A global ecommerce company runs its critical workloads on AWS. The workloads use an Amazon RDS for PostgreSQL DB instance that is configured for a Multi-AZ deployment.
Customers have reported application timeouts when the company undergoes database failovers. The company needs a resilient solution to reduce failover time.
Which solution will meet these requirements?
A. Create an Amazon RDS Proxy. Assign the proxy to the DB instance.
B. Create a read replica for the DB instance. Move the read traffic to the read replica.
C. Enable Performance Insights. Monitor the CPU load to identify the timeouts.
D. Take regular automatic snapshots. Copy the automatic snapshots to multiple AWS Regions.
Show Answer
Correct Answer: A
Explanation: Amazon RDS Proxy maintains and manages database connections during Multi-AZ failovers, allowing applications to reconnect quickly without exhausting connections. This significantly reduces application timeouts during failover. The other options do not reduce failover time: read replicas are for read scaling, Performance Insights is for monitoring, and snapshots are for backup/DR.
Question 52
A company is developing machine learning (ML) models on AWS. The company is developing the ML models as independent microservices. The microservices fetch approximately 1 GB of model data from Amazon S3 at startup and load the data into memory. Users access the ML models through an asynchronous API. Users can send a request or a batch of requests.
The company provides the ML models to hundreds of users. The usage patterns for the models are irregular. Some models are not used for days or weeks. Other models receive batches of thousands of requests at a time.
Which solution will meet these requirements?
A. Direct the requests from the API to a Network Load Balancer (NLB). Deploy the ML models as AWS Lambda functions that the NLB will invoke. Use auto scaling to scale the Lambda functions based on the traffic that the NLB receives.
B. Direct the requests from the API to an Application Load Balancer (ALB). Deploy the ML models as Amazon Elastic Container Service (Amazon ECS) services that the ALB will invoke. Use auto scaling to scale the ECS cluster instances based on the traffic that the ALB receives.
C. Direct the requests from the API into an Amazon Simple Queue Service (Amazon SQS) queue. Deploy the ML models as AWS Lambda functions that SQS events will invoke. Use auto scaling to increase the number of vCPUs for the Lambda functions based on the size of the SQS queue.
D. Direct the requests from the API into an Amazon Simple Queue Service (Amazon SQS) queue. Deploy the ML models as Amazon Elastic Container Service (Amazon ECS) services that read from the queue. Use auto scaling for Amazon ECS to scale both the cluster capacity and number of the services based on the size of the SQS queue.
Show Answer
Correct Answer: D
Explanation: The workload is asynchronous with highly irregular traffic, including long idle periods and sudden large batches. Each model loads ~1 GB of data at startup, which makes frequent cold starts inefficient. Using Amazon SQS decouples request ingestion from processing and smooths traffic bursts. Running the models as Amazon ECS services allows containers to keep the model data in memory across requests, avoiding repeated reloads. ECS service and cluster auto scaling based on SQS queue depth can scale out rapidly for bursts and scale to zero or near-zero when idle, meeting both cost and performance requirements better than Lambda or load-balancer–based synchronous designs.
Question 53
A company runs a Node js function on a server in its on-premises data center. The data center stores data in a PostgreSQL database. The company stores the credentials in a connection string in an environment variable on the server. The company wants to migrate its application to AWS and to replace the Node.js application server with AWS Lambda. The company also wants to migrate to Amazon RDS for PostgreSQL and to ensure that the database credentials are securely managed.
Which solution will meet these requirements with the LEAST operational overhead?
A. Store the database credentials as a parameter in AWS Systems Manager Parameter Store Configure Parameter Store to automatically rotate the secrets every 30 days. Update the Lambda function to retrieve the credentials from the parameter.
B. Store the database credentials as a secret in AWS Secrets Manager. Configure Secrets Manager to automatically rotate the credentials every 30 days. Update the Lambda function to retrieve the credentials from the secret.
C. Store the database credentials as an encrypted Lambda environment variable. Write a custom Lambda function to rotate the credentials. Schedule the Lambda function to run every 30 days.
D. Store the database credentials as a key in AWS Key Management Service (AWS KMS). Configure automatic rotation for the key. Update the Lambda function to retneve the credentials from the KMS key.
