A company operates a food delivery service. Because of recent growth, the company's order processing system is experiencing scaling problems during peak traffic hours. The current architecture includes Amazon EC2 instances in an Auto Scaling group that collect orders from an application. A second group of EC2 instances in an Auto Scaling group fulfills the orders.
The order collection process occurs quickly, but the order fulfillment process can take longer. Data must not be lost because of a scaling event.
A solutions architect must ensure that the order collection process and the order fulfillment process can both scale adequately during peak traffic hours.
Which solution will meet these requirements?
A. Use Amazon CloudWatch to monitor the CPUUtilization metric for each instance in both Auto Scaling groups. Configure each Auto Scaling group's minimum capacity to meet its peak workload value.
B. Use Amazon CloudWatch to monitor the CPUUtilization metric for each instance in both Auto Scaling groups. Configure a CloudWatch alarm to invoke an Amazon Simple Notification Service (Amazon SNS) topic to create additional Auto Scaling groups on demand.
C. Provision two Amazon Simple Queue Service (Amazon SQS) queues. Use one SQS queue for order collection. Use the second SQS queue for order fulfillment. Configure the EC2 instances to poll their respective queues. Scale the Auto Scaling groups based on notifications that the queues send.
D. Provision two Amazon Simple Queue Service (Amazon SQS) queues. Use one SQS queue for order collection. Use the second SQS queue for order fulfillment. Configure the EC2 instances to poll their respective queues. Scale the Auto Scaling groups based on the number of messages in each queue.
Show Answer
Correct Answer: D
Explanation: Using Amazon SQS decouples the fast order collection tier from the slower order fulfillment tier, ensuring orders are durably buffered and not lost during scaling events. Each Auto Scaling group should poll its respective queue, and scaling should be driven by queue depth (number of messages), which directly reflects backlog and workload. CPU utilization is not an appropriate scaling metric for asynchronous queue-based processing, and SQS does not send notifications suitable for Auto Scaling decisions in this context.
Question 20
A company runs its legacy web application on AWS. The web application server runs on an Amazon EC2 instance in the public subnet of a VPC. The web application server collects images from customers and stores the image files in a locally attached Amazon Elastic Block Store (Amazon EBS) volume. The image files are uploaded every night to an Amazon S3 bucket for backup.
A solutions architect discovers that the image files are being uploaded to Amazon S3 through the public endpoint. The solutions architect needs to ensure that traffic to Amazon S3 does not use the public endpoint.
Which solution will meet these requirements?
A. Create a gateway VPC endpoint for the S3 bucket that has the necessary permissions for the VPC. Configure the subnet route table to use the gateway VPC endpoint.
B. Move the S3 bucket inside the VPC. Configure the subnet route table to access the S3 bucket through private IP addresses.
C. Create an Amazon S3 access point for the Amazon EC2 instance inside the VPConfigure the web application to upload by using the Amazon S3 access point.
D. Configure an AWS Direct Connect connection between the VPC that has the Amazon EC2 instance and Amazon S3 to provide a dedicated network path.
Show Answer
Correct Answer: A
Explanation: A gateway VPC endpoint for Amazon S3 allows EC2 instances in the VPC to access S3 over the AWS private network instead of the public S3 endpoint. Updating the subnet route table to use the gateway endpoint ensures S3 traffic does not traverse the public internet. S3 buckets cannot be placed inside a VPC, S3 Access Points manage access but do not by themselves guarantee private network connectivity, and Direct Connect is for on-premises connectivity and is unnecessary for VPC-to-S3 traffic.
Question 21
A company is designing the architecture for a new mobile app that uses the AWS Cloud. The company uses organizational units (OUs) in AWS Organizations to manage its accounts. The company wants to tag Amazon EC2 instances with data sensitivity by using values of sensitive and nonsensitive. IAM identities must not be able to delete a tag or create instances without a tag.
Which combination of steps will meet these requirements? (Choose two.)
A. In Organizations, create a new tag policy that specifies the data sensitivity tag key and the required values. Enforce the tag values for the EC2 instances. Attach the tag policy to the appropriate OU.
B. In Organizations, create a new service control policy (SCP) that specifies the data sensitivity tag key and the required tag values. Enforce the tag values for the EC2 instances. Attach the SCP to the appropriate OU.
C. Create a tag policy to deny running instances when a tag key is not specified. Create another tag policy that prevents identities from deleting tags. Attach the tag policies to the appropriate OU.
D. Create a service control policy (SCP) to deny creating instances when a tag key is not specified. Create another SCP that prevents identities from deleting tags. Attach the SCPs to the appropriate OU.
