A company runs several websites on AWS for its different brands. Each website generates tens of gigabytes of web traffic logs each day. A solutions architect needs to design a scalable solution to give the company's developers the ability to analyze traffic patterns across all the company's websites. This analysis by the developers will occur on demand once a week over the course of several months. The solution must support queries with standard SQL.
Which solution will meet these requirements MOST cost-effectively?
A. Store the logs in Amazon S3. Use Amazon Athena tor analysis.
B. Store the logs in Amazon RDS. Use a database client for analysis.
C. Store the logs in Amazon OpenSearch Service. Use OpenSearch Service for analysis.
D. Store the logs in an Amazon EMR cluster Use a supported open-source framework for SQL-based analysis.
Show Answer
Correct Answer: A
Explanation: Storing the logs in Amazon S3 and analyzing them with Amazon Athena is the most cost-effective solution. S3 provides highly scalable, low-cost storage for large volumes of log data, and Athena is a serverless service that supports standard SQL and charges only per query scanned. Because the analysis is performed on demand once a week, there is no need to pay for always-on infrastructure, making this approach cheaper than running databases, OpenSearch clusters, or EMR clusters.
Question 376
A company wants to monitor its AWS costs for financial review. The cloud operations team is designing an architecture in the AWS Organizations management account to query AWS Cost and Usage Reports for all member accounts. The team must run this query once a month and provide a detailed analysis of the bill.
Which solution is the MOST scalable and cost-effective way to meet these requirements?
A. Enable Cost and Usage Reports in the management account. Deliver reports to Amazon Kinesis. Use Amazon EMR for analysis.
B. Enable Cost and Usage Reports in the management account. Deliver the reports to Amazon S3 Use Amazon Athena for analysis.
C. Enable Cost and Usage Reports for member accounts. Deliver the reports to Amazon S3 Use Amazon Redshift for analysis.
D. Enable Cost and Usage Reports for member accounts. Deliver the reports to Amazon Kinesis. Use Amazon QuickSight tor analysis.
Show Answer
Correct Answer: B
Explanation: AWS Cost and Usage Reports (CUR) are centrally generated in the AWS Organizations management account and are natively delivered to Amazon S3. For a query that runs only once per month, storing CUR in S3 and querying with Amazon Athena is the most scalable and cost-effective option because Athena is serverless and charges only per data scanned. EMR and Kinesis are unnecessary and costly for infrequent batch analysis, Redshift would require provisioning and ongoing cost, and enabling CUR per member account adds operational overhead without benefit.
Question 377
A company has an application workflow that uses an AWS Lambda function to download and decrypt files from Amazon S3. These files are encrypted using AWS Key Management Service (AWS KMS) keys. A solutions architect needs to design a solution that will ensure the required permissions are set correctly.
Which combination of actions accomplish this? (Choose two.)
A. Attach the kms:decrypt permission to the Lambda function’s resource policy
B. Grant the decrypt permission for the Lambda IAM role in the KMS key's policy
C. Grant the decrypt permission for the Lambda resource policy in the KMS key's policy.
D. Create a new IAM policy with the kms:decrypt permission and attach the policy to the Lambda function.
E. Create a new IAM role with the kms:decrypt permission and attach the execution role to the Lambda function.
Show Answer
Correct Answer: B, E
Explanation: To allow a Lambda function to decrypt KMS‑encrypted S3 objects, two permission layers are required. First, the KMS key policy must explicitly trust the Lambda function’s IAM execution role, which is accomplished by granting that role decrypt permission in the key policy (B). Second, the Lambda function must run with an IAM execution role that includes the kms:Decrypt permission, which is achieved by creating or using an IAM role with that permission and attaching it to the Lambda function (E). Resource‑based Lambda policies do not control what the function can do, and permissions are attached to IAM roles, not directly to the function.
Question 378
A company is building a new furniture inventory application. The company has deployed the application on a fleet ofAmazon EC2 instances across multiple Availability Zones. The EC2 instances run behind an Application Load Balancer (ALB) in their VPC.
