A retail company has several businesses. The IT team for each business manages its own AWS account. Each team account is part of an organization in AWS Organizations. Each team monitors its product inventory levels in an Amazon DynamoDB table in the team's own AWS account.
The company is deploying a central inventory reporting application into a shared AWS account. The application must be able to read items from all the teams' DynamoDB tables.
Which authentication option will meet these requirements MOST securely?
A. Integrate DynamoDB with AWS Secrets Manager in the inventory application account. Configure the application to use the correct secret from Secrets Manager to authenticate and read the DynamoDB table. Schedule secret rotation for every 30 days.
B. In every business account, create an IAM user that has programmatic access. Configure the application to use the correct IAM user access key ID and secret access key to authenticate and read the DynamoDB table. Manually rotate IAM access keys every 30 days.
C. In every business account, create an IAM role named BU_ROLE with a policy that gives the role access to the DynamoDB table and a trust policy to trust a specific role in the inventory application account. In the inventory account, create a role named APP_ROLE that allows access to the STS AssumeRole API operation. Configure the application to use APP_ROLE and assume the crossaccount role BU_ROLE to read the DynamoDB table.
D. Integrate DynamoDB with AWS Certificate Manager (ACM). Generate identity certificates to authenticate DynamoDB. Configure the application to use the correct certificate to authenticate and read the DynamoDB table.
Show Answer
Correct Answer: C
Explanation: The most secure approach is to use cross-account IAM roles with AWS STS. Creating a role in each business account that grants read access to its DynamoDB table and trusts a role in the central application account allows the application to assume roles and obtain temporary credentials. This avoids long-term credentials, supports least privilege, enables centralized control, and is the AWS-recommended pattern for secure cross-account access.
Question 506
A company runs a microservice-based serverless web application. The application must be able to retrieve data from multiple Amazon DynamoDB tables A solutions architect needs to give the application the ability to retrieve the data with no impact on the baseline performance of the application.
Which solution will meet these requirements in the MOST operationally efficient way?
A. AWS AppSync pipeline resolvers
B. Amazon CloudFront with Lambda@Edge functions
C. Edge-optimized Amazon API Gateway with AWS Lambda functions
D. Amazon Athena Federated Query with a DynamoDB connector
Show Answer
Correct Answer: A
Explanation: AWS AppSync pipeline resolvers are designed to orchestrate and aggregate data from multiple DynamoDB tables in a serverless, managed way. They enable parallel, low-latency data fetching without adding custom infrastructure, minimize operational overhead, and avoid impacting baseline application performance. The other options are either not intended for low-latency operational reads (Athena), focus on edge content delivery rather than data aggregation (CloudFront/Lambda@Edge), or require more custom wiring with no inherent performance advantage over AppSync (API Gateway + Lambda).
Question 507
A company runs container applications by using Amazon Elastic Kubernetes Service (Amazon EKS). The company's workload is not consistent throughout the day. The company wants Amazon EKS to scale in and out according to the workload.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
A. Use an AWS Lambda function to resize the EKS cluster.
B. Use the Kubernetes Metrics Server to activate horizontal pod autoscaling.
C. Use the Kubernetes Cluster Autoscaler to manage the number of nodes in the cluster.
D. Use Amazon API Gateway and connect it to Amazon EKS.
E. Use AWS App Mesh to observe network activity.
Show Answer
Correct Answer: B, C
Explanation: To scale Amazon EKS with the least operational overhead, use native Kubernetes autoscaling mechanisms. The Kubernetes Metrics Server enables Horizontal Pod Autoscaling to automatically scale pods based on resource usage, handling application-level scaling. The Kubernetes Cluster Autoscaler automatically adjusts the number of worker nodes based on pending pods and resource needs, handling infrastructure-level scaling. Together, they provide end-to-end, automatic scale-in and scale-out without custom code or additional services.
Question 508
A social media company is building a feature for its website. The feature will give users the ability to upload photos. The company expects significant increases in demand during large events and must ensure that the website can handle the upload traffic from users.
Which solution meets these requirements with the MOST scalability?
A. Upload files from the user's browser to the application servers. Transfer the files to an Amazon S3 bucket.
B. Provision an AWS Storage Gateway file gateway. Upload files directly from the user's browser to the file gateway.
C. Generate Amazon S3 presigned URLs in the application. Upload files directly from the user's browser into an S3 bucket.
