A company wants to create an Amazon EMR cluster that multiple teams will use. The company wants to ensure that each team’s big data workloads can access only the AWS services that each team needs to interact with. The company does not want the workloads to have access to Instance Metadata Service Version 2 (IMDSv2) on the cluster’s underlying EC2 instances.
Which solution will meet these requirements?
A. Configure interface VPC endpoints for each AWS service that the teams need. Use the required interface VPC endpoints to submit the big data workloads.
B. Create EMR runtime roles. Configure the cluster to use the runtime roles. Use the runtime roles to submit the big data workloads.
C. Create an EC2 IAM instance profile that has the required permissions for each team. Use the instance profile to submit the big data workloads.
D. Create an EMR security configuration that has the EnableApplicationScopedIAMRole option set to false. Use the security configuration to submit the big data workloads.
Show Answer
Correct Answer: B
Explanation: EMR runtime roles provide per-job IAM permissions so each team's workloads can access only the AWS services allowed by the assigned runtime role. Jobs submitted with runtime roles do not use the EC2 instance profile for AWS access and cannot access the EC2 Instance Metadata Service (including IMDSv2), satisfying both requirements.
Question 50
A global ecommerce company uses a monolithic architecture. The company needs a solution to manage the increasing volume of product data. The solution must be scalable and have a modular service architecture. The company needs to maintain its structured database schemas. The company also needs a storage solution to store product data and product images.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use an Amazon EC2 instance in an Auto Scaling group to deploy a containerized application. Use an Application Load Balancer to distribute web traffic. Use an Amazon RDS DB instance to store product data and product images.
B. Use AWS Lambda functions to manage the existing monolithic application. Use Amazon DynamoDB to store product data and product images. Use Amazon Simple Notification Service (Amazon SNS) for event-driven communication between the Lambda functions.
C. Use Amazon Elastic Kubernetes Service (Amazon EKS) with an Amazon EC2 deployment to deploy a containerized application. Use an Amazon Aurora cluster to store the product data. Use AWS Step Functions to manage workflows. Store the product images in Amazon S3 Glacier Deep Archive.
D. Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate to deploy a containerized application. Use Amazon RDS with a Multi-AZ deployment to store the product data. Store the product images in an Amazon S3 bucket.
Show Answer
Correct Answer: D
Explanation: Amazon ECS with AWS Fargate provides a scalable container platform with minimal operational overhead compared to managing EC2 instances or EKS. Amazon RDS preserves structured relational schemas, satisfying the requirement to maintain structured databases. Amazon S3 is the appropriate storage service for product images. Option A incorrectly stores images in RDS. Option B replaces the relational database with DynamoDB, which does not meet the structured schema requirement. Option C uses EKS, which has higher operational overhead than ECS with Fargate, and Glacier Deep Archive is unsuitable for frequently accessed product images.
Question 51
A global ecommerce company runs its critical workloads on AWS. The workloads use an Amazon RDS for PostgreSQL DB instance that is configured for a Multi-AZ deployment.
Customers have reported application timeouts when the company undergoes database failovers. The company needs a resilient solution to reduce failover time.
Which solution will meet these requirements?
A. Create an Amazon RDS Proxy. Assign the proxy to the DB instance.
B. Create a read replica for the DB instance. Move the read traffic to the read replica.
C. Enable Performance Insights. Monitor the CPU load to identify the timeouts.
D. Take regular automatic snapshots. Copy the automatic snapshots to multiple AWS Regions.
Show Answer
Correct Answer: A
Explanation: Amazon RDS Proxy maintains and pools database connections and automatically reconnects applications to the new primary during Multi-AZ failovers, reducing application interruption and failover impact. Read replicas are for read scaling and are not a solution for reducing Multi-AZ failover time. Performance Insights only provides monitoring, and snapshots are for backup and disaster recovery, not failover resilience.
Question 52
A company is developing machine learning (ML) models on AWS. The company is developing the ML models as independent microservices. The microservices fetch approximately 1 GB of model data from Amazon S3 at startup and load the data into memory. Users access the ML models through an asynchronous API. Users can send a request or a batch of requests.
The company provides the ML models to hundreds of users. The usage patterns for the models are irregular. Some models are not used for days or weeks. Other models receive batches of thousands of requests at a time.
Which solution will meet these requirements?
A. Direct the requests from the API to a Network Load Balancer (NLB). Deploy the ML models as AWS Lambda functions that the NLB will invoke. Use auto scaling to scale the Lambda functions based on the traffic that the NLB receives.
