A company has a financial application that produces reports. The reports average 50 KB in size and are stored in Amazon S3. The reports are frequently accessed during the first week after production and must be stored for several years. The reports must be retrievable within 6 hours.
Which solution meets these requirements MOST cost-effectively?
A. Use S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Glacier after 7 days.
B. Use S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days.
C. Use S3 Intelligent-Tiering. Configure S3 Intelligent-Tiering to transition the reports to S3 Standard-Infrequent Access (S3 Standard-IA) and S3 Glacier.
D. Use S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Glacier Deep Archive after 7 days.
Show Answer
Correct Answer: A
Explanation: Reports are accessed frequently only in the first week, then kept for years, and must be retrievable within 6 hours. S3 Glacier meets the 6‑hour requirement using Standard retrieval (3–5 hours) and is much cheaper for long‑term storage than Standard or Standard‑IA. Transitioning directly from S3 Standard to S3 Glacier after 7 days is allowed and cost‑effective. Standard‑IA has a 30‑day minimum storage charge, Intelligent‑Tiering is unnecessary and more expensive for known access patterns and small objects, and Glacier Deep Archive cannot guarantee retrieval within 6 hours.
Question 476
A retail company uses a regional Amazon API Gateway API for its public REST APIs. The API Gateway endpoint is a custom domain name that points to an Amazon Route 53 alias record. A solutions architect needs to create a solution that has minimal effects on customers and minimal data loss to release the new version of APIs.
Which solution will meet these requirements?
A. Create a canary release deployment stage for API Gateway. Deploy the latest API version. Point an appropriate percentage of traffic to the canary stage. After API verification, promote the canary stage to the production stage.
B. Create a new API Gateway endpoint with a new version of the API in OpenAPI YAML file format. Use the import-to-update operation in merge mode into the API in API Gateway. Deploy the new version of the API to the production stage.
C. Create a new API Gateway endpoint with a new version of the API in OpenAPI JSON file format. Use the import-to-update operation in overwrite mode into the API in API Gateway. Deploy the new version of the API to the production stage.
D. Create a new API Gateway endpoint with new versions of the API definitions. Create a custom domain name for the new API Gateway API. Point the Route 53 alias record to the new API Gateway API custom domain name.
Show Answer
Correct Answer: A
Explanation: A canary release in Amazon API Gateway allows routing a small, configurable percentage of live traffic to the new API version while the rest continues to use the existing production version. This minimizes customer impact and limits potential data loss, and once validated, the canary can be promoted seamlessly to production without changing the custom domain or Route 53 records.
Question 477
A company runs Amazon EC2 instances in multiple AWS accounts that are individually bled. The company recently purchased a Savings Pian. Because of changes in the company’s business requirements, the company has decommissioned a large number of EC2 instances. The company wants to use its Savings Plan discounts on its other AWS accounts.
Which combination of steps will meet these requirements? (Choose two.)
A. From the AWS Account Management Console of the management account, turn on discount sharing from the billing preferences section.
B. From the AWS Account Management Console of the account that purchased the existing Savings Plan, turn on discount sharing from the billing preferences section. Include all accounts.
C. From the AWS Organizations management account, use AWS Resource Access Manager (AWS RAM) to share the Savings Plan with other accounts.
D. Create an organization in AWS Organizations in a new payer account. Invite the other AWS accounts to join the organization from the management account.
E. Create an organization in AWS Organizations in the existing AWS account with the existing EC2 instances and Savings Plan. Invite the other AWS accounts to join the organization from the management account.
Show Answer
Correct Answer: A, D
Explanation: Savings Plans discounts can be shared only within an AWS Organization, and discount sharing is controlled by the management (payer) account. Therefore, the company must create an AWS Organization with a dedicated new payer/management account and invite the other accounts to join (D). Then, from the management account, discount sharing must be enabled in the billing preferences so the Savings Plan benefits are applied across member accounts (A).
Question 478
A media company uses an Amazon CloudFront distribution to deliver content over the internet. The company wants only premium customers to have access to the media streams and file content. The company stores all content in an Amazon S3 bucket. The company also delivers content on demand to customers for a specific purpose, such as movie rentals or music downloads.
Which solution will meet these requirements?
