A company recently migrated its web application to the AWS Cloud. The company uses an Amazon EC2 instance to run multiple processes to host the application. The processes include an Apache web server that serves static content. The Apache web server makes requests to a PHP application that uses a local Redis server for user sessions.
The company wants to redesign the architecture to be highly available and to use AWS managed solutions.
Which solution will meet these requirements?
A. Use AWS Elastic Beanstalk to host the static content and the PHP application. Configure Elastic Beanstalk to deploy its EC2 instance into a public subnet. Assign a public IP address.
B. Use AWS Lambda to host the static content and the PHP application. Use an Amazon API Gateway REST API to proxy requests to the Lambda function. Set the API Gateway CORS configuration to respond to the domain name. Configure Amazon ElastiCache for Redis to handle session information.
C. Keep the backend code on the EC2 instance. Create an Amazon ElastiCache for Redis cluster that has Multi-AZ enabled. Configure the ElastiCache for Redis cluster in cluster mode. Copy the frontend resources to Amazon S3. Configure the backend code to reference the EC2 instance.
D. Configure an Amazon CloudFront distribution with an Amazon S3 endpoint to an S3 bucket that is configured to host the static content. Configure an Application Load Balancer that targets an Amazon Elastic Container Service (Amazon ECS) service that runs AWS Fargate tasks for the PHP application. Configure the PHP application to use an Amazon ElastiCache for Redis cluster that runs in multiple Availability Zones.
Show Answer
Correct Answer: D
Explanation: The requirement is a highly available architecture that uses AWS managed services. Option D separates static and dynamic content using managed, scalable services: Amazon S3 with CloudFront for highly available static content delivery; an Application Load Balancer with Amazon ECS on AWS Fargate to run the PHP application without managing servers; and Amazon ElastiCache for Redis deployed across multiple Availability Zones for highly available session storage. This design removes single-instance dependencies, supports horizontal scaling, and relies on fully managed AWS services, meeting both HA and managed-solution requirements.
Question 356
A company runs applications on AWS that connect to the company's Amazon RDS database. The applications scale on weekends and at peak times of the year. The company wants to scale the database more effectively for its applications that connect to the database.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon DynamoDB with connection pooling with a target group configuration for the database. Change the applications to use the DynamoDB endpoint.
B. Use Amazon RDS Proxy with a target group for the database. Change the applications to use the RDS Proxy endpoint.
C. Use a custom proxy that runs on Amazon EC2 as an intermediary to the database. Change the applications to use the custom proxy endpoint.
D. Use an AWS Lambda function to provide connection pooling with a target group configuration for the database. Change the applications to use the Lambda function.
Show Answer
Correct Answer: B
Explanation: The requirement is to scale database connections efficiently with the least operational overhead. Amazon RDS Proxy is a fully managed service that provides connection pooling, improves scalability during traffic spikes, and reduces failover times without requiring application redesign beyond changing the endpoint. DynamoDB is a different database model, custom EC2 proxies add management overhead, and Lambda is not suitable for persistent connection pooling. Therefore, RDS Proxy is the best solution.
Question 357
A company created a new organization in AWS Organizations. The organization has multiple accounts for the company's development teams. The development team members use AWS IAM Identity Center (AWS Single Sign-On) to access the accounts. For each of the company's applications, the development teams must use a predefined application name to tag resources that are created.
A solutions architect needs to design a solution that gives the development team the ability to create resources only if the application name tag has an approved value.
Which solution will meet these requirements?
A. Create an IAM group that has a conditional Allow policy that requires the application name tag to be specified for resources to be created.
B. Create a cross-account role that has a Deny policy for any resource that has the application name tag.
C. Create a resource group in AWS Resource Groups to validate that the tags are applied to all resources in all accounts.
D. Create a tag policy in Organizations that has a list of allowed application names.
Show Answer
Correct Answer: D
Explanation: AWS Organizations tag policies let you define allowed tag keys and values (such as approved application names) and enforce them across all member accounts. When enforcement is enabled, resource creation or tagging requests that do not comply are denied. This works centrally with IAM Identity Center users across multiple accounts, meeting the requirement to allow resource creation only when the application name tag has an approved value.
Question 358
A company runs its databases on Amazon RDS for PostgreSQL. The company wants a secure solution to manage the master user password by rotating the password every 30 days.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon EventBridge to schedule a custom AWS Lambda function to rotate the password every 30 days.
