A company is creating a new application that will store a large amount of data. The data will be analyzed hourly and will be modified by several Amazon EC2 Linux instances that are deployed across multiple Availability Zones. The needed amount of storage space will continue to grow for the next 6 months.
Which storage solution should a solutions architect recommend to meet these requirements?
A. Store the data in Amazon S3 Glacier. Update the S3 Glacier vault policy to allow access to the application instances.
B. Store the data in an Amazon Elastic Block Store (Amazon EBS) volume. Mount the EBS volume on the application instances.
C. Store the data in an Amazon Elastic File System (Amazon EFS) file system. Mount the file system on the application instances.
D. Store the data in an Amazon Elastic Block Store (Amazon EBS) Provisioned IOPS volume shared between the application instances.
Show Answer
Correct Answer: C
Explanation: The application requires shared, scalable storage that can be accessed and modified concurrently by multiple EC2 Linux instances across multiple Availability Zones, with capacity that grows over time. Amazon EFS is a fully managed, elastic file system designed for this use case and supports multi-AZ access. S3 Glacier is for archival with slow retrieval, and EBS volumes cannot be shared across multiple AZs.
Question 396
A social media company wants to store its database of user profiles, relationships, and interactions in the AWS Cloud. The company needs an application to monitor any changes in the database. The application needs to analyze the relationships between the data entities and to provide recommendations to users.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon Neptune to store the information. Use Amazon Kinesis Data Streams to process changes in the database.
B. Use Amazon Neptune to store the information. Use Neptune Streams to process changes in the database.
C. Use Amazon Quantum Ledger Database (Amazon QLDB) to store the information. Use Amazon Kinesis Data Streams to process changes in the database.
D. Use Amazon Quantum Ledger Database (Amazon QLDB) to store the information. Use Neptune Streams to process changes in the database.
Show Answer
Correct Answer: B
Explanation: The workload involves highly connected data (user profiles, relationships, interactions) and relationship analysis for recommendations, which is best modeled as graph data. Amazon Neptune is a fully managed graph database optimized for querying relationships at scale. To monitor changes with the least operational overhead, Neptune Streams provides a built-in, managed change log of graph updates without needing external streaming infrastructure. QLDB is for immutable ledger/audit use cases, not relationship analysis, and Kinesis adds more operational complexity than Neptune Streams.
Question 397
A company is creating a new web application for its subscribers. The application will consist of a static single page and a persistent database layer. The application will have millions of users for 4 hours in the morning, but the application will have only a few thousand users during the rest of the day. The company's data architects have requested the ability to rapidly evolve their schema.
Which solutions will meet these requirements and provide the MOST scalability? (Choose two.)
A. Deploy Amazon DynamoDB as the database solution. Provision on-demand capacity.
B. Deploy Amazon Aurora as the database solution. Choose the serverless DB engine mode.
C. Deploy Amazon DynamoDB as the database solution. Ensure that DynamoDB auto scaling is enabled.
D. Deploy the static content into an Amazon S3 bucket. Provision an Amazon CloudFront distribution with the S3 bucket as the origin.
E. Deploy the web servers for static content across a fleet of Amazon EC2 instances in Auto Scaling groups. Configure the instances to periodically refresh the content from an Amazon Elastic File System (Amazon EFS) volume.
Show Answer
Correct Answer: A, D
Explanation: The requirements are extreme, time‑bound scale (millions of users for a few hours), minimal users otherwise, and rapid schema evolution.
For the database layer, Amazon DynamoDB best fits rapid schema evolution (NoSQL) and horizontal scalability. On‑demand capacity provides the *maximum scalability* because it can instantly absorb large spikes without pre‑planning or scaling lag, which is ideal when usage jumps from thousands to millions.
For the web layer, the application is a static single‑page app. Hosting static content in Amazon S3 with Amazon CloudFront provides virtually unlimited global scalability with no server management, far exceeding the scalability of EC2‑based solutions.
Aurora Serverless is less suitable due to relational schema constraints, and EC2/EFS introduces unnecessary scaling and operational overhead.
Therefore, the two most scalable solutions are A and D.
Question 398
An online photo-sharing company stores its photos in an Amazon S3 bucket that exists in the us-west-1 Region. The company needs to store a copy of all new photos in the us-east-1 Region.
Which solution will meet this requirement with the LEAST operational effort?
A. Create a second S3 bucket in us-east-1. Use S3 Cross-Region Replication to copy photos from the existing S3 bucket to the second S3 bucket.