Show Answer
Correct Answer: B
Explanation: AWS Secrets Manager is purpose-built for securely storing and managing database credentials and provides native, fully managed rotation for Amazon RDS for PostgreSQL with minimal configuration. Lambda can retrieve the secret securely at runtime. The other options either lack automatic rotation (Parameter Store), require custom rotation logic (encrypted environment variables), or misuse a service not designed for credential storage (AWS KMS).
Question 54
A company runs its production workload on an Amazon Aurora MySQL DB cluster that includes six Aurora Replicas. The company wants near-real-time reporting queries from one of its departments to be automatically distributed across three of the Aurora Replicas. Those three replicas have a different compute and memory specification from the rest of the DB cluster.
Which solution meets these requirements?
A. Create and use a custom endpoint for the workload
B. Create a three-node cluster clone and use the reader endpoint
C. Use any of the instance endpoints for the selected three nodes
D. Use the reader endpoint to automatically distribute the read-only workload
Show Answer
Correct Answer: A
Explanation: An Aurora custom endpoint lets you define a specific subset of DB instances and automatically load-balance connections across them. This allows near-real-time reporting queries to be distributed only across the three selected Aurora Replicas with different compute and memory specifications. The reader endpoint would include all replicas, instance endpoints lack automatic balancing, and a cluster clone is unnecessary.
Question 55
A company has migrated several applications to AWS in the past 3 months. The company wants to know the breakdown of costs for each of these applications. The company wants to receive a regular report that includes this information.
Which solution will meet these requirements MOST cost-effectively?
A. Use AWS Budgets to download data for the past 3 months into a .csv file. Look up the desired information.
B. Load AWS Cost and Usage Reports into an Amazon RDS DB instance. Run SQL queries to get the desired information.
C. Tag all the AWS resources with a key for cost and a value of the application's name. Activate cost allocation tags. Use Cost Explorerto get the desired information.
D. Tag all the AWS resources with a key for cost and a value of the application's name. Use the AWS Billing and Cost Management console todownload bills for the past 3 months. Look up the desired information.
Show Answer
Correct Answer: C
Explanation: To break down costs by application and receive regular reports in the most cost‑effective way, the company should use cost allocation tags and AWS Cost Explorer. By tagging all resources with an application identifier and activating those tags, AWS can attribute costs per application. Cost Explorer natively supports filtering and reporting by these tags, provides up to 13 months of historical data, and can generate ongoing reports without extra infrastructure or operational overhead. Other options either lack proper cost attribution, require manual analysis, or add unnecessary cost and complexity.
Question 56
A company is building a cloud-based application on AWS that will handle sensitive customer data. The application uses Amazon RDS for the database, Amazon S3 for object storage, and S3 Event Notifications that invoke AWS Lambda for serverless processing.
The company uses AWS IAM Identity Center to manage user credentials. The development, testing, and operations teams need secure access to Amazon RDS and Amazon S3 while ensuring the confidentiality of sensitive customer data. The solution must comply with the principle of least privilege.
Which solution meets these requirements with the LEAST operational overhead?
A. Use IAM roles with least privilege to grant all the teams access. Assign IAM roles to each team with customized IAM policies defining specific permission for Amazon RDS and S3 object access based on team responsibilities.
B. Enable IAM Identity Center with an Identity Center directory. Create and configure permission sets with granular access to Amazon RDS and Amazon S3. Assign all the teams to groups that have specific access with the permission sets.
C. Create individual IAM users for each member in all the teams with role-based permissions. Assign the IAM roles with predefined policies for RDS and S3 access to each user based on user needs. Implement IAM Access Analyzer for periodic credential evaluation.
D. Use AWS Organizations to create separate accounts for each team. Implement cross-account IAM roles with least privilege. Grant specific permission for RDS and S3 access based on team roles and responsibilities.
Show Answer
Correct Answer: B
Explanation: IAM Identity Center centralizes identity and access management and integrates natively with AWS services. Using permission sets and group assignments provides granular, least-privilege access to Amazon RDS and Amazon S3 for different teams while avoiding per-user IAM management. This approach reduces administrative effort compared to managing many IAM roles or users, and avoids the higher complexity of multi-account, cross-account role setups, resulting in the least operational overhead.
Question 57
A company is using an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The company must ensure that Kubernetes service accounts in the EKS cluster have secure and granular access to specific AWS resources by using IAM roles for service accounts (IRSA).
Which combination of solutions will meet these requirements? (Choose two.)
A. Create an IAM policy that defines the required permissions Attach the policy directly to the IAM role of the EKS nodes.
