A company is designing a new multi-tier web application that consists of the following components:
• Web and application servers that run on Amazon EC2 instances as part of Auto Scaling groups
• An Amazon RDS DB instance for data storage
A solutions architect needs to limit access to the application servers so that only the web servers can access them.
Which solution will meet these requirements?
A. Deploy AWS PrivateLink in front of the application servers. Configure the network ACL to allow only the web servers to access the application servers.
B. Deploy a VPC endpoint in front of the application servers. Configure the security group to allow only the web servers to access the application servers.
C. Deploy a Network Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the network ACL to allow only the web servers to access the application servers.
D. Deploy an Application Load Balancer with a target group that contains the application servers' Auto Scaling group. Configure the security group to allow only the web servers to access the application servers.
Show Answer
Correct Answer: D
Explanation: Use an internal Application Load Balancer in front of the application servers and restrict its security group so that only the web tier's security group can initiate connections. Security groups provide instance/load balancer-level stateful access control, which is the appropriate mechanism. PrivateLink and VPC endpoints are not intended for exposing an EC2 application tier within the same VPC, and the options using network ACLs rely on subnet-level stateless filtering rather than the recommended instance-level restriction.
Question 420
A company runs a critical, customer-facing application on Amazon Elastic Kubernetes Service (Amazon EKS). The application has a microservices architecture. The company needs to implement a solution that collects, aggregates, and summarizes metrics and logs from the application in a centralized location.
Which solution meets these requirements?
A. Run the Amazon CloudWatch agent in the existing EKS cluster. View the metrics and logs in the CloudWatch console.
B. Run AWS App Mesh in the existing EKS cluster. View the metrics and logs in the App Mesh console.
C. Configure AWS CloudTrail to capture data events. Query CloudTrail by using Amazon OpenSearch Service.
D. Configure Amazon CloudWatch Container Insights in the existing EKS cluster. View the metrics and logs in the CloudWatch console.
Show Answer
Correct Answer: D
Explanation: Amazon CloudWatch Container Insights is specifically designed for Amazon EKS and other container platforms to collect, aggregate, and summarize metrics and logs from containerized applications and microservices into CloudWatch. App Mesh is for service-to-service networking, CloudTrail records API activity rather than application metrics/logs, and the CloudWatch agent alone is the underlying component but the managed feature that fulfills the stated requirement is Container Insights.
Question 421
A company migrated a MySQL database from the company's on-premises data center to an Amazon RDS for MySQL DB instance. The company sized the RDS DB instance to meet the company's average daily workload. Once a month, the database performs slowly when the company runs queries for a report. The company wants to have the ability to run reports and maintain the performance of the daily workloads.
Which solution will meet these requirements?
A. Create a read replica of the database. Direct the queries to the read replica.
B. Create a backup of the database. Restore the backup to another DB instance. Direct the queries to the new database.
C. Export the data to Amazon S3. Use Amazon Athena to query the S3 bucket.
D. Resize the DB instance to accommodate the additional workload.
Show Answer
Correct Answer: A
Explanation: A read replica is the appropriate solution for offloading read-only reporting queries from the primary Amazon RDS for MySQL instance. Reporting workloads are read-intensive, so directing the monthly report queries to a read replica preserves the performance of the primary instance for daily transactional workloads. Restoring backups is not practical for recurring reports, exporting to S3/Athena adds unnecessary complexity and is not ideal for current transactional data, and permanently resizing the DB instance would increase cost for a workload spike that occurs only once a month.
Question 422
An ecommerce company wants a disaster recovery solution for its Amazon RDS DB instances that run Microsoft SQL Server Enterprise Edition. The company's current recovery point objective (RPO) and recovery time objective (RTO) are 24 hours.
Which solution will meet these requirements MOST cost-effectively?
A. Create a cross-Region read replica and promote the read replica to the primary instance.
B. Use AWS Database Migration Service (AWS DMS) to create RDS cross-Region replication.
C. Use cross-Region replication every 24 hours to copy native backups to an Amazon S3 bucket.
D. Copy automatic snapshots to another Region every 24 hours.
Show Answer
Correct Answer: D
Explanation: For an RPO of 24 hours and an RTO of 24 hours, maintaining continuously replicated infrastructure is unnecessary and more expensive. Copying Amazon RDS automated snapshots to another AWS Region every 24 hours provides a low-cost disaster recovery option. In the event of a regional disaster, a new DB instance can be restored from the copied snapshot in the target Region, meeting the stated objectives more cost-effectively than cross-Region replicas or continuous replication.
Question 423
A company has five organizational units (OUs) as part of its organization in AWS Organizations. Each OU correlates to the five businesses that the company owns. The company's research and development (R&D) business is separating from the company and will need its own organization. A solutions architect creates a separate new management account for this purpose.
What should the solutions architect do next in the new management account?
A. Have the R&D AWS account be part of both organizations during the transition.
B. Invite the R&D AWS account to be part of the new organization after the R&D AWS account has left the prior organization.
C. Create a new R&D AWS account in the new organization. Migrate resources from the prior R&D AWS account to the new R&D AWS account.
D. Have the R&D AWS account join the new organization. Make the new management account a member of the prior organization.
Show Answer
Correct Answer: B
Explanation: An AWS account can belong to only one AWS Organization at a time. To move the R&D account to a new organization, it must first leave the existing organization, then the new management account invites it to join the new organization. There is no support for an account belonging to two organizations simultaneously, and creating a new account and migrating resources is unnecessary for this scenario.
Question 424
A solutions architect is designing a disaster recovery (DR) strategy to provide Amazon EC2 capacity in a failover AWS Region. Business requirements state that the DR strategy must meet capacity in the failover Region.
Which solution will meet these requirements?
