A flood monitoring agency has deployed more than 10,000 water-level monitoring sensors. Sensors send continuous data updates, and each update is less than 1 MB in size. The agency has a fleet of on-premises application servers. These servers receive updates from the sensors, convert the raw data into a human readable format, and write the results to an on-premises relational database server. Data analysts then use simple SQL queries to monitor the data.
The agency wants to increase overall application availability and reduce the effort that is required to perform maintenance tasks. These maintenance tasks, which include updates and patches to the application servers, cause downtime. While an application server is down, data is lost from sensors because the remaining servers cannot handle the entire workload.
The agency wants a solution that optimizes operational overhead and costs. A solutions architect recommends the use of AWS IoT Core to collect the sensor data.
What else should the solutions architect recommend to meet these requirements?
A. Send the sensor data to Amazon Kinesis Data Firehose. Use an AWS Lambda function to read the Kinesis Data Firehose data, convert it to .csv format, and insert it into an Amazon Aurora MySQL DB instance. Instruct the data analysts to query the data directly from the DB instance.
B. Send the sensor data to Amazon Kinesis Data Firehose. Use an AWS Lambda function to read the Kinesis Data Firehose data, convert it to Apache Parquet format, and save it to an Amazon S3 bucket. Instruct the data analysts to query the data by using Amazon Athena.
C. Send the sensor data to an Amazon Managed Service for Apache Flink (previously known as Amazon Kinesis Data Analytics) application to convert the data to .csv format and store it in an Amazon S3 bucket. Import the data into an Amazon Aurora MySQL DB instance. Instruct the data analysts to query the data directly from the DB instance.
D. Send the sensor data to an Amazon Managed Service for Apache Flink (previously known as Amazon Kinesis Data Analytics) application to convert the data to Apache Parquet format and store it in an Amazon S3 bucket. Instruct the data analysts to query the data by using Amazon Athena.
Show Answer
Correct Answer: B
Explanation: Kinesis Data Firehose is the best fit for fully managed ingestion of high-volume IoT streaming data. Using a Lambda transformation with Firehose to convert records to Apache Parquet and delivering them to Amazon S3 minimizes operational overhead. Athena can query the Parquet data directly with simple SQL, avoiding management of database servers and improving availability with a serverless architecture. The Flink options add unnecessary stream-processing complexity, and the Aurora options reintroduce database administration and higher operational overhead.
Question 88
A company uses a mobile app on AWS to run online contests. The company selects a winner at random at the end of each contest. The contests run for variable lengths of time. The company does not need to retain any data from a contest after the contest is finished.
The company uses custom code that is hosted on Amazon EC2 instances to process the contest data and select a winner. The EC2 instances run behind an Application Load Balancer and store contest entries on Amazon RDS DB instances. The company must design a new architecture to reduce the cost of running the contests.
Which solution will meet these requirements MOST cost-effectively?
A. Migrate storage of the contest entries to Amazon DynamoDB. Create a DynamoDB Accelerator (DAX) cluster. Rewrite the code to run as Amazon Elastic Container Service (Amazon ECS) containers that use the Fargate launch type. At the end of the contest, delete the DynamoDB table.
B. Migrate the storage of the contest entries to Amazon Redshift. Rewrite the code as AWS Lambda functions. At the end of the contest, delete the Redshift cluster.
C. Add an Amazon ElastiCache for Redis cluster in front of the RDS DB instances to cache the contest entries. Rewrite the code to run as Amazon Elastic Container Service (Amazon ECS) containers that use the Fargate launch type. Set the ElastiCache TTL attribute on each entry to expire each entry at the end of the contest.
D. Migrate the storage of the contest entries to Amazon DynamoDB. Rewrite the code as AWS Lambda functions. Set the DynamoDB TTL attribute on each entry to expire each entry at the end of the contest.
Show Answer
Correct Answer: D
Explanation: AWS Lambda is well suited for event-driven, intermittent processing such as handling contest submissions and selecting a winner, avoiding the cost of always-running EC2 or containers. Amazon DynamoDB is a serverless database that scales with demand. DynamoDB TTL can be set per item using an expiration timestamp, allowing entries to expire after the contest ends (the timestamp can reflect each contest's actual end time). DAX is unnecessary without a stated read-latency bottleneck, Redshift is not appropriate for this workload, and ElastiCache plus RDS adds cost rather than reducing it.
