A company runs its applications on Amazon EC2 instances. The company performs periodic financial assessments of its AWS costs. The company recently identified unusual spending.
The company needs a solution to prevent unusual spending. The solution must monitor costs and notify responsible stakeholders in the event of unusual spending.
Which solution will meet these requirements?
A. Use an AWS Budgets template to create a zero spend budget.
B. Create an AWS Cost Anomaly Detection monitor in the AWS Billing and Cost Management console.
C. Create AWS Pricing Calculator estimates for the current running workload pricing details.
D. Use Amazon CloudWatch to monitor costs and to identify unusual spending.
Show Answer
Correct Answer: B
Explanation: AWS Cost Anomaly Detection uses machine learning to continuously monitor AWS spend, detect unusual cost patterns, and send alerts to designated stakeholders. AWS Budgets tracks budget thresholds rather than detecting anomalies, AWS Pricing Calculator is for estimating costs before deployment, and Amazon CloudWatch does not directly monitor AWS billing anomalies.
Question 350
A company performs tests on an application that uses an Amazon DynamoDB table. The tests run for 4 hours once a week. The company knows how many read and write operations the application performs to the table each second during the tests. The company does not currently use DynamoDB for any other use case. A solutions architect needs to optimize the costs for the table.
Which solution will meet these requirements?
A. Choose on-demand mode. Update the read and write capacity units appropriately.
B. Choose provisioned mode. Update the read and write capacity units appropriately.
C. Purchase DynamoDB reserved capacity for a 1-year term.
D. Purchase DynamoDB reserved capacity for a 3-year term.
Show Answer
Correct Answer: B
Explanation: Provisioned capacity is the best fit because the workload is predictable: the company knows the required read/write throughput during the weekly 4-hour test window. In provisioned mode, the table's RCUs/WCUs can be increased before testing and reduced afterward (or managed with scheduled scaling), minimizing cost while meeting performance. Option A is incorrect because on-demand mode does not use manually configured read/write capacity units. Reserved capacity (C/D) is intended for long-term consistently provisioned capacity and is not cost-effective for a workload that runs only a few hours each week.
Question 351
A startup company is hosting a website for its customers on an Amazon EC2 instance. The website consists of a stateless Python application and a MySQL database. The website serves only a small amount of traffic. The company is concerned about the reliability of the instance and needs to migrate to a highly available architecture. The company cannot modify the application code.
Which combination of actions should a solutions architect take to achieve high availability for the website? (Choose two.)
A. Provision an internet gateway in each Availability Zone in use.
B. Migrate the database to an Amazon RDS for MySQL Multi-AZ DB instance.
C. Migrate the database to Amazon DynamoDB, and enable DynamoDB auto scaling.
D. Use AWS DataSync to synchronize the database data across multiple EC2 instances.
E. Create an Application Load Balancer to distribute traffic to an Auto Scaling group of EC2 instances that are distributed across two Availability Zones.
Show Answer
Correct Answer: B, E
Explanation: Use Amazon RDS for MySQL Multi-AZ to provide high availability and automatic failover for the MySQL database without changing application code. Because the application is stateless, place EC2 instances in an Auto Scaling group spanning two Availability Zones behind an Application Load Balancer to provide highly available application hosting. An internet gateway is attached to a VPC, not per Availability Zone. Migrating to DynamoDB would require application changes, and DataSync is not a high-availability database replication solution.
Question 352
A company has customers located across the world. The company wants to use automation to secure its systems and network infrastructure. The company's security team must be able to track and audit all incremental changes to the infrastructure.
Which solution will meet these requirements?