B. Create a cross-origin resource sharing (CORS) configuration of the existing S3 bucket. Specify us-east-1 in the CORS rule's AllowedOrigin element.
C. Create a second S3 bucket in us-east-1 across multiple Availability Zones. Create an S3 Lifecycle rule to save photos into the second S3 bucket.
D. Create a second S3 bucket in us-east-1. Configure S3 event notifications on object creation and update events to invoke an AWS Lambda function to copy photos from the existing S3 bucket to the second S3 bucket.
Show Answer
Correct Answer: A
Explanation: The requirement is to automatically store copies of all new photos in another AWS Region with the least operational effort. Amazon S3 Cross-Region Replication (CRR) natively and automatically replicates new and updated objects from a source bucket to a destination bucket in a different region once configured, with no custom code or ongoing management. CORS does not copy data, lifecycle rules cannot move objects across buckets/regions, and Lambda-based copying adds unnecessary operational overhead.
Question 399
A company is planning to deploy a business-critical application in the AWS Cloud. The application requires durable storage with consistent, low-latency performance.
Which type of storage should a solutions architect recommend to meet these requirements?
A. Instance store volume
B. Amazon ElastiCache for Memcached cluster
C. Provisioned IOPS SSD Amazon Elastic Block Store (Amazon EBS) volume
D. Throughput Optimized HDD Amazon Elastic Block Store (Amazon EBS) volume
Show Answer
Correct Answer: C
Explanation: The application needs durable storage with consistent, low-latency performance. Provisioned IOPS SSD Amazon EBS volumes are designed for business-critical workloads requiring predictable, low-latency I/O and high durability. Instance store is not durable, ElastiCache is in-memory and not persistent storage, and Throughput Optimized HDD focuses on high throughput rather than low latency.
Question 400
A solutions architect is designing a security solution for a company that wants to provide developers with individual AWS accounts through AWS Organizations, while also maintaining standard security controls. Because the individual developers will have AWS account root user-level access to their own accounts, the solutions architect wants to ensure that the mandatory AWS CloudTrail configuration that is applied to new developer accounts is not modified.
Which action meets these requirements?
A. Create an IAM policy that prohibits changes to CloudTrail. and attach it to the root user.
B. Create a new trail in CloudTrail from within the developer accounts with the organization trails option enabled.
C. Create a service control policy (SCP) that prohibits changes to CloudTrail, and attach it the developer accounts.
D. Create a service-linked role for CloudTrail with a policy condition that allows changes only from an Amazon Resource Name (ARN) in the management account.
Show Answer
Correct Answer: C
Explanation: In an AWS Organizations setup, developers can have full administrative (including root-like) access within their own accounts, so IAM policies cannot reliably restrict them. Service control policies (SCPs) act as organization-level guardrails that apply even to the root user of member accounts. By creating an SCP that denies CloudTrail modification or deletion actions and attaching it to the developer accounts or OU, the mandatory CloudTrail configuration cannot be altered. Other options either cannot restrict root users (IAM policy), do not prevent modification (organization trail alone), or misuse service-linked roles, which are not designed to enforce security restrictions.
Question 401
A company wants to use Amazon FSx for Windows File Server for its Amazon EC2 instances that have an SMB file share mounted as a volume in the us-east-1 Region. The company has a recovery point objective (RPO) of 5 minutes for planned system maintenance or unplanned service disruptions. The company needs to replicate the file system to the us-west-2 Region. The replicated data must not be deleted by any user for 5 years.
Which solution will meet these requirements?
A. Create an FSx for Windows File Server file system in us-east-1 that has a Single-AZ 2 deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in compliance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
B. Create an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in governance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
C. Create an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in compliance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
D. Create an FSx for Windows File Server file system in us-east-1 that has a Single-AZ 2 deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in governance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
Show Answer
Correct Answer: C
Explanation: The 5-minute RPO requires high availability and rapid recovery, which FSx for Windows File Server Multi-AZ provides for planned maintenance and unplanned disruptions. Cross-Region replication is achieved via AWS Backup copy to us-west-2. The requirement that replicated data must not be deleted for 5 years mandates AWS Backup Vault Lock in compliance mode (governance mode allows privileged deletion). Therefore, Multi-AZ with AWS Backup copy and Vault Lock in compliance mode for 5 years is the correct solution.
Question 402
A company has an application with a REST-based interface that allows data to be received in near-real time from a third-party vendor. Once received, the application processes and stores the data for further analysis. The application is running on Amazon EC2 instances.
