A company is creating a new application that will store a large amount of data. The data will be analyzed hourly and will be modified by several Amazon EC2 Linux instances that are deployed across multiple Availability Zones. The needed amount of storage space will continue to grow for the next 6 months.
Which storage solution should a solutions architect recommend to meet these requirements?
A. Store the data in Amazon S3 Glacier. Update the S3 Glacier vault policy to allow access to the application instances.
B. Store the data in an Amazon Elastic Block Store (Amazon EBS) volume. Mount the EBS volume on the application instances.
C. Store the data in an Amazon Elastic File System (Amazon EFS) file system. Mount the file system on the application instances.
D. Store the data in an Amazon Elastic Block Store (Amazon EBS) Provisioned IOPS volume shared between the application instances.
Show Answer
Correct Answer: C
Explanation: Amazon EFS provides a shared, elastic, managed file system that can be mounted concurrently by multiple Linux EC2 instances across multiple Availability Zones. It automatically scales as storage needs grow, making it suitable for continuously expanding datasets that are read and modified by multiple instances. S3 Glacier is archival storage with unsuitable retrieval characteristics for hourly analysis. EBS volumes are block storage and generally cannot be shared across multiple EC2 instances in multiple AZs for this use case; Multi-Attach is limited and does not support cross-AZ shared file storage.
Question 396
A social media company wants to store its database of user profiles, relationships, and interactions in the AWS Cloud. The company needs an application to monitor any changes in the database. The application needs to analyze the relationships between the data entities and to provide recommendations to users.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon Neptune to store the information. Use Amazon Kinesis Data Streams to process changes in the database.
B. Use Amazon Neptune to store the information. Use Neptune Streams to process changes in the database.
C. Use Amazon Quantum Ledger Database (Amazon QLDB) to store the information. Use Amazon Kinesis Data Streams to process changes in the database.
D. Use Amazon Quantum Ledger Database (Amazon QLDB) to store the information. Use Neptune Streams to process changes in the database.
Show Answer
Correct Answer: B
Explanation: Amazon Neptune is the appropriate database for highly connected social graph data such as user profiles, relationships, and interactions. It is optimized for graph queries and recommendation use cases. To monitor changes with the least operational overhead, Neptune Streams provides a managed change log of graph updates. Kinesis Data Streams would require additional infrastructure for change propagation, and Amazon QLDB is a ledger database for immutable transaction histories rather than graph relationship analysis.
Question 397
A company is creating a new web application for its subscribers. The application will consist of a static single page and a persistent database layer. The application will have millions of users for 4 hours in the morning, but the application will have only a few thousand users during the rest of the day. The company's data architects have requested the ability to rapidly evolve their schema.
Which solutions will meet these requirements and provide the MOST scalability? (Choose two.)
A. Deploy Amazon DynamoDB as the database solution. Provision on-demand capacity.
B. Deploy Amazon Aurora as the database solution. Choose the serverless DB engine mode.
C. Deploy Amazon DynamoDB as the database solution. Ensure that DynamoDB auto scaling is enabled.
D. Deploy the static content into an Amazon S3 bucket. Provision an Amazon CloudFront distribution with the S3 bucket as the origin.
E. Deploy the web servers for static content across a fleet of Amazon EC2 instances in Auto Scaling groups. Configure the instances to periodically refresh the content from an Amazon Elastic File System (Amazon EFS) volume.
Show Answer
Correct Answer: A, D
Explanation: DynamoDB is the best fit because it is schemaless/flexible and supports rapid schema evolution. For the highest scalability with large swings from thousands to millions of users, on-demand capacity handles sudden demand without capacity planning. For a static single-page application, hosting in Amazon S3 behind Amazon CloudFront provides virtually unlimited scalability and efficient global content delivery. Aurora Serverless remains a relational database and is less aligned with rapid schema evolution, while EC2/EFS is unnecessary for static content.
Question 398
An online photo-sharing company stores its photos in an Amazon S3 bucket that exists in the us-west-1 Region. The company needs to store a copy of all new photos in the us-east-1 Region.
Which solution will meet this requirement with the LEAST operational effort?
A. Create a second S3 bucket in us-east-1. Use S3 Cross-Region Replication to copy photos from the existing S3 bucket to the second S3 bucket.
B. Create a cross-origin resource sharing (CORS) configuration of the existing S3 bucket. Specify us-east-1 in the CORS rule's AllowedOrigin element.
