A company has a regional subscription-based streaming service that runs in a single AWS Region. The architecture consists of web servers and application servers on Amazon EC2 instances. The EC2 instances are in Auto Scaling groups behind Elastic Load Balancers. The architecture includes an Amazon Aurora global database cluster that extends across multiple Availability Zones.
The company wants to expand globally and to ensure that its application has minimal downtime.
Which solution will provide the MOST fault tolerance?
A. Extend the Auto Scaling groups for the web tier and the application tier to deploy instances in Availability Zones in a second Region. Use an Aurora global database to deploy the database in the primary Region and the second Region. Use Amazon Route 53 health checks with a failover routing policy to the second Region.
B. Deploy the web tier and the application tier to a second Region. Add an Aurora PostgreSQL cross-Region Aurora Replica in the second Region. Use Amazon Route 53 health checks with a failover routing policy to the second Region. Promote the secondary to primary as needed.
C. Deploy the web tier and the application tier to a second Region. Create an Aurora PostgreSQL database in the second Region. Use AWS Database Migration Service (AWS DMS) to replicate the primary database to the second Region. Use Amazon Route 53 health checks with a failover routing policy to the second Region.
D. Deploy the web tier and the application tier to a second Region. Use an Amazon Aurora global database to deploy the database in the primary Region and the second Region. Use Amazon Route 53 health checks with a failover routing policy to the second Region. Promote the secondary to primary as needed.
Show Answer
Correct Answer: D
Explanation: The goal is maximum fault tolerance and minimal downtime during a regional failure. EC2 Auto Scaling groups cannot span Regions, so each Region must have its own web and application tiers, which eliminates option A. Using an Amazon Aurora global database provides managed cross-Region replication with very low replication lag and fast recovery, which is more fault tolerant than manual replication with DMS or standard cross-Region replicas (options B and C). Deploying the full stack in a second Region, using Route 53 failover routing, and promoting the secondary Aurora global database Region when needed provides the most resilient multi-Region architecture with minimal downtime.
Question 486
A company wants to analyze and troubleshoot Access Denied errors and Unauthorized errors that are related to IAM permissions. The company has AWS CloudTrail turned on.
Which solution will meet these requirements with the LEAST effort?
A. Use AWS Glue and write custom scripts to query CloudTrail logs for the errors.
B. Use AWS Batch and write custom scripts to query CloudTrail logs for the errors.
C. Search CloudTrail logs with Amazon Athena queries to identify the errors.
D. Search CloudTrail logs with Amazon QuickSight. Create a dashboard to identify the errors.
Show Answer
Correct Answer: C
Explanation: Amazon Athena can directly query CloudTrail logs stored in Amazon S3 using SQL with no infrastructure to manage and no custom code to write. This makes it the least-effort way to search for AccessDenied and UnauthorizedOperation errors and drill into details (user, role, action, resource) needed for troubleshooting IAM permission issues. AWS Glue or AWS Batch require additional setup and scripting, and Amazon QuickSight is primarily for visualization and still depends on queried data rather than direct log troubleshooting.
Question 487
A global video streaming company uses Amazon CloudFront as a content distribution network (CDN). The company wants to roll out content in a phased manner across multiple countries. The company needs to ensure that viewers who are outside the countries to which the company rolls out content are not able to view the content.
Which solution will meet these requirements?
A. Add geographic restrictions to the content in CloudFront by using an allow list. Set up a custom error message.
B. Set up a new URL tor restricted content. Authorize access by using a signed URL and cookies. Set up a custom error message.
C. Encrypt the data for the content that the company distributes. Set up a custom error message.
D. Create a new URL for restricted content. Set up a time-restricted access policy for signed URLs.
Show Answer
Correct Answer: A
Explanation: The requirement is to prevent viewers outside specific countries from accessing content during a phased rollout. Amazon CloudFront provides built-in geographic restrictions that allow or block access based on the viewer’s country. Using an allow list ensures only viewers from approved countries can access the content, and a custom error message can be shown to blocked users. Signed URLs, encryption, or time-based policies control *who* or *when* content is accessed, not *where*, so they do not meet the geo-restriction requirement.
Question 488
A company runs a three-tier web application in the AWS Cloud that operates across three Availability Zones. The application architecture has an Application Load Balancer, an Amazon EC2 web server that hosts user session states, and a MySQL database that runs on an EC2 instance. The company expects sudden increases in application traffic. The company wants to be able to scale to meet future application capacity demands and to ensure high availability across all three Availability Zones.
Which solution will meet these requirements?
A. Migrate the MySQL database to Amazon RDS for MySQL with a Multi-AZ DB cluster deployment. Use Amazon ElastiCache for Redis with high availability to store session data and to cache reads. Migrate the web server to an Auto Scaling group that is in three Availability Zones.
B. Migrate the MySQL database to Amazon RDS for MySQL with a Multi-AZ DB cluster deployment. Use Amazon ElastiCache for Memcached with high availability to store session data and to cache reads. Migrate the web server to an Auto Scaling group that is in three Availability Zones.
