A software as a service (SaaS) company has developed a multi-tenant environment. The company uses Amazon DynamoDB tables that the tenants share for the storage layer. The company uses AWS Lambda functions for the application services.
The company wants to offer a tiered subscription model that is based on resource consumption by each tenant. Each tenant is identified by a unique tenant ID that is sent as part of each request to the Lambda functions. The company has created an AWS Cost and Usage Report (AWS CUR) in an AWS account. The company wants to allocate the DynamoDB costs to each tenant to match that tenant's resource consumption.
Which solution will provide a granular view of the DynamoDB cost for each tenant with the LEAST operational effort?
A. Associate a new tag that is named tenant ID with each table in DynamoDB. Activate the tag as a cost allocation tag in the AWS Billing and Cost Management console. Deploy new Lambda function code to log the tenant ID in Amazon CloudWatch Logs. Use the AWS CUR to separate DynamoDB consumption cost for each tenant ID.
B. Configure the Lambda functions to log the tenant ID and the number of RCUs and WCUs consumed from DynamoDB for each transaction to Amazon CloudWatch Logs. Deploy another Lambda function to calculate the tenant costs by using the logged capacity units and the overall DynamoDB cost from the AWS Cost Explorer API. Create an Amazon EventBridge rule to invoke the calculation Lambda function on a schedule.
C. Create a new partition key that associates DynamoDB items with individual tenants. Deploy a Lambda function to populate the new column as part of each transaction. Deploy another Lambda function to calculate the tenant costs by using Amazon Athena to calculate the number of tenant items from DynamoDB and the overall DynamoDB cost from the AWS CUR. Create an Amazon EventBridge rule to invoke the calculation Lambda function on a schedule.
D. Deploy a Lambda function to log the tenant ID, the size of each response, and the duration of the transaction call as custom metrics to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query the custom metrics for each tenant. Use AWS Pricing Calculator to obtain the overall DynamoDB costs and to calculate the tenant costs.
Show Answer
Correct Answer: B
Explanation: DynamoDB costs cannot be directly broken down per tenant when tenants share the same tables. Cost allocation tags (option A) work only at the resource level (table or index), not at the item or request level, so they cannot provide per-tenant granularity. Option B attributes cost based on actual resource consumption (RCUs and WCUs) per request, which DynamoDB exposes via metrics, and correlates this usage with tenant IDs logged by Lambda. Although it requires some additional logic, it provides true per-tenant cost allocation with the least operational effort among solutions that are actually granular and accurate.
Question 113
A startup company recently migrated a large ecommerce website to AWS. The website has experienced a 70% increase in sales. Software engineers are using a private GitHub repository to manage code. The DevOps team is using Jenkins for builds and unit testing. The engineers need to receive notifications for bad builds and zero downtime during deployments. The engineers also need to ensure any changes to production are seamless for users and can be rolled back in the event of a major issue.
The software engineers have decided to use AWS CodePipeline to manage their build and deployment process.
Which solution will meet these requirements?
A. Use GitHub websockets to trigger the CodePipeline pipeline. Use the Jenkins plugin for AWS CodeBuild to conduct unit testing. Send alerts to an Amazon SNS topic for any bad builds. Deploy in an in-place, all-at-once deployment configuration using AWS CodeDeploy.
B. Use GitHub webhooks to trigger the CodePipeline pipeline. Use the Jenkins plugin for AWS CodeBuild to conduct unit testing. Send alerts to an Amazon SNS topic for any bad builds. Deploy in a blue/green deployment using AWS CodeDeploy.
C. Use GitHub websockets to trigger the CodePipeline pipeline. Use AWS X-Ray for unit testing and static code analysis. Send alerts to an Amazon SNS topic for any bad builds. Deploy in a blue/green deployment using AWS CodeDeploy.
D. Use GitHub webhooks to trigger the CodePipeline pipeline. Use AWS X-Ray for unit testing and static code analysis. Send alerts to an Amazon SNS topic for any bad builds. Deploy in an in-place, all-at-once deployment configuration using AWS CodeDeploy.
