A company has developed a non-production application that is composed of multiple microservices for each of the company's business units. A single development team maintains all the microservices.
The current architecture uses a static web frontend and a Java-based backend that contains the application logic. The architecture also uses a MySQL database that the company hosts on an Amazon EC2 instance.
The company needs to ensure that the application is secure and available globally.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use Amazon CloudFront and AWS Amplify to host the static web frontend. Refactor the microservices to use AWS Lambda functions that the microservices access by using Amazon API Gateway. Migrate the MySQL database to an Amazon EC2 Reserved Instance.
B. Use Amazon CloudFront and Amazon S3 to host the static web frontend. Refactor the microservices to use AWS Lambda functions that the microservices access by using Amazon API Gateway. Migrate the MySQL database to Amazon RDS for MySQL.
C. Use Amazon CloudFront and Amazon S3 to host the static web frontend. Refactor the microservices to use AWS Lambda functions that are in a target group behind a Network Load Balancer. Migrate the MySQL database to Amazon RDS for MySQL.
D. Use Amazon S3 to host the static web frontend. Refactor the microservices to use AWS Lambda functions that are in a target group behind an Application Load Balancer. Migrate the MySQL database to an Amazon EC2 Reserved Instance.
Show Answer
Correct Answer: B
Explanation: Option B provides the least operational overhead while meeting global availability and security needs. Amazon S3 with CloudFront is a fully managed, globally distributed solution for hosting static web frontends. Refactoring the backend to AWS Lambda behind Amazon API Gateway eliminates server management and scales automatically with built-in security features. Migrating MySQL to Amazon RDS for MySQL removes the need to manage EC2 instances, backups, patching, and high availability. Other options either retain EC2 operational burden, use unsupported integrations (NLB with Lambda), or lack global distribution.
Question 83
A company is building an application on AWS. The application uses multiple AWS Lambda functions to retrieve sensitive data from a single Amazon S3 bucket for processing. The company must ensure that only authorized Lambda functions can access the data. The solution must comply with the principle of least privilege.
Which solution will meet these requirements?
A. Grant full S3 bucket access to all Lambda functions through a shared IAM role.
B. Configure the Lambda functions to run within a VPC. Configure a bucket policy to grant access based on the Lambda functions' VPC endpoint IP addresses.
C. Create individual IAM roles for each Lambda function. Grant the IAM roles access to the S3 bucket. Assign each IAM role as the Lambda execution role for its corresponding Lambda function.
D. Configure a bucket policy granting access to the Lambda functions based on their function ARNs.
Show Answer
Correct Answer: C
Explanation: The requirement is to ensure that only authorized Lambda functions can access sensitive data while following least privilege. Assigning a distinct IAM execution role to each Lambda function and granting that role only the required S3 permissions tightly scopes access and is the AWS-recommended pattern.
Option A violates least privilege by granting full access to all functions. Option B relies on network-level controls and IP-based conditions, which are not ideal or precise for Lambda-to-S3 authorization. Option D is not appropriate because S3 access control is enforced through IAM principals (roles/users), not directly by Lambda function ARNs for data access. Therefore, creating individual IAM roles per Lambda function (Option C) best meets the requirements.
Question 84
A company has stored millions of objects across multiple prefixes in an Amazon S3 bucket by using the Amazon S3 Glacier Deep Archive storage class. The company needs to delete all data older than 3 years except for a subset of data that must be retained. The company has identified the data that must be retained and wants to implement a serverless solution.
Which solution will meet these requirements?
A. Use S3 Inventory to list all objects. Use the AWS CLI to create a script that runs on an Amazon EC2 instance that deletes objects from the inventory list.
B. Use AWS Batch to delete objects older than 3 years except for the data that must be retained.
C. Provision an AWS Glue crawler to query objects older than 3 years. Save the manifest file of old objects. Create a script to delete objects in the manifest.
D. Enable S3 Inventory. Create an AWS Lambda function to filter and delete objects. Invoke the Lambda function with S3 Batch Operations to delete objects by using the inventory reports.
Show Answer
Correct Answer: D
Explanation: The requirement is a serverless solution to delete millions of S3 Glacier Deep Archive objects older than 3 years while retaining a known subset. S3 Inventory provides a scalable, flat report of all objects with metadata such as last modified date and storage class. Amazon S3 Batch Operations can then process millions of objects efficiently using that inventory, invoking an AWS Lambda function to apply custom filtering logic (exclude retained objects) and perform deletions. The other options either are not serverless (EC2), are not designed for S3 object lifecycle management (AWS Batch), or misuse services intended for data cataloging rather than bulk object deletion (AWS Glue crawler).
Question 85
A company is designing an application on AWS that processes sensitive data. The application stores and processes financial data for multiple customers.
