A company is building an ecommerce application and needs to store sensitive customer information. The company needs to give customers the ability to complete purchase transactions on the website. The company also needs to ensure that sensitive customer data is protected, even from database administrators.
Which solution meets these requirements?
A. Store sensitive data in an Amazon Elastic Block Store (Amazon EBS) volume. Use EBS encryption to encrypt the data. Use an IAM instance role to restrict access.
B. Store sensitive data in Amazon RDS for MySQL. Use AWS Key Management Service (AWS KMS) client-side encryption to encrypt the data.
C. Store sensitive data in Amazon S3. Use AWS Key Management Service (AWS KMS) server-side encryption to encrypt the data. Use S3 bucket policies to restrict access.
D. Store sensitive data in Amazon FSx for Windows Server. Mount the file share on application servers. Use Windows file permissions to restrict access.
Show Answer
Correct Answer: B
Explanation: The requirement that sensitive customer data be protected even from database administrators implies application/client-side encryption, where data is encrypted before it reaches the database and only the application can decrypt it. RDS for MySQL is appropriate for transactional ecommerce data, and client-side encryption with AWS KMS-managed keys prevents DBAs from reading plaintext. EBS and S3 server-side encryption protect data at rest but the service can decrypt it for authorized access, and FSx permissions do not prevent privileged administrators from accessing plaintext.
Question 456
A company runs its applications on both Amazon Elastic Kubernetes Service (Amazon EKS) clusters and on-premises Kubernetes clusters. The company wants to view all clusters and workloads from a central location.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon CloudWatch Container Insights to collect and group the cluster information.
B. Use Amazon EKS Connector to register and connect all Kubernetes clusters.
C. Use AWS Systems Manager to collect and view the cluster information.
D. Use Amazon EKS Anywhere as the primary cluster to view the other clusters with native Kubernetes commands.
Show Answer
Correct Answer: B
Explanation: Amazon EKS Connector is designed to register conformant Kubernetes clusters, including on-premises clusters, with Amazon EKS so they can be viewed from the Amazon EKS console. It provides a centralized view of cluster status, configuration, and workloads with minimal operational overhead. CloudWatch Container Insights focuses on observability rather than centralized cluster inventory, Systems Manager is not the native solution for Kubernetes cluster visualization, and EKS Anywhere is for running EKS on customer infrastructure rather than aggregating existing clusters into a single view.
Question 457
A company's website handles millions of requests each day, and the number of requests continues to increase. A solutions architect needs to improve the response time of the web application. The solutions architect determines that the application needs to decrease latency when retrieving product details from the Amazon DynamoDB table.
Which solution will meet these requirements with the LEAST amount of operational overhead?
A. Set up a DynamoDB Accelerator (DAX) cluster. Route all read requests through DAX.
B. Set up Amazon ElastiCache for Redis between the DynamoDB table and the web application. Route all read requests through Redis.
C. Set up Amazon ElastiCache for Memcached between the DynamoDB table and the web application. Route all read requests through Memcached.
D. Set up Amazon DynamoDB Streams on the table, and have AWS Lambda read from the table and populate Amazon ElastiCache. Route all read requests through ElastiCache.
Show Answer
Correct Answer: A
Explanation: DynamoDB Accelerator (DAX) is a fully managed, in-memory cache purpose-built for Amazon DynamoDB that reduces read latency from milliseconds to microseconds with minimal application changes. ElastiCache (Redis or Memcached) requires custom cache management and invalidation logic, increasing operational overhead. Using DynamoDB Streams and Lambda to populate ElastiCache adds even more components and maintenance.
Question 458
A company's solutions architect is designing an AWS multi-account solution that uses AWS Organizations. The solutions architect has organized the company's accounts into organizational units (OUs).
The solutions architect needs a solution that will identify any changes to the OU hierarchy. The solution also needs to notify the company's operations team of any changes.
Which solution will meet these requirements with the LEAST operational overhead?
A. Provision the AWS accounts by using AWS Control Tower. Use account drift notifications to identify the changes to the OU hierarchy.
