A company has a financial application that produces reports. The reports average 50 KB in size and are stored in Amazon S3. The reports are frequently accessed during the first week after production and must be stored for several years. The reports must be retrievable within 6 hours.
Which solution meets these requirements MOST cost-effectively?
A. Use S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Glacier after 7 days.
B. Use S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days.
C. Use S3 Intelligent-Tiering. Configure S3 Intelligent-Tiering to transition the reports to S3 Standard-Infrequent Access (S3 Standard-IA) and S3 Glacier.
D. Use S3 Standard. Use an S3 Lifecycle rule to transition the reports to S3 Glacier Deep Archive after 7 days.
Show Answer
Correct Answer: A
Explanation: S3 Standard is appropriate during the first week of frequent access. After 7 days, transitioning to S3 Glacier minimizes long-term storage cost while still meeting the requirement to retrieve objects within 6 hours using Glacier Standard Retrieval (typically 3–5 hours). S3 Standard-IA is more expensive than Glacier for long-term retention and has a 30-day minimum storage duration. Intelligent-Tiering is unnecessary because the access pattern is known, and the proposed transition to Standard-IA is not supported as described. Glacier Deep Archive does not meet the 6-hour retrieval requirement because standard retrieval is about 12 hours.
Question 476
A retail company uses a regional Amazon API Gateway API for its public REST APIs. The API Gateway endpoint is a custom domain name that points to an Amazon Route 53 alias record. A solutions architect needs to create a solution that has minimal effects on customers and minimal data loss to release the new version of APIs.
Which solution will meet these requirements?
A. Create a canary release deployment stage for API Gateway. Deploy the latest API version. Point an appropriate percentage of traffic to the canary stage. After API verification, promote the canary stage to the production stage.
B. Create a new API Gateway endpoint with a new version of the API in OpenAPI YAML file format. Use the import-to-update operation in merge mode into the API in API Gateway. Deploy the new version of the API to the production stage.
C. Create a new API Gateway endpoint with a new version of the API in OpenAPI JSON file format. Use the import-to-update operation in overwrite mode into the API in API Gateway. Deploy the new version of the API to the production stage.
D. Create a new API Gateway endpoint with new versions of the API definitions. Create a custom domain name for the new API Gateway API. Point the Route 53 alias record to the new API Gateway API custom domain name.
Show Answer
Correct Answer: A
Explanation: API Gateway canary deployments are designed for gradual API rollouts by directing a configurable percentage of traffic to a new deployment while the rest continues using the production deployment. After validating the new version, the canary can be promoted to production. This minimizes customer impact and reduces the risk of issues during release. The import/update and overwrite options do not provide gradual traffic shifting, and switching Route 53 to a new API is a cutover rather than an incremental rollout.
Question 477
A company runs Amazon EC2 instances in multiple AWS accounts that are individually bled. The company recently purchased a Savings Pian. Because of changes in the company’s business requirements, the company has decommissioned a large number of EC2 instances. The company wants to use its Savings Plan discounts on its other AWS accounts.
Which combination of steps will meet these requirements? (Choose two.)
A. From the AWS Account Management Console of the management account, turn on discount sharing from the billing preferences section.
B. From the AWS Account Management Console of the account that purchased the existing Savings Plan, turn on discount sharing from the billing preferences section. Include all accounts.
C. From the AWS Organizations management account, use AWS Resource Access Manager (AWS RAM) to share the Savings Plan with other accounts.
D. Create an organization in AWS Organizations in a new payer account. Invite the other AWS accounts to join the organization from the management account.
E. Create an organization in AWS Organizations in the existing AWS account with the existing EC2 instances and Savings Plan. Invite the other AWS accounts to join the organization from the management account.
Show Answer
Correct Answer: A, D
Explanation: Savings Plans discounts can be shared only within an AWS Organization through consolidated billing, with discount sharing controlled by the management (payer) account. Therefore, the accounts must be brought into an AWS Organization, and discount sharing must be enabled in the management account. AWS RAM does not share Savings Plans, and member accounts cannot control organization-wide discount sharing.
Question 478
A media company uses an Amazon CloudFront distribution to deliver content over the internet. The company wants only premium customers to have access to the media streams and file content. The company stores all content in an Amazon S3 bucket. The company also delivers content on demand to customers for a specific purpose, such as movie rentals or music downloads.
Which solution will meet these requirements?
