A company wants to migrate its on-premises Microsoft SQL Server Enterprise edition database to AWS. The company's online application uses the database to process transactions. The data analysis team uses the same production database to run reports for analytical processing. The company wants to reduce operational overhead by moving to managed services wherever possible.
Which solution will meet these requirements with the LEAST operational overhead?
A. Migrate to Amazon RDS for Microsoft SOL Server. Use read replicas for reporting purposes
B. Migrate to Microsoft SQL Server on Amazon EC2. Use Always On read replicas for reporting purposes
C. Migrate to Amazon DynamoDB. Use DynamoDB on-demand replicas for reporting purposes
D. Migrate to Amazon Aurora MySQL. Use Aurora read replicas for reporting purposes
Show Answer
Correct Answer: A
Explanation: Amazon RDS for Microsoft SQL Server is a managed relational database service that minimizes operational overhead compared with self-managed SQL Server on EC2. It supports read replicas for Microsoft SQL Server (where supported) that can offload read/reporting workloads from the primary transactional database. Running SQL Server on EC2 requires managing the OS, SQL Server, patching, backups, and HA. DynamoDB is not a compatible replacement for a SQL Server transactional application, and migrating to Aurora MySQL requires a database engine conversion with potential compatibility changes, increasing migration complexity and not meeting the desire for least operational overhead.
Question 370
An ecommerce company runs a PostgreSQL database on premises. The database stores data by using high IOPS Amazon Elastic Block Store (Amazon EBS) block storage. The daily peak I/O transactions per second do not exceed 15,000 IOPS. The company wants to migrate the database to Amazon RDS for PostgreSQL and provision disk IOPS performance independent of disk storage capacity.
Which solution will meet these requirements MOST cost-effectively?
A. Configure the General Purpose SSD (gp2) EBS volume storage type and provision 15,000 IOPS.
B. Configure the Provisioned IOPS SSD (io1) EBS volume storage type and provision 15,000 IOPS.
C. Configure the General Purpose SSD (gp3) EBS volume storage type and provision 15,000 IOPS.
D. Configure the EBS magnetic volume type to achieve maximum IOPS.
Show Answer
Correct Answer: C
Explanation: Amazon RDS for PostgreSQL supports gp3 storage, which allows provisioning IOPS independently of storage capacity. gp3 supports up to 16,000 IOPS for RDS and is more cost-effective than io1 for a 15,000 IOPS requirement. gp2 ties performance to allocated storage size, so it does not meet the independence requirement. Magnetic volumes cannot provide the required performance.
Question 371
A weather forecasting company needs to process hundreds of gigabytes of data with sub-millisecond latency. The company has a high performance computing (HPC) environment in its data center and wants to expand its forecasting capabilities.
A solutions architect must identify a highly available cloud storage solution that can handle large amounts of sustained throughput. Files that are stored in the solution should be accessible to thousands of compute instances that will simultaneously access and process the entire dataset.
What should the solutions architect do to meet these requirements?
A. Use Amazon FSx for Lustre scratch file systems.
B. Use Amazon FSx for Lustre persistent file systems.
C. Use Amazon Elastic File System (Amazon EFS) with Bursting Throughput mode.
D. Use Amazon Elastic File System (Amazon EFS) with Provisioned Throughput mode.
Show Answer
Correct Answer: B
Explanation: Amazon FSx for Lustre is purpose-built for HPC workloads, delivering sub-millisecond latency, very high sustained throughput, and concurrent access from thousands of compute instances. A persistent FSx for Lustre file system provides durable storage appropriate for ongoing forecasting datasets, whereas scratch file systems are intended for temporary, nonpersistent data. Amazon EFS, even with Provisioned Throughput, is not the best fit for this level of HPC performance.
