A company is migrating its workloads to AWS. The company has transactional and sensitive data in its databases. The company wants to use AWS Cloud solutions to increase security and reduce operational overhead for the databases.
Which solution will meet these requirements?
A. Migrate the databases to Amazon EC2. Use an AWS Key Management Service (AWS KMS) AWS managed key for encryption.
B. Migrate the databases to Amazon RDS Configure encryption at rest.
C. Migrate the data to Amazon S3 Use Amazon Macie for data security and protection
D. Migrate the database to Amazon RDS. Use Amazon CloudWatch Logs for data security and protection.
Show Answer
Correct Answer: B
Explanation: Amazon RDS is a managed relational database service that reduces operational overhead compared to self-managed databases on EC2. Enabling encryption at rest protects sensitive and transactional data using AWS-managed encryption capabilities. EC2 requires customers to manage the database themselves, S3 with Macie is not a transactional database solution, and CloudWatch Logs is for monitoring and logging rather than database data protection.
Question 496
A solutions architect is reviewing the resilience of an application. The solutions architect notices that a database administrator recently failed over the application's Amazon Aurora PostgreSQL database writer instance as part of a scaling exercise. The failover resulted in 3 minutes of downtime for the application.
Which solution will reduce the downtime for scaling exercises with the LEAST operational overhead?
A. Create more Aurora PostgreSQL read replicas in the cluster to handle the load during failover.
B. Set up a secondary Aurora PostgreSQL cluster in the same AWS Region. During failover, update the application to use the secondary cluster's writer endpoint.
C. Create an Amazon ElastiCache for Memcached cluster to handle the load during failover.
D. Set up an Amazon RDS proxy for the database. Update the application to use the proxy endpoint.
Show Answer
Correct Answer: D
Explanation: Amazon RDS Proxy reduces application recovery time during Aurora PostgreSQL writer failovers by maintaining and reestablishing database connections, avoiding client-side delays such as DNS propagation and connection storms. This provides the least operational overhead compared with maintaining a secondary cluster or redesigning for failover. Additional read replicas do not reduce writer failover downtime, and ElastiCache does not solve database writer availability.
Question 497
A company uses Amazon EC2 instances to host its internal systems. As part of a deployment operation, an administrator tries to use the AWS CLI to terminate an EC2 instance. However, the administrator receives a 403 (Access Denied) error message.
The administrator is using an IAM role that has the following IAM policy attached:
What is the cause of the unsuccessful request?
A. The EC2 instance has a resource-based policy with a Deny statement.
B. The principal has not been specified in the policy statement.
C. The "Action" field does not grant the actions that are required to terminate the EC2 instance.
D. The request to terminate the EC2 instance does not originate from the CIDR blocks 192.0.2.0/24 or 203.0.113.0/24.
Show Answer
Correct Answer: D
Explanation: The IAM policy explicitly allows ec2:TerminateInstances but also contains an explicit Deny for the same action when the request source IP is NOT within 192.0.2.0/24 or 203.0.113.0/24. In IAM evaluation, an explicit Deny overrides an Allow. Therefore, if the administrator's CLI request originates from any other IP address, AWS returns AccessDenied (403).
Question 498
A law firm needs to share information with the public. The information includes hundreds of files that must be publicly readable. Modifications or deletions of the files by anyone before a designated future date are prohibited.
Which solution will meet these requirements in the MOST secure way?
A. Upload all files to an Amazon S3 bucket that is configured for static website hosting. Grant read-only IAM permissions to any AWS principals that access the S3 bucket until the designated date.
B. Create a new Amazon S3 bucket with S3 Versioning enabled. Use S3 Object Lock with a retention period in accordance with the designated date. Configure the S3 bucket for static website hosting. Set an S3 bucket policy to allow read-only access to the objects.
C. Create a new Amazon S3 bucket with S3 Versioning enabled. Configure an event trigger to run an AWS Lambda function in case of object modification or deletion. Configure the Lambda function to replace the objects with the original versions from a private S3 bucket.
D. Upload all files to an Amazon S3 bucket that is configured for static website hosting. Select the folder that contains the files. Use S3 Object Lock with a retention period in accordance with the designated date. Grant read-only IAM permissions to any AWS principals that access the S3 bucket.
Show Answer
Correct Answer: B
Explanation: Amazon S3 Object Lock prevents object deletion or modification for the configured retention period and requires S3 Versioning to be enabled. A bucket policy can provide public read-only access for static website hosting while Object Lock enforces immutability until the designated date. Option A lacks Object Lock, C is reactive rather than preventative, and D is invalid because Object Lock is configured at the bucket level (with versioning), not by selecting a folder.
Question 499
A consulting company provides professional services to customers worldwide. The company provides solutions and tools for customers to expedite gathering and analyzing data on AWS. The company needs to centrally manage and deploy a common set of solutions and tools for customers to use for self-service purposes.
Which solution will meet these requirements?
A. Create AWS CloudFormation templates for the customers.
B. Create AWS Service Catalog products for the customers.
C. Create AWS Systems Manager templates for the customers.
D. Create AWS Config items for the customers.
Show Answer
Correct Answer: B
Explanation: AWS Service Catalog is designed to centrally manage and govern a standardized set of approved solutions (products) that users can deploy through self-service. CloudFormation provides the underlying infrastructure templates but does not by itself offer centralized catalog management and self-service governance. Systems Manager and AWS Config serve different purposes (operations management and configuration compliance, respectively).
Question 500
An application uses an Amazon RDS MySQL DB instance. The RDS database is becoming low on disk space. A solutions architect wants to increase the disk space without downtime.
Which solution meets these requirements with the LEAST amount of effort?
