A company has a regional subscription-based streaming service that runs in a single AWS Region. The architecture consists of web servers and application servers on Amazon EC2 instances. The EC2 instances are in Auto Scaling groups behind Elastic Load Balancers. The architecture includes an Amazon Aurora global database cluster that extends across multiple Availability Zones.
The company wants to expand globally and to ensure that its application has minimal downtime.
Which solution will provide the MOST fault tolerance?
A. Extend the Auto Scaling groups for the web tier and the application tier to deploy instances in Availability Zones in a second Region. Use an Aurora global database to deploy the database in the primary Region and the second Region. Use Amazon Route 53 health checks with a failover routing policy to the second Region.
B. Deploy the web tier and the application tier to a second Region. Add an Aurora PostgreSQL cross-Region Aurora Replica in the second Region. Use Amazon Route 53 health checks with a failover routing policy to the second Region. Promote the secondary to primary as needed.
C. Deploy the web tier and the application tier to a second Region. Create an Aurora PostgreSQL database in the second Region. Use AWS Database Migration Service (AWS DMS) to replicate the primary database to the second Region. Use Amazon Route 53 health checks with a failover routing policy to the second Region.
D. Deploy the web tier and the application tier to a second Region. Use an Amazon Aurora global database to deploy the database in the primary Region and the second Region. Use Amazon Route 53 health checks with a failover routing policy to the second Region. Promote the secondary to primary as needed.
Show Answer
Correct Answer: D
Explanation: EC2 Auto Scaling groups are regional and cannot span Regions, so option A is invalid. For the highest fault tolerance and minimal downtime, deploy the application stack in a second Region, use an Aurora Global Database for cross-Region replication, and use Route 53 failover routing. In a regional failure, promote the secondary Aurora cluster to primary and fail traffic over to the secondary Region. Options B and C rely on replicas or DMS replication, which provide slower/manual recovery compared with Aurora Global Database.
Question 486
A company wants to analyze and troubleshoot Access Denied errors and Unauthorized errors that are related to IAM permissions. The company has AWS CloudTrail turned on.
Which solution will meet these requirements with the LEAST effort?
A. Use AWS Glue and write custom scripts to query CloudTrail logs for the errors.
B. Use AWS Batch and write custom scripts to query CloudTrail logs for the errors.
C. Search CloudTrail logs with Amazon Athena queries to identify the errors.
D. Search CloudTrail logs with Amazon QuickSight. Create a dashboard to identify the errors.
Show Answer
Correct Answer: C
Explanation: Amazon Athena is the lowest-effort way to query AWS CloudTrail logs stored in Amazon S3 using SQL. You can filter for IAM-related errors such as AccessDenied and UnauthorizedOperation without writing custom scripts. AWS Glue and AWS Batch require custom code and additional setup, while QuickSight is primarily for visualization and is not the appropriate tool for directly searching and troubleshooting CloudTrail logs.
Question 487
A global video streaming company uses Amazon CloudFront as a content distribution network (CDN). The company wants to roll out content in a phased manner across multiple countries. The company needs to ensure that viewers who are outside the countries to which the company rolls out content are not able to view the content.
Which solution will meet these requirements?
A. Add geographic restrictions to the content in CloudFront by using an allow list. Set up a custom error message.
B. Set up a new URL tor restricted content. Authorize access by using a signed URL and cookies. Set up a custom error message.
C. Encrypt the data for the content that the company distributes. Set up a custom error message.
D. Create a new URL for restricted content. Set up a time-restricted access policy for signed URLs.
Show Answer
Correct Answer: A
Explanation: CloudFront provides built-in geographic restrictions (geo restriction) that can allow or block access by country. Using an allow list ensures only viewers in the rollout countries can access the content, and a custom error page can be returned to blocked viewers. Signed URLs/cookies control authorization but do not enforce geographic access by themselves, encryption is unrelated to geo-blocking, and time-restricted signed URLs limit duration rather than viewer location.
Question 488
A company runs a three-tier web application in the AWS Cloud that operates across three Availability Zones. The application architecture has an Application Load Balancer, an Amazon EC2 web server that hosts user session states, and a MySQL database that runs on an EC2 instance. The company expects sudden increases in application traffic. The company wants to be able to scale to meet future application capacity demands and to ensure high availability across all three Availability Zones.
Which solution will meet these requirements?
A. Migrate the MySQL database to Amazon RDS for MySQL with a Multi-AZ DB cluster deployment. Use Amazon ElastiCache for Redis with high availability to store session data and to cache reads. Migrate the web server to an Auto Scaling group that is in three Availability Zones.
B. Migrate the MySQL database to Amazon RDS for MySQL with a Multi-AZ DB cluster deployment. Use Amazon ElastiCache for Memcached with high availability to store session data and to cache reads. Migrate the web server to an Auto Scaling group that is in three Availability Zones.