A solutions architect has observed that incoming traffic seems to favor one EC2 instance, resulting in latency for some requests.
What should the solutions architect do to resolve this issue?
A. Disable session affinity (sticky sessions) on the ALB
B. Replace the ALB with a Network Load Balancer
C. Increase the number of EC2 instances in each Availability Zone
D. Adjust the frequency of the health checks on the ALB's target group
Show Answer
Correct Answer: A
Explanation: The behavior described—traffic favoring a single EC2 instance behind an Application Load Balancer—is a classic symptom of session affinity (sticky sessions) being enabled. Sticky sessions cause the ALB to route requests from the same client to the same backend instance, which can overload one instance and increase latency while others remain underutilized. Disabling session affinity allows the ALB to distribute requests evenly across all healthy EC2 instances, resolving the imbalance. The other options do not directly address uneven request distribution caused by stickiness.
Question 379
A company collects and shares research data with the company's employees all over the world. The company wants to collect and store the data in an Amazon S3 bucket and process the data in the AWS Cloud. The company will share the data with the company's employees. The company needs a secure solution in the AWS Cloud that minimizes operational overhead.
Which solution will meet these requirements?
A. Use an AWS Lambda function to create an S3 presigned URL. Instruct employees to use the URL.
B. Create an IAM user for each employee. Create an IAM policy for each employee to allow S3 access. Instruct employees to use the AWS Management Console.
C. Create an S3 File Gateway. Create a share for uploading and a share for downloading. Allow employees to mount shares on their local computers to use S3 File Gateway.
D. Configure AWS Transfer Family SFTP endpoints. Select the custom identity provider options. Use AWS Secrets Manager to manage the user credentials Instruct employees to use Transfer Family.
Show Answer
Correct Answer: A
Explanation: The requirement is a secure solution that minimizes operational overhead for sharing S3 data with employees globally. Using S3 presigned URLs generated by a Lambda function provides temporary, secure access without managing IAM users, credentials, servers, gateways, or client software. Lambda and S3 are fully managed services, and presigned URLs scale easily for global access with minimal administration. Other options introduce higher overhead through user management (IAM users), infrastructure management (S3 File Gateway), or credential and endpoint management (AWS Transfer Family).
Question 380
A solutions architect is designing a new service behind Amazon API Gateway. The request patterns for the service will be unpredictable and can change suddenly from 0 requests to over 500 per second. The total size of the data that needs to be persisted in a backend database is currently less than 1 GB with unpredictable future growth. Data can be queried using simple key-value requests.
Which combination ofAWS services would meet these requirements? (Choose two.)
A. AWS Fargate
B. AWS Lambda
C. Amazon DynamoDB
D. Amazon EC2 Auto Scaling
E. MySQL-compatible Amazon Aurora
Show Answer
Correct Answer: B, C
Explanation: The service must handle sudden, unpredictable spikes from zero to hundreds of requests per second with no pre-provisioning. AWS Lambda provides automatic, near-instant scaling and integrates natively with Amazon API Gateway, making it ideal for bursty request patterns. For persistence, the data is small today, may grow unpredictably, and is accessed via simple key-value queries. Amazon DynamoDB is a fully managed, serverless key-value store that scales automatically in both storage and throughput, fitting these requirements better than relational databases or capacity-based compute options.
Question 381
A development team is creating an event-based application that uses AWS Lambda functions. Events will be generated when files are added to an Amazon S3 bucket. The development team currently has Amazon Simple Notification Service (Amazon SNS) configured as the event target from Amazon S3.
What should a solutions architect do to process the events from Amazon S3 in a scalable way?
A. Create an SNS subscription that processes the event in Amazon Elastic Container Service (Amazon ECS) before the event runs in Lambda.
B. Create an SNS subscription that processes the event in Amazon Elastic Kubernetes Service (Amazon EKS) before the event runs in Lambda
C. Create an SNS subscription that sends the event to Amazon Simple Queue Service (Amazon SQS). Configure the SOS queue to trigger a Lambda function.