To meet compliance requirements, the data for each customer must be encrypted separately at rest by using a secure, centralized key management solution. The company wants to use AWS Key Management Service (AWS KMS) to implement encryption.
Which solution will meet these requirements with the LEAST operational overhead?
A. Generate a unique encryption key for each customer. Store the keys in an Amazon S3 bucket. Enable server-side encryption.
B. Deploy a hardware security appliance in the AWS environment that securely stores customer-provided encryption keys. Integrate the security appliance with AWS KMS to encrypt the sensitive data in the application.
C. Create a single AWS KMS key to encrypt all sensitive data across the application.
D. Create separate AWS KMS keys for each customer's data that have granular access control and logging enabled.
Show Answer
Correct Answer: D
Explanation: The requirement is to encrypt each customer’s data separately at rest using a secure, centralized key management solution with minimal operational overhead. AWS KMS is designed for centralized key management, auditing, and access control. Creating separate AWS KMS keys per customer provides strong isolation, fine-grained IAM permissions, and full CloudTrail logging while remaining fully managed by AWS. Other options either increase operational burden (manually managing keys in S3 or external hardware) or fail to meet the requirement for per-customer encryption separation (single KMS key).
Question 86
A video game company is deploying a new gaming application to its global users. The company requires a solution that will provide near real-time reviews and rankings of the players.
A solutions architect must design a solution to provide fast access to the data. The solution must also ensure the data persists on disks in the event that the company restarts the application.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure an Amazon CloudFront distribution with an Amazon S3 bucket as the origin. Store the player data in the S3 bucket.
B. Create Amazon EC2 instances in multiple AWS Regions. Store the player data on the EC2 instances. Configure Amazon Route 53 with geolocation records to direct users to the closest EC2 instance.
C. Deploy an Amazon ElastiCache for Redis duster. Store the player data in the ElastiCache cluster.
D. Deploy an Amazon ElastiCache for Memcached duster. Store the player data in the ElastiCache cluster.
Show Answer
Correct Answer: C
Explanation: The solution requires near real-time access with low latency, data persistence across application restarts, and minimal operational overhead. Amazon ElastiCache for Redis provides in-memory performance suitable for real-time rankings and reviews, while supporting data persistence through RDB snapshots and AOF logs. Redis also offers managed features such as Multi-AZ, replication, backups, and native data structures (e.g., sorted sets) ideal for leaderboards. Memcached lacks persistence, and the other options introduce higher latency or operational complexity.
Question 87
A company hosts a monolithic web application on an Amazon EC2 instance. Application users have recently reported poor performance at specific times. Analysis of Amazon CloudWatch metrics shows that CPU utilization is 100% during the periods of poor performance.
The company wants to resolve this performance issue and improve application availability.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
A. Use AWS Compute Optimizer to obtain a recommendation for an instance type to scale vertically.
B. Create an Amazon Machine Image (AMI) from the web server. Reference the AMI in a new launch template.
C. Create an Auto Scaling group and an Application Load Balancer to scale vertically.
D. Use AWS Compute Optimizer to obtain a recommendation for an instance type to scale horizontally.
E. Create an Auto Scaling group and an Application Load Balancer to scale horizontally.
Show Answer
Correct Answer: B, E
Explanation: The application is CPU-bound and needs better performance during peak times and improved availability. The most cost-effective way is to scale horizontally with an Auto Scaling group and an Application Load Balancer (E), which adds capacity only when needed and improves availability. To enable horizontal scaling from a single existing EC2 instance, the instance must first be made reusable by creating an AMI and using it in a launch template (B). AWS Compute Optimizer recommendations (A or D) are advisory only and do not by themselves implement scaling or availability improvements, and vertical scaling alone does not improve availability.
Question 88
A company uses Amazon RDS for PostgreSQL to run its applications in the us-east-1 Region. The company also uses machine learning (ML) models to forecast annual revenue based on near real-time reports. The reports are generated by using the same RDS for PostgreSQL database. The database performance slows during business hours. The company needs to improve database performance.
Which solution will meet these requirements MOST cost-effectively?
A. Create a cross-Region read replica. Configure the reports to be generated from the read replica.
B. Activate Multi-AZ DB instance deployment for RDS for PostgreSQL. Configure the reports to be generated from the standby database.
C. Use AWS Data Migration Service (AWS DMS) to logically replicate data to a new database. Configure the reports to be generated from the new database.
D. Create a read replica in us-east-1. Configure the reports to be generated from the read replica.
Show Answer
Correct Answer: D
Explanation: The performance issue is caused by read-heavy reporting and ML workloads competing with transactional traffic on the primary RDS instance. Creating a read replica in the same Region offloads read queries without introducing cross-Region data transfer costs or additional latency. Multi-AZ cannot be used for reads, cross-Region replicas add unnecessary cost and latency, and AWS DMS adds operational complexity and expense. Therefore, a same-Region read replica is the most cost-effective solution.
