A company is using AWS DataSync to migrate millions of files from an on-premises system to AWS. The files are 10 KB in size on average.
The company wants to use Amazon S3 for file storage. For the first year after the migration, the files will be accessed once or twice and must be immediately available. After 1 year, the files must be archived for at least 7 years.
Which solution will meet these requirements MOST cost-effectively?
A. Use an archive tool to group the files into large objects. Use DataSync to migrate the objects. Store the objects in S3 Glacier Instant Retrieval for the first year. Use a lifecycle configuration to transition the files to S3 Glacier Deep Archive after 1 year with a retention period of 7 years.
B. Use an archive tool to group the files into large objects. Use DataSync to copy the objects to S3 Standard-Infrequent Access (S3 Standard-IA). Use a lifecycle configuration to transition the files to S3 Glacier Instant Retrieval after 1 year with a retention period of 7 years.
C. Configure the destination storage class for the files as S3 Glacier Instant Retrieval. Use a lifecycle policy to transition the files to S3 Glacier Flexible Retrieval after 1 year with a retention period of 7 years.
D. Configure a DataSync task to transfer the files to S3 Standard-Infrequent Access (S3 Standard-IA). Use a lifecycle configuration to transition the files to S3 Deep Archive after 1 year with a retention period of 7 years.
Show Answer
Correct Answer: A
Explanation: The key cost factor is the very large number of very small (10 KB) files. Aggregating them into larger archive objects avoids per-object overhead and minimum billable object size effects across lifecycle transitions. During the first year, Glacier Instant Retrieval provides millisecond access and is designed for rarely accessed archived data. After one year, transitioning to Glacier Deep Archive with a retention period satisfies the long-term archival requirement at the lowest storage cost. Options C and D keep millions of tiny objects, and B archives to Glacier Instant Retrieval only after paying for Standard-IA during the first year, making it less cost-effective than starting in Glacier Instant Retrieval.
Question 70
A company regularly uploads confidential data to Amazon S3 buckets for analysis.
The company's security policies mandate that the objects must be encrypted at rest. The company must automatically rotate the encryption key every year. The company must be able to track key rotation by using AWS CloudTrail. The company also must minimize costs for the encryption key.
Which solution will meet these requirements?
A. Use server-side encryption with customer-provided keys (SSE-C)
B. Use server-side encryption with Amazon S3 managed keys (SSE-S3)
C. Use server-side encryption with AWS KMS keys (SSE-KMS)
D. Use server-side encryption with customer managed AWS KMS keys
Show Answer
Correct Answer: C
Explanation: SSE-KMS using an AWS managed KMS key satisfies encryption at rest, provides automatic annual key rotation by AWS, and KMS management events are logged in AWS CloudTrail. Compared with customer managed KMS keys, AWS managed KMS keys avoid the monthly key charge, better satisfying the cost minimization requirement.
Question 71
A media company has a multi-account AWS environment in the us-east-1 Region. The company has an Amazon Simple Notification Service (Amazon SNS) topic in a production account that publishes performance metrics. The company has an AWS Lambda function in an administrator account to process and analyze log data.
The Lambda function that is in the administrator account must be invoked by messages from the SNS topic that is in the production account when significant metrics are reported.
Which combination of steps will meet these requirements? (Choose two.)
A. Create an IAM resource policy for the Lambda function that allows Amazon SNS to invoke the function.
B. Implement an Amazon Simple Queue Service (Amazon SQS) queue in the administrator account to buffer messages from the SNS topic that is in the production account. Configure the SQS queue to invoke the Lambda function.
C. Create an IAM policy for the SNS topic that allows the Lambda function to subscribe to the topic.
D. Use an Amazon EventBridge rule in the production account to capture the SNS topic notifications. Configure the EventBridge rule to forward notifications to the Lambda function that is in the administrator account.
E. Store performance metrics in an Amazon S3 bucket in the production account. Use Amazon Athena to analyze the metrics from the administrator account.
Show Answer
Correct Answer: A, C
Explanation: For a cross-account Amazon SNS to AWS Lambda integration, two permissions are required: the Lambda function must have a resource-based policy allowing the SNS service/topic to invoke it, and the SNS topic must allow the cross-account subscription to the Lambda endpoint. An SQS queue is optional and not required by the stated requirements. EventBridge is unnecessary because SNS can invoke Lambda directly across accounts. S3/Athena does not address the invocation requirement.
Question 72
A company is migrating from a monolithic architecture for a web application that is hosted on Amazon EC2 to a serverless microservices architecture. The company wants to use AWS services that support an event-driven, loosely coupled architecture. The company wants to use the publish/subscribe (pub/sub) pattern.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an Amazon API Gateway REST API to invoke an AWS Lambda function that publishes events to an Amazon Simple Queue Service (Amazon SQS) queue. Configure one or more subscribers to read events from the SQS queue.
B. Configure an Amazon API Gateway REST API to invoke an AWS Lambda function that publishes events to an Amazon Simple Notification Service (Amazon SNS) topic. Configure one or more subscribers to receive events from the SNS topic.
