS Transfer for SFTP to sync data from on premises to Amazon S3.
D. Set up an AWS Direct Connect connection between the on-premises data center and a VPC, and copy the data to Amazon S3.
Show Answer
Correct Answer: B
Explanation: AWS DataSync is purpose-built for transferring data from on-premises NFS (and other storage) to Amazon S3. It uses an on-premises agent, supports scheduled and incremental transfers, and is a managed, cost-effective solution for periodic backups. AWS Glue is an ETL service rather than a file transfer tool, AWS Transfer Family is intended to provide managed SFTP/FTP/FTPS endpoints rather than sync NFS shares, and AWS Direct Connect has significant setup cost that is not justified for small periodic data transfers.
Question 319
A company copies 200 TB of data from a recent ocean survey onto AWS Snowball Edge Storage Optimized devices. The company has a high performance computing (HPC) cluster that is hosted on AWS to look for oil and gas deposits. A solutions architect must provide the cluster with consistent sub-millisecond latency and high-throughput access to the data on the Snowball Edge Storage Optimized devices. The company is sending the devices back to AWS.
Which solution will meet these requirements?
A. Create an Amazon S3 bucket. Import the data into the S3 bucket. Configure an AWS Storage Gateway file gateway to use the S3 bucket. Access the file gateway from the HPC cluster instances.
B. Create an Amazon S3 bucket. Import the data into the S3 bucket. Configure an Amazon FSx for Lustre file system, and integrate it with the S3 bucket. Access the FSx for Lustre file system from the HPC cluster instances.
C. Create an Amazon S3 bucket and an Amazon Elastic File System (Amazon EFS) file system. Import the data into the S3 bucket. Copy the data from the S3 bucket to the EFS file system. Access the EFS file system from the HPC cluster instances.
D. Create an Amazon FSx for Lustre file system. Import the data directly into the FSx for Lustre file system. Access the FSx for Lustre file system from the HPC cluster instances.
Show Answer
Correct Answer: B
Explanation: Snowball Edge Storage Optimized imports data into Amazon S3 when returned to AWS; it does not import directly into Amazon FSx for Lustre. For HPC workloads requiring consistent sub-millisecond latency and high throughput, Amazon FSx for Lustre is the appropriate shared file system and can be linked to an S3 bucket as its data repository. Storage Gateway is not intended for this HPC access pattern, and EFS does not provide the same HPC-optimized performance characteristics.
Question 320
A city has deployed a web application running on Amazon EC2 instances behind an Application Load Balancer (ALB). The application's users have reported sporadic performance, which appears to be related to DDoS attacks originating from random IP addresses. The city needs a solution that requires minimal configuration changes and provides an audit trail for the DDoS sources.
Which solution meets these requirements?
A. Enable an AWS WAF web ACL on the ALB, and configure rules to block traffic from unknown sources.
B. Subscribe to Amazon Inspector. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service.
C. Subscribe to AWS Shield Advanced. Engage the AWS DDoS Response Team (DRT) to integrate mitigating controls into the service.
D. Create an Amazon CloudFront distribution for the application, and set the ALB as the origin. Enable an AWS WAF web ACL on the distribution, and configure rules to block traffic from unknown sources
Show Answer
Correct Answer: C
Explanation: AWS Shield Advanced is designed to protect applications from DDoS attacks and includes access to the AWS DDoS Response Team (DRT) for assistance with mitigation. It also provides enhanced DDoS visibility and attack diagnostics, supporting auditing of attack sources. AWS WAF alone is not sufficient for large-scale DDoS protection, Amazon Inspector is unrelated to DDoS mitigation, and adding CloudFront plus WAF introduces additional configuration without addressing the requirement as directly.
Question 321
A gaming company wants to launch a new internet-facing application in multiple AWS Regions. The application will use the TCP and UDP protocols for communication. The company needs to provide high availability and minimum latency for global users.
Which combination of actions should a solutions architect take to meet these requirements? (Choose two.)