A. Use AWS Organizations to set up the infrastructure. Use AWS Config to track changes.
B. Use AWS CloudFormation to set up the infrastructure. Use AWS Config to track changes.
C. Use AWS Organizations to set up the infrastructure. Use AWS Service Catalog to track changes.
D. Use AWS CloudFormation to set up the infrastructure. Use AWS Service Catalog to track changes.
Show Answer
Correct Answer: B
Explanation: AWS CloudFormation provides infrastructure as code for automated, repeatable provisioning of systems and network infrastructure. AWS Config continuously records configuration changes to AWS resources, enabling tracking, auditing, and compliance over time. AWS Organizations manages multiple AWS accounts, not infrastructure provisioning, and AWS Service Catalog governs approved products rather than tracking incremental infrastructure changes.
Question 353
A company is relocating its data center and wants to securely transfer 50 TB of data to AWS within 2 weeks. The existing data center has a Site-to-Site VPN connection to AWS that is 90% utilized.
Which AWS service should a solutions architect use to meet these requirements?
A. AWS DataSync with a VPC endpoint
B. AWS Direct Connect
C. AWS Snowball Edge Storage Optimized
D. AWS Storage Gateway
Show Answer
Correct Answer: C
Explanation: AWS Snowball Edge Storage Optimized is designed for secure offline transfer of large datasets when existing network connectivity is constrained. The Site-to-Site VPN is already 90% utilized, making network-based options like DataSync impractical. Direct Connect typically requires provisioning time and may not be available within the required two-week window. Storage Gateway is for hybrid storage access, not bulk one-time migration.
Question 354
A company runs a web application on Amazon EC2 instances in an Auto Scaling group that has a target group. The company designed the application to work with session affinity (sticky sessions) for a better user experience.
The application must be available publicly over the internet as an endpoint. A WAF must be applied to the endpoint for additional security. Session affinity (sticky sessions) must be configured on the endpoint.
Which combination of steps will meet these requirements? (Choose two.)
A. Create a public Network Load Balancer. Specify the application target group.
B. Create a Gateway Load Balancer. Specify the application target group.
C. Create a public Application Load Balancer. Specify the application target group.
D. Create a second target group. Add Elastic IP addresses to the EC2 instances.
E. Create a web ACL in AWS WAF. Associate the web ACL with the endpoint
Show Answer
Correct Answer: C, E
Explanation: A public Application Load Balancer is the appropriate internet-facing endpoint for a web application that requires cookie-based session affinity (sticky sessions) with an EC2 Auto Scaling target group. AWS WAF integrates with an Application Load Balancer by associating a web ACL to the ALB, providing the required application-layer protection. A Gateway Load Balancer is for virtual appliances, not web traffic distribution. A second target group with Elastic IPs is unrelated. Although Network Load Balancer supports some forms of stickiness, ALB is the appropriate choice here because of its application-layer features and WAF integration.
Question 355
A company recently migrated its web application to the AWS Cloud. The company uses an Amazon EC2 instance to run multiple processes to host the application. The processes include an Apache web server that serves static content. The Apache web server makes requests to a PHP application that uses a local Redis server for user sessions.
The company wants to redesign the architecture to be highly available and to use AWS managed solutions.
Which solution will meet these requirements?
A. Use AWS Elastic Beanstalk to host the static content and the PHP application. Configure Elastic Beanstalk to deploy its EC2 instance into a public subnet. Assign a public IP address.
B. Use AWS Lambda to host the static content and the PHP application. Use an Amazon API Gateway REST API to proxy requests to the Lambda function. Set the API Gateway CORS configuration to respond to the domain name. Configure Amazon ElastiCache for Redis to handle session information.
C. Keep the backend code on the EC2 instance. Create an Amazon ElastiCache for Redis cluster that has Multi-AZ enabled. Configure the ElastiCache for Redis cluster in cluster mode. Copy the frontend resources to Amazon S3. Configure the backend code to reference the EC2 instance.
D. Configure an Amazon CloudFront distribution with an Amazon S3 endpoint to an S3 bucket that is configured to host the static content. Configure an Application Load Balancer that targets an Amazon Elastic Container Service (Amazon ECS) service that runs AWS Fargate tasks for the PHP application. Configure the PHP application to use an Amazon ElastiCache for Redis cluster that runs in multiple Availability Zones.