A. Generate and provide S3 signed cookies to premium customers.
B. Generate and provide CloudFront signed URLs to premium customers.
C. Use origin access control (OAC) to limit the access of non-premium customers.
D. Generate and activate field-level encryption to block non-premium customers.
Show Answer
Correct Answer: B
Explanation: CloudFront signed URLs are designed to restrict access to private content delivered through CloudFront and are ideal for time-limited, per-object access such as movie rentals or music downloads. S3 signed cookies are not the correct mechanism when CloudFront is serving the content. Origin Access Control (OAC) secures the S3 origin so users cannot bypass CloudFront, but it does not distinguish premium from non-premium users. Field-level encryption protects sensitive request data, not authorization to access content.
Question 479
A company wants to build a web application on AWS. Client access requests to the website are not predictable and can be idle for a long time. Only customers who have paid a subscription fee can have the ability to sign in and use the web application.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose three.)
A. Create an AWS Lambda function to retrieve user information from Amazon DynamoDB. Create an Amazon API Gateway endpoint to accept RESTful APIs. Send the API calls to the Lambda function.
B. Create an Amazon Elastic Container Service (Amazon ECS) service behind an Application Load Balancer to retrieve user information from Amazon RDS. Create an Amazon API Gateway endpoint to accept RESTful APIs. Send the API calls to the Lambda function.
C. Create an Amazon Cognito user pool to authenticate users.
D. Create an Amazon Cognito identity pool to authenticate users.
E. Use AWS Amplify to serve the frontend web content with HTML, CSS, and JS. Use an integrated Amazon CloudFront configuration.
F. Use Amazon S3 static web hosting with PHP, CSS, and JS. Use Amazon CloudFront to serve the frontend web content.
Show Answer
Correct Answer: A, C, E
Explanation: A serverless architecture is the most cost-effective for unpredictable, idle traffic: API Gateway + Lambda + DynamoDB fits the workload. Amazon Cognito user pools provide user authentication for subscriber sign-in. AWS Amplify can host the frontend with integrated CloudFront. ECS/RDS is more expensive for idle workloads, Cognito identity pools are for AWS credential federation rather than primary user authentication, and S3 static website hosting cannot run PHP server-side code.
Question 480
A company has an on-premises server that uses an Oracle database to process and store customer information. The company wants to use an AWS database service to achieve higher availability and to improve application performance. The company also wants to offload reporting from its primary database system.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Use AWS Database Migration Service (AWS DMS) to create an Amazon RDS DB instance in multiple AWS Regions. Point the reporting functions toward a separate DB instance from the primary DB instance.
B. Use Amazon RDS in a Single-AZ deployment to create an Oracle database. Create a read replica in the same zone as the primary DB instance. Direct the reporting functions to the read replica.
C. Use Amazon RDS deployed in a Multi-AZ cluster deployment to create an Oracle database. Direct the reporting functions to use the reader instance in the cluster deployment.
D. Use Amazon RDS deployed in a Multi-AZ instance deployment to create an Amazon Aurora database. Direct the reporting functions to the reader instances.
Show Answer
Correct Answer: D
Explanation: A is incorrect because AWS DMS migrates/replicates data but does not create a multi-Region RDS deployment as described. B is incorrect because Single-AZ does not provide high availability and a read replica in the same AZ does not improve availability. C is incorrect because Multi-AZ DB cluster deployments with reader instances are not supported for Amazon RDS for Oracle. D best matches the intended architecture: a Multi-AZ instance deployment for high availability combined with Aurora reader instances for reporting, implying migration from Oracle to Aurora to improve availability and read performance.
Question 481
A company wants to provide data scientists with near real-time read-only access to the company's production Amazon RDS for PostgreSQL database. The database is currently configured as a Single-AZ database. The data scientists use complex queries that will not affect the production database. The company needs a solution that is highly available.
Which solution will meet these requirements MOST cost-effectively?
A. Scale the existing production database in a maintenance window to provide enough power for the data scientists.
B. Change the setup from a Single-AZ to a Multi-AZ instance deployment with a larger secondary standby instance. Provide the data scientists access to the secondary instance.
C. Change the setup from a Single-AZ to a Multi-AZ instance deployment. Provide two additional read replicas for the data scientists.
D. Change the setup from a Single-AZ to a Multi-AZ cluster deployment with two readable standby instances. Provide read endpoints to the data scientists.