C. Configure an Amazon API Gateway WebSocket API to write to a data stream in Amazon Kinesis Data Streams with enhanced fan-out. Configure one or more subscribers to receive events from the data stream.
D. Configure an Amazon API Gateway HTTP API to invoke an AWS Lambda function that publishes events to an Amazon Simple Notification Service (Amazon SNS) topic. Configure one or more subscribers to receive events from the topic.
Show Answer
Correct Answer: D
Explanation: The publish/subscribe pattern is implemented by Amazon SNS, not SQS. Kinesis Data Streams is intended for streaming workloads and enhanced fan-out adds cost, so it is not the most cost-effective choice for a general pub/sub architecture. Between the SNS options, API Gateway HTTP APIs provide the required Lambda integration at a lower cost than API Gateway REST APIs when advanced REST API features are not required. Therefore, an HTTP API invoking Lambda, which publishes to an SNS topic with one or more subscribers, best meets the requirements at the lowest cost.
Question 73
A company recently performed a lift and shift migration of its on-premises Oracle database workload to run on an Amazon EC2 memory optimized Linux instance. The EC2 Linux instance uses a 1 TB Provisioned IOPS SSD (io1) EBS volume with 64,000 IOPS.
The database storage performance after the migration is slower than the performance of the on-premises database.
Which solution will improve storage performance?
A. Add more Provisioned IOPS SSD (io1) EBS volumes. Use OS commands to create a Logical Volume Management (LVM) stripe.
B. Increase the Provisioned IOPS SSD (io1) EBS volume to more than 64,000 IOPS.
C. Increase the size of the Provisioned IOPS SSD (io1) EBS volume to 2 TB.
D. Change the EC2 Linux instance to a storage optimized instance type. Do not change the Provisioned IOPS SSD (io1) EBS volume.
Show Answer
Correct Answer: A
Explanation: A single io1 EBS volume is already at its maximum provisioned IOPS of 64,000, so increasing IOPS beyond that is not supported. Increasing the volume size does not raise the provisioned IOPS limit, and switching to a storage-optimized instance does not improve EBS volume performance for this scenario. Striping multiple identical io1 EBS volumes with LVM aggregates IOPS and throughput, which is the standard approach when a single EBS volume cannot meet performance requirements.
Question 74
A company that is in the ap-northeast-1 Region has a fleet of thousands of AWS Outposts servers. The company has deployed the servers at remote locations around the world. All the servers regularly download new software versions that consist of 100 files. There is significant latency before all servers run the new software versions.
The company must reduce the deployment latency for new software versions.
Which solution will meet this requirement with the LEAST operational overhead?
A. Create an Amazon S3 bucket in ap-northeast-1. Set up an Amazon CloudFront distribution in ap-northeast-1 that includes a CachingDisabled cache policy. Configure the S3 bucket as the origin. Download the software by using signed URLs.
B. Create an Amazon S3 bucket in ap-northeast-1. Create a second S3 bucket in the us-east-1 Region. Configure replication between the buckets. Set up an Amazon CloudFront distribution that uses ap-northeast-1 as the primary origin and us-east-1 as the secondary origin. Download the software by using signed URLs.
C. Create an Amazon S3 bucket in ap-northeast-1. Configure Amazon S3 Transfer Acceleration. Download the software by using the S3 Transfer Acceleration endpoint.
D. Create an Amazon S3 bucket in ap-northeast-1. Set up an Amazon CloudFront distribution. Configure the S3 bucket as the origin. Download the software by using signed URLs.
Show Answer
Correct Answer: D
Explanation: CloudFront caches the software at edge locations close to the globally distributed AWS Outposts servers, reducing repeated download latency for the 100 software files with minimal ongoing operational effort. Option A disables caching, defeating the primary benefit. Option B adds unnecessary complexity with cross-Region replication and failover origins. Option C (S3 Transfer Acceleration) optimizes network paths to a single S3 bucket but does not provide persistent edge caching for repeated global distribution of the software package.
Question 76
A company recently migrated a monolithic application to an Amazon EC2 instance and Amazon RDS. The application has tightly coupled modules. The existing design of the application gives the application the ability to run on only a single EC2 instance.
The company has noticed high CPU utilization on the EC2 instance during peak usage times. The high CPU utilization corresponds to degraded performance on Amazon RDS for read requests. The company wants to reduce the high CPU utilization and improve read request performance.
Which solution will meet these requirements?
A. Resize the EC2 instance to an EC2 instance type that has more CPU capacity. Configure an Auto Scaling group with a minimum and maximum size of 1. Configure an RDS read replica for read requests.
B. Resize the EC2 instance to an EC2 instance type that has more CPU capacity. Configure an Auto Scaling group with a minimum and maximum size of 1. Add an RDS read replica and redirect all read/write traffic to the replica.
C. Configure an Auto Scaling group with a minimum size of 1 and maximum size of 2. Resize the RDS DB instance to an instance type that has more CPU capacity.
D. Resize the EC2 instance to an EC2 instance type that has more CPU capacity. Configure an Auto Scaling group with a minimum and maximum size of 1. Resize the RDS DB instance to an instance type that has more CPU capacity.
