A company has multiple AWS accounts in an organization in AWS Organizations that different business units use. The company has multiple offices around the world. The company needs to update security group rules to allow new office CIDR ranges or to remove old CIDR ranges across the organization. The company wants to centralize the management of security group rules to minimize the administrative overhead that updating CIDR ranges requires.
Which solution will meet these requirements MOST cost-effectively?
A. Create VPC security groups in the organization's management account. Update the security groups when a CIDR range update is necessary.
B. Create a VPC customer managed prefix list that contains the list of CIDRs. Use AWS Resource Access Manager (AWS RAM) to share the prefix list across the organization. Use the prefix list in the security groups across the organization.
C. Create an AWS managed prefix list. Use an AWS Security Hub policy to enforce the security group update across the organization. Use an AWS Lambda function to update the prefix list automatically when the CIDR ranges change.
D. Create security groups in a central administrative AWS account. Create an AWS Firewall Manager common security group policy for the whole organization. Select the previously created security groups as primary groups in the policy.
Show Answer
Correct Answer: B
Explanation: A customer managed VPC prefix list lets you define shared CIDR ranges once and reference the prefix list in security group rules. By sharing the prefix list across the AWS Organization with AWS RAM, all accounts can use the same centralized list. Updating the prefix list automatically affects all security groups that reference it, minimizing administrative overhead and cost. Option A cannot centrally use security groups across VPCs/accounts this way. Option C incorrectly refers to AWS managed prefix lists, which are AWS-provided and not editable for custom office CIDRs, and Security Hub is not the enforcement mechanism. Option D uses Firewall Manager for common security group policies, but it is more complex and costly than simply sharing a managed prefix list for centralized CIDR management.
Question 360
A company runs a website that stores images of historical events. Website users need the ability to search and view images based on the year that the event in the image occurred. On average, users request each image only once or twice a year. The company wants a highly available solution to store and deliver the images to users.
Which solution will meet these requirements MOST cost-effectively?
A. Store images in Amazon Elastic Block Store (Amazon EBS). Use a web server that runs on Amazon EC2.
B. Store images in Amazon Elastic File System (Amazon EFS). Use a web server that runs on Amazon EC2.
C. Store images in Amazon S3 Standard. Use S3 Standard to directly deliver images by using a static website.
D. Store images in Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Use S3 Standard-IA to directly deliver images by using a static website.
Show Answer
Correct Answer: D
Explanation: Amazon S3 is the appropriate highly available object storage service for static images. EBS and EFS require EC2 and are more expensive and operationally complex for this use case. Because each image is accessed only once or twice per year, S3 Standard-Infrequent Access provides the same high durability and availability at lower storage cost, with retrieval charges that are outweighed by the very low access frequency. S3 can directly serve static content via static website hosting.
Question 361
A company hosts an application on Amazon EC2 On-Demand Instances in an Auto Scaling group. Application peak hours occur at the same time each day. Application users report slow application performance at the start of peak hours. The application performs normally 2-3 hours after peak hours begin. The company wants to ensure that the application works properly at the start of peak hours.
Which solution will meet these requirements?
A. Configure an Application Load Balancer to distribute traffic properly to the instances.
B. Configure a dynamic scaling policy for the Auto Scaling group to launch new instances based on memory utilization.
C. Configure a dynamic scaling policy for the Auto Scaling group to launch new instances based on CPU utilization.
D. Configure a scheduled scaling policy for the Auto Scaling group to launch new instances before peak hours.
Show Answer
Correct Answer: D
Explanation: Because peak demand occurs at the same time every day, the workload is predictable. Scheduled scaling allows the Auto Scaling group to launch additional EC2 instances before the expected peak begins, ensuring capacity is already available when users arrive. Dynamic scaling reacts only after metrics such as CPU or memory increase, which can lead to delays while new instances launch. An Application Load Balancer distributes traffic but does not add capacity.
Question 362
A company maintains an Amazon RDS database that maps users to cost centers. The company has accounts in an organization in AWS Organizations. The company needs a solution that will tag all resources that are created in a specific AWS account in the organization. The solution must tag each resource with the cost center ID of the user who created the resource.
Which solution will meet these requirements?
A. Move the specific AWS account to a new organizational unit (OU) in Organizations from the management account. Create a service control policy (SCP) that requires all existing resources to have the correct cost center tag before the resources are created. Apply the SCP to the new OU.
B. Create an AWS Lambda function to tag the resources after the Lambda function looks up the appropriate cost center from the RDS database. Configure an Amazon EventBridge rule that reacts to AWS CloudTrail events to invoke the Lambda function.