Question 89
A solutions architect has deployed a web application that serves users across two AWS Regions under a custom domain. The application uses Amazon Route 53 latency-based routing. The solutions architect has associated weighted record sets with a pair of web servers in separate Availability Zones for each Region.
The solutions architect runs a disaster recovery scenario. When all the web servers in one Region are stopped, Route 53 does not automatically redirect users to the other Region.
Which of the following are possible root causes of this issue? (Choose two.)
A. The weight for the Region where the web servers were stopped is higher than the weight for the other Region.
B. One of the web servers in the secondary Region did not pass its HTTP health check.
C. Latency resource record sets cannot be used in combination with weighted resource record sets.
D. The setting to evaluate target health is not turned on for the latency alias resource record set that is associated with the domain in the Region where the web servers were stopped.
E. An HTTP health check has not been set up for one or more of the weighted resource record sets associated with the stopped web servers.
Show Answer
Correct Answer: D, E
Explanation: Route 53 latency-based routing can be combined with weighted records in a hierarchical DNS configuration, but failover depends on health evaluation. If the latency alias record does not have Evaluate Target Health enabled, Route 53 will continue routing to that Region. Likewise, if the underlying weighted records for the stopped web servers do not have associated health checks, Route 53 cannot detect that all endpoints are unhealthy and will not fail over to the other Region.
Question 90
A software as a service (SaaS) company provides a media software solution to customers. The solution is hosted on 50 VPCs across various AWS Regions and AWS accounts. One of the VPCs is designated as a management VPC. The compute resources in the VPCs work independently.
The company has developed a new feature that requires all 50 VPCs to be able to communicate with each other. The new feature also requires one-way access from each customer's VPC to the company's management VPC. The management VPC hosts a compute resource that validates licenses for the media software solution.
The number of VPCs that the company will use to host the solution will continue to increase as the solution grows.
Which combination of steps will provide the required VPC connectivity with the LEAST operational overhead? (Choose two.)
A. Create a transit gateway. Attach all the company's VPCs and relevant subnets to the transit gateway.
B. Create VPC peering connections between all the company's VPCs.
C. Create a Network Load Balancer (NLB) that points to the compute resource for license validation. Create an AWS PrivateLink endpoint service that is available to each customer's VPAssociate the endpoint service with the NLB.
D. Create a VPN appliance in each customer's VPC. Connect the company's management VPC to each customer's VPC by using AWS Site-to-Site VPN.
E. Create a VPC peering connection between the company's management VPC and each customer's VPC.
Show Answer
Correct Answer: A, C
Explanation: Use AWS Transit Gateway as the scalable hub-and-spoke connectivity solution for interconnecting many VPCs across accounts (with one transit gateway per Region and inter-Region peering where needed). This has far less operational overhead than full-mesh VPC peering. For one-way access from customer VPCs to the management VPC's license validation service, expose the service through an NLB and AWS PrivateLink endpoint service, which provides private, consumer-initiated access without exposing the management VPC.
Question 91
A company wants to migrate an Amazon Aurora MySQL DB cluster from an existing AWS account to a new AWS account in the same AWS Region. Both accounts are members of the same organization in AWS Organizations.
The company must minimize database service interruption before the company performs DNS cutover to the new database.
Which migration strategy will meet this requirement? (Choose two.)
A. Take a snapshot of the existing Aurora database. Share the snapshot with the new AWS account. Create an Aurora DB cluster in the new account from the snapshot.
B. Create an Aurora DB cluster in the new AWS account. Use AWS Database Migration Service (AWS DMS) to migrate data between the two Aurora DB clusters.
C. Use AWS Backup to share an Aurora database backup from the existing AWS account to the new AWS account. Create an Aurora DB cluster in the new AWS account from the snapshot.
D. Create an Aurora DB cluster in the new AWS account. Use AWS Application Migration Service to migrate data between the two Aurora DB clusters.
Show Answer
Correct Answer: A, B
Explanation: AWS DMS supports ongoing replication (CDC) to minimize downtime before DNS cutover, making B the best fit for the stated requirement. Cross-account Aurora snapshot sharing is also a valid migration strategy for moving an Aurora cluster to another account in the same Region, although it incurs downtime up to the snapshot point. Because the question asks to choose two valid migration strategies rather than two steps in one workflow, A is also correct. AWS Backup sharing is not the standard mechanism described here for Aurora snapshot migration, and AWS Application Migration Service does not migrate RDS/Aurora databases.