Question 89
A company has applications that run in an organization in AWS Organizations. The company outsources operational support of the applications. The company needs to provide access for the external support engineers without compromising security.
The external support engineers need access to the AWS Management Console. The external support engineers also need operating system access to the company’s fleet ofAmazon EC2 instances that run Amazon Linux in private subnets.
Which solution will meet these requirements MOST securely?
A. Confirm that AWS Systems Manager Agent (SSM Agent) is installed on all instances. Assign an instance profile with the necessary policy to connect to Systems Manager. Use AWS IAM Identity Center to provide the external support engineers console access. Use Systems Manager Session Manager to assign the required permissions.
B. Confirm that AWS Systems Manager Agent (SSM Agent) is installed on all instances. Assign an instance profile with the necessary policy to connect to Systems Manager. Use Systems Manager Session Manager to provide local IAM user credentials in each AWS account to the external support engineers for console access.
C. Confirm that all instances have a security group that allows SSH access only from the external support engineers’ source IP address ranges. Provide local IAM user credentials in each AWS account to the external support engineers for console access. Provide each external support engineer an SSH key pair to log in to the application instances.
D. Create a bastion host in a public subnet. Set up the bastion host security group to allow access from only the external engineers’ IP address ranges. Ensure that all instances have a security group that allows SSH access from the bastion host. Provide each external support engineer an SSH key pair to log in to the application instances. Provide local account IAM user credentials to the engineers for console access.
Show Answer
Correct Answer: A
Explanation: Using AWS Systems Manager Session Manager provides secure, auditable OS-level access to EC2 instances in private subnets without opening SSH ports, managing SSH keys, or deploying bastion hosts. Assigning an instance profile enables SSM connectivity. AWS IAM Identity Center offers centralized, federated console access for external engineers across AWS Organizations without creating local IAM users, reducing credential sprawl and improving security. This combination minimizes attack surface and operational overhead while meeting both console and OS access requirements.
Question 90
A company has a custom application with embedded credentials that retrieves information from a database in an Amazon RDS for MySQL DB cluster. The company needs to make the application more secure with minimal programming effort. The company has created credentials on the RDS for MySQL database for the application user.
Which solution will meet these requirements?
A. Store the credentials in AWS Key Management Service (AWS KMS). Create keys in AWS KMS. Configure the application to load the database credentials from AWS KMS. Enable automatic key rotation
B. Store the credentials in encrypted local storage. Configure the application to load the database credentials from the local storage. Set up a credentials rotation schedule by creating a cron job.
C. Store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Set up a credentials rotation schedule by creating an AWS Lambda function for Secrets Manager.
D. Store the credentials in AWS Systems Manager Parameter Store. Configure the application to load the database credentials from Parameter Store. Set up a credentials rotation schedule in the RDS for MySQL database by using Parameter Store.
Show Answer
Correct Answer: C
Explanation: AWS Secrets Manager is purpose-built to securely store and manage sensitive credentials such as database usernames and passwords. It integrates natively with Amazon RDS for MySQL and supports automatic credential rotation using a managed AWS Lambda function, requiring minimal application code changes. Other options either do not manage credentials directly (KMS), require manual rotation and insecure storage practices (local storage with cron), or lack native rotation support for database credentials (Parameter Store).
Question 91
An ecommerce company runs several internal applications in multiple AWS accounts. The company uses AWS Organizations to manage its AWS accounts.
A security appliance in the company's networking account must inspect interactions between applications across AWS accounts.
Which solution will meet these requirements?
A. Deploy a Network Load Balancer (NLB) in the networking account to send traffic to the security appliance. Configure the application accounts to send traffic to the NLB by using an interface VPC endpoint in the application accounts.
B. Deploy an Application Load Balancer (ALB) in the application accounts to send traffic directly to the security appliance.
C. Deploy a Gateway Load Balancer (GWLB) in the networking account to send traffic to the security appliance. Configure the application accounts to send traffic to the GWLB by using an interface GWLB endpoint in the application accounts.
D. Deploy an interface VPC endpoint in the application accounts to send traffic directly to the security appliance.
Show Answer
Correct Answer: C
Explanation: Gateway Load Balancer (GWLB) is purpose-built to integrate third-party security appliances for traffic inspection and supports centralized inspection across multiple AWS accounts. By deploying the GWLB in the networking account and using GWLB endpoints (via PrivateLink) in the application accounts, traffic between applications can be transparently routed through the security appliance across accounts. NLBs and ALBs do not provide the same transparent, scalable traffic inspection capability, and simple interface endpoints cannot route arbitrary application traffic for inspection.
$19
Get all 1003 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.