A company is launching a new application that requires a structured database to store user profiles, application settings, and transactional data. The database must be scalable with application traffic and must offer backups.
Which solution will meet these requirements MOST cost-effectively?
A. Deploy a self-managed database on Amazon EC2 instances by using open source software. Use Spot Instances for cost optimization. Configure automated backups to Amazon S3.
B. Use Amazon RDS. Use on-demand capacity mode for the database with General Purpose SSD storage. Configure automatic backups with a retention period of 7 days.
C. Use Amazon Aurora Serverless for the database. Use serverless capacity scaling. Configure automated backups to Amazon S3.
D. Deploy a self-managed NoSQL database on Amazon EC2 instances. Use Reserved Instances for cost optimization. Configure automated backups directly to Amazon S3 Glacier Flexible Retrieval.
Show Answer
Correct Answer: C
Explanation: The application requires a structured (relational) database that can automatically scale with traffic and provide backups at the lowest operational and cost overhead. Amazon Aurora Serverless is a fully managed relational database that automatically scales capacity up and down based on demand, making it highly cost‑effective for variable or unpredictable workloads. Automated backups are built in and stored in Amazon S3. Other options either require heavy self-management, use unsuitable instance types (Spot for databases), or do not scale as cost‑efficiently.
Question 32
A company runs an on-premises application on a Kubernetes cluster. The company recently added millions of new customers. The company's existing on-premises infrastructure is unable to handle the large number of new customers. The company needs to migrate the on-premises application to the AWS Cloud.
The company will migrate to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The company does not want to manage the underlying compute infrastructure for the new architecture on AWS.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use a self-managed node to supply compute capacity. Deploy the application to the new EKS cluster.
B. Use managed node groups to supply compute capacity. Deploy the application to the new EKS cluster.
C. Use AWS Fargate to supply compute capacity. Create a Fargate profile. Use the Fargate profile to deploy the application.
D. Use managed node groups with Karpenter to supply compute capacity. Deploy the application to the new EKS cluster.
Show Answer
Correct Answer: C
Explanation: The requirement is to avoid managing underlying compute infrastructure and achieve the least operational overhead. Amazon EKS on AWS Fargate is serverless for containers, so there are no EC2 instances or node groups to provision, scale, or maintain. A Fargate profile determines which pods run on Fargate. Self-managed nodes, managed node groups, and Karpenter all still require managing EC2-based compute capacity, resulting in higher operational overhead than Fargate.
Question 33
A streaming media company is rebuilding its infrastructure to accommodate increasing demand for video content that users consume daily.
The company needs to process terabyte-sized videos to block some content in the videos. Video processing can take up to 20 minutes.
The company needs a solution that will scale with demand and remain cost-effective.
Which solution will meet these requirements?
A. Use AWS Lambda functions to process videos. Store video metadata in Amazon DynamoDB. Store video content in Amazon S3 Intelligent-Tiering.
B. Use Amazon Elastic Container Service (Amazon ECS) and AWS Fargate to implement microservices to process videos. Store video metadata in Amazon Aurora. Store video content in Amazon S3 Intelligent-Tiering.
C. Use Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB) to process videos. Store video content in Amazon S3 Standard. Use Amazon Simple Queue Service (Amazon SQS) for queuing and to decouple processing tasks.
D. Deploy a containerized video processing application on Amazon Elastic Kubernetes Service (Amazon EKS) on Amazon EC2. Store video metadata in Amazon RDS in a single Availability Zone. Store video content in Amazon S3 Glacier Deep Archive.
Show Answer
Correct Answer: B
Explanation: Video processing can take up to 20 minutes, which exceeds AWS Lambda limits, eliminating option A. The solution must scale with demand while remaining cost-effective and minimizing operational overhead. Amazon ECS with AWS Fargate runs long-lived, compute-intensive container workloads without managing EC2 instances and scales automatically, making it well-suited for terabyte-scale video processing. Amazon S3 Intelligent-Tiering optimizes storage costs for large video files with variable access patterns, and Amazon Aurora provides scalable, highly available metadata storage. Option C scales but requires EC2 and ALB management and uses S3 Standard, which is less cost-efficient at scale. Option D uses inappropriate storage (Glacier Deep Archive) and introduces availability and complexity issues.
Question 34
A company hosts a multi-tier web application that uses an Amazon Aurora MySQL DB cluster for storage. The application tier is hosted on Amazon EC2 instances. The company's IT security guidelines mandate that the database credentials be encrypted and rotated every 14 days.
What should a solutions architect do to meet this requirement with the LEAST operational effort?