C. Create a second S3 bucket in us-east-1 across multiple Availability Zones. Create an S3 Lifecycle rule to save photos into the second S3 bucket.
D. Create a second S3 bucket in us-east-1. Configure S3 event notifications on object creation and update events to invoke an AWS Lambda function to copy photos from the existing S3 bucket to the second S3 bucket.
Show Answer
Correct Answer: A
Explanation: Amazon S3 Cross-Region Replication (CRR) is the native managed feature for automatically replicating new and updated objects from a bucket in one AWS Region to a bucket in another Region with minimal operational effort. CORS only controls browser access, Lifecycle rules do not copy objects across buckets, and using Lambda requires custom operational management.
Question 399
A company is planning to deploy a business-critical application in the AWS Cloud. The application requires durable storage with consistent, low-latency performance.
Which type of storage should a solutions architect recommend to meet these requirements?
A. Instance store volume
B. Amazon ElastiCache for Memcached cluster
C. Provisioned IOPS SSD Amazon Elastic Block Store (Amazon EBS) volume
D. Throughput Optimized HDD Amazon Elastic Block Store (Amazon EBS) volume
Show Answer
Correct Answer: C
Explanation: Provisioned IOPS SSD Amazon EBS volumes are designed for business-critical workloads that require durable block storage with consistently low latency and high IOPS. Instance store is ephemeral, ElastiCache is an in-memory cache rather than durable storage, and Throughput Optimized HDD is intended for throughput-oriented workloads rather than consistent low-latency performance.
Question 400
A solutions architect is designing a security solution for a company that wants to provide developers with individual AWS accounts through AWS Organizations, while also maintaining standard security controls. Because the individual developers will have AWS account root user-level access to their own accounts, the solutions architect wants to ensure that the mandatory AWS CloudTrail configuration that is applied to new developer accounts is not modified.
Which action meets these requirements?
A. Create an IAM policy that prohibits changes to CloudTrail. and attach it to the root user.
B. Create a new trail in CloudTrail from within the developer accounts with the organization trails option enabled.
C. Create a service control policy (SCP) that prohibits changes to CloudTrail, and attach it the developer accounts.
D. Create a service-linked role for CloudTrail with a policy condition that allows changes only from an Amazon Resource Name (ARN) in the management account.
Show Answer
Correct Answer: C
Explanation: A service control policy (SCP) attached to the developer accounts in AWS Organizations can prevent even the account root user from performing prohibited CloudTrail modification actions. IAM policies cannot effectively restrict the root user, organization trails are created from the management account rather than member accounts, and service-linked roles do not enforce user restrictions.
Question 401
A company wants to use Amazon FSx for Windows File Server for its Amazon EC2 instances that have an SMB file share mounted as a volume in the us-east-1 Region. The company has a recovery point objective (RPO) of 5 minutes for planned system maintenance or unplanned service disruptions. The company needs to replicate the file system to the us-west-2 Region. The replicated data must not be deleted by any user for 5 years.
Which solution will meet these requirements?
A. Create an FSx for Windows File Server file system in us-east-1 that has a Single-AZ 2 deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in compliance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
B. Create an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in governance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
C. Create an FSx for Windows File Server file system in us-east-1 that has a Multi-AZ deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in compliance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
D. Create an FSx for Windows File Server file system in us-east-1 that has a Single-AZ 2 deployment type. Use AWS Backup to create a daily backup plan that includes a backup rule that copies the backup to us-west-2. Configure AWS Backup Vault Lock in governance mode for a target vault in us-west-2. Configure a minimum duration of 5 years.
Show Answer
Correct Answer: C
Explanation: The requirements call for high availability with an RPO of about 5 minutes during planned maintenance or unplanned service disruptions, which is met by Amazon FSx for Windows File Server Multi-AZ deployments that provide automatic failover with minimal disruption. Cross-Region replication is achieved by AWS Backup copy jobs. Because the backups must not be deletable by any user for 5 years, AWS Backup Vault Lock must be configured in compliance mode (not governance mode), with a minimum retention of 5 years. Therefore, the correct combination is Multi-AZ plus Vault Lock compliance mode.
Question 402
A company has an application with a REST-based interface that allows data to be received in near-real time from a third-party vendor. Once received, the application processes and stores the data for further analysis. The application is running on Amazon EC2 instances.
