A global company has a mobile app that displays ticket barcodes. Customers use the tickets on the mobile app to attend live events. Event scanners read the ticket barcodes and call a backend API to validate the barcode data against data in a database. After the barcode is scanned, the backend logic writes to the database's single table to mark the barcode as used.
The company needs to deploy the app on AWS with a DNS name of api.example.com. The company will host the database in three AWS Regions around the world.
Which solution will meet these requirements with the LOWEST latency?
A. Host the database on Amazon Aurora global database clusters. Host the backend on three Amazon Elastic Container Service (Amazon ECS) clusters that are in the same Regions as the database. Create an accelerator in AWS Global Accelerator to route requests to the nearest ECS cluster. Create an Amazon Route 53 record that maps api.example.com to the accelerator endpoint
B. Host the database on Amazon Aurora global database clusters. Host the backend on three Amazon Elastic Kubernetes Service (Amazon EKS) clusters that are in the same Regions as the database. Create an Amazon CloudFront distribution with the three clusters as origins. Route requests to the nearest EKS cluster. Create an Amazon Route 53 record that maps api.example.com to the CloudFront distribution.
C. Host the database on Amazon DynamoDB global tables. Create an Amazon CloudFront distribution. Associate the CloudFront distribution with a CloudFront function that contains the backend logic to validate the barcodes. Create an Amazon Route 53 record that maps api.example.com to the CloudFront distribution.
D. Host the database on Amazon DynamoDB global tables. Create an Amazon CloudFront distribution. Associate the CloudFront distribution with a Lambda@Edge function that contains the backend logic to validate the barcodes. Create an Amazon Route 53 record that maps api.example.com to the CloudFront distribution.
Show Answer
Correct Answer: D
Explanation: The requirement is lowest global latency for barcode validation with a database deployed in three Regions and per-scan writes. DynamoDB global tables provide active-active, multi-Region writes with local reads/writes, avoiding cross-Region write latency. Using CloudFront with Lambda@Edge runs the validation logic at the AWS edge closest to scanners, minimizing network hops. CloudFront Functions cannot access external services, but Lambda@Edge can call DynamoDB. Aurora global databases have a single write Region, which adds latency for writes from other Regions. Therefore, option D delivers the lowest latency end-to-end.
Question 103
A company is planning to migrate an application from on premises to the AWS Cloud. The company will begin the migration by moving the application’s underlying data storage to AWS. The application data is stored on a shared file system on premises, and the application servers connect to the shared file system through SMB.
A solutions architect must implement a solution that uses an Amazon S3 bucket for shared storage. Until the application is fully migrated and code is rewritten to use native Amazon S3 APIs, the application must continue to have access to the data through SMB. The solutions architect must migrate the application data to AWS to its new location while still allowing the on-premises application to access the data.
Which solution will meet these requirements?
A. Create a new Amazon FSx for Windows File Server file system. Configure AWS DataSync with one location for the on-premises file share and one location for the new Amazon FSx file system. Create a new DataSync task to copy the data from the on-premises file share location to the Amazon FSx file system.
B. Create an S3 bucket for the application. Copy the data from the on-premises storage to the S3 bucket.
C. Deploy an AWS Server Migration Service (AWS SMS) VM to the on-premises environment. Use AWS SMS to migrate the file storage server from on premises to an Amazon EC2 instance.
D. Create an S3 bucket for the application. Deploy a new AWS Storage Gateway file gateway on an on-premises VM. Create a new file share that stores data in the S3 bucket and is associated with the file gateway. Copy the data from the on-premises storage to the new file gateway endpoint.
Show Answer
Correct Answer: D
Explanation: The requirement is to use Amazon S3 as the shared storage while allowing the on-premises application to continue accessing data through SMB during migration. AWS Storage Gateway File Gateway provides an SMB interface backed by an S3 bucket, enabling on-premises access while data resides in S3. Option D is the only solution that satisfies both S3-backed storage and continued SMB access.