B. Use the modify-db-instance command in the AWS CLI to change the password.
C. Integrate AWS Secrets Manager with Amazon RDS for PostgreSQL to automate password rotation.
D. Integrate AWS Systems Manager Parameter Store with Amazon RDS for PostgreSQL to automate password rotation.
Show Answer
Correct Answer: C
Explanation: AWS Secrets Manager integrates natively with Amazon RDS for PostgreSQL to securely store the master user credentials and automatically rotate the password on a defined schedule (for example, every 30 days). This is a managed solution that minimizes operational overhead compared to building custom Lambda rotations, manual CLI changes, or using Parameter Store, which does not provide native, automated RDS password rotation.
Question 359
A company has multiple AWS accounts in an organization in AWS Organizations that different business units use. The company has multiple offices around the world. The company needs to update security group rules to allow new office CIDR ranges or to remove old CIDR ranges across the organization. The company wants to centralize the management of security group rules to minimize the administrative overhead that updating CIDR ranges requires.
Which solution will meet these requirements MOST cost-effectively?
A. Create VPC security groups in the organization's management account. Update the security groups when a CIDR range update is necessary.
B. Create a VPC customer managed prefix list that contains the list of CIDRs. Use AWS Resource Access Manager (AWS RAM) to share the prefix list across the organization. Use the prefix list in the security groups across the organization.
C. Create an AWS managed prefix list. Use an AWS Security Hub policy to enforce the security group update across the organization. Use an AWS Lambda function to update the prefix list automatically when the CIDR ranges change.
D. Create security groups in a central administrative AWS account. Create an AWS Firewall Manager common security group policy for the whole organization. Select the previously created security groups as primary groups in the policy.
Show Answer
Correct Answer: B
Explanation: A customer managed VPC prefix list centralizes CIDR ranges so security groups can reference the list instead of individual CIDRs. Sharing the prefix list across all AWS accounts with AWS RAM allows organization-wide reuse. When CIDRs change, updating the prefix list automatically updates all associated security group rules, minimizing administrative overhead and avoiding extra services, making it the most cost-effective solution.
Question 360
A company runs a website that stores images of historical events. Website users need the ability to search and view images based on the year that the event in the image occurred. On average, users request each image only once or twice a year. The company wants a highly available solution to store and deliver the images to users.
Which solution will meet these requirements MOST cost-effectively?
A. Store images in Amazon Elastic Block Store (Amazon EBS). Use a web server that runs on Amazon EC2.
B. Store images in Amazon Elastic File System (Amazon EFS). Use a web server that runs on Amazon EC2.
C. Store images in Amazon S3 Standard. Use S3 Standard to directly deliver images by using a static website.
D. Store images in Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Use S3 Standard-IA to directly deliver images by using a static website.
Show Answer
Correct Answer: D
Explanation: The images are accessed very infrequently (once or twice per year per image), so a storage class optimized for infrequent access is most cost-effective. Amazon S3 provides high durability and availability and can directly serve content via a static website, eliminating the need for EC2 or file/block storage. S3 Standard-IA has significantly lower storage cost than S3 Standard, and the occasional retrieval fees are minimal given the low access frequency, making option D the most cost-effective solution.
Question 361
A company hosts an application on Amazon EC2 On-Demand Instances in an Auto Scaling group. Application peak hours occur at the same time each day. Application users report slow application performance at the start of peak hours. The application performs normally 2-3 hours after peak hours begin. The company wants to ensure that the application works properly at the start of peak hours.
Which solution will meet these requirements?
A. Configure an Application Load Balancer to distribute traffic properly to the instances.
B. Configure a dynamic scaling policy for the Auto Scaling group to launch new instances based on memory utilization.
C. Configure a dynamic scaling policy for the Auto Scaling group to launch new instances based on CPU utilization.
D. Configure a scheduled scaling policy for the Auto Scaling group to launch new instances before peak hours.
Show Answer
Correct Answer: D
Explanation: Peak hours occur at the same predictable time each day, and performance is slow only at the start of peak hours because new instances are not ready yet. A scheduled scaling policy can proactively launch instances before peak hours so capacity is already available when traffic increases. Dynamic scaling reacts after load rises and can be too slow, and a load balancer alone does not add capacity.
