A company's SAP application has a backend SQL Server database in an on-premises environment. The company wants to migrate its on-premises application and database server to AWS. The company needs an instance type that meets the high demands of its SAP database. On-premises performance data shows that both the SAP application and the database have high memory utilization.
Which solution will meet these requirements?
A. Use the compute optimized instance family for the application. Use the memory optimized instance family for the database.
B. Use the storage optimized instance family for both the application and the database.
C. Use the memory optimized instance family for both the application and the database.
D. Use the high performance computing (HPC) optimized instance family for the application. Use the memory optimized instance family for the database.
Show Answer
Correct Answer: C
Explanation: SAP workloads, especially SAP applications and SQL Server databases with high memory utilization, are best suited to memory-optimized EC2 instance families. Since both the application and the database are memory-intensive, using memory-optimized instances for both components satisfies the workload requirements. Compute-optimized, storage-optimized, and HPC instance families are designed for different workload characteristics and do not address the primary bottleneck of high memory usage.
Question 440
A solutions architect is using an AWS CloudFormation template to deploy a three-tier web application. The web application consists of a web tier and an application tier that stores and retrieves user data in Amazon DynamoDB tables. The web and application tiers are hosted on Amazon EC2 instances, and the database tier is not publicly accessible. The application EC2 instances need to access the DynamoDB tables without exposing API credentials in the template.
What should the solutions architect do to meet these requirements?
A. Create an IAM role to read the DynamoDB tables. Associate the role with the application instances by referencing an instance profile.
B. Create an IAM role that has the required permissions to read and write from the DynamoDB tables. Add the role to the EC2 instance profile, and associate the instance profile with the application instances.
C. Use the parameter section in the AWS CloudFormation template to have the user input access and secret keys from an already-created IAM user that has the required permissions to read and write from the DynamoDB tables.
D. Create an IAM user in the AWS CloudFormation template that has the required permissions to read and write from the DynamoDB tables. Use the GetAtt function to retrieve the access and secret keys, and pass them to the application instances through the user data.
Show Answer
Correct Answer: B
Explanation: The application tier both stores and retrieves data in DynamoDB, so it requires read and write permissions. The AWS best practice is to attach an IAM role with the necessary DynamoDB permissions to an EC2 instance profile and associate that instance profile with the application EC2 instances. This provides temporary credentials automatically without embedding API keys in the CloudFormation template.
Question 441
A company hosts multiple applications on AWS for different product lines. The applications use different compute resources, including Amazon EC2 instances and Application Load Balancers. The applications run in different AWS accounts under the same organization in AWS Organizations across multiple AWS Regions. Teams for each product line have tagged each compute resource in the individual accounts.
The company wants more details about the cost for each product line from the consolidated billing feature in Organizations.
Which combination of steps will meet these requirements? (Choose two.)
A. Select a specific AWS generated tag in the AWS Billing console.
B. Select a specific user-defined tag in the AWS Billing console.
C. Select a specific user-defined tag in the AWS Resource Groups console.
D. Activate the selected tag from each AWS account.
E. Activate the selected tag from the Organizations management account.
Show Answer
Correct Answer: B, E
Explanation: For cost allocation in AWS Organizations consolidated billing, use user-defined cost allocation tags and activate them in the Billing and Cost Management console from the Organizations management account. AWS-generated tags do not represent custom product-line groupings, Resource Groups is unrelated to billing cost allocation, and tag activation is managed centrally by the organization management account.
Question 442
An Amazon EventBridge rule targets a third-party API. The third-party API has not received any incoming traffic. A solutions architect needs to determine whether the rule conditions are being met and if the rule's target is being invoked.
Which solution will meet these requirements?
