A company needs to grant a team of developers access to the company's AWS resources. The company must maintain a high level of security for the resources.
The company requires an access control solution that will prevent unauthorized access to the sensitive data.
Which solution will meet these requirements?
A. Share the IAM user credentials for each development team member with the rest of the team to simplify access management and to streamline development workflows.
B. Define IAM roles that have fine-grained permissions based on the principle of least privilege. Assign an IAM role to each developer.
C. Create IAM access keys to grant programmatic access to AWS resources. Allow only developers to interact with AWS resources through API calls by using the access keys.
D. Create an AWS Cognito user pool. Grant developers access to AWS resources by using the user pool.
Show Answer
Correct Answer: B
Explanation: The requirement is to grant developers access to AWS resources with a high level of security and prevent unauthorized access. IAM roles with fine-grained permissions follow the principle of least privilege and provide temporary credentials instead of long‑lived static credentials. This is an AWS best practice for secure access. Sharing credentials (A) is insecure, access keys for users (C) rely on long‑term credentials and increase risk, and AWS Cognito (D) is intended for application end users, not for managing developer access to AWS accounts.
Question 62
A company is implementing a new application on AWS. The company will run the application on multiple Amazon EC2 instances across multiple Availability Zones within multiple AWS Regions. The application will be available through the internet. Users will access the application from around the world.
The company wants to ensure that each user who accesses the application is sent to the EC2 instances that are closest to the user’s location.
Which solution will meet these requirements?
A. Implement an Amazon Route 53 geolocation routing policy. Use an internet-facing Application Load Balancer to distribute the traffic across all Availability Zones within the same Region.
B. Implement an Amazon Route 53 geoproximity routing policy. Use an internet-facing Network Load Balancer to distribute the traffic across all Availability Zones within the same Region.
C. Implement an Amazon Route 53 multivalue answer routing policy. Use an internet-facing Application Load Balancer to distribute the traffic across all Availability Zones within the same Region.
D. Implement an Amazon Route 53 weighted routing policy. Use an internet-facing Network Load Balancer to distribute the traffic across all Availability Zones within the same Region.
Show Answer
Correct Answer: B
Explanation: The requirement is to route each user to the EC2 instances that are closest to the user’s location across multiple AWS Regions. Amazon Route 53 geoproximity routing is designed specifically to route traffic based on the geographic location of users relative to AWS resources, selecting the closest endpoint (with optional bias). Geolocation routing only matches users to predefined geographic regions and does not guarantee the closest Region. Multivalue and weighted routing do not consider user location. Therefore, geoproximity routing meets the requirement best, making option B correct.
Question 63
A company is migrating its on-premises Oracle database to an Amazon RDS for Oracle database. The company needs to retain data for 90 days to meet regulatory requirements. The company must also be able to restore the database to a specific point in time for up to 14 days.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create Amazon RDS automated backups. Set the retention period to 90 days.
B. Create an Amazon RDS manual snapshot every day. Delete manual snapshots that are older than 90 days.
C. Use the Amazon Aurora Clone feature for Oracle to create a point-in-time restore. Delete clones that are older than 90 days.
D. Create a backup plan that has a retention period of 90 days by using AWS Backup for Amazon RDS.
Show Answer
Correct Answer: D
Explanation: Amazon RDS automated backups support point-in-time recovery but only up to a maximum of 35 days, so they cannot meet the 90-day retention requirement. Daily manual snapshots could be retained for 90 days, but they increase operational overhead due to manual scheduling and cleanup. Aurora Clone is not applicable to Amazon RDS for Oracle. AWS Backup for Amazon RDS can centrally manage backups with a 90-day retention policy while still enabling point-in-time recovery within the required 14-day window, meeting both requirements with the least operational overhead.
Question 64
A consumer survey company has gathered data for several years from a specific geographic region. The company stores this data in an Amazon S3 bucket in an AWS Region.
The company has started to share this data with a marketing firm in a new geographic region. The company has granted the firm's AWS account access to the S3 bucket. The company wants to minimize the data transfer costs when the marketing firm requests data from the S3 bucket.
Which solution will meet these requirements?
A. Configure the Requester Pays feature on the company’s S3 bucket.
B. Configure S3 Cross-Region Replication (CRR) from the company’s S3 bucket to one of the marketing firm’s S3 buckets.
C. Configure AWS Resource Access Manager to share the S3 bucket with the marketing firm AWS account.
D. Configure the company’s S3 bucket to use S3 Intelligent-Tiering Sync the S3 bucket to one of the marketing firm’s S3 buckets.
