A company is building an ecommerce application and needs to store sensitive customer information. The company needs to give customers the ability to complete purchase transactions on the website. The company also needs to ensure that sensitive customer data is protected, even from database administrators.
Which solution meets these requirements?
A. Store sensitive data in an Amazon Elastic Block Store (Amazon EBS) volume. Use EBS encryption to encrypt the data. Use an IAM instance role to restrict access.
B. Store sensitive data in Amazon RDS for MySQL. Use AWS Key Management Service (AWS KMS) client-side encryption to encrypt the data.
C. Store sensitive data in Amazon S3. Use AWS Key Management Service (AWS KMS) server-side encryption to encrypt the data. Use S3 bucket policies to restrict access.
D. Store sensitive data in Amazon FSx for Windows Server. Mount the file share on application servers. Use Windows file permissions to restrict access.
Show Answer
Correct Answer: B
Explanation: The application requires a transactional data store for ecommerce purchases and must protect sensitive data even from database administrators. Using Amazon RDS for MySQL fits transactional workloads. Client-side encryption with AWS KMS ensures data is encrypted before it is written to the database, so the database only ever stores ciphertext. As a result, DB administrators and privileged users cannot view sensitive data. Other options only provide server-side or storage-level encryption, which still allows administrators with sufficient access to view plaintext data.
Question 456
A company runs its applications on both Amazon Elastic Kubernetes Service (Amazon EKS) clusters and on-premises Kubernetes clusters. The company wants to view all clusters and workloads from a central location.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon CloudWatch Container Insights to collect and group the cluster information.
B. Use Amazon EKS Connector to register and connect all Kubernetes clusters.
C. Use AWS Systems Manager to collect and view the cluster information.
D. Use Amazon EKS Anywhere as the primary cluster to view the other clusters with native Kubernetes commands.
Show Answer
Correct Answer: B
Explanation: Amazon EKS Connector allows the company to register on-premises and other non-EKS Kubernetes clusters with Amazon EKS and view cluster status, configuration, and workloads centrally in the Amazon EKS console. It provides the required single pane of glass with minimal setup and the least operational overhead. Other options either focus only on metrics (CloudWatch), are not Kubernetes-aware for this use case (Systems Manager), or are meant for running new on-prem clusters rather than centrally viewing existing ones (EKS Anywhere).
Question 457
A company's website handles millions of requests each day, and the number of requests continues to increase. A solutions architect needs to improve the response time of the web application. The solutions architect determines that the application needs to decrease latency when retrieving product details from the Amazon DynamoDB table.
Which solution will meet these requirements with the LEAST amount of operational overhead?
A. Set up a DynamoDB Accelerator (DAX) cluster. Route all read requests through DAX.
B. Set up Amazon ElastiCache for Redis between the DynamoDB table and the web application. Route all read requests through Redis.
C. Set up Amazon ElastiCache for Memcached between the DynamoDB table and the web application. Route all read requests through Memcached.
D. Set up Amazon DynamoDB Streams on the table, and have AWS Lambda read from the table and populate Amazon ElastiCache. Route all read requests through ElastiCache.
Show Answer
Correct Answer: A
Explanation: DynamoDB Accelerator (DAX) is purpose-built to reduce read latency for DynamoDB with minimal application changes and low operational overhead. It is fully managed, DynamoDB-compatible, and automatically handles caching. ElastiCache options require additional integration, cache management, and synchronization logic, and using Streams plus Lambda adds significant complexity and maintenance.
Question 458
A company's solutions architect is designing an AWS multi-account solution that uses AWS Organizations. The solutions architect has organized the company's accounts into organizational units (OUs).
The solutions architect needs a solution that will identify any changes to the OU hierarchy. The solution also needs to notify the company's operations team of any changes.
Which solution will meet these requirements with the LEAST operational overhead?
A. Provision the AWS accounts by using AWS Control Tower. Use account drift notifications to identify the changes to the OU hierarchy.
B. Provision the AWS accounts by using AWS Control Tower. Use AWS Config aggregated rules to identify the changes to the OU hierarchy.