A. Create internal Network Load Balancers in front of the application in each Region.
B. Create external Application Load Balancers in front of the application in each Region.
C. Create an AWS Global Accelerator accelerator to route traffic to the load balancers in each Region.
D. Configure Amazon Route 53 to use a geolocation routing policy to distribute the traffic.
E. Configure Amazon CloudFront to handle the traffic and route requests to the application in each Region
Show Answer
Correct Answer: A, C
Explanation: The application requires both TCP and UDP with low latency across multiple AWS Regions. Network Load Balancers support TCP and UDP, whereas Application Load Balancers do not support UDP. AWS Global Accelerator provides two anycast static IPs, routes users to the optimal regional endpoint over the AWS global network, and performs health-based failover for high availability and low latency. CloudFront is for HTTP(S) content, and Route 53 geolocation routing does not optimize for lowest latency or provide the transport acceleration that Global Accelerator does.
Question 322
A company has an application that uses Docker containers in its local data center. The application runs on a container host that stores persistent data in a volume on the host. The container instances use the stored persistent data.
The company wants to move the application to a fully managed service because the company does not want to manage any servers or storage infrastructure.
Which solution will meet these requirements?
A. Use Amazon Elastic Kubernetes Service (Amazon EKS) with self-managed nodes. Create an Amazon Elastic Block Store (Amazon EBS) volume attached to an Amazon EC2 instance. Use the EBS volume as a persistent volume mounted in the containers.
B. Use Amazon Elastic Container Service (Amazon ECS) with an AWS Fargate launch type. Create an Amazon Elastic File System (Amazon EFS) volume. Add the EFS volume as a persistent storage volume mounted in the containers.
C. Use Amazon Elastic Container Service (Amazon ECS) with an AWS Fargate launch type. Create an Amazon S3 bucket. Map the S3 bucket as a persistent storage volume mounted in the containers.
D. Use Amazon Elastic Container Service (Amazon ECS) with an Amazon EC2 launch type. Create an Amazon Elastic File System (Amazon EFS) volume. Add the EFS volume as a persistent storage volume mounted in the containers.
Show Answer
Correct Answer: B
Explanation: AWS Fargate provides a fully managed compute environment for containers, satisfying the requirement to avoid managing servers. Amazon EFS integrates natively with ECS on Fargate and can be mounted into containers to provide shared persistent storage that outlives container instances. EKS with self-managed nodes and ECS with EC2 both require managing EC2 instances. Amazon S3 is object storage and cannot be mounted as a native persistent container volume for ECS/Fargate in the way described.
Question 323
A company is deploying a new application to Amazon Elastic Kubernetes Service (Amazon EKS) with an AWS Fargate cluster. The application needs a storage solution for data persistence. The solution must be highly available and fault tolerant. The solution also must be shared between multiple application containers.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create Amazon Elastic Block Store (Amazon EBS) volumes in the same Availability Zones where EKS worker nodes are placed. Register the volumes in a StorageClass object on an EKS cluster. Use EBS Multi-Attach to share the data between containers.
B. Create an Amazon Elastic File System (Amazon EFS) file system. Register the file system in a StorageClass object on an EKS cluster. Use the same file system for all containers.
C. Create an Amazon Elastic Block Store (Amazon EBS) volume. Register the volume in a StorageClass object on an EKS cluster. Use the same volume for all containers.
D. Create Amazon Elastic File System (Amazon EFS) file systems in the same Availability Zones where EKS worker nodes are placed. Register the file systems in a StorageClass object on an EKS cluster. Create an AWS Lambda function to synchronize the data between file systems.
Show Answer
Correct Answer: B
Explanation: Amazon EFS is the supported shared, highly available, and fault-tolerant persistent storage solution for Amazon EKS on AWS Fargate. EFS can be mounted concurrently by multiple pods/containers and integrates with Kubernetes through the EFS CSI driver and StorageClass. EBS volumes are AZ-scoped block storage, are not appropriate for shared file storage across multiple Fargate pods, and EKS on Fargate does not use worker nodes. Creating multiple EFS file systems with Lambda synchronization adds unnecessary operational overhead.