A. Check for metrics in Amazon CloudWatch in the namespace for AWS/Events.
B. Review events in the Amazon Simple Queue Service (Amazon SQS) dead-letter queue.
C. Check for the events in Amazon CloudWatch Logs.
D. Check the trails in AWS CloudTrail for the EventBridge events.
Show Answer
Correct Answer: A
Explanation: Amazon EventBridge publishes operational metrics to Amazon CloudWatch in the AWS/Events namespace, including metrics such as MatchedEvents and Invocations. These metrics allow you to verify whether rule conditions are matching events and whether the target is being invoked. SQS dead-letter queues are only relevant if a DLQ is configured for failed deliveries, CloudWatch Logs do not automatically contain EventBridge event logs, and CloudTrail records AWS API activity (such as managing EventBridge resources), not whether a rule matched or invoked a third-party API target.
Question 443
A solutions architect manages an analytics application. The application stores large amounts of semistructured data in an Amazon S3 bucket. The solutions architect wants to use parallel data processing to process the data more quickly. The solutions architect also wants to use information that is stored in an Amazon Redshift database to enrich the data.
Which solution will meet these requirements?
A. Use Amazon Athena to process the S3 data. Use AWS Glue with the Amazon Redshift data to enrich the S3 data.
B. Use Amazon EMR to process the S3 data. Use Amazon EMR with the Amazon Redshift data to enrich the S3 data.
C. Use Amazon EMR to process the S3 data. Use Amazon Kinesis Data Streams to move the S3 data into Amazon Redshift so that the data can be enriched.
D. Use AWS Glue to process the S3 data. Use AWS Lake Formation with the Amazon Redshift data to enrich the S3 data.
Show Answer
Correct Answer: B
Explanation: Amazon EMR is designed for large-scale parallel processing of semi-structured data stored in Amazon S3 using Hadoop/Spark. EMR can also integrate with Amazon Redshift (for example via Spark, Hive, or the Redshift connector) to read Redshift data and join it with S3 data for enrichment. Athena is primarily a serverless query service rather than a distributed data processing framework, Kinesis Data Streams is unrelated to this batch enrichment workflow, and Lake Formation is a data lake governance service, not a data enrichment engine.
Question 444
A financial services company launched a new application that uses an Amazon RDS for MySQL database. The company uses the application to track stock market trends. The company needs to operate the application for only 2 hours at the end of each week. The company needs to optimize the cost of running the database.
Which solution will meet these requirements MOST cost-effectively?
A. Migrate the existing RDS for MySQL database to an Aurora Serverless v2 MySQL database cluster.
B. Migrate the existing RDS for MySQL database to an Aurora MySQL database cluster.
C. Migrate the existing RDS for MySQL database to an Amazon EC2 instance that runs MySQL. Purchase an instance reservation for the EC2 instance.
D. Migrate the existing RDS for MySQL database to an Amazon Elastic Container Service (Amazon ECS) cluster that uses MySQL container images to run tasks.
Show Answer
Correct Answer: A
Explanation: Aurora Serverless v2 is designed for infrequent or intermittent database workloads and automatically scales compute capacity based on demand, making it more cost-effective than provisioned RDS, provisioned Aurora, or self-managed MySQL on EC2/ECS for an application used only about 2 hours per week. While Aurora Serverless v2 does not scale to zero (minimum 0.5 ACU), it still minimizes compute costs compared with always-on alternatives.
Question 445
A solutions architect needs to ensure that API calls to Amazon DynamoDB from Amazon EC2 instances in a VPC do not travel across the internet.
Which combination of steps should the solutions architect take to meet this requirement? (Choose two.)
A. Create a route table entry for the endpoint.
B. Create a gateway endpoint for DynamoD
C. Create an interface endpoint for Amazon EC2.
D. Create an elastic network interface for the endpoint in each of the subnets of the VPC.
E. Create a security group entry in the endpoint's security group to provide access.
Show Answer
Correct Answer: A, B
Explanation: Amazon DynamoDB uses a gateway VPC endpoint (not an interface endpoint) for private access from resources in a VPC. After creating the gateway endpoint, you associate it with the appropriate route tables so traffic destined for DynamoDB is routed through the endpoint instead of the internet. Gateway endpoints do not create ENIs and do not have security groups, so options D and E do not apply.