Show Answer
Correct Answer: A
Explanation: The application can run on only a single EC2 instance because its modules are tightly coupled, so horizontal scaling is not a viable solution. Increasing the EC2 instance size addresses the high CPU utilization. An Auto Scaling group with min=max=1 provides instance management without adding additional application instances. To improve database read performance, create an Amazon RDS read replica and direct read requests to it while keeping all writes on the primary database. Option B is incorrect because read replicas cannot accept writes. Option C cannot help because the application cannot scale to two EC2 instances. Option D improves compute resources but does not specifically offload read traffic from the primary database.
Question 77
A company is migrating an application from an on-premises location to Amazon Elastic Kubernetes Service (Amazon EKS). The company must use a custom subnet for pods that are in the company's VPC to comply with requirements. The company also needs to ensure that the pods can communicate securely within the pods' VPC.
Which solution will meet these requirements?
A. Configure AWS Transit Gateway to directly manage custom subnet configurations for the pods in Amazon EKS.
B. Create an AWS Direct Connect connection from the company's on-premises IP address ranges to the EKS pods.
C. Use the Amazon VPC CNI plugin for Kubernetes. Define custom subnets in the VPC cluster for the pods to use.
D. Implement a Kubernetes network policy that has pod anti-affinity rules to restrict pod placement to specific nodes that are within custom subnets.
Show Answer
Correct Answer: C
Explanation: The Amazon VPC CNI plugin for Kubernetes supports assigning pod IP addresses from VPC subnets, including custom pod subnets through custom networking configuration. This allows pods to use IPs from designated subnets while communicating natively and securely within the VPC. AWS Transit Gateway does not configure pod subnets, Direct Connect is for hybrid connectivity rather than pod subnet assignment, and Kubernetes network policies or pod anti-affinity do not control subnet allocation.
Question 78
A company has an employee web portal. Employees log in to the portal to view payroll details. The company is developing a new system to give employees the ability to upload scanned documents for reimbursement. The company runs a program to extract text-based data from the documents and attach the extracted information to each employee’s reimbursement IDs for processing.
The employee web portal requires 100% uptime. The document extract program runs infrequently throughout the day on an on-demand basis. The company wants to build a scalable and cost-effective new system that will require minimal changes to the existing web portal. The company does not want to make any code changes.
Which solution will meet these requirements with the LEAST implementation effort?
A. Run Amazon EC2 On-Demand Instances in an Auto Scaling group for the web portal. Use an AWS Lambda function to run the document extract program. Invoke the Lambda function when an employee uploads a new reimbursement document.
B. Run Amazon EC2 Spot Instances in an Auto Scaling group for the web portal. Run the document extract program on EC2 Spot Instances. Start document extract program instances when an employee uploads a new reimbursement document.
C. Purchase a Savings Plan to run the web portal and the document extract program. Run the web portal and the document extract program in an Auto Scaling group.
D. Create an Amazon S3 bucket to host the web portal. Use Amazon API Gateway and an AWS Lambda function for the existing functionalities. Use the Lambda function to run the document extract program. Invoke the Lambda function when the API that is associated with a new document upload is called.
Show Answer
Correct Answer: A
Explanation: Option A best satisfies the stated requirements. Keep the existing web portal on highly available EC2 On-Demand instances with Auto Scaling, requiring minimal architectural change. Run the infrequent, on-demand document extraction as an event-driven AWS Lambda function triggered by document upload (for example, via S3 event notifications), which is scalable and cost-effective because it runs only when needed. Option B uses Spot Instances for a workload requiring 100% uptime. Option C reduces EC2 costs but still runs the infrequent extraction workload on EC2 instead of a serverless on-demand model and does not address the event-driven requirement. Option D requires a major rearchitecture of the existing portal to S3/API Gateway/Lambda, conflicting with the requirement for least implementation effort and no code changes.
Question 79
A company is building an application in the AWS Cloud. The application is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses Amazon Route 53 for the DNS.
The company needs a managed solution with proactive engagement to detect against DDoS attacks.
Which solution will meet these requirements?
A. Enable AWS Config. Configure an AWS Config managed rule that detects DDoS attacks.
B. Enable AWS WAF on the ALCreate an AWS WAF web ACL with rules to detect and prevent DDoS attacks. Associate the web ACL with the AL
C. Store the ALB access logs in an Amazon S3 bucket. Configure Amazon GuardDuty to detect and take automated preventative actions for DDoS attacks.
D. Subscribe to AWS Shield Advanced. Configure hosted zones in Route 53. Add ALB resources as protected resources.
Show Answer
Correct Answer: D
Explanation: AWS Shield Advanced is the managed AWS service designed for enhanced DDoS protection. It provides proactive detection, 24/7 access to the AWS DDoS Response Team (DRT), advanced attack visibility, and protects supported resources such as Application Load Balancers and Route 53 hosted zones. AWS WAF mitigates application-layer attacks but is not the managed DDoS protection service requested. AWS Config and GuardDuty do not provide proactive DDoS protection.
$19
Get all 1004 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.