Question 324
A solutions architect creates a VPC that includes two public subnets and two private subnets. A corporate security mandate requires the solutions architect to launch all Amazon EC2 instances in a private subnet. However, when the solutions architect launches an EC2 instance that runs a web server on ports 80 and 443 in a private subnet, no external internet traffic can connect to the server.
What should the solutions architect do to resolve this issue?
A. Attach the EC2 instance to an Auto Scaling group in a private subnet. Ensure that the DNS record for the website resolves to the Auto Scaling group identifier.
B. Provision an internet-facing Application Load Balancer (ALB) in a public subnet. Add the EC2 instance to the target group that is associated with the ALEnsure that the DNS record for the website resolves to the AL
C. Launch a NAT gateway in a private subnet. Update the route table for the private subnets to add a default route to the NAT gateway. Attach a public Elastic IP address to the NAT gateway.
D. Ensure that the security group that is attached to the EC2 instance allows HTTP traffic on port 80 and HTTPS traffic on port 443. Ensure that the DNS record for the website resolves to the public IP address of the EC2 instance.
Show Answer
Correct Answer: B
Explanation: Instances in private subnets cannot receive direct inbound internet traffic because they do not have a route for internet ingress via an internet gateway. The standard AWS architecture is to place an internet-facing Application Load Balancer in public subnets and register the private EC2 instances as targets. The ALB receives HTTP/HTTPS traffic from the internet and forwards it to the instances in the private subnets. Auto Scaling does not provide internet access, a NAT gateway is for outbound connectivity from private subnets (and is deployed in a public subnet), and private instances should not be addressed via a public IP.
Question 325
A company needs to provide customers with secure access to its data. The company processes customer data and stores the results in an Amazon S3 bucket.
All the data is subject to strong regulations and security requirements. The data must be encrypted at rest. Each customer must be able to access only their data from their AWS account. Company employees must not be able to access the data.
Which solution will meet these requirements?
A. Provision an AWS Certificate Manager (ACM) certificate for each customer. Encrypt the data client-side. In the private certificate policy, deny access to the certificate for all principals except an IAM role that the customer provides.
B. Provision a separate AWS Key Management Service (AWS KMS) key for each customer. Encrypt the data server-side. In the S3 bucket policy, deny decryption of data for all principals except an IAM role that the customer provides.
C. Provision a separate AWS Key Management Service (AWS KMS) key for each customer. Encrypt the data server-side. In each KMS key policy, deny decryption of data for all principals except an IAM role that the customer provides.
D. Provision an AWS Certificate Manager (ACM) certificate for each customer. Encrypt the data client-side. In the public certificate policy, deny access to the certificate for all principals except an IAM role that the customer provides.
Show Answer
Correct Answer: C
Explanation: Use a separate AWS KMS key per customer with S3 server-side encryption (SSE-KMS). KMS key policies are the primary mechanism for controlling who can use a KMS key for decryption. By allowing only the customer-provided IAM role to use that customer's key, only that customer can decrypt their objects, while company employees are denied. ACM certificates are unrelated to encryption at rest, and S3 bucket policies do not control KMS decrypt permissions.
Question 326
A company is building a microservices-based application that will be deployed on Amazon Elastic Kubernetes Service (Amazon EKS). The microservices will interact with each other. The company wants to ensure that the application is observable to identify performance issues in the future.
Which solution will meet these requirements?
A. Configure the application to use Amazon ElastiCache to reduce the number of requests that are sent to the microservices.
B. Configure Amazon CloudWatch Container Insights to collect metrics from the EKS clusters. Configure AWS X-Ray to trace the requests between the microservices.
C. Configure AWS CloudTrail to review the API calls. Build an Amazon QuickSight dashboard to observe the microservice interactions.
D. Use AWS Trusted Advisor to understand the performance of the application.
Show Answer
Correct Answer: B
Explanation: Amazon CloudWatch Container Insights provides observability for Amazon EKS by collecting container, node, and cluster metrics. AWS X-Ray provides distributed tracing across microservices, allowing identification of latency bottlenecks and request flows. ElastiCache improves performance but not observability, CloudTrail is for auditing AWS API calls rather than application tracing, and Trusted Advisor provides best-practice recommendations rather than runtime observability.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.