B. Implement network policies within the EKS cluster to prevent Kubernetes service accounts from accessing specific AWS services.
C. Modify the EKS cluster's IAM role to include permissions for each Kubernetes service account. Ensure a one-to-one mapping between IAM roles and Kubernetes roles.
D. Define an IAM role that includes the necessary permissions. Annotate the Kubernetes service accounts with the Amazon ResourceName (ARN) of the IAM role.
E. Set up a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider.
Show Answer
Correct Answer: D, E
Explanation: IAM Roles for Service Accounts (IRSA) require two key components: (1) an IAM role with the required permissions that is associated directly with a Kubernetes service account via annotation, and (2) a trust relationship between that IAM role and the EKS cluster’s OIDC identity provider so the service account can assume the role securely. Attaching policies to node roles or cluster roles is overly permissive, and network policies do not control AWS IAM access.
Question 58
A company needs to design a hybrid network architecture. The company's workloads are currently stored in the AWS Cloud and in on-premises data centers. The workloads require single-digit latencies to communicate. The company uses an AWS Transit Gateway transit gateway to connect multiple VPCs.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
A. Establish an AWS Site-to-Site VPN connection to each VPC.
B. Associate an AWS Direct Connect gateway with the transit gateway that is attached to the VPCs.
C. Establish an AWS Site-to-Site VPN connection to an AWS Direct Connect gateway.
D. Establish an AWS Direct Connect connection. Create a transit virtual interface (VIF) to a Direct Connect gateway.
E. Associate AWS Site-to-Site VPN connections with the transit gateway that is attached to the VPCs.
Show Answer
Correct Answer: B, D
Explanation: The workloads require single-digit latency between on-premises and multiple VPCs connected by an AWS Transit Gateway. AWS Direct Connect provides dedicated private connectivity with predictable, low latency compared to VPN over the public internet. Creating a Direct Connect connection with a transit VIF to a Direct Connect gateway (D) enables private connectivity from on premises into AWS. Associating the Direct Connect gateway with the transit gateway attached to the VPCs (B) allows that low-latency connection to reach multiple VPCs in a scalable and cost-effective way. VPN-based options rely on the public internet and typically cannot meet single-digit latency requirements.
Question 59
A company uses an Amazon RDS for MySQL instance. To prepare for end-of-year processing, the company added a read replica to accommodate extra read-only queries from the company's reporting tool. The read replica CPU usage was 60% and the primary instance CPU usage was 60%.
After end-of-year activities are complete, the read replica has a constant 25% CPU usage. The primary instance still has a constant 60% CPU usage. The company wants to rightsize the database and still provide enough performance for future growth.
Which solution will meet these requirements?
A. Delete the read replica Do not make changes to the primary instance
B. Resize the read replica to a smaller instance size Do not make changes to the primary instance
C. Resize the read replica to a larger instance size Resize the primary instance to a smaller instance size
D. Delete the read replica Resize the primary instance to a larger instance
Show Answer
Correct Answer: B
Explanation: After year-end processing, the read replica is consistently underutilized at 25% CPU, indicating it is oversized for the current workload. Rightsizing means reducing unused capacity while retaining architecture that supports future growth. Downsizing the read replica lowers cost and still preserves read-scaling capability for future reporting spikes. The primary instance remains at 60% CPU, which is a healthy utilization level with headroom, so it should not be changed.
Question 60
A company is running a media store across multiple Amazon EC2 instances distributed across multiple Availability Zones in a single VPC. The company wants a high-performing solution to share data between all the EC2 instances, and prefers to keep the data within the VPC only.
What should a solutions architect recommend?
A. Create an Amazon S3 bucket and call the service APIs from each instance's application
B. Create an Amazon S3 bucket and configure all instances to access it as a mounted volume
C. Configure an Amazon Elastic Block Store (Amazon EBS) volume and mount it across all instances
D. Configure an Amazon Elastic File System (Amazon EFS) file system and mount it across all instances
Show Answer
Correct Answer: D
Explanation: Amazon Elastic File System (EFS) is a fully managed, high-performance shared file system that can be mounted concurrently by multiple EC2 instances across multiple Availability Zones within the same VPC. It keeps data private to the VPC and is designed specifically for sharing files between instances. S3 is object storage (not a shared file system), EBS volumes cannot be mounted to multiple instances simultaneously, and mounting S3 as a file system is not natively supported or suitable for this use case.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.