A company has several on-premises Internet Small Computer Systems Interface (ISCSI) network storage servers. The company wants to reduce the number of these servers by moving to the AWS Cloud. A solutions architect must provide low-latency access to frequently used data and reduce the dependency on on-premises servers with a minimal number of infrastructure changes.
Which solution will meet these requirements?
A. Deploy an Amazon S3 File Gateway.
B. Deploy Amazon Elastic Block Store (Amazon EBS) storage with backups to Amazon S3.
C. Deploy an AWS Storage Gateway volume gateway that is configured with stored volumes.
D. Deploy an AWS Storage Gateway volume gateway that is configured with cached volumes.
Show Answer
Correct Answer: D
Explanation: The company needs to replace on‑premises iSCSI block storage with minimal changes while providing low‑latency access to frequently used data and reducing reliance on local servers. AWS Storage Gateway volume gateway supports iSCSI, making it compatible with existing systems. When configured with cached volumes, frequently accessed data is stored locally for low latency, while the full dataset is stored durably in Amazon S3. This meets all requirements. Other options either do not provide iSCSI block storage, do not reduce on‑premises dependency sufficiently, or do not optimize for frequently accessed data.
Question 416
A company is building a data analysis platform on AWS by using AWS Lake Formation. The platform will ingest data from different sources such as Amazon S3 and Amazon RDS. The company needs a secure solution to prevent access to portions of the data that contain sensitive information.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an IAM role that includes permissions to access Lake Formation tables.
B. Create data filters to implement row-level security and cell-level security.
C. Create an AWS Lambda function that removes sensitive information before Lake Formation ingests the data.
D. Create an AWS Lambda function that periodically queries and removes sensitive information from Lake Formation tables.
Show Answer
Correct Answer: B
Explanation: AWS Lake Formation provides native data filters that enforce row-level and cell-level security on tables. This directly prevents access to sensitive portions of data without altering or removing the data itself. Because data filters are built-in to Lake Formation, they require minimal configuration and no custom code or additional services, resulting in the least operational overhead compared to IAM-only permissions or Lambda-based data processing solutions.
Question 417
A company has an application that runs on Amazon EC2 instances in a private subnet. The application needs to process sensitive information from an Amazon S3 bucket. The application must not use the internet to connect to the S3 bucket.
Which solution will meet these requirements?
A. Configure an internet gateway. Update the S3 bucket policy to allow access from the internet gateway. Update the application to use the new internet gateway.
B. Configure a VPN connection. Update the S3 bucket policy to allow access from the VPN connection. Update the application to use the new VPN connection.
C. Configure a NAT gateway. Update the S3 bucket policy to allow access from the NAT gateway. Update the application to use the new NAT gateway.
D. Configure a VPC endpoint. Update the S3 bucket policy to allow access from the VPC endpoint. Update the application to use the new VPC endpoint.
Show Answer
Correct Answer: D
Explanation: A VPC endpoint for Amazon S3 provides private connectivity between EC2 instances in a VPC and S3 without traversing the public internet. By updating the S3 bucket policy to allow access from the VPC endpoint, the application in a private subnet can securely access sensitive data without using an internet gateway, NAT gateway, or VPN.
Question 418
A company uses Amazon Elastic Kubernetes Service (Amazon EKS) to run a container application. The EKS cluster stores sensitive information in the Kubernetes secrets object. The company wants to ensure that the information is encrypted.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use the container application to encrypt the information by using AWS Key Management Service (AWS KMS).
B. Enable secrets encryption in the EKS cluster by using AWS Key Management Service (AWS KMS).
C. Implement an AWS Lambda function to encrypt the information by using AWS Key Management Service (AWS KMS).
D. Use AWS Systems Manager Parameter Store to encrypt the information by using AWS Key Management Service (AWS KMS).
Show Answer
Correct Answer: B
Explanation: Amazon EKS natively supports encrypting Kubernetes Secrets at rest by enabling secrets encryption with AWS KMS. This is a managed, cluster-level configuration that requires minimal setup and no application or workflow changes, resulting in the least operational overhead. Other options introduce additional components, code changes, or services that are unnecessary for encrypting Kubernetes Secrets stored in EKS.
Question 419
A company is designing a new multi-tier web application that consists of the following components:
• Web and application servers that run on Amazon EC2 instances as part of Auto Scaling groups
• An Amazon RDS DB instance for data storage
A solutions architect needs to limit access to the application servers so that only the web servers can access them.
Which solution will meet these requirements?
A. Deploy AWS PrivateLink in front of the application servers. Configure the network ACL to allow only the web servers to access the application servers.
B. Deploy a VPC endpoint in front of the application servers. Configure the security group to allow only the web servers to access the application servers.
C. Deploy a Network Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the network ACL to allow only the web servers to access the application servers.
D. Deploy an Application Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the security group to allow only the web servers to access the application servers.
Show Answer
Correct Answer: D
Explanation: To ensure that only the web servers can access the application servers in a multi-tier EC2-based architecture, the correct approach is to place an internal Application Load Balancer (ALB) in front of the application servers and control access using security groups. An ALB integrates natively with Auto Scaling groups and allows you to attach a security group that permits inbound traffic only from the web servers' security group. Security groups provide instance-level, stateful access control, which is more appropriate and flexible than network ACLs. VPC endpoints and AWS PrivateLink are designed for private access to AWS or third-party services, not for restricting traffic between EC2 tiers within the same VPC.
