A company is designing a new internal web application in the AWS Cloud. The new application must securely retrieve and store multiple employee usernames and passwords from an AWS managed service.
Which solution will meet these requirements with the LEAST operational overhead?
A. Store the employee credentials in AWS Systems Manager Parameter Store. Use AWS CloudFormation and the BatchGetSecretValue API to retrieve usernames and passwords from Parameter Store.
B. Store the employee credentials in AWS Secrets Manager. Use AWS CloudFormation and AWS Batch with the BatchGetSecretValue API to retrieve the usernames and passwords from Secrets Manager.
C. Store the employee credentials in AWS Systems Manager Parameter Store. Use AWS CloudFormation and AWS Batch with the BatchGetSecretValue API to retrieve the usernames and passwords from Parameter Store.
D. Store the employee credentials in AWS Secrets Manager. Use AWS CloudFormation and the BatchGetSecretValue API to retrieve the usernames and passwords from Secrets Manager.
Show Answer
Correct Answer: D
Explanation: AWS Secrets Manager is the AWS managed service designed for securely storing and retrieving secrets such as usernames and passwords. The BatchGetSecretValue API is a Secrets Manager API that efficiently retrieves multiple secrets in a single request. AWS Batch is unrelated to secret retrieval and would add unnecessary operational overhead. Systems Manager Parameter Store can store secure strings, but Secrets Manager is the purpose-built service for credentials and secret management.
Question 40
A company hosts its application on several Amazon EC2 instances inside a VPC. The company creates a dedicated Amazon S3 bucket for each customer to store their relevant information in Amazon S3.
The company wants to ensure that the application running on EC2 instances can securely access only the S3 buckets that belong to the company’s AWS account.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a gateway endpoint for Amazon S3 that is attached to the VPC. Update the IAM instance profile policy to provide access to only the specific buckets that the application needs.
B. Create a NAT gateway in a public subnet with a security group that allows access to only Amazon S3. Update the route tables to use the NAT Gateway.
C. Create a gateway endpoint for Amazon S3 that is attached to the VPUpdate the IAM instance profile policy with a Deny action and the following condition key:
D. Create a NAT Gateway in a public subnet. Update route tables to use the NAT Gateway. Assign bucket policies for all buckets with a Deny action and the following condition key:
Show Answer
Correct Answer: C
Explanation: Using an Amazon S3 gateway VPC endpoint keeps S3 traffic on the AWS network with minimal operational overhead. Adding an IAM explicit Deny using the s3:ResourceAccount (or S3ResourceAccount as presented in the option) condition prevents access to S3 buckets not owned by the company's AWS account, avoiding the need to continually update IAM policies as new customer buckets are created. NAT gateway options are unnecessary for S3 access and add cost and operational overhead. Option A would require maintaining an allow list of buckets as new buckets are added.
Question 41
A company runs a web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application stores data in an Amazon Aurora MySQL DB cluster.
The company needs to create a disaster recovery (DR) solution. The acceptable recovery time for the DR solution is up to 30 minutes. The DR solution does not need to support customer usage when the primary infrastructure is healthy.
Which solution will meet these requirements?
A. Deploy the DR infrastructure in a second AWS Region with an ALB and an Auto Scaling group. Set the desired capacity and maximum capacity of the Auto Scaling group to a minimum value. Convert the Aurora MySQL DB cluster to an Aurora global database. Configure Amazon Route 53 for an active-passive failover with ALB endpoints.
B. Deploy the DR infrastructure in a second AWS Region with an ALUpdate the Auto Scaling group to include EC2 instances from the second Region. Use Amazon Route 53 to configure active-active failover. Convert the Aurora MySQL DB cluster to an Aurora global database.
C. Back up the Aurora MySQL DB cluster data by using AWS Backup. Deploy the DR infrastructure in a second AWS Region with an ALB. Update the Auto Scaling group to include EC2 instances from the second Region. Use Amazon Route 53 to configure active-active failover. Create an Aurora MySQL DB cluster in the second Region Restore the data from the backup.
D. Back up the infrastructure configuration by using AWS Backup. Use the backup to create the required infrastructure in a second AWS Region. Set the Auto Scaling group desired capacity to zero. Use Amazon Route 53 to configure active-passive failover. Convert the Aurora MySQL DB cluster to an Aurora global database.
Show Answer
Correct Answer: A
Explanation: A warm standby deployment in a second Region with minimal application capacity, Route 53 active-passive failover, and an Aurora Global Database meets an RTO of up to 30 minutes while avoiding serving customer traffic during normal operations. Option B is active-active, which is unnecessary. Options C and D rely on backup/restore or incorrectly describe backing up infrastructure configuration with AWS Backup, which do not best satisfy the stated RTO and contain implementation issues.
Question 42
A company uses an Amazon DynamoDB table to store data that the company receives from devices. The DynamoDB table supports a customer-facing website to display recent activity on customer devices. The company configured the table with provisioned throughput for writes and reads.
The company wants to calculate performance metrics for customer device data on a daily basis. The solution must have minimal effect on the table's provisioned read and write capacity.
