A company is migrating its workloads to AWS. The company has transactional and sensitive data in its databases. The company wants to use AWS Cloud solutions to increase security and reduce operational overhead for the databases.
Which solution will meet these requirements?
A. Migrate the databases to Amazon EC2. Use an AWS Key Management Service (AWS KMS) AWS managed key for encryption.
B. Migrate the databases to Amazon RDS Configure encryption at rest.
C. Migrate the data to Amazon S3 Use Amazon Macie for data security and protection
D. Migrate the database to Amazon RDS. Use Amazon CloudWatch Logs for data security and protection.
Show Answer
Correct Answer: B
Explanation: Amazon RDS is a fully managed database service that reduces operational overhead compared to self-managed databases on EC2. It natively supports encryption at rest (using AWS KMS) to protect sensitive and transactional data. Other options either increase operational burden (EC2), are not suited for transactional databases (S3 with Macie), or do not provide data protection (CloudWatch Logs).
Question 496
A solutions architect is reviewing the resilience of an application. The solutions architect notices that a database administrator recently failed over the application's Amazon Aurora PostgreSQL database writer instance as part of a scaling exercise. The failover resulted in 3 minutes of downtime for the application.
Which solution will reduce the downtime for scaling exercises with the LEAST operational overhead?
A. Create more Aurora PostgreSQL read replicas in the cluster to handle the load during failover.
B. Set up a secondary Aurora PostgreSQL cluster in the same AWS Region. During failover, update the application to use the secondary cluster's writer endpoint.
C. Create an Amazon ElastiCache for Memcached cluster to handle the load during failover.
D. Set up an Amazon RDS proxy for the database. Update the application to use the proxy endpoint.
Show Answer
Correct Answer: D
Explanation: Amazon RDS Proxy minimizes application downtime during Aurora PostgreSQL failovers by managing and reusing database connections and automatically routing traffic to the new writer without requiring the application to wait for DNS updates or reconnect logic. This significantly reduces recovery time during scaling-related failovers with minimal operational overhead compared to managing additional clusters, replicas, or caching layers.
Question 497
A company uses Amazon EC2 instances to host its internal systems. As part of a deployment operation, an administrator tries to use the AWS CLI to terminate an EC2 instance. However, the administrator receives a 403 (Access Denied) error message.
The administrator is using an IAM role that has the following IAM policy attached:
What is the cause of the unsuccessful request?
A. The EC2 instance has a resource-based policy with a Deny statement.
B. The principal has not been specified in the policy statement.
C. The "Action" field does not grant the actions that are required to terminate the EC2 instance.
D. The request to terminate the EC2 instance does not originate from the CIDR blocks 192.0.2.0/24 or 203.0.113.0/24.
Show Answer
Correct Answer: D
Explanation: The IAM policy explicitly allows ec2:TerminateInstances, but it also includes an explicit Deny with a NotIpAddress condition on aws:SourceIp. This Deny applies whenever the request does not originate from 192.0.2.0/24 or 203.0.113.0/24. Explicit Deny overrides Allow, resulting in a 403 Access Denied if the CLI request comes from any other IP range.
Question 498
A law firm needs to share information with the public. The information includes hundreds of files that must be publicly readable. Modifications or deletions of the files by anyone before a designated future date are prohibited.
Which solution will meet these requirements in the MOST secure way?
A. Upload all files to an Amazon S3 bucket that is configured for static website hosting. Grant read-only IAM permissions to any AWS principals that access the S3 bucket until the designated date.
B. Create a new Amazon S3 bucket with S3 Versioning enabled. Use S3 Object Lock with a retention period in accordance with the designated date. Configure the S3 bucket for static website hosting. Set an S3 bucket policy to allow read-only access to the objects.
C. Create a new Amazon S3 bucket with S3 Versioning enabled. Configure an event trigger to run an AWS Lambda function in case of object modification or deletion. Configure the Lambda function to replace the objects with the original versions from a private S3 bucket.
D. Upload all files to an Amazon S3 bucket that is configured for static website hosting. Select the folder that contains the files. Use S3 Object Lock with a retention period in accordance with the designated date. Grant read-only IAM permissions to any AWS principals that access the S3 bucket.
Show Answer
Correct Answer: B
Explanation: The requirement is public read access while preventing any modification or deletion until a future date. Amazon S3 Object Lock enforces write-once-read-many (WORM) protection, which prevents object deletion or overwrite during the retention period, even by privileged users. Object Lock requires S3 Versioning to be enabled. A bucket policy can safely allow public read access, and static website hosting meets the public sharing requirement. Other options either lack immutability (A), rely on reactive remediation (C), or incorrectly apply Object Lock without proper bucket-level configuration (D).
Question 499
A consulting company provides professional services to customers worldwide. The company provides solutions and tools for customers to expedite gathering and analyzing data on AWS. The company needs to centrally manage and deploy a common set of solutions and tools for customers to use for self-service purposes.
Which solution will meet these requirements?
A. Create AWS CloudFormation templates for the customers.
B. Create AWS Service Catalog products for the customers.
C. Create AWS Systems Manager templates for the customers.
D. Create AWS Config items for the customers.
Show Answer
Correct Answer: B
Explanation: AWS Service Catalog is designed to centrally manage and govern a standardized set of approved solutions and tools that users can deploy through self-service. It supports centralized control, versioning, access permissions, and reuse of CloudFormation- or Terraform-based products, which fits the requirement to deploy common solutions for customers worldwide. CloudFormation alone lacks centralized governance, Systems Manager focuses on operations, and AWS Config is for compliance and auditing, not deployment.
Question 500
An application uses an Amazon RDS MySQL DB instance. The RDS database is becoming low on disk space. A solutions architect wants to increase the disk space without downtime.
