A media company has a multi-account AWS environment in the us-east-1 Region. The company has an Amazon Simple Notification Service (Amazon SNS) topic in a production account that publishes performance metrics. The company has an AWS Lambda function in an administrator account to process and analyze log data.
The Lambda function that is in the administrator account must be invoked by messages from the SNS topic that is in the production account when significant metrics are reported.
Which combination of steps will meet these requirements? (Choose two.)
A. Create an IAM resource policy for the Lambda function that allows Amazon SNS to invoke the function.
B. Implement an Amazon Simple Queue Service (Amazon SQS) queue in the administrator account to buffer messages from the SNS topic that is in the production account. Configure the SQS queue to invoke the Lambda function.
C. Create an IAM policy for the SNS topic that allows the Lambda function to subscribe to the topic.
D. Use an Amazon EventBridge rule in the production account to capture the SNS topic notifications. Configure the EventBridge rule to forward notifications to the Lambda function that is in the administrator account.
E. Store performance metrics in an Amazon S3 bucket in the production account. Use Amazon Athena to analyze the metrics from the administrator account.
Show Answer
Correct Answer: A, C
Explanation: To enable cross-account invocation of a Lambda function by an SNS topic, two permissions are required. First, the Lambda function must have a resource-based policy that allows the Amazon SNS service (from the production account) to invoke it (A). Second, the SNS topic must have an access policy that allows the Lambda function in the administrator account to subscribe to the topic (C). Together, these steps establish the necessary cross-account subscription and invocation permissions without adding unnecessary services.
Question 72
A company is migrating from a monolithic architecture for a web application that is hosted on Amazon EC2 to a serverless microservices architecture. The company wants to use AWS services that support an event-driven, loosely coupled architecture. The company wants to use the publish/subscribe (pub/sub) pattern.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an Amazon API Gateway REST API to invoke an AWS Lambda function that publishes events to an Amazon Simple Queue Service (Amazon SQS) queue. Configure one or more subscribers to read events from the SQS queue.
B. Configure an Amazon API Gateway REST API to invoke an AWS Lambda function that publishes events to an Amazon Simple Notification Service (Amazon SNS) topic. Configure one or more subscribers to receive events from the SNS topic.
C. Configure an Amazon API Gateway WebSocket API to write to a data stream in Amazon Kinesis Data Streams with enhanced fan-out. Configure one or more subscribers to receive events from the data stream.
D. Configure an Amazon API Gateway HTTP API to invoke an AWS Lambda function that publishes events to an Amazon Simple Notification Service (Amazon SNS) topic. Configure one or more subscribers to receive events from the topic.
Show Answer
Correct Answer: D
Explanation: The requirement is an event-driven, loosely coupled pub/sub architecture at the lowest cost. Amazon SNS is the correct service for pub/sub messaging, eliminating SQS-based point-to-point semantics. Between the remaining options, Amazon API Gateway HTTP APIs are significantly cheaper than REST APIs while still supporting Lambda integration. Therefore, using an API Gateway HTTP API to invoke Lambda, which publishes events to an SNS topic, is the most cost-effective solution that meets all requirements.
Question 73
A company recently performed a lift and shift migration of its on-premises Oracle database workload to run on an Amazon EC2 memory optimized Linux instance. The EC2 Linux instance uses a 1 TB Provisioned IOPS SSD (io1) EBS volume with 64,000 IOPS.
The database storage performance after the migration is slower than the performance of the on-premises database.
Which solution will improve storage performance?
A. Add more Provisioned IOPS SSD (io1) EBS volumes. Use OS commands to create a Logical Volume Management (LVM) stripe.
B. Increase the Provisioned IOPS SSD (io1) EBS volume to more than 64,000 IOPS.
C. Increase the size of the Provisioned IOPS SSD (io1) EBS volume to 2 TB.
D. Change the EC2 Linux instance to a storage optimized instance type. Do not change the Provisioned IOPS SSD (io1) EBS volume.
Show Answer
Correct Answer: A
Explanation: A single io1 EBS volume is capped at 64,000 provisioned IOPS per volume when attached to an EC2 instance. Increasing size or attempting to provision more IOPS on the same volume will not exceed this limit. By attaching multiple io1 volumes and striping them together with LVM, I/O is distributed across volumes, allowing aggregate IOPS and throughput to scale beyond the single-volume limit. This directly improves database storage performance after lift-and-shift.
Question 74
A company that is in the ap-northeast-1 Region has a fleet of thousands of AWS Outposts servers. The company has deployed the servers at remote locations around the world. All the servers regularly download new software versions that consist of 100 files. There is significant latency before all servers run the new software versions.
The company must reduce the deployment latency for new software versions.
Which solution will meet this requirement with the LEAST operational overhead?
A. Create an Amazon S3 bucket in ap-northeast-1. Set up an Amazon CloudFront distribution in ap-northeast-1 that includes a CachingDisabled cache policy. Configure the S3 bucket as the origin. Download the software by using signed URLs.