Show Answer
Correct Answer: B
Explanation: The requirements include Jenkins-based builds and unit testing, notifications for failed builds, zero-downtime deployments, and easy rollback. GitHub webhooks are the correct integration mechanism for triggering AWS CodePipeline. Jenkins can be integrated with AWS CodeBuild for managed builds and tests. Amazon SNS satisfies build failure notifications. Zero downtime and seamless rollback are best achieved using a blue/green deployment strategy with AWS CodeDeploy. Other options either misuse AWS X-Ray (not a unit testing tool) or use in-place deployments, which do not guarantee zero downtime.
Question 114
A retail company is mounting IoT sensors in all of its stores worldwide. During the manufacturing of each sensor, the company’s private certificate authority (CA) issues an X.509 certificate that contains a unique serial number. The company then deploys each certificate to its respective sensor.
A solutions architect needs to give the sensors the ability to send data to AWS after they are installed. Sensors must not be able to send data to AWS until they are installed.
Which solution will meet these requirements?
A. Create an AWS Lambda function that can validate the serial number. Create an AWS IoT Core provisioning template. Include the SerialNumber parameter in the Parameters section. Add the Lambda function as a pre-provisioning hook. During manufacturing, call the RegisterThing API operation and specify the template and parameters.
B. Create an AWS Step Functions state machine that can validate the serial number. Create an AWS IoT Core provisioning template. Include the SerialNumber parameter in the Parameters section. Specify the Step Functions state machine to validate parameters. Call the StartThingRegistrationTask API operation during installation.
C. Create an AWS Lambda function that can validate the serial number. Create an AWS IoT Core provisioning template. Include the SerialNumber parameter in the Parameters section. Add the Lambda function as a pre-provisioning hook. Register the CA with AWS IoT Core, specify the provisioning template, and set the allow-auto-registration parameter.
D. Create an AWS IoT Core provisioning template. Include the SerialNumber parameter in the Parameters section. Include parameter validation in the template. Provision a claim certificate and a private key for each device that uses the CA. Grant AWS IoT Core service permissions to update AWS IoT things during provisioning.
Show Answer
Correct Answer: C
Explanation: Option C uses AWS IoT Core Fleet Provisioning with a registered CA and auto-registration, combined with a Lambda pre-provisioning hook to validate the device’s unique serial number embedded in the X.509 certificate. Devices cannot connect or provision until installation, when they present their certificate and pass the Lambda validation. This matches the requirement to issue certificates during manufacturing, block data transmission until installation, and securely onboard devices at scale.
Question 115
A company has an application that uses an Amazon Aurora PostgreSQL DB cluster for the application's database. The DB cluster contains one small primary instance and three larger replica instances. The application runs on an AWS Lambda function. The application makes many short-lived connections to the database's replica instances to perform read-only operations.
During periods of high traffic, the application becomes unreliable and the database reports that too many connections are being established. The frequency of high-traffic periods is unpredictable.
Which solution will improve the reliability of the application?
A. Use Amazon RDS Proxy to create a proxy for the DB cluster. Configure a read-only endpoint for the proxy. Update the Lambda function to connect to the proxy endpoint.
B. Increase the max_connections setting on the DB cluster's parameter group. Reboot all the instances in the DB cluster. Update the Lambda function to connect to the DB cluster endpoint.
C. Configure instance scaling for the DB cluster to occur when the DatabaseConnections metric is close to the max connections setting. Update the Lambda function to connect to the Aurora reader endpoint.
D. Use Amazon RDS Proxy to create a proxy for the DB cluster. Configure a read-only endpoint for the Aurora Data API on the proxy. Update the Lambda function to connect to the proxy endpoint.
Show Answer
Correct Answer: A
Explanation: The reliability issue is caused by many short-lived Lambda connections overwhelming the Aurora replicas. Amazon RDS Proxy is designed to pool and reuse database connections, which is especially important for Lambda workloads with unpredictable traffic spikes. Configuring a read-only proxy endpoint allows the Lambda function to efficiently route read traffic to Aurora replicas while drastically reducing the number of database connections. Increasing max_connections or scaling instances does not solve the connection churn problem, and the Aurora Data API is not applicable to provisioned Aurora PostgreSQL clusters.
Question 116
A solutions architect is preparing to deploy a new security tool into several previously unused AWS Regions. The solutions architect will deploy the tool by using an AWS CloudFormation stack set. The stack set's template contains an IAM role that has a custom name. Upon creation of the stack set, no stack instances are created successfully.