Question 362
A company maintains an Amazon RDS database that maps users to cost centers. The company has accounts in an organization in AWS Organizations. The company needs a solution that will tag all resources that are created in a specific AWS account in the organization. The solution must tag each resource with the cost center ID of the user who created the resource.
Which solution will meet these requirements?
A. Move the specific AWS account to a new organizational unit (OU) in Organizations from the management account. Create a service control policy (SCP) that requires all existing resources to have the correct cost center tag before the resources are created. Apply the SCP to the new OU.
B. Create an AWS Lambda function to tag the resources after the Lambda function looks up the appropriate cost center from the RDS database. Configure an Amazon EventBridge rule that reacts to AWS CloudTrail events to invoke the Lambda function.
C. Create an AWS CloudFormation stack to deploy an AWS Lambda function. Configure the Lambda function to look up the appropriate cost center from the RDS database and to tag resources. Create an Amazon EventBridge scheduled rule to invoke the CloudFormation stack.
D. Create an AWS Lambda function to tag the resources with a default value. Configure an Amazon EventBridge rule that reacts to AWS CloudTrail events to invoke the Lambda function when a resource is missing the cost center tag.
Show Answer
Correct Answer: B
Explanation: The requirement is to automatically tag all newly created resources in a specific AWS account with the cost center ID of the user who created them, using an existing RDS database that maps users to cost centers. Service control policies (SCPs) cannot apply tags or look up external data, so option A cannot meet the requirement. Option B uses CloudTrail events to detect resource creation and an EventBridge rule to invoke a Lambda function, which can look up the creator’s user identity, query the RDS database for the correct cost center, and tag the resource dynamically at creation time. Option C relies on scheduled execution and CloudFormation, which is not appropriate for per‑resource, real‑time tagging. Option D applies only a default tag value and does not meet the requirement for user‑specific cost center tagging.
Question 363
A company uses AWS Cost Explorer to monitor its AWS costs. The company notices that Amazon Elastic Block Store (Amazon EBS) storage and snapshot costs increase every month. However, the company does not purchase additional EBS storage every month. The company wants to optimize monthly costs for its current storage usage.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use logs in Amazon CloudWatch Logs to monitor the storage utilization of Amazon EBS. Use Amazon EBS Elastic Volumes to reduce the size of the EBS volumes.
B. Use a custom script to monitor space usage. Use Amazon EBS Elastic Volumes to reduce the size of the EBS volumes.
C. Delete all expired and unused snapshots to reduce snapshot costs.
D. Delete all nonessential snapshots. Use Amazon Data Lifecycle Manager to create and manage the snapshots according to the company's snapshot policy requirements.
Show Answer
Correct Answer: D
Explanation: The increasing monthly EBS costs without adding new volumes are most commonly caused by accumulating snapshots. Deleting nonessential snapshots immediately reduces storage costs, and using Amazon Data Lifecycle Manager automates snapshot creation and deletion based on policies. This provides ongoing cost optimization with minimal operational overhead compared to manual scripts or monitoring solutions.
Question 364
A company is moving its data and applications to AWS during a multiyear migration project. The company wants to securely access data on Amazon S3 from the company's AWS Region and from the company's on-premises location. The data must not traverse the internet. The company has established an AWS Direct Connect connection between its Region and its on-premises location.
Which solution will meet these requirements?
A. Create gateway endpoints for Amazon S3. Use the gateway endpoints to securely access the data from the Region and the on-premises location.
B. Create a gateway in AWS Transit Gateway to access Amazon S3 securely from the Region and the on-premises location.
C. Create interface endpoints for Amazon S3. Use the interface endpoints to securely access the data from the Region and the on-premises location.
D. Use an AWS Key Management Service (AWS KMS) key to access the data securely from the Region and the on-premises location.
Show Answer
Correct Answer: C
Explanation: The requirement is private access to Amazon S3 from both an AWS Region (VPC) and an on-premises location over AWS Direct Connect, without traversing the internet. Amazon S3 gateway endpoints only support access from within the VPC where they are created and do not support on‑premises access. AWS Transit Gateway does not provide native S3 access, and AWS KMS is unrelated to network connectivity. Amazon S3 interface endpoints (AWS PrivateLink) provide private IP–based access to S3 and explicitly support access from on‑premises networks over VPN or Direct Connect while keeping traffic on the AWS network. Therefore, creating interface endpoints for Amazon S3 meets all requirements.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.