Show Answer
Correct Answer: A
Explanation: The requirement is to minimize the data transfer costs for the company when the marketing firm requests data from the S3 bucket. Enabling S3 Requester Pays shifts the cost of data requests and data transfer out of the bucket to the requester (the marketing firm), directly minimizing the company’s data transfer costs. Cross-Region Replication would add replication and storage costs for the company, and the other options do not reduce or shift data transfer charges.
Question 65
A company has a web application that has thousands of users. The application uses 8-10 user-uploaded images to generate AI images. Users can download the generated AI images once every 6 hours. The company also has a premium user option that gives users the ability to download the generated AI images anytime.
The company uses the user-uploaded images to run AI model training twice a year. The company needs a storage solution to store the images.
Which storage solution meets these requirements MOST cost-effectively?
A. Move uploaded images to Amazon S3 Glacier Deep Archive. Move premium user-generated AI images to S3 Standard. Move non-premium user-generated AI images to S3 Standard-Infrequent Access (S3 Standard-IA).
B. Move uploaded images to Amazon S3 Glacier Deep Archive Move all generated AI images to S3 Glacier Flexible Retrieval.
C. Move uploaded images to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA). Move premium user-generated AI images to S3 Standard. Move non-premium user-generated AI images to S3 Standard-Infrequent Access (S3 Standard-IA).
D. Move uploaded images to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA). Move all generated AI images to S3 Glacier Flexible Retrieval.
Show Answer
Correct Answer: A
Explanation: User-uploaded images are accessed only twice a year for AI model training, making Amazon S3 Glacier Deep Archive the most cost-effective choice despite long retrieval times. Premium users require immediate, frequent access to generated AI images, so S3 Standard is appropriate. Non‑premium users have limited download frequency (every 6 hours), which aligns well with S3 Standard‑IA’s lower storage cost and immediate access with higher retrieval fees. Other options either introduce unacceptable retrieval delays for users or higher ongoing storage costs.
Question 66
An ecommerce company is preparing to deploy a web application on AWS to ensure continuous service for customers. The architecture includes a web application that the company hosts on Amazon EC2 instances, a relational database in Amazon RDS, and static assets that the company stores in Amazon S3.
The company wants to design a robust and resilient architecture for the application.
Which solution will meet these requirements?
A. Deploy Amazon EC2 instances in a single Availability Zone. Deploy an RDS DB instance in the same Availability Zone. Use Amazon S3 with versioning enabled to store static assets.
B. Deploy Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones. Deploy a Multi-AZ RDS DB instance. Use Amazon CloudFront to distribute static assets.
C. Deploy Amazon EC2 instances in a single Availability Zone. Deploy an RDS DB instance in a second Availability Zone for cross-AZ redundancy. Serve static assets directly from the EC2 instances.
D. Use AWS Lambda functions to serve the web application. Use Amazon Aurora Serverless v2 for the database. Store static assets in Amazon Elastic File System (Amazon EFS) One Zone-Infrequent Access (One Zone-IA).
Show Answer
Correct Answer: B
Explanation: A robust and resilient AWS architecture requires high availability and fault tolerance across Availability Zones. Option B deploys EC2 instances in an Auto Scaling group across multiple AZs, ensuring the web tier remains available during AZ failures. A Multi-AZ RDS deployment provides automatic failover for the database. Using CloudFront to distribute static assets improves availability, performance, and resilience by leveraging edge locations and S3 as an origin. The other options rely on single-AZ components or less appropriate services, creating single points of failure.
Question 67
A company uses AWS to host its public ecommerce website. The website uses an AWS Global Accelerator accelerator for traffic from the internet. The Global Accelerator accelerator forwards the traffic to an Application Load Balancer (ALB) that is the entry point for an Auto Scaling group.
The company recently identified a DDoS attack on the website. The company needs a solution to mitigate future attacks.
Which solution will meet these requirements with the LEAST implementation effort?
A. Configure an AWS WAF web ACL for the Global Accelerator accelerator to block traffic by using rate-based rules
B. Configure an AWS Lambda function to read the ALB metrics to block attacks by updating a VPC network ACL
C. Configure an AWS WAF web ACL on the ALB to block traffic by using rate-based rules
D. Configure an Amazon CloudFront distribution in front of the Global Accelerator accelerator
Show Answer
Correct Answer: C
Explanation: AWS WAF can be directly associated with an Application Load Balancer and supports rate-based rules to mitigate Layer 7 DDoS attacks with minimal setup. AWS Global Accelerator does not directly support attaching a WAF web ACL, so option A is not valid. The Lambda/NACL approach is complex and indirect, and adding CloudFront in front of Global Accelerator is unnecessary and higher effort. Therefore, attaching AWS WAF to the ALB is the least-effort and correct solution.