A. Generate and provide S3 signed cookies to premium customers.
B. Generate and provide CloudFront signed URLs to premium customers.
C. Use origin access control (OAC) to limit the access of non-premium customers.
D. Generate and activate field-level encryption to block non-premium customers.
Show Answer
Correct Answer: B
Explanation: CloudFront signed URLs are designed to restrict access to private content served through a CloudFront distribution. They allow the company to grant time-limited, purpose-specific access (such as movie rentals or music downloads) only to premium customers. S3 signed cookies are not used for CloudFront access control, OAC only secures the S3 origin from direct access but does not handle customer-level authorization, and field-level encryption protects sensitive fields rather than controlling who can access content.
Question 479
A company wants to build a web application on AWS. Client access requests to the website are not predictable and can be idle for a long time. Only customers who have paid a subscription fee can have the ability to sign in and use the web application.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose three.)
A. Create an AWS Lambda function to retrieve user information from Amazon DynamoDB. Create an Amazon API Gateway endpoint to accept RESTful APIs. Send the API calls to the Lambda function.
B. Create an Amazon Elastic Container Service (Amazon ECS) service behind an Application Load Balancer to retrieve user information from Amazon RDS. Create an Amazon API Gateway endpoint to accept RESTful APIs. Send the API calls to the Lambda function.
C. Create an Amazon Cognito user pool to authenticate users.
D. Create an Amazon Cognito identity pool to authenticate users.
E. Use AWS Amplify to serve the frontend web content with HTML, CSS, and JS. Use an integrated Amazon CloudFront configuration.
F. Use Amazon S3 static web hosting with PHP, CSS, and JS. Use Amazon CloudFront to serve the frontend web content.
Show Answer
Correct Answer: A, C, E
Explanation: The workload has unpredictable and often idle traffic, so a serverless architecture is most cost-effective. Option A uses API Gateway and AWS Lambda, which incur cost only per request and avoid paying for idle compute. User authentication for subscribed users is best handled by Amazon Cognito user pools (Option C), which are designed specifically for user sign-up and sign-in. For the frontend, AWS Amplify (Option E) provides low-cost, managed hosting for static web assets with CloudFront integration and fits naturally with a serverless backend. ECS (B) would incur ongoing costs when idle, identity pools (D) are for authorization to AWS resources rather than authentication, and S3 static hosting with PHP (F) is invalid because S3 does not support server-side scripting.
Question 480
A company has an on-premises server that uses an Oracle database to process and store customer information. The company wants to use an AWS database service to achieve higher availability and to improve application performance. The company also wants to offload reporting from its primary database system.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Use AWS Database Migration Service (AWS DMS) to create an Amazon RDS DB instance in multiple AWS Regions. Point the reporting functions toward a separate DB instance from the primary DB instance.
B. Use Amazon RDS in a Single-AZ deployment to create an Oracle database. Create a read replica in the same zone as the primary DB instance. Direct the reporting functions to the read replica.
C. Use Amazon RDS deployed in a Multi-AZ cluster deployment to create an Oracle database. Direct the reporting functions to use the reader instance in the cluster deployment.
D. Use Amazon RDS deployed in a Multi-AZ instance deployment to create an Amazon Aurora database. Direct the reporting functions to the reader instances.
Show Answer
Correct Answer: D
Explanation: The requirements are higher availability, improved performance, and offloading reporting with minimal operational effort. Amazon Aurora provides built‑in high availability across multiple AZs and supports multiple reader instances that are designed specifically for read scaling and reporting. Options using Oracle on RDS either lack readable standbys (Multi‑AZ instance) or rely on unsupported configurations (Multi‑AZ DB clusters with Oracle). Aurora therefore best meets the HA, performance, and reporting offload requirements in the most operationally efficient way.
Question 481
A company wants to provide data scientists with near real-time read-only access to the company's production Amazon RDS for PostgreSQL database. The database is currently configured as a Single-AZ database. The data scientists use complex queries that will not affect the production database. The company needs a solution that is highly available.
Which solution will meet these requirements MOST cost-effectively?
A. Scale the existing production database in a maintenance window to provide enough power for the data scientists.
B. Change the setup from a Single-AZ to a Multi-AZ instance deployment with a larger secondary standby instance. Provide the data scientists access to the secondary instance.
C. Change the setup from a Single-AZ to a Multi-AZ instance deployment. Provide two additional read replicas for the data scientists.
D. Change the setup from a Single-AZ to a Multi-AZ cluster deployment with two readable standby instances. Provide read endpoints to the data scientists.