Question 420
A company runs a critical, customer-facing application on Amazon Elastic Kubernetes Service (Amazon EKS). The application has a microservices architecture. The company needs to implement a solution that collects, aggregates, and summarizes metrics and logs from the application in a centralized location.
Which solution meets these requirements?
A. Run the Amazon CloudWatch agent in the existing EKS cluster. View the metrics and logs in the CloudWatch console.
B. Run AWS App Mesh in the existing EKS cluster. View the metrics and logs in the App Mesh console.
C. Configure AWS CloudTrail to capture data events. Query CloudTrail by using Amazon OpenSearch Service.
D. Configure Amazon CloudWatch Container Insights in the existing EKS cluster. View the metrics and logs in the CloudWatch console.
Show Answer
Correct Answer: D
Explanation: Amazon CloudWatch Container Insights is purpose-built for Amazon EKS and containerized microservices. It collects, aggregates, and summarizes metrics and logs from clusters, nodes, pods, and containers, and stores them centrally in Amazon CloudWatch for visualization and analysis. Other options either do not provide centralized metrics/log aggregation for applications (App Mesh, CloudTrail) or are less precise than explicitly enabling Container Insights.
Question 421
A company migrated a MySQL database from the company's on-premises data center to an Amazon RDS for MySQL DB instance. The company sized the RDS DB instance to meet the company's average daily workload. Once a month, the database performs slowly when the company runs queries for a report. The company wants to have the ability to run reports and maintain the performance of the daily workloads.
Which solution will meet these requirements?
A. Create a read replica of the database. Direct the queries to the read replica.
B. Create a backup of the database. Restore the backup to another DB instance. Direct the queries to the new database.
C. Export the data to Amazon S3. Use Amazon Athena to query the S3 bucket.
D. Resize the DB instance to accommodate the additional workload.
Show Answer
Correct Answer: A
Explanation: The performance issue occurs only during monthly reporting queries, which are read-heavy and can impact the primary DB instance. Creating an Amazon RDS read replica allows the company to offload these reporting queries to the replica while the primary instance continues to handle daily transactional workloads without degradation. This approach meets the requirement without resizing the primary instance or performing costly data exports or restores.
Question 422
An ecommerce company wants a disaster recovery solution for its Amazon RDS DB instances that run Microsoft SQL Server Enterprise Edition. The company's current recovery point objective (RPO) and recovery time objective (RTO) are 24 hours.
Which solution will meet these requirements MOST cost-effectively?
A. Create a cross-Region read replica and promote the read replica to the primary instance.
B. Use AWS Database Migration Service (AWS DMS) to create RDS cross-Region replication.
C. Use cross-Region replication every 24 hours to copy native backups to an Amazon S3 bucket.
D. Copy automatic snapshots to another Region every 24 hours.
Show Answer
Correct Answer: D
Explanation: The RPO and RTO are both 24 hours, which allows a simple backup-based DR approach. Copying automated RDS snapshots to another Region every 24 hours meets the RPO, enables restore within the RTO, and is the most cost-effective option. Cross-Region replicas or DMS-based replication incur continuous replication and data transfer costs that are unnecessary for a 24-hour objective.
Question 423
A company has five organizational units (OUs) as part of its organization in AWS Organizations. Each OU correlates to the five businesses that the company owns. The company's research and development (R&D) business is separating from the company and will need its own organization. A solutions architect creates a separate new management account for this purpose.
What should the solutions architect do next in the new management account?
A. Have the R&D AWS account be part of both organizations during the transition.
B. Invite the R&D AWS account to be part of the new organization after the R&D AWS account has left the prior organization.
C. Create a new R&D AWS account in the new organization. Migrate resources from the prior R&D AWS account to the new R&D AWS account.
D. Have the R&D AWS account join the new organization. Make the new management account a member of the prior organization.
Show Answer
Correct Answer: B
Explanation: An AWS account can belong to only one AWS Organization at a time. To move the existing R&D AWS account into its own new organization, the correct process is to first remove the account from the current organization and then invite it to join the new organization from the new management account. This preserves all resources, billing history, and account configuration without requiring migration.
Question 424
A solutions architect is designing a disaster recovery (DR) strategy to provide Amazon EC2 capacity in a failover AWS Region. Business requirements state that the DR strategy must meet capacity in the failover Region.
Which solution will meet these requirements?
A. Purchase On-Demand Instances in the failover Region.
B. Purchase an EC2 Savings Plan in the failover Region.
C. Purchase regional Reserved Instances in the failover Region.
D. Purchase a Capacity Reservation in the failover Region.
Show Answer
Correct Answer: D
Explanation: The requirement is to guarantee EC2 capacity in a failover Region for disaster recovery. Only EC2 Capacity Reservations explicitly reserve and guarantee instance capacity so it is available when needed. On-Demand Instances, Savings Plans, and Reserved Instances primarily provide pricing benefits and do not ensure capacity availability during shortages.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.