A company recently migrated its web application to the AWS Cloud. The company uses an Amazon EC2 instance to run multiple processes to host the application. The processes include an Apache web server that serves static content. The Apache web server makes requests to a PHP application that uses a local Redis server for user sessions.
The company wants to redesign the architecture to be highly available and to use AWS managed solutions.
Which solution will meet these requirements?
A. Use AWS Elastic Beanstalk to host the static content and the PHP application. Configure Elastic Beanstalk to deploy its EC2 instance into a public subnet. Assign a public IP address.
B. Use AWS Lambda to host the static content and the PHP application. Use an Amazon API Gateway REST API to proxy requests to the Lambda function. Set the API Gateway CORS configuration to respond to the domain name. Configure Amazon ElastiCache for Redis to handle session information.
C. Keep the backend code on the EC2 instance. Create an Amazon ElastiCache for Redis cluster that has Multi-AZ enabled. Configure the ElastiCache for Redis cluster in cluster mode. Copy the frontend resources to Amazon S3. Configure the backend code to reference the EC2 instance.
D. Configure an Amazon CloudFront distribution with an Amazon S3 endpoint to an S3 bucket that is configured to host the static content. Configure an Application Load Balancer that targets an Amazon Elastic Container Service (Amazon ECS) service that runs AWS Fargate tasks for the PHP application. Configure the PHP application to use an Amazon ElastiCache for Redis cluster that runs in multiple Availability Zones.
Show Answer
Correct Answer: D
Explanation: The goal is a highly available architecture using AWS managed services. Serving static content from Amazon S3 behind CloudFront is the standard managed pattern. Running the PHP application on Amazon ECS with AWS Fargate behind an Application Load Balancer provides managed, highly available compute across Availability Zones. Moving Redis sessions to Amazon ElastiCache for Redis with Multi-AZ removes the single-instance dependency and provides high availability. The other options either misuse services (Lambda for static hosting), retain EC2 as a single point of failure, or rely on Elastic Beanstalk in a way that does not fully address the architecture or static content best practices.
Question 356
A company runs applications on AWS that connect to the company's Amazon RDS database. The applications scale on weekends and at peak times of the year. The company wants to scale the database more effectively for its applications that connect to the database.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon DynamoDB with connection pooling with a target group configuration for the database. Change the applications to use the DynamoDB endpoint.
B. Use Amazon RDS Proxy with a target group for the database. Change the applications to use the RDS Proxy endpoint.
C. Use a custom proxy that runs on Amazon EC2 as an intermediary to the database. Change the applications to use the custom proxy endpoint.
D. Use an AWS Lambda function to provide connection pooling with a target group configuration for the database. Change the applications to use the Lambda function.
Show Answer
Correct Answer: B
Explanation: Amazon RDS Proxy is a fully managed database proxy designed for Amazon RDS. It provides connection pooling and manages large numbers of application connections efficiently, improving scalability with minimal operational overhead. Applications only need to be updated to use the RDS Proxy endpoint. DynamoDB is a different database service and is not a proxy for RDS, a custom EC2 proxy requires ongoing management, and Lambda is not an appropriate connection pooling solution.
Question 357
A company created a new organization in AWS Organizations. The organization has multiple accounts for the company's development teams. The development team members use AWS IAM Identity Center (AWS Single Sign-On) to access the accounts. For each of the company's applications, the development teams must use a predefined application name to tag resources that are created.
A solutions architect needs to design a solution that gives the development team the ability to create resources only if the application name tag has an approved value.
Which solution will meet these requirements?
A. Create an IAM group that has a conditional Allow policy that requires the application name tag to be specified for resources to be created.
B. Create a cross-account role that has a Deny policy for any resource that has the application name tag.
C. Create a resource group in AWS Resource Groups to validate that the tags are applied to all resources in all accounts.
D. Create a tag policy in Organizations that has a list of allowed application names.
Show Answer
Correct Answer: D
Explanation: AWS Organizations tag policies allow organizations to define allowed tag keys and values (such as approved application names) across multiple accounts. When tag policy enforcement is enabled for supported resource types, noncompliant tagging operations are prevented. IAM groups cannot generally enforce tag values for all resource creation across services, the cross-account role option is unrelated, and AWS Resource Groups only help organize and assess resources rather than enforce allowed tag values.