What should the solutions architect do to deploy the stacks successfully?
A. Enable the new Regions in all relevant accounts. Specify the CAPABILITY_NAMED_IAM capability during the creation of the stack set.
B. Use the Service Quotas console to request a quota increase for the number of CloudFormation stacks in each new Region in all relevant accounts. Specify the CAPABILITY_IAM capability during the creation of the stack set.
C. Specify the CAPABILITY_NAMED_IAM capability and the SELF_MANAGED permissions model during the creation of the stack set.
D. Specify an administration role ARN and the CAPABILITY_IAM capability during the creation of the stack set.
Show Answer
Correct Answer: A
Explanation: The stack set template creates an IAM role with a custom name, which requires explicitly acknowledging IAM creation by specifying CAPABILITY_NAMED_IAM. In addition, the Regions are previously unused, so they must be enabled in each target account before stack instances can be created there. Without enabling the Regions and acknowledging named IAM resources, stack set creation fails.
Question 117
A retail company is operating its ecommerce application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses an Amazon RDS DB instance as the database backend. Amazon CloudFront is configured with one origin that points to the ALB. Static content is cached. Amazon Route 53 is used to host all public zones.
After an update of the application, the ALB occasionally returns a 502 status code (Bad Gateway) error. The root cause is malformed HTTP headers that are returned to the ALB. The webpage returns successfully when a solutions architect reloads the webpage immediately after the error occurs.
While the company is working on the problem, the solutions architect needs to provide a custom error page instead of the standard ALB error page to visitors.
Which combination of steps will meet this requirement with the LEAST amount of operational overhead? (Choose two.)
A. Create an Amazon S3 bucket. Configure the S3 bucket to host a static webpage. Upload the custom error pages to Amazon S3.
B. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function if the ALB health check response Target.FailedHealthChecks is greater than 0. Configure the Lambda function to modify the forwarding rule at the ALB to point to a publicly accessible web server.
C. Modify the existing Amazon Route 53 records by adding health checks. Configure a fallback target if the health check fails. Modify DNS records to point to a publicly accessible webpage.
D. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function if the ALB health check response Elb.InternalError is greater than 0. Configure the Lambda function to modify the forwarding rule at the ALB to point to a public accessible web server.
E. Add a custom error response by configuring a CloudFront custom error page. Modify DNS records to point to a publicly accessible web page.
Show Answer
Correct Answer: A, E
Explanation: CloudFront sits in front of the ALB and can intercept 5xx errors such as ALB 502 responses. Configuring CloudFront custom error responses allows serving a custom error page without changing the ALB, Route 53, or application behavior, which is the lowest operational overhead. Hosting the custom error page on Amazon S3 static website hosting is the simplest and most common origin for CloudFront custom error pages. Other options involve DNS failover or dynamic ALB rule changes, which add complexity and do not handle transient errors effectively.
Question 118
A company has multiple lines of business (LOBs) that roll up to the parent company. The company has asked its solutions architect to develop a solution with the following requirements:
• Produce a single AWS invoice for all of the AWS accounts used by its LOBs.
• The costs for each LOB account should be broken out on the invoice.
• Provide the ability to restrict services and features in the LOB accounts, as defined by the company's governance policy.
• Each LOB account should be delegated full administrator permissions, regardless of the governance policy.
Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
A. Use AWS Organizations to create an organization in the parent account for each LOB. Then invite each LOB account to the appropriate organization.
B. Use AWS Organizations to create a single organization in the parent account. Then, invite each LOB's AWS account to join the organization.
C. Implement service quotas to define the services and features that are permitted and apply the quotas to each LOB. as appropriate.
D. Create an SCP that allows only approved services and features, then apply the policy to the LOB accounts.
E. Enable consolidated billing in the parent account's billing console and link the LOB accounts.
Show Answer
Correct Answer: B, D
Explanation: Using AWS Organizations with a single organization (B) provides consolidated billing with a single invoice while still breaking down costs per member account, and it supports centralized governance. Service control policies (D) are the correct mechanism to restrict which AWS services and features can be used in each LOB account according to governance policies. SCPs do not remove administrator privileges within the allowed boundaries, so LOB accounts can still have full administrator permissions. Options A, C, and E do not fully meet all requirements or are unnecessary because consolidated billing is inherent to AWS Organizations.