Question 104
A company runs a software-as-a-service (SaaS) application on AWS. The application consists of AWS Lambda functions and an Amazon RDS for MySQL Multi-AZ database. During market events, the application has a much higher workload than normal. Users notice slow response times during the peak periods because of many database connections. The company needs to improve the scalable performance and availability of the database.
Which solution meets these requirements?
A. Create an Amazon CloudWatch alarm action that triggers a Lambda function to add an Amazon RDS for MySQL read replica when resource utilization hits a threshold.
B. Migrate the database to Amazon Aurora, and add a read replica. Add a database connection pool outside of the Lambda handler function.
C. Migrate the database to Amazon Aurora, and add a read replica. Use Amazon Route 53 weighted records.
D. Migrate the database to Amazon Aurora, and add an Aurora Replica. Configure Amazon RDS Proxy to manage database connection pools.
Show Answer
Correct Answer: D
Explanation: The primary issue is slow performance during peaks caused by too many database connections from AWS Lambda. Migrating to Amazon Aurora improves scalability and availability over standard RDS MySQL. Adding an Aurora Replica allows read scaling. Most importantly, configuring Amazon RDS Proxy efficiently manages and pools database connections from Lambda, preventing connection storms and improving performance and availability during high-concurrency events. Other options do not adequately address the Lambda connection management problem.
Question 105
A company is planning to migrate an on-premises data center to AWS. The company currently hosts the data center on Linux-based VMware VMs. A solutions architect must collect information about network dependencies between the VMs. The information must be in the form of a diagram that details host IP addresses, hostnames, and network connection information.
Which solution will meet these requirements?
A. Use AWS Application Discovery Service. Select an AWS Migration Hub home AWS Region. Install the AWS Application Discovery Agent on the on-premises servers for data collection. Grant permissions to Application Discovery Service to use the Migration Hub network diagrams.
B. Use the AWS Application Discovery Service Agentless Collector for server data collection. Export the network diagrams from the AWS Migration Hub in .png format.
C. Install the AWS Application Migration Service agent on the on-premises servers for data collection. Use AWS Migration Hub data in Workload Discovery on AWS to generate network diagrams.
D. Install the AWS Application Migration Service agent on the on-premises servers for data collection. Export data from AWS Migration Hub in .csv format into an Amazon CloudWatch dashboard to generate network diagrams.
Show Answer
Correct Answer: A
Explanation: The requirement is to discover detailed network dependencies (IP addresses, hostnames, and connection information) and present them as network diagrams. AWS Application Discovery Service with the Discovery Agent installed on each on-premises Linux VM can collect process-level and network connection data. This data is integrated with AWS Migration Hub, which can generate network dependency diagrams. The agentless collector does not support Migration Hub network diagrams for dependency mapping, and Application Migration Service is for lift-and-shift migration, not discovery.
Question 106
A company has an application that has a web frontend. The application runs in the company's on-premises data center and requires access to file storage for critical data. The application runs on three Linux VMs for redundancy. The architecture includes a load balancer with HTTP request-based routing.
The company needs to migrate the application to AWS as quickly as possible. The architecture on AWS must be highly available.
Which solution will meet these requirements with the FEWEST changes to the architecture?
A. Migrate the application to Amazon Elastic Container Service (Amazon ECS) containers that use the Fargate launch type in three Availability Zones. Use Amazon S3 to provide file storage for all three containers. Use a Network Load Balancer to direct traffic to the containers.
B. Migrate the application to Amazon EC2 instances in three Availability Zones. Use Amazon Elastic File System (Amazon EFS) for file storage. Mount the file storage on all three EC2 instances. Use an Application Load Balancer to direct traffic to the EC2 instances.
C. Migrate the application to Amazon Elastic Kubernetes Service (Amazon EKS) containers that use the Fargate launch type in three Availability Zones. Use Amazon FSx for Lustre to provide file storage for all three containers. Use a Network Load Balancer to direct traffic to the containers.