B. Create an Amazon S3 bucket in ap-northeast-1. Create a second S3 bucket in the us-east-1 Region. Configure replication between the buckets. Set up an Amazon CloudFront distribution that uses ap-northeast-1 as the primary origin and us-east-1 as the secondary origin. Download the software by using signed URLs.
C. Create an Amazon S3 bucket in ap-northeast-1. Configure Amazon S3 Transfer Acceleration. Download the software by using the S3 Transfer Acceleration endpoint.
D. Create an Amazon S3 bucket in ap-northeast-1. Set up an Amazon CloudFront distribution. Configure the S3 bucket as the origin. Download the software by using signed URLs.
Show Answer
Correct Answer: D
Explanation: The goal is to reduce global download latency for thousands of servers with the least operational overhead. Amazon CloudFront caches content at edge locations worldwide, so Outposts servers download software from the nearest edge instead of the distant ap-northeast-1 Region. This directly addresses latency at scale with minimal setup (one S3 bucket and one CloudFront distribution). S3 Transfer Acceleration (C) optimizes network paths but does not provide caching, so every server still fetches each file from the origin, which is less effective for repeated global distribution. Options A and B add unnecessary configuration or complexity, and disabling caching in A contradicts the latency-reduction goal.
Question 76
A company recently migrated a monolithic application to an Amazon EC2 instance and Amazon RDS. The application has tightly coupled modules. The existing design of the application gives the application the ability to run on only a single EC2 instance.
The company has noticed high CPU utilization on the EC2 instance during peak usage times. The high CPU utilization corresponds to degraded performance on Amazon RDS for read requests. The company wants to reduce the high CPU utilization and improve read request performance.
Which solution will meet these requirements?
A. Resize the EC2 instance to an EC2 instance type that has more CPU capacity. Configure an Auto Scaling group with a minimum and maximum size of 1. Configure an RDS read replica for read requests.
B. Resize the EC2 instance to an EC2 instance type that has more CPU capacity. Configure an Auto Scaling group with a minimum and maximum size of 1. Add an RDS read replica and redirect all read/write traffic to the replica.
C. Configure an Auto Scaling group with a minimum size of 1 and maximum size of 2. Resize the RDS DB instance to an instance type that has more CPU capacity.
D. Resize the EC2 instance to an EC2 instance type that has more CPU capacity. Configure an Auto Scaling group with a minimum and maximum size of 1. Resize the RDS DB instance to an instance type that has more CPU capacity.
Show Answer
Correct Answer: A
Explanation: The application can run on only a single EC2 instance, so horizontal scaling is not possible. Resizing the EC2 instance adds CPU capacity to reduce high utilization. The degraded database read performance should be improved by offloading read traffic to an Amazon RDS read replica, which is designed for read-only workloads. An Auto Scaling group with min=max=1 does not scale out, but provides instance management benefits without violating the single-instance constraint. Other options are incorrect because read replicas cannot accept writes, or they do not directly address read scaling.
Question 77
A company is migrating an application from an on-premises location to Amazon Elastic Kubernetes Service (Amazon EKS). The company must use a custom subnet for pods that are in the company's VPC to comply with requirements. The company also needs to ensure that the pods can communicate securely within the pods' VPC.
Which solution will meet these requirements?
A. Configure AWS Transit Gateway to directly manage custom subnet configurations for the pods in Amazon EKS.
B. Create an AWS Direct Connect connection from the company's on-premises IP address ranges to the EKS pods.
C. Use the Amazon VPC CNI plugin for Kubernetes. Define custom subnets in the VPC cluster for the pods to use.
D. Implement a Kubernetes network policy that has pod anti-affinity rules to restrict pod placement to specific nodes that are within custom subnets.
Show Answer
Correct Answer: C
Explanation: The Amazon VPC CNI plugin for Kubernetes assigns VPC IP addresses to pods directly from specified VPC subnets. This allows the company to use custom subnets for pods, ensures pods are first-class VPC resources, and enables secure, native communication within the VPC. The other options do not provide pod-level subnet assignment or secure intra-VPC pod networking.
Question 78
A company has an employee web portal. Employees log in to the portal to view payroll details. The company is developing a new system to give employees the ability to upload scanned documents for reimbursement. The company runs a program to extract text-based data from the documents and attach the extracted information to each employee’s reimbursement IDs for processing.
The employee web portal requires 100% uptime. The document extract program runs infrequently throughout the day on an on-demand basis. The company wants to build a scalable and cost-effective new system that will require minimal changes to the existing web portal. The company does not want to make any code changes.
Which solution will meet these requirements with the LEAST implementation effort?
A. Run Amazon EC2 On-Demand Instances in an Auto Scaling group for the web portal. Use an AWS Lambda function to run the document extract program. Invoke the Lambda function when an employee uploads a new reimbursement document.
B. Run Amazon EC2 Spot Instances in an Auto Scaling group for the web portal. Run the document extract program on EC2 Spot Instances. Start document extract program instances when an employee uploads a new reimbursement document.