Which solution will meet these requirements?
A. Use an Amazon Athena SQL query with the Amazon Athena DynamoDB connector to calculate performance metrics on a recurring schedule.
B. Use an AWS Glue job with the AWS Glue DynamoDB export connector to calculate performance metrics on a recurring schedule.
C. Use an Amazon Redshift COPY command to calculate performance metrics on a recurring schedule.
D. Use an Amazon EMR job with an Apache Hive external table to calculate performance metrics on a recurring schedule.
Show Answer
Correct Answer: B
Explanation: The AWS Glue DynamoDB export connector uses DynamoDB's export to Amazon S3 capability, which exports a table snapshot without consuming provisioned read capacity or affecting table performance. The Glue job can then calculate the daily metrics from the exported data. Athena's DynamoDB connector reads the live table, which consumes read capacity. Redshift COPY cannot directly ingest from DynamoDB for this purpose, and EMR/Hive would also read the live table unless an export pipeline is added.
Question 43
A solutions architect is designing the cloud architecture for a new stateless application that will be deployed on AWS. The solutions architect created an Amazon Machine Image (AMI) and launch template for the application.
Based on the number of jobs that need to be processed, the processing must run in parallel while adding and removing application Amazon EC2 instances as needed. The application must be loosely coupled. The job items must be durably stored.
Which solution will meet these requirements?
A. Create an Amazon Simple Notification Service (Amazon SNS) topic to send the jobs that need to be processed. Create an Auto Scaling group by using the launch template with the scaling policy set to add and remove EC2 instances based on CPU usage.
B. Create an Amazon Simple Queue Service (Amazon SQS) queue to hold the jobs that need to be processed. Create an Auto Scaling group by using the launch template with the scaling policy set to add and remove EC2 instances based on network usage.
C. Create an Amazon Simple Queue Service (Amazon SQS) queue to hold the jobs that need to be processed. Create an Auto Scaling group by using the launch template with the scaling policy set to add and remove EC2 instances based on the number of items in the SQS queue.
D. Create an Amazon Simple Notification Service (Amazon SNS) topic to send the jobs that need to be processed. Create an Auto Scaling group by using the launch template with the scaling policy set to add and remove EC2 instances based on the number of messages published to the SNS topic.
Show Answer
Correct Answer: C
Explanation: The requirements call for a loosely coupled architecture with durable job storage and parallel processing that scales with workload. Amazon SQS provides durable message queuing and decouples producers from consumers. An EC2 Auto Scaling group should scale based on the SQS queue depth (number of messages), which directly reflects pending work. SNS is a pub/sub service, not a durable work queue for this pattern, and scaling on CPU or network usage is less directly aligned with queued job demand.
Question 44
A company is developing a new application that uses a relational database to store user data and application configurations. The company expects the application to have steady user growth. The company expects the database usage to be variable and read-heavy, with occasional writes.
The company wants to cost-optimize the database solution. The company wants to use an AWS managed database solution that will provide the necessary performance.
Which solution will meet these requirements MOST cost-effectively?
A. Deploy the database on Amazon RDS. Use Provisioned IOPS SSD storage to ensure consistent performance for read and write operations.
B. Deploy the database on Amazon Aurora Serverless to automatically scale the database capacity based on actual usage to accommodate the workload.
C. Deploy the database on Amazon DynamoDB. Use on-demand capacity mode to automatically scale throughput to accommodate the workload.
D. Deploy the database on Amazon RDS. Use magnetic storage and use read replicas to accommodate the workload.
Show Answer
Correct Answer: B
Explanation: The application requires a managed relational database, variable and read-heavy workload, steady growth, and cost optimization. Amazon Aurora Serverless is a managed relational database that automatically scales capacity based on demand, making it cost-effective for variable usage. Provisioned IOPS on RDS (A) is unnecessarily expensive for this workload. DynamoDB (C) is not a relational database. RDS with magnetic storage (D) sacrifices performance and magnetic storage is not the appropriate choice for a growing read-heavy production workload.
Question 45
A company currently runs an on-premises stock trading application by using Microsoft Windows Server. The company wants to migrate the application to the AWS Cloud.
The company needs to design a highly available solution that provides low-latency access to block storage across multiple Availability Zones.
Which solution will meet these requirements with the LEAST implementation effort?
A. Configure a Windows Server cluster that spans two Availability Zones on Amazon EC2 instances. Install the application on both cluster nodes. Use Amazon FSx for Windows File Server as shared storage between the two cluster nodes.
B. Configure a Windows Server cluster that spans two Availability Zones on Amazon EC2 instances. Install the application on both cluster nodes. Use Amazon Elastic Block Store (Amazon EBS) General Purpose SSD (gp3) volumes as storage attached to the EC2 instances. Set up application-level replication to sync data from one EBS volume in one Availability Zone to another EBS volume in the second Availability Zone.