C. Create an AWS CloudFormation stack to deploy an AWS Lambda function. Configure the Lambda function to look up the appropriate cost center from the RDS database and to tag resources. Create an Amazon EventBridge scheduled rule to invoke the CloudFormation stack.
D. Create an AWS Lambda function to tag the resources with a default value. Configure an Amazon EventBridge rule that reacts to AWS CloudTrail events to invoke the Lambda function when a resource is missing the cost center tag.
Show Answer
Correct Answer: B
Explanation: The correct solution is to use Amazon EventBridge with AWS CloudTrail resource creation events to invoke a Lambda function. The Lambda can identify the IAM principal who created the resource from the event, look up that user's cost center in the Amazon RDS database, and apply the appropriate tag to the newly created resource. SCPs cannot dynamically query an RDS database or apply tags. A scheduled CloudFormation deployment does not perform event-driven tagging, and tagging with a default value does not satisfy the requirement to use the creator's cost center.
Question 363
A company uses AWS Cost Explorer to monitor its AWS costs. The company notices that Amazon Elastic Block Store (Amazon EBS) storage and snapshot costs increase every month. However, the company does not purchase additional EBS storage every month. The company wants to optimize monthly costs for its current storage usage.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use logs in Amazon CloudWatch Logs to monitor the storage utilization of Amazon EBS. Use Amazon EBS Elastic Volumes to reduce the size of the EBS volumes.
B. Use a custom script to monitor space usage. Use Amazon EBS Elastic Volumes to reduce the size of the EBS volumes.
C. Delete all expired and unused snapshots to reduce snapshot costs.
D. Delete all nonessential snapshots. Use Amazon Data Lifecycle Manager to create and manage the snapshots according to the company's snapshot policy requirements.
Show Answer
Correct Answer: D
Explanation: The increasing costs are driven by both EBS storage and especially accumulating snapshots. Resizing EBS volumes is not the primary issue, and Elastic Volumes does not support shrinking volumes. Deleting unnecessary snapshots reduces current costs, but automating snapshot creation and retention with Amazon Data Lifecycle Manager provides ongoing cost optimization with the least operational overhead by enforcing lifecycle policies.
Question 364
A company is moving its data and applications to AWS during a multiyear migration project. The company wants to securely access data on Amazon S3 from the company's AWS Region and from the company's on-premises location. The data must not traverse the internet. The company has established an AWS Direct Connect connection between its Region and its on-premises location.
Which solution will meet these requirements?
A. Create gateway endpoints for Amazon S3. Use the gateway endpoints to securely access the data from the Region and the on-premises location.
B. Create a gateway in AWS Transit Gateway to access Amazon S3 securely from the Region and the on-premises location.
C. Create interface endpoints for Amazon S3. Use the interface endpoints to securely access the data from the Region and the on-premises location.
D. Use an AWS Key Management Service (AWS KMS) key to access the data securely from the Region and the on-premises location.
Show Answer
Correct Answer: C
Explanation: Amazon S3 interface VPC endpoints (AWS PrivateLink for S3) support private access from both VPCs and on-premises environments over AWS Direct Connect or VPN. Gateway endpoints for S3 only work for resources within the VPC and cannot be accessed from on-premises networks. AWS Transit Gateway is not an S3 endpoint, and AWS KMS is for encryption key management, not network connectivity.
Question 365
A company has a web application that runs on premises. The application experiences latency issues during peak hours. The latency issues occur twice each month. At the start of a latency issue, the application's CPU utilization immediately increases to 10 times its normal amount.
The company wants to migrate the application to AWS to improve latency. The company also wants to scale the application automatically when application demand increases. The company will use AWS Elastic Beanstalk for application deployment.
Which solution will meet these requirements?
A. Configure an Elastic Beanstalk environment to use burstable performance instances in unlimited mode. Configure the environment to scale based on requests.
B. Configure an Elastic Beanstalk environment to use compute optimized instances. Configure the environment to scale based on requests.
C. Configure an Elastic Beanstalk environment to use compute optimized instances. Configure the environment to scale on a schedule.
D. Configure an Elastic Beanstalk environment to use burstable performance instances in unlimited mode. Configure the environment to scale on predictive metrics.
Show Answer
Correct Answer: A
Explanation: Burstable performance instances in unlimited mode can absorb sudden CPU spikes immediately while Auto Scaling based on requests adds capacity as demand increases. Scheduled scaling does not satisfy automatic scaling based on changing demand, and predictive scaling is not an Elastic Beanstalk environment scaling option. Compute-optimized instances alone do not specifically address sudden burst behavior as well as burstable instances for this scenario.