C. Purchase a Savings Plan to run the web portal and the document extract program. Run the web portal and the document extract program in an Auto Scaling group.
D. Create an Amazon S3 bucket to host the web portal. Use Amazon API Gateway and an AWS Lambda function for the existing functionalities. Use the Lambda function to run the document extract program. Invoke the Lambda function when the API that is associated with a new document upload is called.
Show Answer
Correct Answer: A
Explanation: The key requirements are 100% uptime for the existing web portal, on-demand/infrequent document processing, scalability, cost effectiveness, and least implementation effort with no code changes. Using EC2 On-Demand Instances in an Auto Scaling group meets the uptime requirement for the portal. Running the document extraction as an AWS Lambda function is ideal for infrequent, event-driven workloads and avoids paying for idle capacity. Triggering Lambda on document upload can be done via existing upload events or storage notifications without changing portal code. Spot Instances cannot guarantee uptime (B). Savings Plans alone do not change architecture and still require always-on EC2 for infrequent jobs (C). Rehosting the portal on S3/API Gateway/Lambda requires major re-architecture and code changes (D).
Question 79
A company is building an application in the AWS Cloud. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 for the DNS.
The company needs a managed solution with proactive engagement to detect against DDoS attacks.
Which solution will meet these requirements?
A. Enable AWS Config. Configure an AWS Config managed rule that detects DDoS attacks.
B. Enable AWS WAF on the ALCreate an AWS WAF web ACL with rules to detect and prevent DDoS attacks. Associate the web ACL with the AL
C. Store the ALB access logs in an Amazon S3 bucket. Configure Amazon GuardDuty to detect and take automated preventative actions for DDoS attacks.
D. Subscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources.
Show Answer
Correct Answer: D
Explanation: The requirement is a managed solution with proactive engagement to detect and mitigate DDoS attacks for ALB and Route 53. AWS Shield Advanced provides advanced DDoS protection, proactive monitoring, automatic mitigations, 24/7 access to the AWS DDoS Response Team (DRT), and integration with Route 53 and ALB as protected resources. Other options either do not provide DDoS protection, are reactive, or lack proactive engagement.
Question 80
A company needs to implement a new data retention policy for regulatory compliance. As part of this policy, sensitive documents that are stored in an Amazon S3 bucket must be protected from deletion or modification for a fixed period of time.
Which solution will meet these requirements?
A. Activate S3 Object Lock on the required objects and enable governance mode.
B. Activate S3 Object Lock on the required objects and enable compliance mode.
C. Enable versioning on the S3 bucket. Set a lifecycle policy to delete the objects after a specified period.
D. Configure an S3 Lifecycle policy to transition objects to S3 Glacier Flexible Retrieval for the retention duration.
Show Answer
Correct Answer: B
Explanation: S3 Object Lock is specifically designed to prevent deletion or modification of objects for a defined retention period. Compliance mode enforces the strongest protection: once the retention period is set, no user (including the root user) can delete or alter the objects until the period expires, which satisfies strict regulatory requirements. Governance mode can be overridden by privileged users, versioning and lifecycle policies do not prevent premature deletion, and Glacier transitions address storage class, not immutability.
Question 81
A company needs to design a resilient web application to process customer orders. The web application must automatically handle increases in web traffic and application usage without affecting the customer experience or losing customer orders.
Which solution will meet these requirements?
A. Use a NAT gateway to manage web traffic. Use Amazon EC2 Auto Scaling groups to receive, process, and store processed customer orders. Use an AWS Lambda function to capture and store unprocessed orders.
B. Use a Network Load Balancer (NLB) to manage web traffic. Use an Application Load Balancer to receive customer orders from the NLUse Amazon Redshift with a Multi-AZ deployment to store unprocessed and processed customer orders.
C. Use a Gateway Load Balancer (GWLB) to manage web traffic. Use Amazon Elastic Container Service (Amazon ECS) to receive and process customer orders. Use the GWLB to capture and store unprocessed orders. Use Amazon DynamoDB to store processed customer orders.
D. Use an Application Load Balancer to manage web traffic. Use Amazon EC2 Auto Scaling groups to receive and process customer orders. Use Amazon Simple Queue Service (Amazon SQS) to store unprocessed orders. Use Amazon RDS with a Multi-AZ deployment to store processed customer orders.
Show Answer
Correct Answer: D
Explanation: The application must scale automatically, remain resilient, and avoid losing orders during traffic spikes. An Application Load Balancer distributes HTTP/HTTPS traffic and works natively with EC2 Auto Scaling groups to scale the web and application tier. Amazon SQS decouples order intake from processing, buffering unprocessed orders so none are lost during spikes or failures. Amazon RDS with a Multi-AZ deployment provides highly available, durable storage for processed orders. The other options misuse services (NAT, GWLB), add unnecessary complexity, or use unsuitable data stores for transactional order processing.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.