A company has several on-premises Internet Small Computer Systems Interface (ISCSI) network storage servers. The company wants to reduce the number of these servers by moving to the AWS Cloud. A solutions architect must provide low-latency access to frequently used data and reduce the dependency on on-premises servers with a minimal number of infrastructure changes.
Which solution will meet these requirements?
A. Deploy an Amazon S3 File Gateway.
B. Deploy Amazon Elastic Block Store (Amazon EBS) storage with backups to Amazon S3.
C. Deploy an AWS Storage Gateway volume gateway that is configured with stored volumes.
D. Deploy an AWS Storage Gateway volume gateway that is configured with cached volumes.
Show Answer
Correct Answer: D
Explanation: AWS Storage Gateway Volume Gateway with cached volumes presents iSCSI block storage to on-premises applications, keeps frequently accessed data cached locally for low-latency access, and stores the primary dataset in Amazon S3. This minimizes infrastructure changes while reducing dependence on on-premises storage servers. S3 File Gateway provides file storage rather than iSCSI block storage, EBS cannot directly replace on-premises iSCSI servers, and stored volumes keep the primary data on-premises rather than primarily in AWS.
Question 416
A company is building a data analysis platform on AWS by using AWS Lake Formation. The platform will ingest data from different sources such as Amazon S3 and Amazon RDS. The company needs a secure solution to prevent access to portions of the data that contain sensitive information.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an IAM role that includes permissions to access Lake Formation tables.
B. Create data filters to implement row-level security and cell-level security.
C. Create an AWS Lambda function that removes sensitive information before Lake Formation ingests the data.
D. Create an AWS Lambda function that periodically queries and removes sensitive information from Lake Formation tables.
Show Answer
Correct Answer: B
Explanation: AWS Lake Formation data filters provide built-in row-level and cell-level security, allowing access to only non-sensitive portions of data without modifying or deleting the underlying datasets. This satisfies the requirement to prevent access to sensitive information with the least operational overhead. IAM roles alone do not provide this level of data filtering, and Lambda-based solutions add unnecessary maintenance and complexity.
Question 417
A company has an application that runs on Amazon EC2 instances in a private subnet. The application needs to process sensitive information from an Amazon S3 bucket. The application must not use the internet to connect to the S3 bucket.
Which solution will meet these requirements?
A. Configure an internet gateway. Update the S3 bucket policy to allow access from the internet gateway. Update the application to use the new internet gateway.
B. Configure a VPN connection. Update the S3 bucket policy to allow access from the VPN connection. Update the application to use the new VPN connection.
C. Configure a NAT gateway. Update the S3 bucket policy to allow access from the NAT gateway. Update the application to use the new NAT gateway.
D. Configure a VPC endpoint. Update the S3 bucket policy to allow access from the VPC endpoint. Update the application to use the new VPC endpoint.
Show Answer
Correct Answer: D
Explanation: Amazon S3 supports VPC endpoints (specifically a gateway endpoint for S3), allowing EC2 instances in private subnets to access S3 privately without traversing the public internet. The S3 bucket policy can be restricted to allow access only through the specified VPC endpoint. Internet gateways and NAT gateways involve internet routing, and a VPN is unnecessary for private access to an AWS service within the same AWS network.
Question 418
A company uses Amazon Elastic Kubernetes Service (Amazon EKS) to run a container application. The EKS cluster stores sensitive information in the Kubernetes secrets object. The company wants to ensure that the information is encrypted.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use the container application to encrypt the information by using AWS Key Management Service (AWS KMS).
B. Enable secrets encryption in the EKS cluster by using AWS Key Management Service (AWS KMS).
C. Implement an AWS Lambda function to encrypt the information by using AWS Key Management Service (AWS KMS).
D. Use AWS Systems Manager Parameter Store to encrypt the information by using AWS Key Management Service (AWS KMS).
Show Answer
Correct Answer: B
Explanation: Amazon EKS natively supports envelope encryption for Kubernetes Secrets using AWS Key Management Service (AWS KMS). Enabling EKS secrets encryption encrypts Secrets stored in etcd with minimal operational overhead and no application code changes. The other options require custom application logic, Lambda orchestration, or move secrets to a different service rather than encrypting Kubernetes Secrets in the cluster.
Question 419
A company is designing a new multi-tier web application that consists of the following components:
• Web and application servers that run on Amazon EC2 instances as part of Auto Scaling groups
• An Amazon RDS DB instance for data storage
A solutions architect needs to limit access to the application servers so that only the web servers can access them.
Which solution will meet these requirements?
A. Deploy AWS PrivateLink in front of the application servers. Configure the network ACL to allow only the web servers to access the application servers.
B. Deploy a VPC endpoint in front of the application servers. Configure the security group to allow only the web servers to access the application servers.
C. Deploy a Network Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the network ACL to allow only the web servers to access the application servers.
D. Deploy an Application Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the security group to allow only the web servers to access the application servers.
Show Answer
Correct Answer: D
Explanation: Use an internal Application Load Balancer in front of the application servers and restrict its security group so that only the web tier's security group can initiate connections. Security groups provide instance/load balancer-level stateful access control, which is the appropriate mechanism. PrivateLink and VPC endpoints are not intended for exposing an EC2 application tier within the same VPC, and the options using network ACLs rely on subnet-level stateless filtering rather than the recommended instance-level restriction.