B. Provision the AWS accounts by using AWS Control Tower. Use AWS Config aggregated rules to identify the changes to the OU hierarchy.
C. Use AWS Service Catalog to create accounts in Organizations. Use an AWS CloudTrail organization trail to identify the changes to the OU hierarchy.
D. Use AWS CloudFormation templates to create accounts in Organizations. Use the drift detection operation on a stack to identify the changes to the OU hierarchy.
Show Answer
Correct Answer: A
Explanation: AWS Control Tower provides managed governance for AWS Organizations and includes account drift detection and drift notifications with Amazon EventBridge for changes that move enrolled accounts or otherwise cause drift from the expected OU placement and governance baseline. This is the managed option with the least operational overhead. AWS Config aggregated rules do not track Organizations OU hierarchy changes, CloudFormation drift is unrelated to Organizations structure, and CloudTrail can record Organizations API calls but requires additional detection and notification logic.
Question 459
A company runs an application in a VPC with public and private subnets. The VPC extends across multiple Availability Zones. The application runs on Amazon EC2 instances in private subnets. The application uses an Amazon Simple Queue Service (Amazon SQS) queue.
A solutions architect needs to design a secure solution to establish a connection between the EC2 instances and the SQS queue.
Which solution will meet these requirements?
A. Implement an interface VPC endpoint for Amazon SQS. Configure the endpoint to use the private subnets. Add to the endpoint a security group that has an inbound access rule that allows traffic from the EC2 instances that are in the private subnets.
B. Implement an interface VPC endpoint for Amazon SQS. Configure the endpoint to use the public subnets. Attach to the interface endpoint a VPC endpoint policy that allows access from the EC2 instances that are in the private subnets.
C. Implement an interface VPC endpoint for Amazon SQS. Configure the endpoint to use the public subnets. Attach an Amazon SQS access policy to the interface VPC endpoint that allows requests from only a specified VPC endpoint.
D. Implement a gateway endpoint for Amazon SQS. Add a NAT gateway to the private subnets. Attach an IAM role to the EC2 instances that allows access to the SQS queue.
Show Answer
Correct Answer: A
Explanation: Amazon SQS supports interface VPC endpoints (AWS PrivateLink), allowing EC2 instances in private subnets to access SQS privately without traversing the internet or requiring a NAT gateway. Interface endpoints are created in subnets (typically private subnets for this use case) and have attached security groups that control inbound traffic to the endpoint ENIs. Gateway endpoints are not supported for SQS, making option D invalid. Options B and C incorrectly place the interface endpoint in public subnets and do not provide the most secure private connectivity design.
Question 460
A company is using AWS Key Management Service (AWS KMS) keys to encrypt AWS Lambda environment variables. A solutions architect needs to ensure that the required permissions are in place to decrypt and use the environment variables.
Which steps must the solutions architect take to implement the correct permissions? (Choose two.)
A. Add AWS KMS permissions in the Lambda resource policy.
B. Add AWS KMS permissions in the Lambda execution role.
C. Add AWS KMS permissions in the Lambda function policy.
D. Allow the Lambda execution role in the AWS KMS key policy.
E. Allow the Lambda resource policy in the AWS KMS key policy.
Show Answer
Correct Answer: B, D
Explanation: Lambda decrypts environment variables by using its execution role to call AWS KMS. The execution role must have the required KMS permissions (such as kms:Decrypt, and where applicable kms:GenerateDataKey), and the KMS key policy must allow that execution role to use the key. Lambda resource policies and function policies control who can invoke the function, not KMS key usage.
Question 461
A company has created a multi-tier application for its ecommerce website. The website uses an Application Load Balancer that resides in the public subnets, a web tier in the public subnets, and a MySQL cluster hosted on Amazon EC2 instances in the private subnets. The MySQL database needs to retrieve product catalog and pricing information that is hosted on the internet by a third-party provider. A solutions architect must devise a strategy that maximizes security without increasing operational overhead.