D. Migrate the application to Amazon EC2 instances in three AWS Regions. Use Amazon Elastic Block Store (Amazon EBS) for file storage. Enable Cross-Region Replication (CRR) for all three EC2 instances. Use an Application Load Balancer to direct traffic to the EC2 instances.
Show Answer
Correct Answer: B
Explanation: Option B requires the fewest architectural changes while meeting high availability needs. The existing Linux VMs map directly to Amazon EC2 instances across multiple Availability Zones. Amazon EFS provides shared, POSIX-compliant file storage that can be mounted concurrently by all instances, matching the on-premises file storage requirement. An Application Load Balancer supports HTTP request-based routing, aligning with the current load balancer design. Other options introduce major changes such as containers, Kubernetes, inappropriate storage services, or unnecessary multi-Region complexity.
Question 107
A company has a web application that uses Amazon API Gateway. AWS Lambda, and Amazon DynamoDB. A recent marketing campaign has increased demand. Monitoring software reports that many requests have significantly longer response times than before the marketing campaign.
A solutions architect enabled Amazon CloudWatch Logs for API Gateway and noticed that errors are occurring on 20% of the requests. In CloudWatch, the Lambda function Throttles metric represents 1% of the requests and the Errors metric represents 10% of the requests. Application logs indicate that, when errors occur, there is a call to DynamoDB.
What change should the solutions architect make to improve the current response times as the web application becomes more popular?
A. Increase the concurrency limit of the Lambda function.
B. Implement DynamoDB auto scaling on the table.
C. Increase the API Gateway throttle limit.
D. Re-create the DynamoDB table with a better-partitioned primary index.
Show Answer
Correct Answer: B
Explanation: The errors and increased latency occur when the application calls DynamoDB, indicating the database is the bottleneck under increased load. Lambda throttles (1%) and errors (10%) do not account for the majority of slow requests, and API Gateway throttling is not indicated. Enabling DynamoDB auto scaling allows the table’s read/write capacity to scale with traffic, reducing throttling and latency as demand grows, which directly improves response times.
Question 108
A company that develops consumer electronics with offices in Europe and Asia has 60 TB of software images stored on premises in Europe. The company wants to transfer the images to an Amazon S3 bucket in the ap-northeast-1 Region. New software images are created daily and must be encrypted in transit. The company needs a solution that does not require custom development to automatically transfer all existing and new software images to Amazon S3.
What is the next step in the transfer process?
A. Deploy an AWS DataSync agent and configure a task to transfer the images to the S3 bucket.
B. Configure Amazon Kinesis Data Firehose to transfer the images using S3 Transfer Acceleration.
C. Use an AWS Snowball device to transfer the images with the S3 bucket as the target.
D. Transfer the images over a Site-to-Site VPN connection using the S3 API with multipart upload.
Show Answer
Correct Answer: A
Explanation: AWS DataSync is a managed service designed to move large datasets from on-premises storage to Amazon S3 with no custom development. It supports encrypted data transfer in transit, can be scheduled or run continuously to sync both existing and newly created files, and is well suited for ongoing transfers across Regions. Other options either require custom development, are not suitable for continuous daily transfers, or are intended for different use cases.
Question 109
A company creates an AWS Control Tower landing zone to manage and govern a multi-account AWS environment. The company's security team will deploy preventive controls and detective controls to monitor AWS services across all the accounts. The security team needs a centralized view of the security state of all the accounts.
Which solution will meet these requirements?
A. From the AWS Control Tower management account, use AWS CloudFormation StackSets to deploy an AWS Config conformance pack to all accounts in the organization.
B. Enable Amazon Detective for the organization in AWS Organizations. Designate one AWS account as the delegated administrator for Detective.
C. From the AWS Control Tower management account, deploy an AWS CloudFormation stack set that uses the automatic deployment option to enable Amazon Detective for the organization.
D. Enable AWS Security Hub for the organization in AWS Organizations. Designate one AWS account as the delegated administrator for Security Hub.