C. Migrate the MySQL database to Amazon DynamoDB Use DynamoDB Accelerator (DAX) to cache reads. Store the session data in DynamoDB. Migrate the web server to an Auto Scaling group that is in three Availability Zones.
D. Migrate the MySQL database to Amazon RDS for MySQL in a single Availability Zone. Use Amazon ElastiCache for Redis with high availability to store session data and to cache reads. Migrate the web server to an Auto Scaling group that is in three Availability Zones.
Show Answer
Correct Answer: A
Explanation: The application must scale for sudden traffic spikes and remain highly available across three Availability Zones. Web servers should be stateless and scale horizontally, which is achieved by using an Auto Scaling group across three AZs and externalizing session state. Amazon ElastiCache for Redis supports replication, Multi-AZ, and automatic failover, making it well suited for highly available session storage, unlike Memcached, which does not provide the same HA capabilities. Migrating MySQL to Amazon RDS for MySQL with a Multi-AZ DB cluster deployment provides high availability and improved scalability compared to a single EC2-hosted database. Option D lacks database HA, and option C changes the data model unnecessarily. Therefore, option A best meets the requirements.
Question 489
A company is building an Amazon Elastic Kubernetes Service (Amazon EKS) cluster for its workloads. All secrets that are stored in Amazon EKS must be encrypted in the Kubernetes etcd key-value store.
Which solution will meet these requirements?
A. Create a new AWS Key Management Service (AWS KMS) key. Use AWS Secrets Manager to manage, rotate, and store all secrets in Amazon EKS.
B. Create a new AWS Key Management Service (AWS KMS) key. Enable Amazon EKS KMS secrets encryption on the Amazon EKS cluster.
C. Create the Amazon EKS cluster with default options. Use the Amazon Elastic Block Store (Amazon EBS) Container Storage Interface (CSI) driver as an add-on.
D. Create a new AWS Key Management Service (AWS KMS) key with the alias/aws/ebs alias. Enable default Amazon Elastic Block Store (Amazon EBS) volume encryption for the account.
Show Answer
Correct Answer: B
Explanation: Amazon EKS supports envelope encryption of Kubernetes secrets stored in the etcd key-value store by integrating with AWS KMS. By creating a customer-managed KMS key and enabling EKS KMS secrets encryption on the cluster, all Kubernetes secrets are encrypted at rest in etcd. The other options relate to Secrets Manager usage or EBS volume encryption, which do not encrypt secrets inside the Kubernetes etcd store.
Question 490
A company has a workload in an AWS Region. Customers connect to and access the workload by using an Amazon API Gateway REST API. The company uses Amazon Route 53 as its DNS provider. The company wants to provide individual and secure URLs for all customers.
Which combination of steps will meet these requirements with the MOST operational efficiency? (Choose three.)
A. Register the required domain in a registrar. Create a wildcard custom domain name in a Route 53 hosted zone and record in the zone that points to the API Gateway endpoint.
B. Request a wildcard certificate that matches the domains in AWS Certificate Manager (ACM) in a different Region.
C. Create hosted zones for each customer as required in Route 53. Create zone records that point to the API Gateway endpoint.
D. Request a wildcard certificate that matches the custom domain name in AWS Certificate Manager (ACM) in the same Region.
E. Create multiple API endpoints for each customer in API Gateway.
F. Create a custom domain name in API Gateway for the REST API. Import the certificate from AWS Certificate Manager (ACM).
Show Answer
Correct Answer: A, D, F
Explanation: To provide individual and secure URLs for many customers with the least operational overhead, the company should use a single wildcard-based setup. Registering a domain and creating a wildcard custom domain record in Route 53 allows all customer-specific subdomains to resolve without managing separate DNS configurations. Requesting a wildcard certificate in AWS Certificate Manager in the same Region as the API Gateway REST API ensures HTTPS for all subdomains with one certificate. Finally, creating a custom domain name in API Gateway and associating it with the ACM certificate enables API Gateway to serve the REST API securely under those custom URLs. Together, these steps minimize per-customer configuration and operational complexity.
Question 491
A data analytics company wants to migrate its batch processing system to AWS. The company receives thousands of small data files periodically during the day through FTP. An on-premises batch job processes the data files overnight. However, the batch job takes hours to finish running.
The company wants the AWS solution to process incoming data files as soon as possible with minimal changes to the FTP clients that send the files. The solution must delete the incoming data files after the files have been processed successfully. Processing for each file needs to take 3-8 minutes.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Use an Amazon EC2 instance that runs an FTP server to store incoming files as objects in Amazon S3 Glacier Flexible Retrieval. Configure a job queue in AWS Batch. Use Amazon EventBridge rules to invoke the job to process the objects nightly from S3 Glacier Flexible Retrieval. Delete the objects after the job has processed the objects.
B. Use an Amazon EC2 instance that runs an FTP server to store incoming files on an Amazon Elastic Block Store (Amazon EBS) volume. Configure a job queue in AWS Batch. Use Amazon EventBridge rules to invoke the job to process the files nightly from the EBS volume. Delete the files after the job has processed the files.