C. Use AWS Service Catalog to create accounts in Organizations. Use an AWS CloudTrail organization trail to identify the changes to the OU hierarchy.
D. Use AWS CloudFormation templates to create accounts in Organizations. Use the drift detection operation on a stack to identify the changes to the OU hierarchy.
Show Answer
Correct Answer: C
Explanation: The requirement is to detect changes to the AWS Organizations OU hierarchy and notify the operations team with the least operational overhead. AWS CloudTrail natively records AWS Organizations API events such as CreateOrganizationalUnit, MoveAccount, UpdateOrganizationalUnit, and DeleteOrganizationalUnit. By enabling a CloudTrail organization trail, these events are captured automatically across all accounts, and notifications can be triggered using Amazon EventBridge and SNS with minimal setup. AWS Control Tower drift detection focuses on account and resource configuration drift from guardrails, not on tracking OU hierarchy changes, and AWS Config does not natively track OU structure. Therefore, using CloudTrail organization trails is the most direct and lowest-overhead solution.
Question 459
A company runs an application in a VPC with public and private subnets. The VPC extends across multiple Availability Zones. The application runs on Amazon EC2 instances in private subnets. The application uses an Amazon Simple Queue Service (Amazon SQS) queue.
A solutions architect needs to design a secure solution to establish a connection between the EC2 instances and the SQS queue.
Which solution will meet these requirements?
A. Implement an interface VPC endpoint for Amazon SQS. Configure the endpoint to use the private subnets. Add to the endpoint a security group that has an inbound access rule that allows traffic from the EC2 instances that are in the private subnets.
B. Implement an interface VPC endpoint for Amazon SQS. Configure the endpoint to use the public subnets. Attach to the interface endpoint a VPC endpoint policy that allows access from the EC2 instances that are in the private subnets.
C. Implement an interface VPC endpoint for Amazon SQS. Configure the endpoint to use the public subnets. Attach an Amazon SQS access policy to the interface VPC endpoint that allows requests from only a specified VPC endpoint.
D. Implement a gateway endpoint for Amazon SQS. Add a NAT gateway to the private subnets. Attach an IAM role to the EC2 instances that allows access to the SQS queue.
Show Answer
Correct Answer: A
Explanation: Amazon SQS supports interface VPC endpoints (AWS PrivateLink), which allow private connectivity from EC2 instances in private subnets to SQS without traversing the public internet or requiring NAT. The endpoint should be placed in private subnets, and a security group attached to the endpoint can restrict inbound traffic to only the EC2 instances. Other options are invalid because SQS does not support gateway endpoints and using public subnets is unnecessary and less secure.
Question 460
A company is using AWS Key Management Service (AWS KMS) keys to encrypt AWS Lambda environment variables. A solutions architect needs to ensure that the required permissions are in place to decrypt and use the environment variables.
Which steps must the solutions architect take to implement the correct permissions? (Choose two.)
A. Add AWS KMS permissions in the Lambda resource policy.
B. Add AWS KMS permissions in the Lambda execution role.
C. Add AWS KMS permissions in the Lambda function policy.
D. Allow the Lambda execution role in the AWS KMS key policy.
E. Allow the Lambda resource policy in the AWS KMS key policy.
Show Answer
Correct Answer: B, D
Explanation: To decrypt Lambda environment variables encrypted with a customer-managed AWS KMS key, permissions are required in two places. First, the Lambda execution role must include KMS permissions such as kms:Decrypt and kms:GenerateDataKey so the function can call KMS (Option B). Second, the KMS key policy itself must explicitly allow that Lambda execution role to use the key (Option D). Both IAM policy and key policy permissions are required for KMS access.
Question 461
A company has created a multi-tier application for its ecommerce website. The website uses an Application Load Balancer that resides in the public subnets, a web tier in the public subnets, and a MySQL cluster hosted on Amazon EC2 instances in the private subnets. The MySQL database needs to retrieve product catalog and pricing information that is hosted on the internet by a third-party provider. A solutions architect must devise a strategy that maximizes security without increasing operational overhead.