Question 358
A company runs its databases on Amazon RDS for PostgreSQL. The company wants a secure solution to manage the master user password by rotating the password every 30 days.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon EventBridge to schedule a custom AWS Lambda function to rotate the password every 30 days.
B. Use the modify-db-instance command in the AWS CLI to change the password.
C. Integrate AWS Secrets Manager with Amazon RDS for PostgreSQL to automate password rotation.
D. Integrate AWS Systems Manager Parameter Store with Amazon RDS for PostgreSQL to automate password rotation.
Show Answer
Correct Answer: C
Explanation: Amazon RDS integrates with AWS Secrets Manager to securely store and automatically rotate the master user password on a schedule (such as every 30 days) with minimal operational effort. Using Lambda or CLI requires custom automation and maintenance, while Systems Manager Parameter Store does not provide native automated database credential rotation like Secrets Manager.
Question 359
A company has multiple AWS accounts in an organization in AWS Organizations that different business units use. The company has multiple offices around the world. The company needs to update security group rules to allow new office CIDR ranges or to remove old CIDR ranges across the organization. The company wants to centralize the management of security group rules to minimize the administrative overhead that updating CIDR ranges requires.
Which solution will meet these requirements MOST cost-effectively?
A. Create VPC security groups in the organization's management account. Update the security groups when a CIDR range update is necessary.
B. Create a VPC customer managed prefix list that contains the list of CIDRs. Use AWS Resource Access Manager (AWS RAM) to share the prefix list across the organization. Use the prefix list in the security groups across the organization.
C. Create an AWS managed prefix list. Use an AWS Security Hub policy to enforce the security group update across the organization. Use an AWS Lambda function to update the prefix list automatically when the CIDR ranges change.
D. Create security groups in a central administrative AWS account. Create an AWS Firewall Manager common security group policy for the whole organization. Select the previously created security groups as primary groups in the policy.
Show Answer
Correct Answer: B
Explanation: A customer managed VPC prefix list lets you define shared CIDR ranges once and reference the prefix list in security group rules. By sharing the prefix list across the AWS Organization with AWS RAM, all accounts can use the same centralized list. Updating the prefix list automatically affects all security groups that reference it, minimizing administrative overhead and cost. Option A cannot centrally use security groups across VPCs/accounts this way. Option C incorrectly refers to AWS managed prefix lists, which are AWS-provided and not editable for custom office CIDRs, and Security Hub is not the enforcement mechanism. Option D uses Firewall Manager for common security group policies, but it is more complex and costly than simply sharing a managed prefix list for centralized CIDR management.
Question 360
A company runs a website that stores images of historical events. Website users need the ability to search and view images based on the year that the event in the image occurred. On average, users request each image only once or twice a year. The company wants a highly available solution to store and deliver the images to users.
Which solution will meet these requirements MOST cost-effectively?
A. Store images in Amazon Elastic Block Store (Amazon EBS). Use a web server that runs on Amazon EC2.
B. Store images in Amazon Elastic File System (Amazon EFS). Use a web server that runs on Amazon EC2.
C. Store images in Amazon S3 Standard. Use S3 Standard to directly deliver images by using a static website.
D. Store images in Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Use S3 Standard-IA to directly deliver images by using a static website.
Show Answer
Correct Answer: D
Explanation: Amazon S3 is the appropriate highly available object storage service for static images. EBS and EFS require EC2 and are more expensive and operationally complex for this use case. Because each image is accessed only once or twice per year, S3 Standard-Infrequent Access provides the same high durability and availability at lower storage cost, with retrieval charges that are outweighed by the very low access frequency. S3 can directly serve static content via static website hosting.
Question 361
A company hosts an application on Amazon EC2 On-Demand Instances in an Auto Scaling group. Application peak hours occur at the same time each day. Application users report slow application performance at the start of peak hours. The application performs normally 2-3 hours after peak hours begin. The company wants to ensure that the application works properly at the start of peak hours.
Which solution will meet these requirements?
A. Configure an Application Load Balancer to distribute traffic properly to the instances.
B. Configure a dynamic scaling policy for the Auto Scaling group to launch new instances based on memory utilization.
C. Configure a dynamic scaling policy for the Auto Scaling group to launch new instances based on CPU utilization.
D. Configure a scheduled scaling policy for the Auto Scaling group to launch new instances before peak hours.
Show Answer
Correct Answer: D
Explanation: Because peak demand occurs at the same time every day, the workload is predictable. Scheduled scaling allows the Auto Scaling group to launch additional EC2 instances before the expected peak begins, ensuring capacity is already available when users arrive. Dynamic scaling reacts only after metrics such as CPU or memory increase, which can lead to delays while new instances launch. An Application Load Balancer distributes traffic but does not add capacity.