E. Create an AWS Config rule to check if EC2 instances use the data sensitivity tag and the specified values. Configure an AWS Lambda function to delete the resource if a noncompliant resource is found.
Show Answer
Correct Answer: A, D
Explanation: Use an AWS Organizations tag policy to define the allowed tag key and values (sensitive and nonsensitive) and enforce tag value compliance for supported resources. Tag policies do not prevent resource creation or tag deletion. Use service control policies (SCPs) to deny EC2 instance creation when the required tag is missing and to deny deletion of the required tag, applying these controls at the OU level.
Question 22
A medical company wants to perform transformations on a large amount of clinical trial data that comes from several customers. The company must extract the data from a relational database that contains the customer data. Then the company will transform the data by using a series of complex rules. The company will load the data to Amazon S3 when the transformations are complete.
All data must be encrypted where it is processed before the company stores the data in Amazon S3. All data must be encrypted by using customer-specific keys.
Which solution will meet these requirements with the LEAST amount of operational effort?
A. Create one AWS Glue job for each customer. Attach a security configuration to each job that uses server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data.
B. Create one Amazon EMR cluster for each customer. Attach a security configuration to each cluster that uses client-side encryption with a custom client-side root key (CSE-Custom) to encrypt the data.
C. Create one AWS Glue job for each customer. Attach a security configuration to each job that uses client-side encryption with AWS KMS managed keys (CSE-KMS) to encrypt the data.
D. Create one Amazon EMR cluster for each customer. Attach a security configuration to each cluster that uses server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the data.
Show Answer
Correct Answer: C
Explanation: AWS Glue is the managed, serverless ETL service and requires the least operational effort compared to managing Amazon EMR clusters. The requirement states that data must be encrypted where it is processed before being stored in Amazon S3, which calls for client-side encryption during processing rather than relying only on S3 server-side encryption. Using a separate AWS Glue job per customer with a security configuration that uses client-side encryption with AWS KMS (CSE-KMS) allows customer-specific KMS keys to be used during processing and before the data is written to Amazon S3.
Question 23
A company recently launched a new application for its customers. The application runs on multiple Amazon EC2 instances across two Availability Zones. End users use TCP to communicate with the application.
The application must be highly available and must automatically scale as the number of users increases.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
A. Add a Network Load Balancer in front of the EC2 instances.
B. Configure an Auto Scaling group for the EC2 instances.
C. Add an Application Load Balancer in front of the EC2 instances.
D. Manually add more EC2 instances for the application.
E. Add a Gateway Load Balancer in front of the EC2 instances.
Show Answer
Correct Answer: A, B
Explanation: Because clients communicate using TCP, a Network Load Balancer is the appropriate Elastic Load Balancer as it operates at Layer 4 and supports TCP traffic. To achieve automatic scaling and high availability across multiple Availability Zones, place the EC2 instances in an Auto Scaling group. An Application Load Balancer is intended for Layer 7 HTTP/HTTPS/gRPC traffic, not generic TCP forwarding. Gateway Load Balancer is for deploying virtual network appliances, and manually adding instances does not provide automatic scaling.
Question 24
A company is testing an application that runs on an Amazon EC2 Linux instance. A single 500 GB Amazon Elastic Block Store (Amazon EBS) General Purpose SSO (gp2) volume is attached to the EC2 instance.
The company will deploy the application on multiple EC2 instances in an Auto Scaling group. All instances require access to the data that is stored in the EBS volume. The company needs a highly available and resilient solution that does not introduce significant changes to the application's code.
Which solution will meet these requirements?
A. Provision an EC2 instance that uses NFS server software. Attach a single 500 GB gp2 EBS volume to the instance.
B. Provision an Amazon FSx for Windows File Server file system. Configure the file system as an SMB file store within a single Availability Zone.
C. Provision an EC2 instance with two 250 GB Provisioned IOPS SSD EBS volumes.
D. Provision an Amazon Elastic File System (Amazon EFS) file system. Configure the file system to use General Purpose performance mode.
Show Answer
Correct Answer: D
Explanation: Amazon EFS is a managed, highly available, multi-AZ network file system that can be mounted concurrently by multiple Linux EC2 instances, making it ideal for Auto Scaling groups that need shared file access with minimal application changes. Option A creates a single EC2/NFS server, introducing a single point of failure. Option B is FSx for Windows File Server (SMB), which is not appropriate for a Linux application in this context. Option C still uses EBS volumes attached to a single EC2 instance and does not provide shared storage for multiple instances.
Question 25
A company stores user data in AWS. The data is used continuously with peak usage during business hours. Access patterns vary, with some data not being used for months at a time. A solutions architect must choose a cost-effective solution that maintains the highest level of durability while maintaining high availability.