Question 420
A company runs a critical, customer-facing application on Amazon Elastic Kubernetes Service (Amazon EKS). The application has a microservices architecture. The company needs to implement a solution that collects, aggregates, and summarizes metrics and logs from the application in a centralized location.
Which solution meets these requirements?
A. Run the Amazon CloudWatch agent in the existing EKS cluster. View the metrics and logs in the CloudWatch console.
B. Run AWS App Mesh in the existing EKS cluster. View the metrics and logs in the App Mesh console.
C. Configure AWS CloudTrail to capture data events. Query CloudTrail by using Amazon OpenSearch Service.
D. Configure Amazon CloudWatch Container Insights in the existing EKS cluster. View the metrics and logs in the CloudWatch console.
Show Answer
Correct Answer: D
Explanation: Amazon CloudWatch Container Insights is specifically designed for Amazon EKS and other container platforms to collect, aggregate, and summarize metrics and logs from containerized applications and microservices into CloudWatch. App Mesh is for service-to-service networking, CloudTrail records API activity rather than application metrics/logs, and the CloudWatch agent alone is the underlying component but the managed feature that fulfills the stated requirement is Container Insights.
Question 421
A company migrated a MySQL database from the company's on-premises data center to an Amazon RDS for MySQL DB instance. The company sized the RDS DB instance to meet the company's average daily workload. Once a month, the database performs slowly when the company runs queries for a report. The company wants to have the ability to run reports and maintain the performance of the daily workloads.
Which solution will meet these requirements?
A. Create a read replica of the database. Direct the queries to the read replica.
B. Create a backup of the database. Restore the backup to another DB instance. Direct the queries to the new database.
C. Export the data to Amazon S3. Use Amazon Athena to query the S3 bucket.
D. Resize the DB instance to accommodate the additional workload.
Show Answer
Correct Answer: A
Explanation: A read replica is the appropriate solution for offloading read-only reporting queries from the primary Amazon RDS for MySQL instance. Reporting workloads are read-intensive, so directing the monthly report queries to a read replica preserves the performance of the primary instance for daily transactional workloads. Restoring backups is not practical for recurring reports, exporting to S3/Athena adds unnecessary complexity and is not ideal for current transactional data, and permanently resizing the DB instance would increase cost for a workload spike that occurs only once a month.
Question 422
An ecommerce company wants a disaster recovery solution for its Amazon RDS DB instances that run Microsoft SQL Server Enterprise Edition. The company's current recovery point objective (RPO) and recovery time objective (RTO) are 24 hours.
Which solution will meet these requirements MOST cost-effectively?
A. Create a cross-Region read replica and promote the read replica to the primary instance.
B. Use AWS Database Migration Service (AWS DMS) to create RDS cross-Region replication.
C. Use cross-Region replication every 24 hours to copy native backups to an Amazon S3 bucket.
D. Copy automatic snapshots to another Region every 24 hours.
Show Answer
Correct Answer: D
Explanation: For an RPO of 24 hours and an RTO of 24 hours, maintaining continuously replicated infrastructure is unnecessary and more expensive. Copying Amazon RDS automated snapshots to another AWS Region every 24 hours provides a low-cost disaster recovery option. In the event of a regional disaster, a new DB instance can be restored from the copied snapshot in the target Region, meeting the stated objectives more cost-effectively than cross-Region replicas or continuous replication.
Question 423
A company has five organizational units (OUs) as part of its organization in AWS Organizations. Each OU correlates to the five businesses that the company owns. The company's research and development (R&D) business is separating from the company and will need its own organization. A solutions architect creates a separate new management account for this purpose.
What should the solutions architect do next in the new management account?
A. Have the R&D AWS account be part of both organizations during the transition.
B. Invite the R&D AWS account to be part of the new organization after the R&D AWS account has left the prior organization.
C. Create a new R&D AWS account in the new organization. Migrate resources from the prior R&D AWS account to the new R&D AWS account.
D. Have the R&D AWS account join the new organization. Make the new management account a member of the prior organization.
Show Answer
Correct Answer: B
Explanation: An AWS account can belong to only one AWS Organization at a time. To move the R&D account to a new organization, it must first leave the existing organization, then the new management account invites it to join the new organization. There is no support for an account belonging to two organizations simultaneously, and creating a new account and migrating resources is unnecessary for this scenario.
Question 424
A solutions architect is designing a disaster recovery (DR) strategy to provide Amazon EC2 capacity in a failover AWS Region. Business requirements state that the DR strategy must meet capacity in the failover Region.
Which solution will meet these requirements?
A. Purchase On-Demand Instances in the failover Region.
B. Purchase an EC2 Savings Plan in the failover Region.
C. Purchase regional Reserved Instances in the failover Region.
D. Purchase a Capacity Reservation in the failover Region.
Show Answer
Correct Answer: D
Explanation: Capacity Reservations are the AWS feature designed to guarantee EC2 capacity when you need it, making them appropriate for disaster recovery in a failover Region. On-Demand Instances do not guarantee capacity availability, Savings Plans provide pricing discounts only, and Regional Reserved Instances primarily provide billing benefits rather than reserving EC2 capacity.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.