Question 92
A company runs an application in the cloud that consists of a database and a website. Users can post data to the website, have the data processed, and have the data sent back to them in an email. Data is stored in a MySQL database running on an Amazon EC2 instance. The database is running in a VPC with two private subnets. The website is running on Apache Tomcat in a single EC2 instance in a different VPC with one public subnet. There is a single VPC peering connection between the database and website VPC.
The website has suffered several outages during the last month due to high traffic.
Which actions should a solutions architect take to increase the reliability of the application? (Choose three.)
A. Place the Tomcat server in an Auto Scaling group with multiple EC2 instances behind an Application Load Balancer.
B. Provision an additional VPC peering connection.
C. Migrate the MySQL database to Amazon Aurora with one Aurora Replica.
D. Provision two NAT gateways in the database VPC.
E. Move the Tomcat server to the database VPC.
F. Create an additional public subnet in a different Availability Zone in the website VPC.
Show Answer
Correct Answer: A, C, F
Explanation: The web tier is a single EC2 instance and is the source of outages under high traffic, so placing Tomcat instances in an Auto Scaling group behind an Application Load Balancer improves availability and scalability (A). The database is a single MySQL EC2 instance, so migrating to Amazon Aurora with an Aurora Replica improves database availability and failover (C). To support a highly available load balancer and EC2 instances across Availability Zones, the website VPC needs an additional public subnet in a different Availability Zone (F). An additional VPC peering connection provides no availability benefit, NAT gateways in the database VPC are unrelated to the stated issue, and moving the web server into the database VPC does not improve reliability.
Question 93
A company has developed a new release of a popular video game and wants to make it available for public download. The new release package is approximately 5 GB in size. The company provides downloads for existing releases from a Linux-based, publicly facing FTP site hosted in an on-premises data center. The company expects the new release will be downloaded by users worldwide. The company wants a solution that provides improved download performance and low transfer costs, regardless of a user's location.
A. Store the game files on Amazon EBS volumes mounted on Amazon EC2 instances within an Auto Scaling group. Configure an FTP service on the EC2 instances. Use an Application Load Balancer in front of the Auto Scaling group. Publish the game download URL for users to download the package.
B. Store the game files on Amazon EFS volumes that are attached to Amazon EC2 instances within an Auto Scaling group. Configure an FTP service on each of the EC2 instances. Use an Application Load Balancer in front of the Auto Scaling group. Publish the game download URL for users to download the package.
C. Configure Amazon Route 53 and an Amazon S3 bucket for website hosting. Upload the game files to the S3 bucket. Use Amazon CloudFront for the website. Publish the game download URL for users to download the package.
D. Configure Amazon Route 53 and an Amazon S3 bucket for website hosting. Upload the game files to the S3 bucket. Set Requester Pays for the S3 bucket. Publish the game download URL for users to download the package.
Show Answer
Correct Answer: C
Explanation: Amazon S3 provides durable, highly scalable storage for large downloadable objects, and Amazon CloudFront caches the 5 GB game package at edge locations worldwide to improve download performance and reduce transfer costs by serving users from nearby edge caches. Route 53 provides DNS. The EC2/EBS and EC2/EFS FTP solutions add unnecessary operational overhead and do not provide global edge caching. S3 Requester Pays shifts S3 request/transfer charges to downloaders but does not improve global performance, so it does not meet the performance requirement as well as CloudFront.
Question 94
A company is running its solution on AWS in a manually created VPC. The company is using AWS CloudFormation to provision other parts of the infrastructure. According to a new requirement, the company must manage all infrastructure in an automatic way.
What should the company do to meet this new requirement with the LEAST effort?
A. Create a new AWS Cloud Development Kit (AWS CDK) stack that strictly provisions the existing VPC resources and configuration. Use AWS CDK to import the VPC into the stack and to manage the VPC.
B. Create a CloudFormation stack set that creates the VPC. Use the stack set to import the VPC into the stack.
C. Create a new CloudFormation template that strictly provisions the existing VPC resources and configuration. From the CloudFormation console, create a new stack by importing the Existing resources.