What should the solutions architect do to meet these requirements?
A. Deploy a NAT instance in the VPC. Route all the internet-based traffic through the NAT instance.
B. Deploy a NAT gateway in the public subnets. Modify the private subnet route table to direct all internet-bound traffic to the NAT gateway.
C. Configure an internet gateway and attach it to the VPModify the private subnet route table to direct internet-bound traffic to the internet gateway.
D. Configure a virtual private gateway and attach it to the VPC. Modify the private subnet route table to direct internet-bound traffic to the virtual private gateway.
Show Answer
Correct Answer: B
Explanation: A NAT gateway in a public subnet allows instances in private subnets to initiate outbound internet connections (such as retrieving product catalog data) without allowing unsolicited inbound internet access. It is a managed service, minimizing operational overhead. A NAT instance requires administration and maintenance. Routing private subnets directly to an internet gateway would require public IPs and expose instances. A virtual private gateway is used for VPN or Direct Connect connectivity, not general internet access.
Question 462
A company has separate AWS accounts for its finance, data analytics, and development departments. Because of costs and security concerns, the company wants to control which services each AWS account can use.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS Systems Manager templates to control which AWS services each department can use.
B. Create organization units (OUs) for each department in AWS Organizations. Attach service control policies (SCPs) to the OUs.
C. Use AWS CloudFormation to automatically provision only the AWS services that each department can use.
D. Set up a list of products in AWS Service Catalog in the AWS accounts to manage and control the usage of specific AWS services.
Show Answer
Correct Answer: B
Explanation: AWS Organizations with organizational units (OUs) and service control policies (SCPs) provides centralized control over which AWS services and API actions can be used by accounts in each department. SCPs act as guardrails across accounts with minimal operational overhead. Systems Manager and CloudFormation do not restrict service usage, and Service Catalog governs approved provisioning but does not by itself prevent access to other AWS services.
Question 463
A company has data collection sensors at different locations. The data collection sensors stream a high volume of data to the company. The company wants to design a platform on AWS to ingest and process high-volume streaming data. The solution must be scalable and support data collection in near real time. The company must store the data in Amazon S3 for future reporting.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon Kinesis Data Firehose to deliver streaming data to Amazon S3.
B. Use AWS Glue to deliver streaming data to Amazon S3.
C. Use AWS Lambda to deliver streaming data and store the data to Amazon S3.
D. Use AWS Database Migration Service (AWS DMS) to deliver streaming data to Amazon S3.
Show Answer
Correct Answer: A
Explanation: Amazon Kinesis Data Firehose is a fully managed service designed to ingest, buffer, optionally transform, and deliver high-volume streaming data to Amazon S3 with automatic scaling and minimal operational overhead. AWS Glue is primarily for ETL, Lambda would require custom ingestion and scaling logic, and AWS DMS is for database migration/replication rather than sensor streaming.
Question 464
A recent analysis of a company's IT expenses highlights the need to reduce backup costs. The company's chief information officer wants to simplify the on-premises backup infrastructure and reduce costs by eliminating the use of physical backup tapes. The company must preserve the existing investment in the on-premises backup applications and workflows.
What should a solutions architect recommend?
A. Set up AWS Storage Gateway to connect with the backup applications using the NFS interface.
B. Set up an Amazon EFS file system that connects with the backup applications using the NFS interface.
C. Set up an Amazon EFS file system that connects with the backup applications using the iSCSI interface.
D. Set up AWS Storage Gateway to connect with the backup applications using the iSCSI-virtual tape library (VTL) interface.
Show Answer
Correct Answer: D
Explanation: The requirement is to eliminate physical backup tapes while preserving the existing on-premises backup applications and workflows. AWS Storage Gateway Tape Gateway exposes an iSCSI virtual tape library (VTL) interface that is designed as a drop-in replacement for physical tape infrastructure, allowing existing backup software to continue operating without workflow changes. Amazon EFS is a network file system and does not replace tape-based backup workflows or provide a VTL interface.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.