C. Use AWS Transfer Family to create an FTP server to store incoming files on an Amazon Elastic Block Store (Amazon EBS) volume. Configure a job queue in AWS Batch. Use an Amazon S3 event notification when each file arrives to invoke the job in AWS Batch. Delete the files after the job has processed the files.
D. Use AWS Transfer Family to create an FTP server to store incoming files in Amazon S3 Standard. Create an AWS Lambda function to process the files and to delete the files after they are processed. Use an S3 event notification to invoke the Lambda function when the files arrive.
Show Answer
Correct Answer: D
Explanation: AWS Transfer Family provides a managed FTP service with minimal changes for existing FTP clients and delivers files directly into Amazon S3. An S3 event notification can trigger processing immediately when each file arrives. AWS Lambda is operationally efficient and can handle per-file processing times of 3–8 minutes (within the 15-minute limit), and it can delete the file after successful processing. Other options introduce unnecessary infrastructure (EC2, EBS, Batch) or latency (Glacier, nightly batch jobs).
Question 492
A company wants to use the AWS Cloud to improve its on-premises disaster recovery (DR) configuration. The company's core production business application uses Microsoft SQL Server Standard, which runs on a virtual machine (VM). The application has a recovery point objective (RPO) of 30 seconds or fewer and a recovery time objective (RTO) of 60 minutes. The DR solution needs to minimize costs wherever possible.
Which solution will meet these requirements?
A. Configure a multi-site active/active setup between the on-premises server and AWS by using Microsoft SQL Server Enterprise with Always On availability groups.
B. Configure a warm standby Amazon RDS for SQL Server database on AWS. Configure AWS Database Migration Service (AWS DMS) to use change data capture (CDC).
C. Use AWS Elastic Disaster Recovery configured to replicate disk changes to AWS as a pilot light.
D. Use third-party backup software to capture backups every night. Store a secondary set of backups in Amazon S3.
Show Answer
Correct Answer: C
Explanation: The requirements are RPO ≤30 seconds, RTO ≤60 minutes, and minimizing cost. AWS Elastic Disaster Recovery (pilot light) continuously replicates block-level disk changes from the on‑premises SQL Server VM, supporting RPOs of seconds and RTOs of minutes while keeping recovery resources mostly powered off, which minimizes cost. It also preserves full SQL Server Standard and OS compatibility. A warm standby RDS with DMS is more expensive and may have feature/CDC limitations, while nightly backups and active/active Enterprise options do not meet the cost or RPO/RTO constraints.
Question 493
A company wants to add its existing AWS usage cost to its operation cost dashboard. A solutions architect needs to recommend a solution that will give the company access to its usage cost programmatically. The company must be able to access cost data for the current year and forecast costs for the next 12 months.
Which solution will meet these requirements with the LEAST operational overhead?
A. Access usage cost-related data by using the AWS Cost Explorer API with pagination.
B. Access usage cost-related data by using downloadable AWS Cost Explorer report .csv files.
C. Configure AWS Budgets actions to send usage cost data to the company through FTP.
D. Create AWS Budgets reports for usage cost data. Send the data to the company through SMTP.
Show Answer
Correct Answer: A
Explanation: The requirement is to access AWS usage and cost data programmatically, include historical data for the current year, and generate a 12‑month cost forecast with the least operational overhead. AWS Cost Explorer API directly fulfills all of these needs: it provides programmatic access, supports historical cost and usage queries, and includes built‑in forecasting capabilities up to 12 months ahead. Using the API avoids managing file downloads, transfers, or email workflows, resulting in minimal operational overhead. The other options rely on manual reports, file handling, or notification mechanisms and do not provide native forecasting through an API.
Question 494
A company has an online gaming application that has TCP and UDP multiplayer gaming capabilities. The company uses Amazon Route 53 to point the application traffic to multiple Network Load Balancers (NLBs) in different AWS Regions. The company needs to improve application performance and decrease latency for the online game in preparation for user growth.
Which solution will meet these requirements?
A. Add an Amazon CloudFront distribution in front of the NLBs. Increase the Cache-Control max-age parameter.
B. Replace the NLBs with Application Load Balancers (ALBs). Configure Route 53 to use latency-based routing.
C. Add AWS Global Accelerator in front of the NLBs. Configure a Global Accelerator endpoint to use the correct listener ports.
D. Add an Amazon API Gateway endpoint behind the NLBs. Enable API caching. Override method caching for the different stages.
Show Answer
Correct Answer: C
Explanation: The application uses TCP and UDP for real-time multiplayer gaming, which requires Layer 4 support and low latency. AWS Global Accelerator is designed for this use case: it supports TCP and UDP, provides static anycast IP addresses, and routes players to the closest healthy regional endpoint over the AWS global network, reducing latency and improving performance. It integrates directly with Network Load Balancers and can be configured with the required listener ports. CloudFront and API Gateway are HTTP-based and caching-focused, and Application Load Balancers do not support UDP, making those options unsuitable.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.