Which solution meets these requirements with the LEAST amount of effort?
A. Enable storage autoscaling in RDS
B. Increase the RDS database instance size
C. Change the RDS database instance storage type to Provisioned IOPS
D. Back up the RDS database, increase the storage capacity, restore the database, and stop the previous instance
Show Answer
Correct Answer: A
Explanation: RDS Storage Auto Scaling can be enabled with minimal effort and automatically increases allocated storage when usage approaches capacity. It is supported for Amazon RDS MySQL and scales storage without downtime, meeting the requirement to increase disk space with the least operational effort.
Question 501
A company provides an API interface to customers so the customers can retrieve their financial information. Еhe company expects a larger number of requests during peak usage times of the year.
The company requires the API to respond consistently with low latency to ensure customer satisfaction. The company needs to provide a compute host for the API.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use an Application Load Balancer and Amazon Elastic Container Service (Amazon ECS).
B. Use Amazon API Gateway and AWS Lambda functions with provisioned concurrency.
C. Use an Application Load Balancer and an Amazon Elastic Kubernetes Service (Amazon EKS) cluster.
D. Use Amazon API Gateway and AWS Lambda functions with reserved concurrency.
Show Answer
Correct Answer: B
Explanation: The requirement is consistent low latency during peak usage with the least operational overhead. Amazon API Gateway combined with AWS Lambda eliminates server and container management entirely, reducing operational effort compared to ECS or EKS. Provisioned concurrency keeps Lambda execution environments pre-initialized, avoiding cold starts and ensuring predictable, low-latency responses even under high load. Reserved concurrency only limits or guarantees capacity but does not prevent cold starts, so it does not meet the consistency requirement as well as provisioned concurrency.
Question 502
A social media company wants to allow its users to upload images in an application that is hosted in the AWS Cloud. The company needs a solution that automatically resizes the images so that the images can be displayed on multiple device types. The application experiences unpredictable traffic patterns throughout the day. The company is seeking a highly available solution that maximizes scalability.
What should a solutions architect do to meet these requirements?
A. Create a static website hosted in Amazon S3 that invokes AWS Lambda functions to resize the images and store the images in an Amazon S3 bucket.
B. Create a static website hosted in Amazon CloudFront that invokes AWS Step Functions to resize the images and store the images in an Amazon RDS database.
C. Create a dynamic website hosted on a web server that runs on an Amazon EC2 instance. Configure a process that runs on the EC2 instance to resize the images and store the images in an Amazon S3 bucket.
D. Create a dynamic website hosted on an automatically scaling Amazon Elastic Container Service (Amazon ECS) cluster that creates a resize job in Amazon Simple Queue Service (Amazon SQS). Set up an image-resizing program that runs on an Amazon EC2 instance to process the resize jobs.
Show Answer
Correct Answer: A
Explanation: A serverless architecture using Amazon S3 and AWS Lambda best meets the requirements. S3 provides highly available, durable, and infinitely scalable storage for uploaded images, while Lambda can automatically resize images on upload via S3 event notifications and scales seamlessly with unpredictable traffic. This approach maximizes scalability and availability with minimal operational overhead, unlike EC2/ECS-based or database-centric solutions.
Question 503
A company uses AWS Organizations with resources tagged by account. The company also uses AWS Backup to back up its AWS infrastructure resources. The company needs to back up all AWS resources.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS Config to identify all untagged resources. Tag the identified resources programmatically. Use tags in the backup plan.
B. Use AWS Config to identify all resources that are not running. Add those resources to the backup vault.
C. Require all AWS account owners to review their resources to identify the resources that need to be backed up.
D. Use Amazon Inspector to identify all noncompliant resources.
Show Answer
Correct Answer: A
Explanation: Using AWS Config to identify untagged resources and then programmatically tagging them allows AWS Backup plans to include resources automatically based on tags. This approach scales across AWS Organizations, ensures new resources are covered without manual intervention, and minimizes operational overhead. The other options involve manual effort, irrelevant criteria, or services that do not manage backup eligibility.
Question 504
A global marketing company has applications that run in the ap-southeast-2 Region and the eu-west-1 Region. Applications that run in a VPC in eu-west-1 need to communicate securely with databases that run in a VPC in ap-southeast-2.
Which network design will meet these requirements?
A. Create a VPC peering connection between the eu-west-1 VPC and the ap-southeast-2 VPC. Create an inbound rule in the eu-west-1 application security group that allows traffic from the database server IP addresses in the ap-southeast-2 security group.
B. Configure a VPC peering connection between the ap-southeast-2 VPC and the eu-west-1 VPC. Update the subnet route tables. Create an inbound rule in the ap-southeast-2 database security group that references the security group ID of the application servers in eu-west-1.
C. Configure a VPC peering connection between the ap-southeast-2 VPC and the eu-west-1 VPUpdate the subnet route tables. Create an inbound rule in the ap-southeast-2 database security group that allows traffic from the eu-west-1 application server IP addresses.
D. Create a transit gateway with a peering attachment between the eu-west-1 VPC and the ap-southeast-2 VPC. After the transit gateways are properly peered and routing is configured, create an inbound rule in the database security group that references the security group ID of the application servers in eu-west-1.
Show Answer
Correct Answer: C
Explanation: Applications in eu-west-1 must securely reach databases in ap-southeast-2 across Regions. Cross-Region VPC peering supports this, provided route tables are updated. However, security groups cannot reference security group IDs from a peered VPC in a different Region. Therefore, the database security group must allow inbound traffic using the IP addresses (or CIDR blocks) of the application servers. Option C correctly uses VPC peering, updates routing, and configures security group rules with IP addresses, making it the only valid design.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.