D. Provision an Amazon Elastic File System (Amazon EFS) file system. Upload files directly from the user's browser to the file system.
Show Answer
Correct Answer: C
Explanation: The most scalable solution is to generate Amazon S3 presigned URLs and allow users to upload files directly from their browsers to S3. This removes application servers from the data path, preventing them from becoming a bottleneck during traffic spikes. Amazon S3 is designed for massive scale and can handle very high concurrent upload volumes automatically, making this approach far more scalable than routing uploads through application servers, Storage Gateway, or Amazon EFS.
Question 509
A company has Amazon EC2 instances that run nightly batch jobs to process data. The EC2 instances run in an Auto Scaling group that uses On-Demand billing. If a job fails on one instance, another instance will reprocess the job. The batch jobs run between 12:00 AM and 06:00 AM local time every day.
Which solution will provide EC2 instances to meet these requirements MOST cost-effectively?
A. Purchase a 1-year Savings Plan for Amazon EC2 that covers the instance family of the Auto Scaling group that the batch job uses.
B. Purchase a 1-year Reserved Instance for the specific instance type and operating system of the instances in the Auto Scaling group that the batch job uses.
C. Create a new launch template for the Auto Scaling group. Set the instances to Spot Instances. Set a policy to scale out based on CPU usage.
D. Create a new launch template for the Auto Scaling group. Increase the instance size. Set a policy to scale out based on CPU usage.
Show Answer
Correct Answer: C
Explanation: The batch jobs are fault-tolerant (failed jobs can be retried on another instance) and run only during a limited nightly window. Spot Instances provide the lowest EC2 cost and are well-suited for interruptible, stateless batch processing. Using an Auto Scaling group with Spot Instances meets capacity needs at a significantly lower cost than On-Demand, Savings Plans, or Reserved Instances, which are better for steady, long-running workloads.
Question 510
A company needs to connect several VPCs in the us-east-1 Region that span hundreds of AWS accounts. The company's networking team has its own AWS account to manage the cloud network.
What is the MOST operationally efficient solution to connect the VPCs?
A. Set up VPC peering connections between each VPC. Update each associated subnet’s route table
B. Configure a NAT gateway and an internet gateway in each VPC to connect each VPC through the internet
C. Create an AWS Transit Gateway in the networking team’s AWS account. Configure static routes from each VP
D. Deploy VPN gateways in each VPC. Create a transit VPC in the networking team’s AWS account to connect to each VPC.
Show Answer
Correct Answer: C
Explanation: The most operationally efficient way to connect hundreds of VPCs across many AWS accounts in a single Region is to use an AWS Transit Gateway. Transit Gateway provides a centralized, scalable hub-and-spoke model that avoids the complexity and connection limits of VPC peering. It can be owned by the networking team’s account and shared with other accounts using AWS Resource Access Manager, allowing centralized routing and management. Other options either do not scale (VPC peering), are not meant for VPC-to-VPC connectivity (NAT/IGW), or introduce unnecessary complexity (VPN-based transit VPC).
Question 511
A company has multiple Windows file servers on premises. The company wants to migrate and consolidate its files into an Amazon FSx for Windows File Server file system. File permissions must be preserved to ensure that access rights do not change.
Which solutions will meet these requirements? (Choose two.)
A. Deploy AWS DataSync agents on premises. Schedule DataSync tasks to transfer the data to the FSx for Windows File Server file system.
B. Copy the shares on each file server into Amazon S3 buckets by using the AWS CLI. Schedule AWS DataSync tasks to transfer the data to the FSx for Windows File Server file system.
C. Remove the drives from each file server. Ship the drives to AWS for import into Amazon S3. Schedule AWS DataSync tasks to transfer the data to the FSx for Windows File Server file system.
D. Order an AWS Snowcone device. Connect the device to the on-premises network. Launch AWS DataSync agents on the device. Schedule DataSync tasks to transfer the data to the FSx for Windows File Server file system.
E. Order an AWS Snowball Edge Storage Optimized device. Connect the device to the on-premises network. Copy data to the device by using the AWS CLI. Ship the device back to AWS for import into Amazon S3. Schedule AWS DataSync tasks to transfer the data to the FSx for Windows File Server file system.