Which storage solution meets these requirements?
A. Amazon S3 Standard
B. Amazon S3 Intelligent-Tiering
C. Amazon S3 Glacier Deep Archive
D. Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)
Show Answer
Correct Answer: B
Explanation: Amazon S3 Intelligent-Tiering is designed for data with unknown or changing access patterns. It automatically moves objects between frequent and infrequent access tiers to optimize cost while maintaining the same high durability (11 9s) and high availability characteristics for the frequent access tiers. S3 Standard is more expensive for infrequently accessed data, Glacier Deep Archive is not suitable for continuous access due to long retrieval times, and One Zone-IA sacrifices multi-AZ resilience by storing data in a single Availability Zone.
Question 26
A company hosts its main public web application in one AWS Region across multiple Availability Zones. The application uses an Amazon EC2 Auto Scaling group and an Application Load Balancer (ALB).
A web development team needs a cost-optimized compute solution to improve the company’s ability to serve dynamic content globally to millions of customers.
Which solution will meet these requirements?
A. Create an Amazon CloudFront distribution. Configure the existing ALB as the origin.
B. Use Amazon Route 53 to serve traffic to the ALB and EC2 instances based on the geographic location of each customer.
C. Create an Amazon S3 bucket with public read access enabled. Migrate the web application to the S3 bucket. Configure the S3 bucket for website hosting.
D. Use AWS Direct Connect to directly serve content from the web application to the location of each customer.
Show Answer
Correct Answer: A
Explanation: Amazon CloudFront in front of the existing Application Load Balancer is the best fit. CloudFront accelerates delivery for global users by using the AWS edge network and supports dynamic content acceleration (not just cached static content). It integrates directly with an ALB origin, improving global performance while remaining cost-optimized. Route 53 geolocation routing does not accelerate a single-region application, S3 static website hosting cannot run a dynamic EC2-based web application, and AWS Direct Connect is for private network connectivity rather than global content delivery.
Question 27
A company hosts its core network services, including directory services and DNS, in its on-premises data center. The data center is connected to the AWS Cloud using AWS Direct Connect (DX). Additional AWS accounts are planned that will require quick, cost-effective, and consistent access to these network services.
What should a solutions architect implement to meet these requirements with the LEAST amount of operational overhead?
A. Create a DX connection in each new account. Route the network traffic to the on-premises servers.
B. Configure VPC endpoints in the DX VPC for all required services. Route the network traffic to the on-premises servers.
C. Create a VPN connection between each new account and the DX VPRoute the network traffic to the on-premises servers.
D. Configure AWS Transit Gateway between the accounts. Assign DX to the transit gateway and route network traffic to the on-premises servers.
Show Answer
Correct Answer: D
Explanation: AWS Transit Gateway provides a scalable hub-and-spoke architecture that can connect VPCs across multiple AWS accounts and integrate with a Direct Connect gateway. This allows all new accounts to consistently access on-premises directory and DNS services over the existing Direct Connect with minimal per-account configuration and operational overhead. Creating separate Direct Connect links or VPNs for each account is costly and harder to manage, and VPC endpoints are for privately accessing supported AWS services, not on-premises services.
Question 28
A company has an Amazon S3 bucket that contains sensitive data files. The company has an application that runs on virtual machines in an on-premises data center. The company currently uses AWS IAM Identity Center.
The application requires temporary access to files in the S3 bucket. The company wants to grant the application secure access to the files in the S3 bucket.
Which solution will meet these requirements?
A. Create an S3 bucket policy that permits access to the bucket from the public IP address range of the company’s on-premises data center.
B. Use IAM Roles Anywhere to obtain security credentials in IAM Identity Center that grant access to the S3 bucket. Configure the virtual machines to assume the role by using the AWS CLI.
C. Install the AWS CLI on the virtual machine. Configure the AWS CLI with access keys from an IAM user that has access to the bucket.
D. Create an IAM user and policy that grants access to the bucket. Store the access key and secret key for the IAM user in AWS Secrets Manager. Configure the application to retrieve the access key and secret key at startup.
Show Answer
Correct Answer: B
Explanation: IAM Roles Anywhere is designed for workloads running outside AWS, such as on-premises virtual machines, to obtain temporary IAM security credentials by assuming IAM roles. This avoids long-term access keys and provides secure, temporary access to the S3 bucket. Bucket policies based only on source IP do not provide identity-based temporary credentials, and IAM users with access keys (stored locally or in Secrets Manager) still rely on long-term credentials, which does not meet the requirement for temporary secure access.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.