D. Create a new CloudFormation template that creates the VPC. Use the AWS Serverless Application Model (AWS SAM) CLI to import the VPC.
Show Answer
Correct Answer: C
Explanation: CloudFormation supports importing existing resources into a stack using the resource import feature. The company is already using CloudFormation, so creating a template that accurately defines the existing VPC and importing the existing VPC into a new CloudFormation stack is the least-effort way to bring the manually created infrastructure under infrastructure-as-code management. StackSets are for multi-account/multi-region deployments, not resource import. AWS SAM does not provide VPC resource import, and adopting CDK would add unnecessary migration effort.
Question 95
A company has implemented a new security requirement. According to the new requirement, the company must scan all traffic from corporate AWS instances in the company's VPC for violations of the company's security policies. As a result of these scans, the company can block access to and from specific IP addresses.
To meet the new requirement, the company deploys a set of Amazon EC2 instances in private subnets to serve as transparent proxies. The company installs approved proxy server software on these EC2 instances. The company modifies the route tables on all subnets to use the corresponding EC2 instances with proxy software as the default route. The company also creates security groups that are compliant with the security policies and assigns these security groups to the EC2 instances.
Despite these configurations, the traffic of the EC2 instances in their private subnets is not being properly forwarded to the internet.
What should a solutions architect do to resolve this issue?
A. Disable source/destination checks on the EC2 instances that run the proxy software.
B. Add a rule to the security group that is assigned to the proxy EC2 instances to allow all traffic between instances that have this security group. Assign this security group to all EC2 instances in the VPC.
C. Change the VPCs DHCP options set. Set the DNS server options to point to the addresses of the proxy EC2 instances.
D. Assign one additional elastic network interface to each proxy EC2 instance. Ensure that one of these network interfaces has a route to the private subnets. Ensure that the other network interface has a route to the internet.
Show Answer
Correct Answer: A
Explanation: EC2 instances that act as transparent proxies, routers, or NAT instances must have source/destination checks disabled. By default, EC2 only accepts traffic destined for itself and only sends traffic sourced from itself. With source/destination checks enabled, the instance cannot forward transit traffic, so routed VPC traffic will not reach the internet through the proxy. The other options do not address the forwarding restriction: security groups do not enable routing, DHCP options only affect DNS and DHCP behavior, and an additional ENI is not required to make an EC2 instance forward traffic.
Question 96
A company wants to migrate its website to AWS. The website uses microservices and runs on containers that are deployed in an on-premises, self-managed Kubernetes cluster. All the manifests that define the deployments for the containers in the Kubernetes deployment are in source control.
All data for the website is stored in a PostgreSQL database. An open source container image repository runs alongside the on-premises environment.
A solutions architect needs to determine the architecture that the company will use for the website on AWS.
Which solution will meet these requirements with the LEAST effort to migrate?
A. Create an AWS App Runner service. Connect the App Runner service to the open source container image repository. Deploy the manifests from on premises to the App Runner service. Create an Amazon RDS for PostgreSQL database.
B. Create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that has managed node groups. Copy the application containers to a new Amazon Elastic Container Registry (Amazon ECR) repository. Deploy the manifests from on premises to the EKS cluster. Create an Amazon Aurora PostgreSQL DB cluster.
C. Create an Amazon Elastic Container Service (Amazon ECS) cluster that has an Amazon EC2 capacity pool. Copy the application containers to a new Amazon Elastic Container Registry (Amazon ECR) repository. Register each container image as a new task definition. Configure ECS services for each task definition to match the original Kubernetes deployments. Create an Amazon Aurora PostgreSQL DB cluster.
D. Rebuild the on-premises Kubernetes cluster by hosting the cluster on Amazon EC2 instances. Migrate the open source container image repository to the EC2 instances. Deploy the manifests from on premises to the new cluster on AWS. Deploy an open source PostgreSQL database on the new cluster.
Show Answer
Correct Answer: B
Explanation: Amazon EKS is the managed Kubernetes service, allowing reuse of the existing Kubernetes manifests with minimal changes while moving container images to Amazon ECR. This requires significantly less migration effort than converting Kubernetes workloads to App Runner or ECS. Using a managed PostgreSQL-compatible database (Aurora PostgreSQL) also reduces operational overhead compared with self-managing PostgreSQL on EC2 or Kubernetes.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.