C. Migrate the MySQL database to Amazon DynamoDB Use DynamoDB Accelerator (DAX) to cache reads. Store the session data in DynamoDB. Migrate the web server to an Auto Scaling group that is in three Availability Zones.
D. Migrate the MySQL database to Amazon RDS for MySQL in a single Availability Zone. Use Amazon ElastiCache for Redis with high availability to store session data and to cache reads. Migrate the web server to an Auto Scaling group that is in three Availability Zones.
Show Answer
Correct Answer: A
Explanation: The application needs horizontal scaling, high availability across three Availability Zones, and externalized session state. Amazon RDS for MySQL with a Multi-AZ DB cluster provides a highly available managed relational database with readable standbys for improved scalability. Amazon ElastiCache for Redis supports replication, automatic failover, and is well suited for shared session storage and read caching. Placing the web tier in an Auto Scaling group across three Availability Zones enables elastic scaling and high availability. Memcached does not provide the same high-availability replication/failover capabilities as Redis, DynamoDB is not an appropriate migration target for an existing MySQL relational database in this scenario, and a single-AZ RDS deployment does not meet the HA requirement.
Question 489
A company is building an Amazon Elastic Kubernetes Service (Amazon EKS) cluster for its workloads. All secrets that are stored in Amazon EKS must be encrypted in the Kubernetes etcd key-value store.
Which solution will meet these requirements?
A. Create a new AWS Key Management Service (AWS KMS) key. Use AWS Secrets Manager to manage, rotate, and store all secrets in Amazon EKS.
B. Create a new AWS Key Management Service (AWS KMS) key. Enable Amazon EKS KMS secrets encryption on the Amazon EKS cluster.
C. Create the Amazon EKS cluster with default options. Use the Amazon Elastic Block Store (Amazon EBS) Container Storage Interface (CSI) driver as an add-on.
D. Create a new AWS Key Management Service (AWS KMS) key with the alias/aws/ebs alias. Enable default Amazon Elastic Block Store (Amazon EBS) volume encryption for the account.
Show Answer
Correct Answer: B
Explanation: Amazon EKS supports envelope encryption of Kubernetes Secrets stored in the etcd key-value store by integrating the cluster with a customer-managed AWS KMS key. Enabling EKS KMS secrets encryption specifically addresses encryption of secrets in etcd. Using Secrets Manager alone does not encrypt the Kubernetes etcd store, and EBS encryption or the EBS CSI driver protect storage volumes rather than Kubernetes Secrets stored in etcd.
Question 490
A company has a workload in an AWS Region. Customers connect to and access the workload by using an Amazon API Gateway REST API. The company uses Amazon Route 53 as its DNS provider. The company wants to provide individual and secure URLs for all customers.
Which combination of steps will meet these requirements with the MOST operational efficiency? (Choose three.)
A. Register the required domain in a registrar. Create a wildcard custom domain name in a Route 53 hosted zone and record in the zone that points to the API Gateway endpoint.
B. Request a wildcard certificate that matches the domains in AWS Certificate Manager (ACM) in a different Region.
C. Create hosted zones for each customer as required in Route 53. Create zone records that point to the API Gateway endpoint.
D. Request a wildcard certificate that matches the custom domain name in AWS Certificate Manager (ACM) in the same Region.
E. Create multiple API endpoints for each customer in API Gateway.
F. Create a custom domain name in API Gateway for the REST API. Import the certificate from AWS Certificate Manager (ACM).
Show Answer
Correct Answer: A, D, F
Explanation: Use a single wildcard custom domain and wildcard ACM certificate to provide unique subdomains (for example, customer1.example.com) with minimal operational overhead. For a Regional API Gateway REST API, the ACM certificate must be in the same AWS Region as the API. Then configure an API Gateway custom domain and map Route 53 wildcard DNS records to it. Creating separate hosted zones or separate API endpoints per customer is unnecessary and increases operational complexity.
Question 491
A data analytics company wants to migrate its batch processing system to AWS. The company receives thousands of small data files periodically during the day through FTP. An on-premises batch job processes the data files overnight. However, the batch job takes hours to finish running.
The company wants the AWS solution to process incoming data files as soon as possible with minimal changes to the FTP clients that send the files. The solution must delete the incoming data files after the files have been processed successfully. Processing for each file needs to take 3-8 minutes.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Use an Amazon EC2 instance that runs an FTP server to store incoming files as objects in Amazon S3 Glacier Flexible Retrieval. Configure a job queue in AWS Batch. Use Amazon EventBridge rules to invoke the job to process the objects nightly from S3 Glacier Flexible Retrieval. Delete the objects after the job has processed the objects.
B. Use an Amazon EC2 instance that runs an FTP server to store incoming files on an Amazon Elastic Block Store (Amazon EBS) volume. Configure a job queue in AWS Batch. Use Amazon EventBridge rules to invoke the job to process the files nightly from the EBS volume. Delete the files after the job has processed the files.