Question 372
A solutions architect needs to host a high performance computing (HPC) workload in the AWS Cloud. The workload will run on hundreds of Amazon EC2 instances and will require parallel access to a shared file system to enable distributed processing of large datasets. Datasets will be accessed across multiple instances simultaneously. The workload requires access latency within 1 ms. After processing has completed, engineers will need access to the dataset for manual postprocessing.
Which solution will meet these requirements?
A. Use Amazon Elastic File System (Amazon EFS) as a shared file system. Access the dataset from Amazon EFS.
B. Mount an Amazon S3 bucket to serve as the shared file system. Perform postprocessing directly from the S3 bucket.
C. Use Amazon FSx for Lustre as a shared file system. Link the file system to an Amazon S3 bucket for postprocessing.
D. Configure AWS Resource Access Manager to share an Amazon S3 bucket so that it can be mounted to all instances for processing and postprocessing.
Show Answer
Correct Answer: C
Explanation: Amazon FSx for Lustre is purpose-built for high performance computing workloads, providing a shared parallel file system with sub-millisecond latency and high throughput across hundreds of EC2 instances. It integrates with Amazon S3, allowing datasets to be imported from and exported to S3 so engineers can access the processed data afterward for manual postprocessing.
Question 373
A company is required to use cryptographic keys in its on-premises key manager. The key manager is outside of the AWS Cloud because of regulatory and compliance requirements. The company wants to manage encryption and decryption by using cryptographic keys that are retained outside of the AWS Cloud and that support a variety of external key managers from different vendors.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS CloudHSM key store backed by a CloudHSM cluster.
B. Use an AWS Key Management Service (AWS KMS) external key store backed by an external key manager.
C. Use the default AWS Key Management Service (AWS KMS) managed key store.
D. Use a custom key store backed by an AWS CloudHSM cluster.
Show Answer
Correct Answer: B
Explanation: An AWS KMS external key store (XKS) is designed for organizations that must keep cryptographic keys in an external key manager outside AWS while still using AWS KMS APIs. It supports external key managers from different vendors and satisfies regulatory requirements to retain keys on premises or outside AWS. CloudHSM-based options (A and D) keep key material in AWS, and the default KMS managed key store (C) also stores keys within AWS-managed infrastructure.
Question 374
An international company has a subdomain for each country that the company operates in. The subdomains are formatted as example.com, country1.example.com, and country2.example.com. The company's workloads are behind an Application Load Balancer. The company wants to encrypt the website data that is in transit.
Which combination of steps will meet these requirements? (Choose two.)
A. Use the AWS Certificate Manager (ACM) console to request a public certificate for the apex top domain example com and a wildcard certificate for *.example.com.
B. Use the AWS Certificate Manager (ACM) console to request a private certificate for the apex top domain example.com and a wildcard certificate for *.example.com.
C. Use the AWS Certificate Manager (ACM) console to request a public and private certificate for the apex top domain example.com.
D. Validate domain ownership by email address. Switch to DNS validation by adding the required DNS records to the DNS provider.
E. Validate domain ownership for the domain by adding the required DNS records to the DNS provider.
Show Answer
Correct Answer: A, E
Explanation: Use ACM public certificates for internet-facing websites behind an Application Load Balancer. Request one public certificate for the apex domain (example.com) and a wildcard public certificate (*.example.com) to cover the country subdomains. ACM public certificates require proof of domain ownership; DNS validation by adding the required DNS records to the domain's DNS provider is the standard validation method. Private ACM certificates are for internal PKI use and are not appropriate for public websites.
Question 375
A company runs several websites on AWS for its different brands. Each website generates tens of gigabytes of web traffic logs each day. A solutions architect needs to design a scalable solution to give the company's developers the ability to analyze traffic patterns across all the company's websites. This analysis by the developers will occur on demand once a week over the course of several months. The solution must support queries with standard SQL.
Which solution will meet these requirements MOST cost-effectively?