What should the solutions architect do to meet these requirements?
A. Deploy a NAT instance in the VPC. Route all the internet-based traffic through the NAT instance.
B. Deploy a NAT gateway in the public subnets. Modify the private subnet route table to direct all internet-bound traffic to the NAT gateway.
C. Configure an internet gateway and attach it to the VPModify the private subnet route table to direct internet-bound traffic to the internet gateway.
D. Configure a virtual private gateway and attach it to the VPC. Modify the private subnet route table to direct internet-bound traffic to the virtual private gateway.
Show Answer
Correct Answer: B
Explanation: The MySQL instances are in private subnets and need outbound internet access to a third-party provider without being directly reachable from the internet. A NAT gateway placed in public subnets provides managed, highly available outbound internet access for resources in private subnets with minimal operational overhead. NAT instances require maintenance, internet gateways cannot be used directly by private subnets, and virtual private gateways are for VPN/Direct Connect, not internet access.
Question 462
A company has separate AWS accounts for its finance, data analytics, and development departments. Because of costs and security concerns, the company wants to control which services each AWS account can use.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS Systems Manager templates to control which AWS services each department can use.
B. Create organization units (OUs) for each department in AWS Organizations. Attach service control policies (SCPs) to the OUs.
C. Use AWS CloudFormation to automatically provision only the AWS services that each department can use.
D. Set up a list of products in AWS Service Catalog in the AWS accounts to manage and control the usage of specific AWS services.
Show Answer
Correct Answer: B
Explanation: AWS Organizations with organizational units (OUs) and service control policies (SCPs) provides centralized, account-level control over which AWS services can be used. SCPs act as guardrails that restrict services across entire accounts with minimal ongoing management, meeting both security and cost-control goals with the least operational overhead compared to per-account tooling or provisioning approaches.
Question 463
A company has data collection sensors at different locations. The data collection sensors stream a high volume of data to the company. The company wants to design a platform on AWS to ingest and process high-volume streaming data. The solution must be scalable and support data collection in near real time. The company must store the data in Amazon S3 for future reporting.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3.
B. Use AWS Glue to deliver streaming data to Amazon S3.
C. Use AWS Lambda to deliver streaming data and store the data to Amazon S3.
D. Use AWS Database Migration Service (AWS DMS) to deliver streaming data to Amazon S3.
Show Answer
Correct Answer: A
Explanation: Amazon Kinesis Data Firehose is a fully managed service designed specifically for ingesting high-volume streaming data and delivering it to destinations such as Amazon S3 in near real time. It automatically scales with throughput, requires minimal setup and maintenance, and has the least operational overhead compared to building custom ingestion with Lambda, using Glue ETL jobs, or using AWS DMS, which is intended for database migration rather than streaming sensor data.
Question 464
A recent analysis of a company's IT expenses highlights the need to reduce backup costs. The company's chief information officer wants to simplify the on-premises backup infrastructure and reduce costs by eliminating the use of physical backup tapes. The company must preserve the existing investment in the on-premises backup applications and workflows.
What should a solutions architect recommend?
A. Set up AWS Storage Gateway to connect with the backup applications using the NFS interface.
B. Set up an Amazon EFS file system that connects with the backup applications using the NFS interface.
C. Set up an Amazon EFS file system that connects with the backup applications using the iSCSI interface.
D. Set up AWS Storage Gateway to connect with the backup applications using the iSCSI-virtual tape library (VTL) interface.
Show Answer
Correct Answer: D
Explanation: The requirement is to eliminate physical backup tapes while preserving existing on‑premises backup applications and workflows. AWS Storage Gateway with the iSCSI Virtual Tape Library (VTL) interface is designed specifically for this use case: it emulates a traditional tape library, is compatible with existing tape‑based backup software, and stores data cost‑effectively in Amazon S3 and Glacier tiers. NFS or EFS options would require changing backup workflows and applications, violating the requirement.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.