Question 446
A company has 5 PB of archived data on physical tapes. The company needs to preserve the data on the tapes for another 10 years for compliance purposes. The company wants to migrate to AWS in the next 6 months. The data center that stores the tapes has a 1 Gbps uplink internet connectivity.
Which solution will meet these requirements MOST cost-effectively?
A. Read the data from the tapes on premises. Stage the data in a local NFS storage. Use AWS DataSync to migrate the data to Amazon S3 Glacier Flexible Retrieval.
B. Use an on-premises backup application to read the data from the tapes and to write directly to Amazon S3 Glacier Deep Archive.
C. Order multiple AWS Snowball devices that have Tape Gateway. Copy the physical tapes to virtual tapes in Snowball. Ship the Snowball devices to AWS. Create a lifecycle policy to move the tapes to Amazon S3 Glacier Deep Archive.
D. Configure an on-premises Tape Gateway. Create virtual tapes in the AWS Cloud. Use backup software to copy the physical tape to the virtual tape.
Show Answer
Correct Answer: C
Explanation: The 1 Gbps internet link cannot transfer 5 PB within the 6-month migration window. Using AWS Snowball with Tape Gateway is designed for petabyte-scale migration from physical tapes by copying to virtual tapes offline and shipping the devices to AWS. After ingestion, lifecycle policies can transition data to Amazon S3 Glacier Deep Archive for the lowest long-term archival storage cost. Internet-based options (A, B, and D) are impractical due to bandwidth constraints.
Question 447
A solutions architect needs to review a company's Amazon S3 buckets to discover personally identifiable information (PII). The company stores the PII data in the us-east-1 Region and us-west-2 Region.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure Amazon Macie in each Region. Create a job to analyze the data that is in Amazon S3.
B. Configure AWS Security Hub for all Regions. Create an AWS Config rule to analyze the data that is in Amazon S3.
C. Configure Amazon Inspector to analyze the data that is in Amazon S3.
D. Configure Amazon GuardDuty to analyze the data that is in Amazon S3.
Show Answer
Correct Answer: A
Explanation: Amazon Macie is the AWS service specifically designed to discover, classify, and protect sensitive data such as personally identifiable information (PII) in Amazon S3. Because Macie is a Regional service, it should be enabled in each Region that contains the S3 buckets (us-east-1 and us-west-2) and configured to analyze those buckets. Security Hub aggregates security findings but does not perform PII discovery. Amazon Inspector assesses vulnerabilities and software exposure, not S3 data classification. Amazon GuardDuty detects threats and malicious activity, not PII in S3.
Question 448
A company has two VPCs that are located in the us-west-2 Region within the same AWS account. The company needs to allow network traffic between these VPCs. Approximately 500 GB of data transfer will occur between the VPCs each month.
What is the MOST cost-effective solution to connect these VPCs?
A. Implement AWS Transit Gateway to connect the VPCs. Update the route tables of each VPC to use the transit gateway for inter-VPC communication.
B. Implement an AWS Site-to-Site VPN tunnel between the VPCs. Update the route tables of each VPC to use the VPN tunnel for inter-VPC communication.
C. Set up a VPC peering connection between the VPCs. Update the route tables of each VPC to use the VPC peering connection for inter-VPC communication.
D. Set up a 1 GB AWS Direct Connect connection between the VPCs. Update the route tables of each VPC to use the Direct Connect connection for inter-VPC communication.
Show Answer
Correct Answer: C
Explanation: For two VPCs in the same AWS account and the same Region, a VPC peering connection is the simplest and most cost-effective option. It provides private connectivity directly between the VPCs without the hourly attachment and data processing charges of Transit Gateway, the tunnel overhead and charges of Site-to-Site VPN, or the significant cost and inappropriate use case of Direct Connect. After creating the peering connection, update each VPC's route tables to route traffic through the peering connection.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.