C. Deploy the application on Amazon EC2 instances in two Availability Zones. Configure one EC2 instance as active and the second EC2 instance in standby mode. Use an Amazon FSx for NetApp ONTAP Multi-AZ file system to access the data by using Internet Small Computer Systems Interface (iSCSI) protocol.
D. Deploy the application on Amazon EC2 instances in two Availability Zones. Configure one EC2 instance as active and the second EC2 instance in standby mode. Use Amazon Elastic Block Store (Amazon EBS) Provisioned IOPS SSD (io2) volumes as storage attached to the EC2 instances. Set up Amazon EBS level replication to sync data from one io2 volume in one Availability Zone to another io2 volume in the second Availability Zone.
Show Answer
Correct Answer: C
Explanation: The requirement is for highly available, low-latency block storage across multiple Availability Zones with the least implementation effort. Amazon FSx for NetApp ONTAP Multi-AZ provides managed high availability and exposes shared block storage over iSCSI, avoiding custom replication. FSx for Windows File Server is a file service (SMB), not shared block storage. EBS volumes are AZ-scoped, and the replication approaches described require additional setup; Amazon EBS does not provide native cross-AZ volume replication as described in option D.
Question 46
A financial services company plans to launch a new application on AWS to handle sensitive financial transactions. The company will deploy the application on Amazon EC2 instances. The company will use Amazon RDS for MySQL as the database. The company’s security policies mandate that data must be encrypted at rest and in transit.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure AWS Certificate Manager (ACM) SSL/TLS certificates for encryption in transit.
B. Configure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure IPsec tunnels for encryption in transit.
C. Implement third-party application-level data encryption before storing data in Amazon RDS for MySQL. Configure AWS Certificate Manager (ACM) SSL/TLS certificates for encryption in transit.
D. Configure encryption at rest for Amazon RDS for MySQL by using AWS KMS managed keys. Configure a VPN connection to enable private connectivity to encrypt data in transit.
Show Answer
Correct Answer: A
Explanation: Amazon RDS for MySQL supports encryption at rest using AWS KMS-managed encryption keys, which is the native, fully managed approach with minimal operational overhead. For encryption in transit, use SSL/TLS for the database connection. ACM simplifies certificate lifecycle management for supported AWS services, and RDS uses TLS certificates for encrypted client connections. The intent of the option is to use managed TLS rather than managing IPsec tunnels, VPNs, or application-level encryption, all of which add operational complexity.
Question 47
A company is designing a web application with an internet-facing Application Load Balancer (ALB).
The company needs the ALB to receive HTTPS web traffic from the public internet. The ALB must send only HTTPS traffic to the web application servers hosted on the Amazon EC2 instances on port 443. The ALB must perform a health check of the web application servers over HTTPS on port 8443.
Which combination of configurations of the security group that is associated with the ALB will meet these requirements? (Choose three.)
A. Allow HTTPS inbound traffic from 0.0.0.0/0 for port 443.
B. Allow all outbound traffic to 0.0.0.0/0 for port 443.
C. Allow HTTPS outbound traffic to the web application instances for port 443.
D. Allow HTTPS inbound traffic from the web application instances for port 443.
E. Allow HTTPS outbound traffic to the web application instances for the health check on port 8443.
F. Allow HTTPS inbound traffic from the web application instances for the health check on port 8443.
Show Answer
Correct Answer: A, C, E
Explanation: The ALB security group must allow inbound HTTPS (443) from the internet. It must allow outbound HTTPS to the target EC2 instances on port 443 for application traffic and outbound HTTPS to the target EC2 instances on port 8443 for health checks. Inbound rules from the instances are not required because security groups are stateful; return traffic is automatically allowed. An 'allow all outbound traffic to 0.0.0.0/0 for port 443' rule is not the specific configuration required and does not cover health checks on 8443.
Question 48
A company currently runs an on-premises application that usesASP.NET on Linux machines. The application is resource-intensive and serves customers directly.
The company wants to modernize the application to .NET. The company wants to run the application on containers and to scale based on Amazon CloudWatch metrics. The company also wants to reduce the time spent on operational maintenance activities.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS App2Container to containerize the application. Use an AWS CloudFormation template to deploy the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.
B. Use AWS App2Container to containerize the application. Use an AWS CloudFormation template to deploy the application to Amazon Elastic Container Service (Amazon ECS) on Amazon EC2 instances.
C. Use AWS App Runner to containerize the application. Use App Runner to deploy the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.
D. Use AWS App Runner to containerize the application. Use App Runner to deploy the application to Amazon Elastic Kubernetes Service (Amazon EKS) on Amazon EC2 instances.
Show Answer
Correct Answer: A
Explanation: AWS App2Container is designed to containerize existing ASP.NET/.NET applications and can generate deployment artifacts such as CloudFormation templates for Amazon ECS. Running the containers on AWS Fargate minimizes operational overhead because there are no EC2 instances to manage. Amazon ECS supports auto scaling based on Amazon CloudWatch metrics. Options C and D are invalid because AWS App Runner does not containerize applications or deploy them to ECS/EKS; it is its own managed runtime service. Option B requires managing EC2 instances, increasing operational overhead.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.