Question 119
A company is deploying a third-party web application on AWS. The application is packaged as a Docker image. The company has deployed the Docker image as an AWS Fargate service in Amazon Elastic Container Service (Amazon ECS). An Application Load Balancer (ALB) directs traffic to the application.
The company needs to give only a specific list of users the ability to access the application from the internet. The company cannot change the application and cannot integrate the application with an identity provider. All users must be authenticated through multi-factor authentication (MFA).
Which solution will meet these requirements?
A. Create a user pool in Amazon Cognito. Configure the pool for the application. Populate the pool with the required users. Configure the pool to require MFConfigure a listener rule on the ALB to require authentication through the Amazon Cognito hosted UI.
B. Configure the users in AWS Identity and Access Management (IAM). Attach a resource policy to the Fargate service to require users to use MFA. Configure a listener rule on the ALB to require authentication through IAM.
C. Configure the users in AWS Identity and Access Management (IAM). Enable AWS IAM Identity Center (AWS Single Sign-On). Configure resource protection for the ALB. Create a resource protection rule to require users to use MFA.
D. Create a user pool in AWS Amplify. Configure the pool for the application. Populate the pool with the required users. Configure the pool to require MFA. Configure a listener rule on the ALB to require authentication through the Amplify hosted UI.
Show Answer
Correct Answer: A
Explanation: Application Load Balancer supports native authentication only with Amazon Cognito (or generic OIDC) without changing the application. A Cognito user pool can contain a specific list of users, enforce MFA, and use the Cognito hosted UI. An ALB listener rule can require Cognito authentication before forwarding traffic to the ECS Fargate service, meeting all requirements. IAM, IAM Identity Center, or Amplify cannot be used to authenticate internet users directly through ALB for this use case.
Question 120
A company is deploying a distributed in-memory database on a fleet of Amazon EC2 instances. The fleet consists of a primary node and eight worker nodes. The primary node is responsible for monitoring cluster health, accepting user requests, distributing user requests to worker nodes, and sending an aggregate response back to a client. Worker nodes communicate with each other to replicate data partitions.
The company requires the lowest possible networking latency to achieve maximum performance.
Which solution will meet these requirements?
A. Launch memory optimized EC2 instances in a partition placement group.
B. Launch compute optimized EC2 instances in a partition placement group.
C. Launch memory optimized EC2 instances in a cluster placement group.
D. Launch compute optimized EC2 instances in a spread placement group.
Show Answer
Correct Answer: C
Explanation: A distributed in-memory database requires extremely low network latency and high throughput between nodes. Cluster placement groups place instances physically close together within a single AZ, providing the lowest latency and highest bandwidth networking. Memory-optimized instances are appropriate for an in-memory database workload. Partition and spread placement groups are designed for fault isolation, not minimal latency.
Question 121
A solutions architect works for a government agency that has strict disaster recovery requirements. All Amazon Elastic Block Store (Amazon EBS) snapshots are required to be saved in at least two additional AWS Regions. The agency also is required to maintain the lowest possible operational overhead.
Which solution meets these requirements?
A. Configure a policy in Amazon Data Lifecycle Manager (Amazon DLM) to run once daily to copy the EBS snapshots to the additional Regions.
B. Use Amazon EventBridge to schedule an AWS Lambda function to copy the EBS snapshots to the additional Regions.
C. Setup AWS Backup to create the EBS snapshots. Configure Amazon S3 Cross-Region Replication to copy the EBS snapshots to the additional Regions.
D. Schedule Amazon EC2 Image Builder to run once daily to create an AMI and copy the AMI to the additional Regions.
Show Answer
Correct Answer: A
Explanation: Amazon Data Lifecycle Manager (DLM) natively supports automated EBS snapshot creation and cross-Region snapshot copy via policies. A single DLM policy can copy snapshots to multiple additional Regions with minimal configuration and no custom code, meeting strict disaster recovery requirements while keeping operational overhead very low. The other options either require custom automation (Lambda/EventBridge), misuse S3 Cross-Region Replication (which cannot be applied to EBS snapshots), or create AMIs unnecessarily, increasing complexity.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.