Question 68
A company has multiple Amazon RDS DB instances that run in a development AWS account. All the instances have tags to identify them as development resources. The company needs the development DB instances to run on a schedule only during business hours.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an Amazon CloudWatch alarm to identify RDS instances that need to be stopped. Create an AWS Lambda function to start and stop the RDS instances.
B. Create an AWS Trusted Advisor report to identify RDS instances to be started and stopped. Create an AWS Lambda function to start and stop the RDS instances.
C. Create AWS Systems Manager State Manager associations to start and stop the RDS instances.
D. Create an Amazon EventBridge rule that invokes AWS Lambda functions to start and stop the RDS instances.
Show Answer
Correct Answer: C
Explanation: AWS Systems Manager State Manager provides managed automation documents (runbooks) to start and stop Amazon RDS instances on a defined schedule. This avoids building and maintaining custom Lambda functions and EventBridge rules, resulting in the least operational overhead. Options A and B are not designed for scheduling, and D requires additional components and ongoing maintenance compared to State Manager.
Question 69
A company is using AWS DataSync to migrate millions of files from an on-premises system to AWS. The files are 10 KB in size on average.
The company wants to use Amazon S3 for file storage. For the first year after the migration, the files will be accessed once or twice and must be immediately available. After 1 year, the files must be archived for at least 7 years.
Which solution will meet these requirements MOST cost-effectively?
A. Use an archive tool to group the files into large objects. Use DataSync to migrate the objects. Store the objects in S3 Glacier Instant Retrieval for the first year. Use a lifecycle configuration to transition the files to S3 Glacier Deep Archive after 1 year with a retention period of 7 years.
B. Use an archive tool to group the files into large objects. Use DataSync to copy the objects to S3 Standard-Infrequent Access (S3 Standard-IA). Use a lifecycle configuration to transition the files to S3 Glacier Instant Retrieval after 1 year with a retention period of 7 years.
C. Configure the destination storage class for the files as S3 Glacier Instant Retrieval. Use a lifecycle policy to transition the files to S3 Glacier Flexible Retrieval after 1 year with a retention period of 7 years.
D. Configure a DataSync task to transfer the files to S3 Standard-Infrequent Access (S3 Standard-IA). Use a lifecycle configuration to transition the files to S3 Deep Archive after 1 year with a retention period of 7 years.
Show Answer
Correct Answer: A
Explanation: Millions of 10‑KB files incur significant per‑object minimum storage and request costs in S3. Grouping small files into larger objects greatly reduces these costs. For the first year, S3 Glacier Instant Retrieval provides millisecond access at lower storage cost than S3 Standard‑IA for data accessed only once or twice. After one year, transitioning the aggregated objects to S3 Glacier Deep Archive is the lowest‑cost option for long‑term (7+ years) retention. This combination minimizes both storage and transition costs while meeting immediate availability and archival requirements.
Question 70
A company regularly uploads confidential data to Amazon S3 buckets for analysis.
The company's security policies mandate that the objects must be encrypted at rest. The company must automatically rotate the encryption key every year. The company must be able to track key rotation by using AWS CloudTrail. The company also must minimize costs for the encryption key.
Which solution will meet these requirements?
A. Use server-side encryption with customer-provided keys (SSE-C)
B. Use server-side encryption with Amazon S3 managed keys (SSE-S3)
C. Use server-side encryption with AWS KMS keys (SSE-KMS)
D. Use server-side encryption with customer managed AWS KMS keys
Show Answer
Correct Answer: C
Explanation: The requirements are: encryption at rest, automatic annual key rotation, ability to track rotation in CloudTrail, and minimal cost.
SSE-S3 does not provide CloudTrail visibility into key usage or rotation. SSE-C requires the customer to manage and rotate keys manually and does not integrate with CloudTrail for rotation events.
SSE-KMS with AWS-managed KMS keys meets all requirements: AWS automatically rotates AWS-managed KMS keys every year, rotation and key usage are logged in CloudTrail, and there is no monthly key fee (only standard KMS request charges, often absorbed by S3).
Customer-managed KMS keys would also work functionally, but they incur an additional monthly cost per key, which violates the requirement to minimize cost. Therefore, option C is the best choice.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.