Show Answer
Correct Answer: D
Explanation: The requirement is near real-time, read-only access without impacting production, plus high availability and lowest cost. A Multi-AZ DB *cluster* for RDS PostgreSQL provides one writer and multiple *readable standby* instances that replicate synchronously, giving near real-time reads and built-in high availability. Option B is invalid because Multi-AZ instance standbys are not readable. Option C would require paying for a Multi-AZ instance (writer + standby) plus additional asynchronous read replicas, resulting in more instances and higher cost. Option A does not provide isolation or high availability. Therefore, a Multi-AZ cluster with readable standbys (D) is the most cost-effective solution that meets all requirements.
Question 482
A company wants to build a logging solution for its multiple AWS accounts. The company currently stores the logs from all accounts in a centralized account. The company has created an Amazon S3 bucket in the centralized account to store the VPC flow logs and AWS CloudTrail logs. All logs must be highly available for 30 days for frequent analysis, retained for an additional 60 days for backup purposes, and deleted 90 days after creation.
Which solution will meet these requirements MOST cost-effectively?
A. Transition objects to the S3 Standard storage class 30 days after creation. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
B. Transition objects to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class 30 days after creation. Move all objects to the S3 Glacier Flexible Retrieval storage class after 90 days. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
C. Transition objects to the S3 Glacier Flexible Retrieval storage class 30 days after creation. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
D. Transition objects to the S3 One Zone-Infrequent Access (S3 One Zone-IA) storage class 30 days after creation. Move all objects to the S3 Glacier Flexible Retrieval storage class after 90 days. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
Show Answer
Correct Answer: C
Explanation: Logs must be highly available for the first 30 days, which is satisfied by the default S3 Standard storage. After 30 days, the requirement is only backup retention (no frequent access), so transitioning to a lower-cost archival class is appropriate. S3 Glacier Flexible Retrieval is the most cost-effective option for this period. The objects are then deleted at 90 days, meeting the retention requirement. Options B and D add unnecessary transitions at 90 days before deletion, increasing cost, and option A keeps data in S3 Standard longer than needed, making it less cost-effective.
Question 483
A company stores data in Amazon S3. According to regulations, the data must not contain personally identifiable information (PII). The company recently discovered that S3 buckets have some objects that contain PII. The company needs to automatically detect PII in S3 buckets and to notify the company’s security team.
Which solution will meet these requirements?
A. Use Amazon Macie. Create an Amazon EventBridge rule to filter the SensitiveData event type from Macie findings and to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
B. Use Amazon GuardDuty. Create an Amazon EventBridge rule to filter the CRITICAL event type from GuardDuty findings and to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
C. Use Amazon Macie. Create an Amazon EventBridge rule to filter the SensitiveData:S3Object/Personal event type from Macie findings and to send an Amazon Simple Queue Service (Amazon SQS) notification to the security team.
D. Use Amazon GuardDuty. Create an Amazon EventBridge rule to filter the CRITICAL event type from GuardDuty findings and to send an Amazon Simple Queue Service (Amazon SQS) notification to the security team.
Show Answer
Correct Answer: A
Explanation: Amazon Macie is the AWS service designed to automatically discover and detect sensitive data, including PII, in Amazon S3. Macie generates findings that are published as events. An Amazon EventBridge rule can filter Macie sensitive data findings and trigger notifications. Amazon SNS is appropriate for notifying a security team because it supports direct human notifications (email, SMS, integrations). GuardDuty does not detect PII, and Amazon SQS is not intended for direct notifications to people.
Question 484
A company needs to integrate with a third-party data feed. The data feed sends a webhook to notify an external service when new data is ready for consumption. A developer wrote an AWS Lambda function to retrieve data when the company receives a webhook callback. The developer must make the Lambda function available for the third party to call.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a function URL for the Lambda function. Provide the Lambda function URL to the third party for the webhook.
B. Deploy an Application Load Balancer (ALB) in front of the Lambda function. Provide the ALB URL to the third party for the webhook.
C. Create an Amazon Simple Notification Service (Amazon SNS) topic. Attach the topic to the Lambda function. Provide the public hostname of the SNS topic to the third party for the webhook.
D. Create an Amazon Simple Queue Service (Amazon SQS) queue. Attach the queue to the Lambda function. Provide the public hostname of the SQS queue to the third party for the webhook.
Show Answer
Correct Answer: A
Explanation: The requirement is to expose a Lambda function so a third party can invoke it via a webhook with the MOST operational efficiency. AWS Lambda Function URLs provide a native HTTPS endpoint managed entirely by Lambda, requiring no additional infrastructure. This directly satisfies webhook invocation with minimal setup and maintenance. Using an ALB, SNS, or SQS would introduce extra services, configuration, cost, and operational overhead without providing additional benefit for a simple webhook callback.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.