A. Enable storage autoscaling in RDS
B. Increase the RDS database instance size
C. Change the RDS database instance storage type to Provisioned IOPS
D. Back up the RDS database, increase the storage capacity, restore the database, and stop the previous instance
Show Answer
Correct Answer: A
Explanation: Amazon RDS Storage Auto Scaling automatically increases allocated storage as needed for supported engines such as MySQL, without downtime. Increasing the DB instance size affects compute, not storage. Changing to Provisioned IOPS changes the storage type, not necessarily capacity. Backing up and restoring is unnecessary and involves significantly more operational effort.
Question 501
A company provides an API interface to customers so the customers can retrieve their financial information. Еhe company expects a larger number of requests during peak usage times of the year.
The company requires the API to respond consistently with low latency to ensure customer satisfaction. The company needs to provide a compute host for the API.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use an Application Load Balancer and Amazon Elastic Container Service (Amazon ECS).
B. Use Amazon API Gateway and AWS Lambda functions with provisioned concurrency.
C. Use an Application Load Balancer and an Amazon Elastic Kubernetes Service (Amazon EKS) cluster.
D. Use Amazon API Gateway and AWS Lambda functions with reserved concurrency.
Show Answer
Correct Answer: B
Explanation: Amazon API Gateway with AWS Lambda provides the least operational overhead because there are no servers or container orchestration platforms to manage. The requirement for consistently low latency during predictable peak periods is best addressed with Lambda provisioned concurrency, which keeps execution environments pre-initialized and minimizes cold-start latency. Reserved concurrency only guarantees execution capacity and limits concurrency; it does not pre-warm environments or ensure low-latency startup.
Question 502
A social media company wants to allow its users to upload images in an application that is hosted in the AWS Cloud. The company needs a solution that automatically resizes the images so that the images can be displayed on multiple device types. The application experiences unpredictable traffic patterns throughout the day. The company is seeking a highly available solution that maximizes scalability.
What should a solutions architect do to meet these requirements?
A. Create a static website hosted in Amazon S3 that invokes AWS Lambda functions to resize the images and store the images in an Amazon S3 bucket.
B. Create a static website hosted in Amazon CloudFront that invokes AWS Step Functions to resize the images and store the images in an Amazon RDS database.
C. Create a dynamic website hosted on a web server that runs on an Amazon EC2 instance. Configure a process that runs on the EC2 instance to resize the images and store the images in an Amazon S3 bucket.
D. Create a dynamic website hosted on an automatically scaling Amazon Elastic Container Service (Amazon ECS) cluster that creates a resize job in Amazon Simple Queue Service (Amazon SQS). Set up an image-resizing program that runs on an Amazon EC2 instance to process the resize jobs.
Show Answer
Correct Answer: A
Explanation: A serverless architecture using Amazon S3 and AWS Lambda provides automatic scaling and high availability for unpredictable upload traffic. Images can be uploaded to S3, which triggers a Lambda function to resize them and store the resized versions back in S3. The other options introduce unnecessary infrastructure, misuse services (CloudFront is not a website host, RDS is not appropriate for image storage), or rely on EC2 for image processing, reducing scalability.
Question 503
A company uses AWS Organizations with resources tagged by account. The company also uses AWS Backup to back up its AWS infrastructure resources. The company needs to back up all AWS resources.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS Config to identify all untagged resources. Tag the identified resources programmatically. Use tags in the backup plan.
B. Use AWS Config to identify all resources that are not running. Add those resources to the backup vault.
C. Require all AWS account owners to review their resources to identify the resources that need to be backed up.
D. Use Amazon Inspector to identify all noncompliant resources.
Show Answer
Correct Answer: A
Explanation: AWS Backup can use tag-based resource selection in backup plans. AWS Config can identify untagged resources across accounts, and automatic remediation or programmatic tagging ensures resources are consistently included in backups with minimal manual effort. Option B is unrelated because running state does not determine backup needs. Option C is manual and has high operational overhead. Option D is incorrect because Amazon Inspector assesses security vulnerabilities and exposure, not backup compliance or resource tagging.
Question 504
A global marketing company has applications that run in the ap-southeast-2 Region and the eu-west-1 Region. Applications that run in a VPC in eu-west-1 need to communicate securely with databases that run in a VPC in ap-southeast-2.
Which network design will meet these requirements?
A. Create a VPC peering connection between the eu-west-1 VPC and the ap-southeast-2 VPC. Create an inbound rule in the eu-west-1 application security group that allows traffic from the database server IP addresses in the ap-southeast-2 security group.
B. Configure a VPC peering connection between the ap-southeast-2 VPC and the eu-west-1 VPC. Update the subnet route tables. Create an inbound rule in the ap-southeast-2 database security group that references the security group ID of the application servers in eu-west-1.
C. Configure a VPC peering connection between the ap-southeast-2 VPC and the eu-west-1 VPUpdate the subnet route tables. Create an inbound rule in the ap-southeast-2 database security group that allows traffic from the eu-west-1 application server IP addresses.
D. Create a transit gateway with a peering attachment between the eu-west-1 VPC and the ap-southeast-2 VPC. After the transit gateways are properly peered and routing is configured, create an inbound rule in the database security group that references the security group ID of the application servers in eu-west-1.
Show Answer
Correct Answer: C
Explanation: Inter-Region VPC peering supports private connectivity between two VPCs when routes are updated. However, security group references cannot be used across inter-Region VPC peering. Therefore the database security group must allow the application side by IP/CIDR rather than referencing the remote security group. Transit Gateway is unnecessary for connecting just these two VPCs, and option A applies the security rule in the wrong direction.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.