C. Use AWS Transfer Family to create an FTP server to store incoming files on an Amazon Elastic Block Store (Amazon EBS) volume. Configure a job queue in AWS Batch. Use an Amazon S3 event notification when each file arrives to invoke the job in AWS Batch. Delete the files after the job has processed the files.
D. Use AWS Transfer Family to create an FTP server to store incoming files in Amazon S3 Standard. Create an AWS Lambda function to process the files and to delete the files after they are processed. Use an S3 event notification to invoke the Lambda function when the files arrive.
Show Answer
Correct Answer: D
Explanation: AWS Transfer Family provides a managed FTP endpoint with minimal client changes and can store uploaded files directly in Amazon S3. S3 event notifications can invoke AWS Lambda immediately when each file arrives, satisfying the requirement to process files as soon as possible. A processing time of 3–8 minutes is within the 15-minute Lambda execution limit. After successful processing, the Lambda function can delete the S3 object. The other options either require managing EC2-based FTP servers, incorrectly use EBS with Transfer Family, rely on nightly batch processing, or use Glacier, which is unsuitable for immediate processing.
Question 492
A company wants to use the AWS Cloud to improve its on-premises disaster recovery (DR) configuration. The company's core production business application uses Microsoft SQL Server Standard, which runs on a virtual machine (VM). The application has a recovery point objective (RPO) of 30 seconds or fewer and a recovery time objective (RTO) of 60 minutes. The DR solution needs to minimize costs wherever possible.
Which solution will meet these requirements?
A. Configure a multi-site active/active setup between the on-premises server and AWS by using Microsoft SQL Server Enterprise with Always On availability groups.
B. Configure a warm standby Amazon RDS for SQL Server database on AWS. Configure AWS Database Migration Service (AWS DMS) to use change data capture (CDC).
C. Use AWS Elastic Disaster Recovery configured to replicate disk changes to AWS as a pilot light.
D. Use third-party backup software to capture backups every night. Store a secondary set of backups in Amazon S3.
Show Answer
Correct Answer: C
Explanation: AWS Elastic Disaster Recovery continuously replicates the entire VM at the block level, making it well suited for on-premises VM disaster recovery with low RPO (seconds) and RTO (minutes) while keeping costs low through a pilot-light approach. Option A requires SQL Server Enterprise instead of the existing Standard edition and is more expensive. Option B introduces RDS and DMS, which is not a full VM DR solution and may not support all SQL Server VM features. Option D cannot meet the required RPO.
Question 493
A company wants to add its existing AWS usage cost to its operation cost dashboard. A solutions architect needs to recommend a solution that will give the company access to its usage cost programmatically. The company must be able to access cost data for the current year and forecast costs for the next 12 months.
Which solution will meet these requirements with the LEAST operational overhead?
A. Access usage cost-related data by using the AWS Cost Explorer API with pagination.
B. Access usage cost-related data by using downloadable AWS Cost Explorer report .csv files.
C. Configure AWS Budgets actions to send usage cost data to the company through FTP.
D. Create AWS Budgets reports for usage cost data. Send the data to the company through SMTP.
Show Answer
Correct Answer: A
Explanation: The requirement is to access AWS usage cost programmatically, retrieve current-year cost data, and obtain a 12-month cost forecast with the least operational overhead. The AWS Cost Explorer API is designed for programmatic access to historical costs, usage, and forecasting. Pagination is the standard mechanism for retrieving larger result sets. CSV exports are not ideal for programmatic integration, and AWS Budgets focuses on budget monitoring and alerts rather than serving as a programmatic cost data source or forecast API.
Question 494
A company has an online gaming application that has TCP and UDP multiplayer gaming capabilities. The company uses Amazon Route 53 to point the application traffic to multiple Network Load Balancers (NLBs) in different AWS Regions. The company needs to improve application performance and decrease latency for the online game in preparation for user growth.
Which solution will meet these requirements?
A. Add an Amazon CloudFront distribution in front of the NLBs. Increase the Cache-Control max-age parameter.
B. Replace the NLBs with Application Load Balancers (ALBs). Configure Route 53 to use latency-based routing.
C. Add AWS Global Accelerator in front of the NLBs. Configure a Global Accelerator endpoint to use the correct listener ports.
D. Add an Amazon API Gateway endpoint behind the NLBs. Enable API caching. Override method caching for the different stages.
Show Answer
Correct Answer: C
Explanation: AWS Global Accelerator is designed to improve global application performance and reduce latency for TCP and UDP traffic by routing users onto the AWS global network to the optimal regional endpoint. It integrates directly with Network Load Balancers and supports configuring the required listener ports. CloudFront is for HTTP(S) content caching, ALBs do not support UDP, and API Gateway is not appropriate for multiplayer TCP/UDP gaming traffic.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.