B. Direct the requests from the API to an Application Load Balancer (ALB). Deploy the ML models as Amazon Elastic Container Service (Amazon ECS) services that the ALB will invoke. Use auto scaling to scale the ECS cluster instances based on the traffic that the ALB receives.
C. Direct the requests from the API into an Amazon Simple Queue Service (Amazon SQS) queue. Deploy the ML models as AWS Lambda functions that SQS events will invoke. Use auto scaling to increase the number of vCPUs for the Lambda functions based on the size of the SQS queue.
D. Direct the requests from the API into an Amazon Simple Queue Service (Amazon SQS) queue. Deploy the ML models as Amazon Elastic Container Service (Amazon ECS) services that read from the queue. Use auto scaling for Amazon ECS to scale both the cluster capacity and number of the services based on the size of the SQS queue.
Show Answer
Correct Answer: D
Explanation: The workload is asynchronous and highly bursty, making Amazon SQS an appropriate buffer. Each model loads about 1 GB of data from Amazon S3 into memory at startup, which is a poor fit for AWS Lambda because frequent cold starts would repeatedly incur large model-loading overhead and Lambda has execution and runtime constraints. Amazon ECS services can keep model data resident in memory while running and can scale the number of tasks and cluster capacity based on SQS queue depth, providing an efficient pattern for irregular demand with large bursts.
Question 53
A company runs a Node js function on a server in its on-premises data center. The data center stores data in a PostgreSQL database. The company stores the credentials in a connection string in an environment variable on the server. The company wants to migrate its application to AWS and to replace the Node.js application server with AWS Lambda. The company also wants to migrate to Amazon RDS for PostgreSQL and to ensure that the database credentials are securely managed.
Which solution will meet these requirements with the LEAST operational overhead?
A. Store the database credentials as a parameter in AWS Systems Manager Parameter Store Configure Parameter Store to automatically rotate the secrets every 30 days. Update the Lambda function to retrieve the credentials from the parameter.
B. Store the database credentials as a secret in AWS Secrets Manager. Configure Secrets Manager to automatically rotate the credentials every 30 days. Update the Lambda function to retrieve the credentials from the secret.
C. Store the database credentials as an encrypted Lambda environment variable. Write a custom Lambda function to rotate the credentials. Schedule the Lambda function to run every 30 days.
D. Store the database credentials as a key in AWS Key Management Service (AWS KMS). Configure automatic rotation for the key. Update the Lambda function to retneve the credentials from the KMS key.
Show Answer
Correct Answer: B
Explanation: AWS Secrets Manager is the managed AWS service designed for storing and rotating database credentials. It integrates with Amazon RDS for PostgreSQL and supports automatic credential rotation with minimal operational overhead. Lambda can securely retrieve the secret at runtime. Systems Manager Parameter Store does not provide native automatic database credential rotation, KMS manages encryption keys rather than secrets, and implementing custom rotation with Lambda increases operational overhead.
Question 54
A company runs its production workload on an Amazon Aurora MySQL DB cluster that includes six Aurora Replicas. The company wants near-real-time reporting queries from one of its departments to be automatically distributed across three of the Aurora Replicas. Those three replicas have a different compute and memory specification from the rest of the DB cluster.
Which solution meets these requirements?
A. Create and use a custom endpoint for the workload
B. Create a three-node cluster clone and use the reader endpoint
C. Use any of the instance endpoints for the selected three nodes
D. Use the reader endpoint to automatically distribute the read-only workload
Show Answer
Correct Answer: A
Explanation: A custom endpoint allows you to define a specific subset of Aurora instances (such as three selected Aurora Replicas) and automatically load balance connections across only those instances. The standard reader endpoint distributes connections across all Aurora Replicas, instance endpoints do not provide automatic load balancing, and creating a cloned cluster is unnecessary for this requirement.
Question 55
A company has migrated several applications to AWS in the past 3 months. The company wants to know the breakdown of costs for each of these applications. The company wants to receive a regular report that includes this information.
Which solution will meet these requirements MOST cost-effectively?
A. Use AWS Budgets to download data for the past 3 months into a .csv file. Look up the desired information.
B. Load AWS Cost and Usage Reports into an Amazon RDS DB instance. Run SQL queries to get the desired information.
C. Tag all the AWS resources with a key for cost and a value of the application's name. Activate cost allocation tags. Use Cost Explorerto get the desired information.
D. Tag all the AWS resources with a key for cost and a value of the application's name. Use the AWS Billing and Cost Management console todownload bills for the past 3 months. Look up the desired information.