D. Create an SNS subscription that sends the event to AWS Server Migration Service (AWS SMS). Configure the Lambda function to poll from the SMS event.
Show Answer
Correct Answer: C
Explanation: To process Amazon S3 events in a scalable and reliable way, the recommended pattern is SNS to SQS to Lambda. Subscribing an Amazon SQS queue to the SNS topic decouples event ingestion from processing, buffers bursts of events, and enables Lambda to scale horizontally by polling the queue. ECS and EKS add unnecessary operational complexity for this use case, and AWS Server Migration Service is unrelated to event processing.
Question 382
A company uses Amazon FSx for NetApp ONTAP in its primary AWS Region for CIFS and NFS file shares. Applications that run on Amazon EC2 instances access the file shares. The company needs a storage disaster recovery (DR) solution in a secondary Region. The data that is replicated in the secondary Region needs to be accessed by using the same protocols as the primary Region.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an AWS Lambda function to copy the data to an Amazon S3 bucket. Replicate the S3 bucket to the secondary Region.
B. Create a backup of the FSx for ONTAP volumes by using AWS Backup. Copy the volumes to the secondary Region. Create a new FSx for ONTAP instance from the backup.
C. Create an FSx for ONTAP instance in the secondary Region. Use NetApp SnapMirror to replicate data from the primary Region to the secondary Region.
D. Create an Amazon Elastic File System (Amazon EFS) volume. Migrate the current data to the volume. Replicate the volume to the secondary Region.
Show Answer
Correct Answer: C
Explanation: Amazon FSx for NetApp ONTAP natively supports NetApp SnapMirror for scheduled, continuous replication between ONTAP file systems, including cross-Region. This provides low RPO/RTO disaster recovery while preserving CIFS (SMB) and NFS access with minimal operational overhead. Other options either do not support the required protocols, provide only backup/restore (not replication), or require migration to a different service.
Question 383
A company collects 10 GB of telemetry data daily from various machines. The company stores the data in an Amazon S3 bucket in a source data account.
The company has hired several consulting agencies to use this data for analysis. Each agency needs read access to the data for its analysts. The company must share the data from the source data account by choosing a solution that maximizes security and operational efficiency.
Which solution will meet these requirements?
A. Configure S3 global tables to replicate data for each agency.
B. Make the S3 bucket public for a limited time. Inform only the agencies.
C. Configure cross-account access for the S3 bucket to the accounts that the agencies own.
D. Set up an IAM user for each analyst in the source data account. Grant each user access to the S3 bucket.
Show Answer
Correct Answer: C
Explanation: The company should grant cross-account read access to the S3 bucket to the AWS accounts owned by the consulting agencies. This follows AWS best practices by keeping data centralized, avoiding duplication, and allowing each agency to manage access for its own analysts. It maximizes security through least privilege and bucket policies, and maximizes operational efficiency by avoiding public access or managing individual IAM users in the source account.
Question 384
A solutions architect is creating a data processing job that runs once daily and can take up to 2 hours to complete. If the job is interrupted, it has to restart from the beginning.
How should the solutions architect address this issue in the MOST cost-effective manner?
A. Create a script that runs locally on an Amazon EC2 Reserved Instance that is triggered by a cron job.
B. Create an AWS Lambda function triggered by an Amazon EventBridge scheduled event.
C. Use an Amazon Elastic Container Service (Amazon ECS) Fargate task triggered by an Amazon EventBridge scheduled event.
D. Use an Amazon Elastic Container Service (Amazon ECS) task running on Amazon EC2 triggered by an Amazon EventBridge scheduled event.
Show Answer
Correct Answer: C
Explanation: The job runs once daily, can take up to 2 hours, and must restart if interrupted. AWS Lambda is not suitable because it has a maximum execution time of 15 minutes. Running on EC2 (either Reserved Instance or ECS on EC2) is less cost-effective because you pay for the instance even when the job is not running. Amazon ECS with AWS Fargate allows running a scheduled, long-running container task without managing servers and charges only for vCPU and memory while the task runs, making it the most cost-effective and appropriate solution.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.