Show Answer
Correct Answer: A, D
Explanation: Amazon FSx for Windows File Server requires preserving NTFS permissions and ACLs. AWS DataSync supports copying Windows file shares to FSx while preserving file metadata and permissions. Option A uses on‑premises DataSync agents to migrate data directly to FSx, meeting the requirement. Option D also uses DataSync (running on a Snowcone device) to transfer data while preserving permissions, suitable when a portable edge device is needed. Options B, C, and E stage data in Amazon S3 using AWS CLI or import jobs; S3 is object storage and does not preserve Windows file system permissions, so they do not meet the requirement.
Question 512
A company uses Amazon S3 to store high-resolution pictures in an S3 bucket. To minimize application changes, the company stores the pictures as the latest version of an S3 object. The company needs to retain only the two most recent versions of the pictures.
The company wants to reduce costs. The company has identified the S3 bucket as a large expense.
Which solution will reduce the S3 costs with the LEAST operational overhead?
A. Use S3 Lifecycle to delete expired object versions and retain the two most recent versions.
B. Use an AWS Lambda function to check for older versions and delete all but the two most recent versions.
C. Use S3 Batch Operations to delete noncurrent object versions and retain only the two most recent versions.
D. Deactivate versioning on the S3 bucket and retain the two most recent versions.
Show Answer
Correct Answer: A
Explanation: S3 Lifecycle rules natively support versioned buckets and can automatically expire noncurrent object versions while retaining a specified number of the most recent versions. This approach is fully managed by S3, requires no custom code or ongoing management, and directly reduces storage costs by deleting older versions. Lambda or Batch Operations add operational overhead, and disabling versioning cannot selectively retain only two versions.
Question 513
A company has a service that reads and writes large amounts of data from an Amazon S3 bucket in the same AWS Region. The service is deployed on Amazon EC2 instances within the private subnet of a VPC. The service communicates with Amazon S3 over a NAT gateway in the public subnet. However, the company wants a solution that will reduce the data output costs.
Which solution will meet these requirements MOST cost-effectively?
A. Provision a dedicated EC2 NAT instance in the public subnet. Configure the route table for the private subnet to use the elastic network interface of this instance as the destination for all S3 traffic.
B. Provision a dedicated EC2 NAT instance in the private subnet. Configure the route table for the public subnet to use the elastic network interface of this instance as the destination for all S3 traffic.
C. Provision a VPC gateway endpoint. Configure the route table for the private subnet to use the gateway endpoint as the route for all S3 traffic.
D. Provision a second NAT gateway. Configure the route table for the private subnet to use this NAT gateway as the destination for all S3 traffic.
Show Answer
Correct Answer: C
Explanation: Traffic from private EC2 instances to Amazon S3 is currently routed through a NAT gateway, which incurs data processing and data transfer costs. An S3 VPC gateway endpoint allows resources in a VPC to access S3 directly over the AWS network without traversing a NAT gateway or the internet. Gateway endpoints are free to provision and eliminate NAT gateway data processing charges, making this the most cost‑effective solution for large volumes of S3 read/write traffic in the same Region.
Question 514
A company is conducting an internal audit. The company wants to ensure that the data in an Amazon S3 bucket that is associated with the company’s AWS Lake Formation data lake does not contain sensitive customer or employee data. The company wants to discover personally identifiable information (PII) or financial information, including passport numbers and credit card numbers.
Which solution will meet these requirements?
A. Configure AWS Audit Manager on the account. Select the Payment Card Industry Data Security Standards (PCI DSS) for auditing.
B. Configure Amazon S3 Inventory on the S3 bucket Configure Amazon Athena to query the inventory.
C. Configure Amazon Macie to run a data discovery job that uses managed identifiers for the required data types.
D. Use Amazon S3 Select to run a report across the S3 bucket.
Show Answer
Correct Answer: C
Explanation: Amazon Macie is specifically designed to discover, classify, and protect sensitive data in Amazon S3. It uses managed identifiers and machine learning to detect PII and financial data such as passport numbers and credit card numbers, which directly meets the audit requirement. The other options do not provide sensitive data discovery capabilities.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.