A. Create a new AWS Key Management Service (AWS KMS) encryption key. Use AWS Secrets Manager to create a new secret that uses the KMS key with the appropriate credentials. Associate the secret with the Aurora DB cluster. Configure a custom rotation period of 14 days.
B. Create two parameters in AWS Systems Manager Parameter Store: one for the user name as a string parameter and one that uses the SecureString type for the password. Select AWS Key Management Service (AWS KMS) encryption for the password parameter, and load these parameters in the application tier. Implement an AWS Lambda function that rotates the password every 14 days.
C. Store a file that contains the credentials in an AWS Key Management Service (AWS KMS) encrypted Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system in all EC2 instances of the application tier. Restrict the access to the file on the file system so that the application can read the file and that only super users can modify the file. Implement an AWS Lambda function that rotates the key in Aurora every 14 days and writes new credentials into the file.
D. Store a file that contains the credentials in an AWS Key Management Service (AWS KMS) encrypted Amazon S3 bucket that the application uses to load the credentials. Download the file to the application regularly to ensure that the correct credentials are used. Implement an AWS Lambda function that rotates the Aurora credentials every 14 days and uploads these credentials to the file in the S3 bucket.
Show Answer
Correct Answer: A
Explanation: AWS Secrets Manager provides native encryption with AWS KMS and built-in, fully managed secret rotation for Amazon Aurora MySQL, including support for custom rotation intervals such as every 14 days. Associating the secret directly with the Aurora DB cluster minimizes operational effort compared to manually building and maintaining rotation logic with Lambda or managing credentials in files or Parameter Store.
Question 35
A solutions architect is creating an application that will handle batch processing of large amounts of data. The input data will be held in Amazon S3 and the output data will be stored in a different S3 bucket. For processing, the application will transfer the data over the network between multiple Amazon EC2 instances.
What should the solutions architect do to reduce the overall data transfer costs?
A. Place all the EC2 instances in an Auto Scaling group.
B. Place all the EC2 instances in the same AWS Region.
C. Place all the EC2 instances in the same Availability Zone.
D. Place all the EC2 instances in private subnets in multiple Availability Zones.
Show Answer
Correct Answer: C
Explanation: To minimize data transfer costs, EC2 instances that exchange large volumes of data should be placed in the same Availability Zone. Data transfer between EC2 instances within the same AZ is free, whereas data transfer between different AZs incurs inter-AZ charges. Placing instances only in the same Region does not avoid these inter-AZ costs.
Question 36
A company's software development team needs an Amazon RDS Multi-AZ cluster. The RDS cluster will serve as a backend for a desktop client that is deployed on premises. The desktop client requires direct connectivity to the RDS cluster.
The company must give the development team the ability to connect to the cluster by using the client when the team is in the office.
Which solution provides the required connectivity MOST securely?
A. Create a VPC and two public subnets. Create the RDS cluster in the public subnets. Use AWS Site-to-Site VPN with a customer gateway in the company's office.
B. Create a VPC and two private subnets. Create the RDS cluster in the private subnets. Use AWS Site-to-Site VPN with a customer gateway in the company's office.
C. Create a VPC and two private subnets. Create the RDS cluster in the private subnets. Use RDS security groups to allow the company's office IP ranges to access the cluster.
D. Create a VPC and two public subnets. Create the RDS cluster in the public subnets. Create a cluster user for each developer. Use RDS security groups to allow the users to access the cluster.
Show Answer
Correct Answer: B
Explanation: The most secure solution is to place the RDS Multi-AZ cluster in private subnets and provide access from the on-premises office through an AWS Site-to-Site VPN. Private subnets prevent any direct internet exposure of the database, and the Site-to-Site VPN establishes an encrypted, private connection between the office network and the VPC. This allows developers to connect to the RDS cluster only when they are in the office, without opening the database to the public internet.
Question 37
A company is planning to migrate a legacy application to AWS. The application currently uses NFS to communicate to an on-premises storage solution to store application data. The application cannot be modified to use any other communication protocols other than NFS for this purpose.
Which storage solution should a solutions architect recommend for use after the migration?
A. AWS DataSync
B. Amazon Elastic Block Store (Amazon EBS)
C. Amazon Elastic File System (Amazon EFS)
D. Amazon EMR File System (Amazon EMRFS)
Show Answer
Correct Answer: C
Explanation: The application requires NFS and cannot be modified. Amazon EFS is a fully managed, scalable file system that natively supports the NFS protocol for use with AWS compute services. DataSync is a transfer service, EBS is block storage (not NFS), and EMRFS is specific to EMR.