The third-party vendor has received many 503 Service Unavailable Errors when sending data to the application. When the data volume spikes, the compute capacity reaches its maximum limit and the application is unable to process all requests.
Which design should a solutions architect recommend to provide a more scalable solution?
A. Use Amazon Kinesis Data Streams to ingest the data. Process the data using AWS Lambda functions.
B. Use Amazon API Gateway on top of the existing application. Create a usage plan with a quota limit for the third-party vendor.
C. Use Amazon Simple Notification Service (Amazon SNS) to ingest the data. Put the EC2 instances in an Auto Scaling group behind an Application Load Balancer.
D. Repackage the application as a container. Deploy the application using Amazon Elastic Container Service (Amazon ECS) using the EC2 launch type with an Auto Scaling group.
Show Answer
Correct Answer: A
Explanation: The failures occur because the EC2-based application cannot scale fast enough during traffic spikes, resulting in 503 errors. A more scalable design must decouple ingestion from processing and scale automatically with demand. Amazon Kinesis Data Streams is purpose-built for near–real-time, high-throughput data ingestion and can absorb spikes without rejecting requests. AWS Lambda scales automatically to process records from Kinesis without EC2 capacity limits. The other options either do not address ingestion bottlenecks (API Gateway quotas), are not designed for high-volume streaming ingestion (SNS), or still depend on EC2 capacity management (ECS on EC2).
Question 403
A company deploys Amazon EC2 instances that run in a VPC. The EC2 instances load source data into Amazon S3 buckets so that the data can be processed in the future. According to compliance laws, the data must not be transmitted over the public internet. Servers in the company's on-premises data center will consume the output from an application that runs on the EC2 instances.
Which solution will meet these requirements?
A. Deploy an interface VPC endpoint for Amazon EC2. Create an AWS Site-to-Site VPN connection between the company and the VPC.
B. Deploy a gateway VPC endpoint for Amazon S3. Set up an AWS Direct Connect connection between the on-premises network and the VPC.
C. Set up an AWS Transit Gateway connection from the VPC to the S3 buckets. Create an AWS Site-to-Site VPN connection between the company and the VP
D. Set up proxy EC2 instances that have routes to NAT gateways. Configure the proxy EC2 instances to fetch S3 data and feed the application instances.
Show Answer
Correct Answer: B
Explanation: The EC2 instances must load data into Amazon S3 without traversing the public internet, and on‑premises servers must consume application output without using the public internet. A gateway VPC endpoint for Amazon S3 ensures that traffic between EC2 instances and S3 stays on the AWS private network. AWS Direct Connect provides a dedicated private connection between the on‑premises data center and the VPC, avoiding the public internet. Options using Site‑to‑Site VPN still rely on the public internet, and the other options do not correctly address private EC2–S3 access or are not valid architectures.
Question 404
A company has an application that serves clients that are deployed in more than 20.000 retail storefront locations around the world. The application consists of backend web services that are exposed over HTTPS on port 443. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The retail locations communicate with the web application over the public internet. The company allows each retail location to register the IP address that the retail location has been allocated by its local ISP.
The company's security team recommends to increase the security of the application endpoint by restricting access to only the IP addresses registered by the retail locations.
What should a solutions architect do to meet these requirements?
A. Associate an AWS WAF web ACL with the ALB. Use IP rule sets on the ALB to filter traffic. Update the IP addresses in the rule to include the registered IP addresses.
B. Deploy AWS Firewall Manager to manage the ALConfigure firewall rules to restrict traffic to the ALModify the firewall rules to include the registered IP addresses.
C. Store the IP addresses in an Amazon DynamoDB table. Configure an AWS Lambda authorization function on the ALB to validate that incoming requests are from the registered IP addresses.
D. Configure the network ACL on the subnet that contains the public interface of the ALB. Update the ingress rules on the network ACL with entries for each of the registered IP addresses.
Show Answer
Correct Answer: A
Explanation: The requirement is to restrict HTTPS access to an ALB so that only a large, known set of public IP addresses (from ~20,000 retail locations) can reach the application. AWS WAF integrates directly with an Application Load Balancer and supports IP allow/deny rules using IP sets, each of which can contain up to 10,000 IP addresses or CIDR ranges, making it scalable for this use case. WAF evaluates requests before they reach the backend, providing centralized, managed, and efficient IP-based access control.
Other options are unsuitable: Firewall Manager is for multi-account policy management, not direct enforcement here; Lambda-based authorization would add unnecessary complexity and occurs after traffic reaches the ALB; and network ACLs do not scale to thousands of IP entries and are not designed for this purpose.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.