Show Answer
Correct Answer: D
Explanation: AWS Security Hub provides a centralized view of security findings and compliance status across all AWS accounts and Regions. When enabled at the organization level with a delegated administrator, Security Hub aggregates preventive and detective control findings from services like AWS Config, GuardDuty, and others, meeting the requirement for centralized security visibility in an AWS Control Tower–managed multi-account environment.
Question 110
A company needs to improve the security of its web-based application on AWS. The application uses Amazon CloudFront with two custom origins. The first custom origin routes requests to an Amazon API Gateway HTTP API. The second custom origin routes traffic to an Application Load Balancer (ALB). The application integrates with an OpenID Connect (OIDC) identity provider (IdP) for user management.
A security audit shows that a JSON Web Token (JWT) authorizer provides access to the API. The security audit also shows that the ALB accepts requests from unauthenticated users.
A solutions architect must design a solution to ensure that all backend services respond to only authenticated users.
Which solution will meet this requirement?
A. Configure the ALB to enforce authentication and authorization by integrating the ALB with the IdP. Allow only authenticated users to access the backend services.
B. Modify the CloudFront configuration to use signed URLs. Implement a permissive signing policy that allows any request to access the backend services.
C. Create an AWS WAF web ACL that filters out unauthenticated requests at the ALB level. Allow only authenticated traffic to reach the backend services.
D. Enable AWS CloudTrail to log all requests that come to the ALB. Create an AWS Lambda function to analyze the logs and block any requests that come from unauthenticated users.
Show Answer
Correct Answer: A
Explanation: The requirement is that all backend services respond only to authenticated users. The API Gateway HTTP API already uses a JWT authorizer with an OIDC IdP, but the ALB currently allows unauthenticated access. Application Load Balancers natively support OIDC authentication, allowing the ALB to authenticate users against the same IdP before forwarding requests to targets. Enforcing authentication at the ALB ensures unauthenticated requests are blocked and brings the ALB-origin backend to the same security posture as the API Gateway. Other options do not provide proper authentication enforcement (signed URLs), are not designed for user authentication (WAF), or are reactive and ineffective (CloudTrail with Lambda).
Question 111
A company has an application that stores data in a single Amazon S3 bucket. The company must keep all data for 1 year. The company’s security team is concerned that an attacker could gain access to the AWS account through leaked long-term credentials.
Which solution will ensure that existing and future objects in the S3 bucket are protected?
A. Create a new AWS account that is accessible only to the security team through an assumed role. Create an S3 bucket in the new account. Enable S3 Versioning and S3 Object Lock. Configure a default retention period of 1 year. Set up replication from the existing S3 bucket to the new S3 bucket. Create an S3 Batch Replication job to copy all existing data.
B. Use the s3-bucket-versioning-enabled AWS Config managed rule. Configure an automatic remediation action that uses an AWS Lambda function to enable S3 Versioning and MFA Delete on noncompliant resources. Add an S3 Lifecycle rule to delete objects after 1 year.
C. Explicitly deny bucket creation from all users and roles except for an AWS Service Catalog launch constraint role. Define a Service Catalog product for the creation of the S3 bucket to force S3 Versioning and MFA Delete to be enabled. Authorize users to launch the product when they need to create an S3 bucket.
D. Enable Amazon GuardDuty with the S3 protection feature for the account and the AWS Region. Add an S3 Lifecycle rule to delete objects after 1 year.
Show Answer
Correct Answer: A
Explanation: The key risk is that an attacker could use leaked long-term credentials to delete or tamper with data. The only option that provides strong, preventative protection for both existing and future objects is to use S3 Object Lock with a 1-year retention period, ideally isolated from the compromised account. Option A replicates all data to a separate AWS account controlled by the security team and applies S3 Object Lock and Versioning, making the replicated data immutable for 1 year even if the original account is compromised. The other options focus on detection, governance, or lifecycle management and do not prevent an attacker with valid credentials from deleting or altering data.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.