Show Answer
Correct Answer: C
Explanation: Cost allocation tags are the standard way to attribute AWS costs to applications. After tagging resources and activating the cost allocation tags, AWS Cost Explorer can break down costs by tag, covers the previous 13 months of cost data, and supports scheduled/reporting use cases more cost-effectively than building a custom reporting solution with RDS. AWS Budgets is not intended for detailed historical cost breakdowns, and downloading bills does not provide the same tag-based analysis.
Question 56
A company is building a cloud-based application on AWS that will handle sensitive customer data. The application uses Amazon RDS for the database, Amazon S3 for object storage, and S3 Event Notifications that invoke AWS Lambda for serverless processing.
The company uses AWS IAM Identity Center to manage user credentials. The development, testing, and operations teams need secure access to Amazon RDS and Amazon S3 while ensuring the confidentiality of sensitive customer data. The solution must comply with the principle of least privilege.
Which solution meets these requirements with the LEAST operational overhead?
A. Use IAM roles with least privilege to grant all the teams access. Assign IAM roles to each team with customized IAM policies defining specific permission for Amazon RDS and S3 object access based on team responsibilities.
B. Enable IAM Identity Center with an Identity Center directory. Create and configure permission sets with granular access to Amazon RDS and Amazon S3. Assign all the teams to groups that have specific access with the permission sets.
C. Create individual IAM users for each member in all the teams with role-based permissions. Assign the IAM roles with predefined policies for RDS and S3 access to each user based on user needs. Implement IAM Access Analyzer for periodic credential evaluation.
D. Use AWS Organizations to create separate accounts for each team. Implement cross-account IAM roles with least privilege. Grant specific permission for RDS and S3 access based on team roles and responsibilities.
Show Answer
Correct Answer: B
Explanation: Because the company already uses AWS IAM Identity Center, the lowest-overhead approach is to manage access centrally with Identity Center permission sets and group assignments. Permission sets implement least-privilege IAM permissions for Amazon RDS and Amazon S3, while group-based assignments simplify administration compared with managing individual IAM roles or users. Creating IAM users increases operational effort, and separate AWS accounts with cross-account roles are unnecessary for the stated requirements.
Question 57
A company is using an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The company must ensure that Kubernetes service accounts in the EKS cluster have secure and granular access to specific AWS resources by using IAM roles for service accounts (IRSA).
Which combination of solutions will meet these requirements? (Choose two.)
A. Create an IAM policy that defines the required permissions Attach the policy directly to the IAM role of the EKS nodes.
B. Implement network policies within the EKS cluster to prevent Kubernetes service accounts from accessing specific AWS services.
C. Modify the EKS cluster's IAM role to include permissions for each Kubernetes service account. Ensure a one-to-one mapping between IAM roles and Kubernetes roles.
D. Define an IAM role that includes the necessary permissions. Annotate the Kubernetes service accounts with the Amazon ResourceName (ARN) of the IAM role.
E. Set up a trust relationship between the IAM roles for the service accounts and an OpenID Connect (OIDC) identity provider.
Show Answer
Correct Answer: D, E
Explanation: IAM Roles for Service Accounts (IRSA) works by creating an IAM role with the required permissions, configuring a trust policy that allows the EKS cluster's OIDC identity provider to assume the role for a specific Kubernetes service account, and annotating that Kubernetes service account with the IAM role ARN. Attaching permissions to the node role grants overly broad access, network policies do not control AWS IAM authorization, and the EKS cluster IAM role is not used for per-service-account AWS permissions.
Question 58
A company needs to design a hybrid network architecture. The company's workloads are currently stored in the AWS Cloud and in on-premises data centers. The workloads require single-digit latencies to communicate. The company uses an AWS Transit Gateway transit gateway to connect multiple VPCs.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
A. Establish an AWS Site-to-Site VPN connection to each VPC.
B. Associate an AWS Direct Connect gateway with the transit gateway that is attached to the VPCs.
C. Establish an AWS Site-to-Site VPN connection to an AWS Direct Connect gateway.
D. Establish an AWS Direct Connect connection. Create a transit virtual interface (VIF) to a Direct Connect gateway.
E. Associate AWS Site-to-Site VPN connections with the transit gateway that is attached to the VPCs.
Show Answer
Correct Answer: B, D
Explanation: Single-digit latency between on-premises and AWS workloads is best achieved with AWS Direct Connect rather than VPN over the public internet. Create an AWS Direct Connect connection with a transit virtual interface (VIF) to a Direct Connect gateway, then associate the Direct Connect gateway with the AWS Transit Gateway. This provides private, low-latency connectivity from on-premises to all VPCs attached to the Transit Gateway in a scalable and cost-effective architecture.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.