Question 362
A company maintains an Amazon RDS database that maps users to cost centers. The company has accounts in an organization in AWS Organizations. The company needs a solution that will tag all resources that are created in a specific AWS account in the organization. The solution must tag each resource with the cost center ID of the user who created the resource.
Which solution will meet these requirements?
A. Move the specific AWS account to a new organizational unit (OU) in Organizations from the management account. Create a service control policy (SCP) that requires all existing resources to have the correct cost center tag before the resources are created. Apply the SCP to the new OU.
B. Create an AWS Lambda function to tag the resources after the Lambda function looks up the appropriate cost center from the RDS database. Configure an Amazon EventBridge rule that reacts to AWS CloudTrail events to invoke the Lambda function.
C. Create an AWS CloudFormation stack to deploy an AWS Lambda function. Configure the Lambda function to look up the appropriate cost center from the RDS database and to tag resources. Create an Amazon EventBridge scheduled rule to invoke the CloudFormation stack.
D. Create an AWS Lambda function to tag the resources with a default value. Configure an Amazon EventBridge rule that reacts to AWS CloudTrail events to invoke the Lambda function when a resource is missing the cost center tag.
Show Answer
Correct Answer: B
Explanation: The correct solution is to use Amazon EventBridge with AWS CloudTrail resource creation events to invoke a Lambda function. The Lambda can identify the IAM principal who created the resource from the event, look up that user's cost center in the Amazon RDS database, and apply the appropriate tag to the newly created resource. SCPs cannot dynamically query an RDS database or apply tags. A scheduled CloudFormation deployment does not perform event-driven tagging, and tagging with a default value does not satisfy the requirement to use the creator's cost center.
Question 363
A company uses AWS Cost Explorer to monitor its AWS costs. The company notices that Amazon Elastic Block Store (Amazon EBS) storage and snapshot costs increase every month. However, the company does not purchase additional EBS storage every month. The company wants to optimize monthly costs for its current storage usage.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use logs in Amazon CloudWatch Logs to monitor the storage utilization of Amazon EBS. Use Amazon EBS Elastic Volumes to reduce the size of the EBS volumes.
B. Use a custom script to monitor space usage. Use Amazon EBS Elastic Volumes to reduce the size of the EBS volumes.
C. Delete all expired and unused snapshots to reduce snapshot costs.
D. Delete all nonessential snapshots. Use Amazon Data Lifecycle Manager to create and manage the snapshots according to the company's snapshot policy requirements.
Show Answer
Correct Answer: D
Explanation: The increasing costs are driven by both EBS storage and especially accumulating snapshots. Resizing EBS volumes is not the primary issue, and Elastic Volumes does not support shrinking volumes. Deleting unnecessary snapshots reduces current costs, but automating snapshot creation and retention with Amazon Data Lifecycle Manager provides ongoing cost optimization with the least operational overhead by enforcing lifecycle policies.
Question 364
A company is moving its data and applications to AWS during a multiyear migration project. The company wants to securely access data on Amazon S3 from the company's AWS Region and from the company's on-premises location. The data must not traverse the internet. The company has established an AWS Direct Connect connection between its Region and its on-premises location.
Which solution will meet these requirements?
A. Create gateway endpoints for Amazon S3. Use the gateway endpoints to securely access the data from the Region and the on-premises location.
B. Create a gateway in AWS Transit Gateway to access Amazon S3 securely from the Region and the on-premises location.
C. Create interface endpoints for Amazon S3. Use the interface endpoints to securely access the data from the Region and the on-premises location.
D. Use an AWS Key Management Service (AWS KMS) key to access the data securely from the Region and the on-premises location.
Show Answer
Correct Answer: C
Explanation: Amazon S3 interface VPC endpoints (AWS PrivateLink for S3) support private access from both VPCs and on-premises environments over AWS Direct Connect or VPN. Gateway endpoints for S3 only work for resources within the VPC and cannot be accessed from on-premises networks. AWS Transit Gateway is not an S3 endpoint, and AWS KMS is for encryption key management, not network connectivity.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.