Show Answer
Correct Answer: D
Explanation: The goal is a highly available architecture using AWS managed services. Serving static content from Amazon S3 behind CloudFront is the standard managed pattern. Running the PHP application on Amazon ECS with AWS Fargate behind an Application Load Balancer provides managed, highly available compute across Availability Zones. Moving Redis sessions to Amazon ElastiCache for Redis with Multi-AZ removes the single-instance dependency and provides high availability. The other options either misuse services (Lambda for static hosting), retain EC2 as a single point of failure, or rely on Elastic Beanstalk in a way that does not fully address the architecture or static content best practices.
Question 356
A company runs applications on AWS that connect to the company's Amazon RDS database. The applications scale on weekends and at peak times of the year. The company wants to scale the database more effectively for its applications that connect to the database.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon DynamoDB with connection pooling with a target group configuration for the database. Change the applications to use the DynamoDB endpoint.
B. Use Amazon RDS Proxy with a target group for the database. Change the applications to use the RDS Proxy endpoint.
C. Use a custom proxy that runs on Amazon EC2 as an intermediary to the database. Change the applications to use the custom proxy endpoint.
D. Use an AWS Lambda function to provide connection pooling with a target group configuration for the database. Change the applications to use the Lambda function.
Show Answer
Correct Answer: B
Explanation: Amazon RDS Proxy is a fully managed database proxy designed for Amazon RDS. It provides connection pooling and manages large numbers of application connections efficiently, improving scalability with minimal operational overhead. Applications only need to be updated to use the RDS Proxy endpoint. DynamoDB is a different database service and is not a proxy for RDS, a custom EC2 proxy requires ongoing management, and Lambda is not an appropriate connection pooling solution.
Question 357
A company created a new organization in AWS Organizations. The organization has multiple accounts for the company's development teams. The development team members use AWS IAM Identity Center (AWS Single Sign-On) to access the accounts. For each of the company's applications, the development teams must use a predefined application name to tag resources that are created.
A solutions architect needs to design a solution that gives the development team the ability to create resources only if the application name tag has an approved value.
Which solution will meet these requirements?
A. Create an IAM group that has a conditional Allow policy that requires the application name tag to be specified for resources to be created.
B. Create a cross-account role that has a Deny policy for any resource that has the application name tag.
C. Create a resource group in AWS Resource Groups to validate that the tags are applied to all resources in all accounts.
D. Create a tag policy in Organizations that has a list of allowed application names.
Show Answer
Correct Answer: D
Explanation: AWS Organizations tag policies allow organizations to define allowed tag keys and values (such as approved application names) across multiple accounts. When tag policy enforcement is enabled for supported resource types, noncompliant tagging operations are prevented. IAM groups cannot generally enforce tag values for all resource creation across services, the cross-account role option is unrelated, and AWS Resource Groups only help organize and assess resources rather than enforce allowed tag values.
Question 358
A company runs its databases on Amazon RDS for PostgreSQL. The company wants a secure solution to manage the master user password by rotating the password every 30 days.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon EventBridge to schedule a custom AWS Lambda function to rotate the password every 30 days.
B. Use the modify-db-instance command in the AWS CLI to change the password.
C. Integrate AWS Secrets Manager with Amazon RDS for PostgreSQL to automate password rotation.
D. Integrate AWS Systems Manager Parameter Store with Amazon RDS for PostgreSQL to automate password rotation.
Show Answer
Correct Answer: C
Explanation: Amazon RDS integrates with AWS Secrets Manager to securely store and automatically rotate the master user password on a schedule (such as every 30 days) with minimal operational effort. Using Lambda or CLI requires custom automation and maintenance, while Systems Manager Parameter Store does not provide native automated database credential rotation like Secrets Manager.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.