Question 366
A company is developing a new application on AWS. The application consists of an Amazon Elastic Container Service (Amazon ECS) cluster, an Amazon S3 bucket that contains assets for the application, and an Amazon RDS for MySQL database that contains the dataset for the application. The dataset contains sensitive information. The company wants to ensure that only the ECS cluster can access the data in the RDS for MySQL database and the data in the S3 bucket.
Which solution will meet these requirements?
A. Create a new AWS Key Management Service (AWS KMS) customer managed key to encrypt both the S3 bucket and the RDS for MySQL database. Ensure that the KMS key policy includes encrypt and decrypt permissions for the ECS task execution role.
B. Create an AWS Key Management Service (AWS KMS) AWS managed key to encrypt both the S3 bucket and the RDS for MySQL database. Ensure that the S3 bucket policy specifies the ECS task execution role as a user.
C. Create an S3 bucket policy that restricts bucket access to the ECS task execution role. Create a VPC endpoint for Amazon RDS for MySQL. Update the RDS for MySQL security group to allow access from only the subnets that the ECS cluster will generate tasks in.
D. Create a VPC endpoint for Amazon RDS for MySQL. Update the RDS for MySQL security group to allow access from only the subnets that the ECS cluster will generate tasks in. Create a VPC endpoint for Amazon S3. Update the S3 bucket policy to allow access from only the S3 VPC endpoint.
Show Answer
Correct Answer: C
Explanation: Among the provided choices, C is the closest to meeting the stated goal. The S3 bucket policy can restrict access to the ECS task role, and limiting database connectivity with the RDS security group to the ECS task subnets is the intended network control. Options A and B focus on KMS encryption, which protects data at rest but does not enforce who can access the S3 bucket or database. D improves S3 access via a VPC endpoint but still relies on subnet-level controls for RDS and does not identify the ECS role for S3 access. Note that the mention of a VPC endpoint for Amazon RDS data access is technically inaccurate in the question, since RDS database connections are normally controlled with security groups rather than an RDS VPC endpoint.
Question 367
A company uses an on-premises network-attached storage (NAS) system to provide file shares to its high performance computing (HPC) workloads. The company wants to migrate its latency-sensitive HPC workloads and its storage to the AWS Cloud. The company must be able to provide NFS and SMB multi-protocol access from the file system.
Which solution will meet these requirements with the LEAST latency? (Choose two.)
A. Deploy compute optimized EC2 instances into a cluster placement group.
B. Deploy compute optimized EC2 instances into a partition placement group.
C. Attach the EC2 instances to an Amazon FSx for Lustre file system.
D. Attach the EC2 instances to an Amazon FSx for OpenZFS file system.
E. Attach the EC2 instances to an Amazon FSx for NetApp ONTAP file system.
Show Answer
Correct Answer: A, E
Explanation: Latency-sensitive HPC workloads benefit from a cluster placement group, which provides the lowest network latency and highest bandwidth between EC2 instances. For storage, the requirement is shared file storage with concurrent NFS and SMB multi-protocol access. Amazon FSx for NetApp ONTAP supports both NFS and SMB with true multiprotocol access. FSx for Lustre does not provide NFS/SMB multiprotocol access, OpenZFS supports NFS but not SMB multiprotocol, and partition placement groups are designed for fault isolation rather than the lowest latency.
Question 368
A company has a large data workload that runs for 6 hours each day. The company cannot lose any data while the process is running. A solutions architect is designing an Amazon EMR cluster configuration to support this critical data workload.
Which solution will meet these requirements MOST cost-effectively?
A. Configure a long-running cluster that runs the primary node and core nodes on On-Demand Instances and the task nodes on Spot Instances.
B. Configure a transient cluster that runs the primary node and core nodes on On-Demand Instances and the task nodes on Spot Instances.
C. Configure a transient cluster that runs the primary node on an On-Demand Instance and the core nodes and task nodes on Spot Instances.
D. Configure a long-running cluster that runs the primary node on an On-Demand Instance, the core nodes on Spot Instances, and the task nodes on Spot Instances.
Show Answer
Correct Answer: B
Explanation: A transient EMR cluster is the most cost-effective choice for a workload that runs only 6 hours per day because it is created for the job and terminates afterward. To prevent data loss, the primary and core nodes should use On-Demand Instances, since core nodes store HDFS data and Spot interruptions can cause data loss. Task nodes do not store HDFS data, so they can safely use Spot Instances for cost savings.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.