Show Answer
Correct Answer: D
Explanation: A Multi-AZ DB cluster for Amazon RDS for PostgreSQL provides one writer and two readable standby instances with synchronous replication. The standby instances can serve read-only workloads through reader endpoints while also providing high availability and near real-time data access. Option B is incorrect because the standby in a traditional Multi-AZ instance deployment is not readable. Option C requires a Multi-AZ instance plus two asynchronous read replicas, resulting in more instances and asynchronous replication. Option A does not provide high availability.
Question 482
A company wants to build a logging solution for its multiple AWS accounts. The company currently stores the logs from all accounts in a centralized account. The company has created an Amazon S3 bucket in the centralized account to store the VPC flow logs and AWS CloudTrail logs. All logs must be highly available for 30 days for frequent analysis, retained for an additional 60 days for backup purposes, and deleted 90 days after creation.
Which solution will meet these requirements MOST cost-effectively?
A. Transition objects to the S3 Standard storage class 30 days after creation. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
B. Transition objects to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class 30 days after creation. Move all objects to the S3 Glacier Flexible Retrieval storage class after 90 days. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
C. Transition objects to the S3 Glacier Flexible Retrieval storage class 30 days after creation. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
D. Transition objects to the S3 One Zone-Infrequent Access (S3 One Zone-IA) storage class 30 days after creation. Move all objects to the S3 Glacier Flexible Retrieval storage class after 90 days. Write an expiration action that directs Amazon S3 to delete objects after 90 days.
Show Answer
Correct Answer: C
Explanation: Logs require frequent access for the first 30 days, so keeping them in S3 Standard initially is appropriate. For the remaining 60 days they are retained only for backup, making S3 Glacier Flexible Retrieval the most cost-effective highly available storage class. Expire the objects at 90 days. Options B and D include an unnecessary transition at 90 days immediately before deletion, and One Zone-IA does not meet the high availability requirement. Option A keeps data in the more expensive Standard class for the entire retention period.
Question 483
A company stores data in Amazon S3. According to regulations, the data must not contain personally identifiable information (PII). The company recently discovered that S3 buckets have some objects that contain PII. The company needs to automatically detect PII in S3 buckets and to notify the company’s security team.
Which solution will meet these requirements?
A. Use Amazon Macie. Create an Amazon EventBridge rule to filter the SensitiveData event type from Macie findings and to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
B. Use Amazon GuardDuty. Create an Amazon EventBridge rule to filter the CRITICAL event type from GuardDuty findings and to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
C. Use Amazon Macie. Create an Amazon EventBridge rule to filter the SensitiveData:S3Object/Personal event type from Macie findings and to send an Amazon Simple Queue Service (Amazon SQS) notification to the security team.
D. Use Amazon GuardDuty. Create an Amazon EventBridge rule to filter the CRITICAL event type from GuardDuty findings and to send an Amazon Simple Queue Service (Amazon SQS) notification to the security team.
Show Answer
Correct Answer: A
Explanation: Amazon Macie is the AWS service designed to automatically discover and classify sensitive data, including PII, in Amazon S3. Macie findings are published to Amazon EventBridge, where you can create a rule to match sensitive data findings and send notifications through Amazon SNS to the security team. GuardDuty detects threats, not PII, and SQS is a queue for applications rather than a direct notification mechanism for people.
Question 484
A company needs to integrate with a third-party data feed. The data feed sends a webhook to notify an external service when new data is ready for consumption. A developer wrote an AWS Lambda function to retrieve data when the company receives a webhook callback. The developer must make the Lambda function available for the third party to call.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create a function URL for the Lambda function. Provide the Lambda function URL to the third party for the webhook.
B. Deploy an Application Load Balancer (ALB) in front of the Lambda function. Provide the ALB URL to the third party for the webhook.
C. Create an Amazon Simple Notification Service (Amazon SNS) topic. Attach the topic to the Lambda function. Provide the public hostname of the SNS topic to the third party for the webhook.
D. Create an Amazon Simple Queue Service (Amazon SQS) queue. Attach the queue to the Lambda function. Provide the public hostname of the SQS queue to the third party for the webhook.
Show Answer
Correct Answer: A
Explanation: AWS Lambda Function URLs provide a native HTTPS endpoint that allows third parties to invoke a Lambda function directly with minimal configuration and no additional infrastructure. An ALB adds unnecessary operational overhead, while SNS and SQS are not appropriate webhook HTTP endpoints for arbitrary third-party callbacks in this scenario.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.