A. Purchase On-Demand Instances in the failover Region.
B. Purchase an EC2 Savings Plan in the failover Region.
C. Purchase regional Reserved Instances in the failover Region.
D. Purchase a Capacity Reservation in the failover Region.
Show Answer
Correct Answer: D
Explanation: Capacity Reservations are the AWS feature designed to guarantee EC2 capacity when you need it, making them appropriate for disaster recovery in a failover Region. On-Demand Instances do not guarantee capacity availability, Savings Plans provide pricing discounts only, and Regional Reserved Instances primarily provide billing benefits rather than reserving EC2 capacity.
Question 425
An ecommerce application uses a PostgreSQL database that runs on an Amazon EC2 instance. During a monthly sales event, database usage increases and causes database connection issues for the application. The traffic is unpredictable for subsequent monthly sales events, which impacts the sales forecast. The company needs to maintain performance when there is an unpredictable increase in traffic.
Which solution resolves this issue in the MOST cost-effective way?
A. Migrate the PostgreSQL database to Amazon Aurora Serverless v2.
B. Enable auto scaling for the PostgreSQL database on the EC2 instance to accommodate increased usage.
C. Migrate the PostgreSQL database to Amazon RDS for PostgreSQL with a larger instance type.
D. Migrate the PostgreSQL database to Amazon Redshift to accommodate increased usage.
Show Answer
Correct Answer: A
Explanation: Aurora Serverless v2 automatically scales database capacity up and down based on demand, making it well suited for unpredictable traffic spikes while avoiding the ongoing cost of permanently oversized instances. A self-managed PostgreSQL database on EC2 does not support database autoscaling as described, a larger fixed RDS instance may still be insufficient or unnecessarily expensive during normal periods, and Amazon Redshift is a data warehouse rather than a transactional OLTP database.
Question 426
A company is designing a solution to capture customer activity in different web applications to process analytics and make predictions. Customer activity in the web applications is unpredictable and can increase suddenly. The company requires a solution that integrates with other web applications. The solution must include an authorization step for security purposes.
Which solution will meet these requirements?
A. Configure a Gateway Load Balancer (GWLB) in front of an Amazon Elastic Container Service (Amazon ECS) container instance that stores the information that the company receives in an Amazon Elastic File System (Amazon EFS) file system. Authorization is resolved at the GWLB.
B. Configure an Amazon API Gateway endpoint in front of an Amazon Kinesis data stream that stores the information that the company receives in an Amazon S3 bucket. Use an AWS Lambda function to resolve authorization.
C. Configure an Amazon API Gateway endpoint in front of an Amazon Kinesis Data Firehose that stores the information that the company receives in an Amazon S3 bucket. Use an API Gateway Lambda authorizer to resolve authorization.
D. Configure a Gateway Load Balancer (GWLB) in front of an Amazon Elastic Container Service (Amazon ECS) container instance that stores the information that the company receives on an Amazon Elastic File System (Amazon EFS) file system. Use an AWS Lambda function to resolve authorization.
Show Answer
Correct Answer: C
Explanation: API Gateway is the appropriate front end for web application integration and supports Lambda authorizers for authorization. Kinesis Data Firehose is designed to ingest streaming data and deliver it directly to Amazon S3, automatically scaling with unpredictable traffic. Option B is incorrect because Kinesis Data Streams does not directly store data in S3; it requires a consumer application. GWLB is intended for deploying and scaling virtual network appliances, not for API ingestion and authorization.
Question 427
A company runs a container application by using Amazon Elastic Kubernetes Service (Amazon EKS). The application includes microservices that manage customers and place orders. The company needs to route incoming requests to the appropriate microservices.
Which solution will meet this requirement MOST cost-effectively?
A. Use the AWS Load Balancer Controller to provision a Network Load Balancer.
B. Use the AWS Load Balancer Controller to provision an Application Load Balancer.
C. Use an AWS Lambda function to connect the requests to Amazon EKS.
D. Use Amazon API Gateway to connect the requests to Amazon EKS.
Show Answer
Correct Answer: B
Explanation: An Application Load Balancer (ALB) provisioned by the AWS Load Balancer Controller is the standard EKS ingress solution for Layer 7 HTTP/HTTPS routing. It supports host- and path-based routing, making it ideal for directing requests to different microservices such as customer and order services. A Network Load Balancer operates at Layer 4 and does not provide application-layer routing. Lambda is not an appropriate request router for EKS. API Gateway can front EKS but adds unnecessary cost and complexity for simple microservice routing, making ALB the most cost-effective choice in this scenario.
Question 428
A company uses AWS and sells access to copyrighted images. The company’s global customer base needs to be able to access these images quickly. The company must deny access to users from specific countries. The company wants to minimize costs as much as possible.
Which solution will meet these requirements?
A. Use Amazon S3 to store the images. Turn on multi-factor authentication (MFA) and public bucket access. Provide customers with a link to the S3 bucket.
B. Use Amazon S3 to store the images. Create an IAM user for each customer. Add the users to a group that has permission to access the S3 bucket.
C. Use Amazon EC2 instances that are behind Application Load Balancers (ALBs) to store the images. Deploy the instances only in the countries the company services. Provide customers with links to the ALBs for their specific country's instances.
D. Use Amazon S3 to store the images. Use Amazon CloudFront to distribute the images with geographic restrictions. Provide a signed URL for each customer to access the data in CloudFront.
Show Answer
Correct Answer: D
Explanation: Amazon S3 is the most cost-effective storage for static images. Amazon CloudFront provides a global CDN for fast access, supports geographic restrictions to block requests from specific countries, and signed URLs restrict access to authorized customers. The other options either expose the bucket publicly, require impractical per-customer IAM users, or use unnecessarily expensive EC2 infrastructure.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.