The third-party vendor has received many 503 Service Unavailable Errors when sending data to the application. When the data volume spikes, the compute capacity reaches its maximum limit and the application is unable to process all requests.
Which design should a solutions architect recommend to provide a more scalable solution?
A. Use Amazon Kinesis Data Streams to ingest the data. Process the data using AWS Lambda functions.
B. Use Amazon API Gateway on top of the existing application. Create a usage plan with a quota limit for the third-party vendor.
C. Use Amazon Simple Notification Service (Amazon SNS) to ingest the data. Put the EC2 instances in an Auto Scaling group behind an Application Load Balancer.
D. Repackage the application as a container. Deploy the application using Amazon Elastic Container Service (Amazon ECS) using the EC2 launch type with an Auto Scaling group.
Show Answer
Correct Answer: A
Explanation: The application is failing during traffic spikes because the EC2-based backend cannot absorb bursty request volume. Amazon Kinesis Data Streams is designed for high-throughput, near-real-time streaming data ingestion and decouples producers from consumers. AWS Lambda can scale automatically to process records from the stream and store the results, eliminating the EC2 bottleneck. API Gateway with quotas would throttle the vendor rather than solve scalability. SNS is not the right service for durable high-throughput streaming ingestion, and moving to ECS on EC2 still depends on EC2 capacity and does not inherently address burst handling.
Question 403
A company deploys Amazon EC2 instances that run in a VPC. The EC2 instances load source data into Amazon S3 buckets so that the data can be processed in the future. According to compliance laws, the data must not be transmitted over the public internet. Servers in the company's on-premises data center will consume the output from an application that runs on the EC2 instances.
Which solution will meet these requirements?
A. Deploy an interface VPC endpoint for Amazon EC2. Create an AWS Site-to-Site VPN connection between the company and the VPC.
B. Deploy a gateway VPC endpoint for Amazon S3. Set up an AWS Direct Connect connection between the on-premises network and the VPC.
C. Set up an AWS Transit Gateway connection from the VPC to the S3 buckets. Create an AWS Site-to-Site VPN connection between the company and the VP
D. Set up proxy EC2 instances that have routes to NAT gateways. Configure the proxy EC2 instances to fetch S3 data and feed the application instances.
Show Answer
Correct Answer: B
Explanation: A gateway VPC endpoint for Amazon S3 keeps EC2-to-S3 traffic on the AWS private network, avoiding the public internet. AWS Direct Connect provides a private dedicated connection between the on-premises data center and AWS, so on-premises servers can access the VPC without traversing the public internet. Option A relies on Site-to-Site VPN, which is encrypted but typically traverses the public internet, and it incorrectly refers to an interface endpoint for Amazon EC2 rather than solving the S3 access requirement. Transit Gateway is not used to connect directly to S3, and the proxy/NAT solution still uses internet-based paths.
Question 404
A company has an application that serves clients that are deployed in more than 20.000 retail storefront locations around the world. The application consists of backend web services that are exposed over HTTPS on port 443. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The retail locations communicate with the web application over the public internet. The company allows each retail location to register the IP address that the retail location has been allocated by its local ISP.
The company's security team recommends to increase the security of the application endpoint by restricting access to only the IP addresses registered by the retail locations.
What should a solutions architect do to meet these requirements?
A. Associate an AWS WAF web ACL with the ALB. Use IP rule sets on the ALB to filter traffic. Update the IP addresses in the rule to include the registered IP addresses.
B. Deploy AWS Firewall Manager to manage the ALConfigure firewall rules to restrict traffic to the ALModify the firewall rules to include the registered IP addresses.
C. Store the IP addresses in an Amazon DynamoDB table. Configure an AWS Lambda authorization function on the ALB to validate that incoming requests are from the registered IP addresses.
D. Configure the network ACL on the subnet that contains the public interface of the ALB. Update the ingress rules on the network ACL with entries for each of the registered IP addresses.
Show Answer
Correct Answer: A
Explanation: AWS WAF attached to the Application Load Balancer is the appropriate service to restrict access based on source IP addresses. Create one or more IP sets containing the registered retail location IPs and use a web ACL rule to allow only those addresses. Firewall Manager is for centralized policy management rather than implementing the filtering itself, ALB does not support Lambda authorizers like API Gateway, and network ACLs are not suitable due to entry limits and operational complexity for tens of thousands of IPs.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.