A. Store the logs in Amazon S3. Use Amazon Athena tor analysis.
B. Store the logs in Amazon RDS. Use a database client for analysis.
C. Store the logs in Amazon OpenSearch Service. Use OpenSearch Service for analysis.
D. Store the logs in an Amazon EMR cluster Use a supported open-source framework for SQL-based analysis.
Show Answer
Correct Answer: A
Explanation: Amazon S3 combined with Amazon Athena is the most cost-effective solution. Storing logs in S3 provides durable, highly scalable, low-cost storage, and Athena is serverless, allowing developers to run standard SQL queries directly against data in S3 while paying only per query. Since analysis occurs only once a week, Athena avoids the ongoing infrastructure costs of OpenSearch, RDS, or EMR clusters.
Question 376
A company wants to monitor its AWS costs for financial review. The cloud operations team is designing an architecture in the AWS Organizations management account to query AWS Cost and Usage Reports for all member accounts. The team must run this query once a month and provide a detailed analysis of the bill.
Which solution is the MOST scalable and cost-effective way to meet these requirements?
A. Enable Cost and Usage Reports in the management account. Deliver reports to Amazon Kinesis. Use Amazon EMR for analysis.
B. Enable Cost and Usage Reports in the management account. Deliver the reports to Amazon S3 Use Amazon Athena for analysis.
C. Enable Cost and Usage Reports for member accounts. Deliver the reports to Amazon S3 Use Amazon Redshift for analysis.
D. Enable Cost and Usage Reports for member accounts. Deliver the reports to Amazon Kinesis. Use Amazon QuickSight tor analysis.
Show Answer
Correct Answer: B
Explanation: AWS Cost and Usage Reports (CUR) are designed to be generated in the AWS Organizations management account and delivered to Amazon S3. Amazon Athena can query CUR data directly in S3 on demand without provisioning infrastructure, making it highly scalable and very cost-effective for a workload that runs only once per month. EMR and Redshift are unnecessary for this use case, and enabling separate CURs in each member account adds operational overhead and duplicates reporting.
Question 377
A company has an application workflow that uses an AWS Lambda function to download and decrypt files from Amazon S3. These files are encrypted using AWS Key Management Service (AWS KMS) keys. A solutions architect needs to design a solution that will ensure the required permissions are set correctly.
Which combination of actions accomplish this? (Choose two.)
A. Attach the kms:decrypt permission to the Lambda function’s resource policy
B. Grant the decrypt permission for the Lambda IAM role in the KMS key's policy
C. Grant the decrypt permission for the Lambda resource policy in the KMS key's policy.
D. Create a new IAM policy with the kms:decrypt permission and attach the policy to the Lambda function.
E. Create a new IAM role with the kms:decrypt permission and attach the execution role to the Lambda function.
Show Answer
Correct Answer: B, E
Explanation: The Lambda function needs an execution IAM role that is allowed to call kms:Decrypt, and the KMS key policy must also allow that IAM role to use the key. Lambda resource policies control who can invoke or manage the function, not what the function can access. IAM policies are attached to IAM principals (such as roles), not directly to Lambda functions.
Question 378
A company is building a new furniture inventory application. The company has deployed the application on a fleet ofAmazon EC2 instances across multiple Availability Zones. The EC2 instances run behind an Application Load Balancer (ALB) in their VPC.
A solutions architect has observed that incoming traffic seems to favor one EC2 instance, resulting in latency for some requests.
What should the solutions architect do to resolve this issue?
A. Disable session affinity (sticky sessions) on the ALB
B. Replace the ALB with a Network Load Balancer
C. Increase the number of EC2 instances in each Availability Zone
D. Adjust the frequency of the health checks on the ALB's target group
Show Answer
Correct Answer: A
Explanation: The most likely cause of one EC2 instance consistently receiving more traffic behind an Application Load Balancer is enabled sticky sessions (session affinity). Sticky sessions intentionally route repeat requests from the same client to the same target, which can create uneven load distribution and increased latency on one instance. Replacing the ALB, adding more instances, or changing health check frequency does not directly address this symptom.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.