Question 38
A company runs database workloads on AWS that are the backend for the company's customer portals. The company runs a Multi-AZ database cluster on Amazon RDS for PostgreSQL.
The company needs to implement a 30-day backup retention policy. The company currently has both automated RDS backups and manual RDS backups. The company wants to maintain both types of existing RDS backups that are less than 30 days old.
Which solution will meet these requirements MOST cost-effectively?
A. Configure the RDS backup retention policy to 30 days for automated backups by using AWS Backup. Manually delete manual backups that are older than 30 days.
B. Disable RDS automated backups. Delete automated backups and manual backups that are older than 30 days. Configure the RDS backup retention policy to 30 days for automated backups.
C. Configure the RDS backup retention policy to 30 days for automated backups. Manually delete manual backups that are older than 30 days.
D. Disable RDS automated backups. Delete automated backups and manual backups that are older than 30 days automatically by using AWS CloudFormation. Configure the RDS backup retention policy to 30 days for automated backups.
Show Answer
Correct Answer: C
Explanation: Amazon RDS natively supports automated backup retention up to 35 days at no additional service cost beyond storage. Setting the automated backup retention to 30 days directly on the RDS PostgreSQL cluster satisfies the policy requirement. Existing manual snapshots are not governed by the automated retention policy, so manually deleting only those manual backups older than 30 days preserves all backups under 30 days. Using AWS Backup, CloudFormation automation, or disabling/re-enabling backups adds unnecessary cost or complexity without additional benefit, making option C the most cost-effective solution.
Question 39
A company is designing a new internal web application in the AWS Cloud. The new application must securely retrieve and store multiple employee usernames and passwords from an AWS managed service.
Which solution will meet these requirements with the LEAST operational overhead?
A. Store the employee credentials in AWS Systems Manager Parameter Store. Use AWS CloudFormation and the BatchGetSecretValue API to retrieve usernames and passwords from Parameter Store.
B. Store the employee credentials in AWS Secrets Manager. Use AWS CloudFormation and AWS Batch with the BatchGetSecretValue API to retrieve the usernames and passwords from Secrets Manager.
C. Store the employee credentials in AWS Systems Manager Parameter Store. Use AWS CloudFormation and AWS Batch with the BatchGetSecretValue API to retrieve the usernames and passwords from Parameter Store.
D. Store the employee credentials in AWS Secrets Manager. Use AWS CloudFormation and the BatchGetSecretValue API to retrieve the usernames and passwords from Secrets Manager.
Show Answer
Correct Answer: D
Explanation: AWS Secrets Manager is purpose-built to securely store and retrieve sensitive information such as usernames and passwords with minimal operational overhead. It provides native features like encryption, fine-grained IAM access control, auditing, and rotation support. The BatchGetSecretValue API is part of Secrets Manager and efficiently retrieves multiple secrets in a single call, making it suitable for a web application. Options involving AWS Systems Manager Parameter Store lack some advanced secret management capabilities, and options introducing AWS Batch add unnecessary complexity. Therefore, option D best meets the requirements with the least operational overhead.
Question 40
A company hosts its application on several Amazon EC2 instances inside a VPC. The company creates a dedicated Amazon S3 bucket for each customer to store their relevant information in Amazon S3.
The company wants to ensure that the application running on EC2 instances can securely access only the S3 buckets that belong to the company’s AWS account.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a gateway endpoint for Amazon S3 that is attached to the VPC. Update the IAM instance profile policy to provide access to only the specific buckets that the application needs.
B. Create a NAT gateway in a public subnet with a security group that allows access to only Amazon S3. Update the route tables to use the NAT Gateway.
C. Create a gateway endpoint for Amazon S3 that is attached to the VPUpdate the IAM instance profile policy with a Deny action and the following condition key:
D. Create a NAT Gateway in a public subnet. Update route tables to use the NAT Gateway. Assign bucket policies for all buckets with a Deny action and the following condition key:
Show Answer
Correct Answer: C
Explanation: The requirement is to allow EC2 instances to access only S3 buckets that belong to the company’s AWS account, with the least operational overhead. Using an S3 Gateway VPC Endpoint avoids internet/NAT usage and is the most secure and cost‑effective path. Option C adds an IAM instance profile policy with an explicit Deny using the s3:ResourceAccount (or aws:ResourceAccount) condition key (for example, StringNotEquals to the company’s account ID). This automatically blocks access to any S3 bucket not owned by the company, without needing to list or continuously update individual bucket ARNs as new customer buckets are created. Options using NAT gateways add cost and complexity, and option A requires ongoing policy updates as buckets grow.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.