A company has a web application that uses Amazon API Gateway. AWS Lambda, and Amazon DynamoDB. A recent marketing campaign has increased demand. Monitoring software reports that many requests have significantly longer response times than before the marketing campaign.
A solutions architect enabled Amazon CloudWatch Logs for API Gateway and noticed that errors are occurring on 20% of the requests. In CloudWatch, the Lambda function Throttles metric represents 1% of the requests and the Errors metric represents 10% of the requests. Application logs indicate that, when errors occur, there is a call to DynamoDB.
What change should the solutions architect make to improve the current response times as the web application becomes more popular?
A. Increase the concurrency limit of the Lambda function.
B. Implement DynamoDB auto scaling on the table.
C. Increase the API Gateway throttle limit.
D. Re-create the DynamoDB table with a better-partitioned primary index.
Show Answer
Correct Answer: B
Explanation: The evidence points to DynamoDB as the bottleneck during traffic growth. API Gateway is reporting errors, Lambda throttling is only about 1% (too low to explain the overall failures), and Lambda errors occur when the function calls DynamoDB. This pattern is consistent with DynamoDB provisioned throughput being exceeded. Enabling DynamoDB Auto Scaling allows read/write capacity to adjust to increased demand, reducing throttling and improving response times. Increasing Lambda concurrency or API Gateway limits would not address the downstream database bottleneck, and redesigning the partition key is only warranted if there is evidence of a hot partition rather than insufficient provisioned capacity.
Question 108
A company that develops consumer electronics with offices in Europe and Asia has 60 TB of software images stored on premises in Europe. The company wants to transfer the images to an Amazon S3 bucket in the ap-northeast-1 Region. New software images are created daily and must be encrypted in transit. The company needs a solution that does not require custom development to automatically transfer all existing and new software images to Amazon S3.
What is the next step in the transfer process?
A. Deploy an AWS DataSync agent and configure a task to transfer the images to the S3 bucket.
B. Configure Amazon Kinesis Data Firehose to transfer the images using S3 Transfer Acceleration.
C. Use an AWS Snowball device to transfer the images with the S3 bucket as the target.
D. Transfer the images over a Site-to-Site VPN connection using the S3 API with multipart upload.
Show Answer
Correct Answer: A
Explanation: AWS DataSync is designed to automate transfers from on-premises storage to Amazon S3, supports encryption in transit, performs initial and incremental syncs for new files, and requires no custom development. Snowball is intended for one-time or bulk offline transfers rather than continuous synchronization. Kinesis Data Firehose is not used to migrate file repositories like software images, and using the S3 API over a VPN would require custom implementation.
Question 109
A company creates an AWS Control Tower landing zone to manage and govern a multi-account AWS environment. The company's security team will deploy preventive controls and detective controls to monitor AWS services across all the accounts. The security team needs a centralized view of the security state of all the accounts.
Which solution will meet these requirements?
A. From the AWS Control Tower management account, use AWS CloudFormation StackSets to deploy an AWS Config conformance pack to all accounts in the organization.
B. Enable Amazon Detective for the organization in AWS Organizations. Designate one AWS account as the delegated administrator for Detective.
C. From the AWS Control Tower management account, deploy an AWS CloudFormation stack set that uses the automatic deployment option to enable Amazon Detective for the organization.
D. Enable AWS Security Hub for the organization in AWS Organizations. Designate one AWS account as the delegated administrator for Security Hub.
Show Answer
Correct Answer: D
Explanation: AWS Security Hub provides a centralized view of security findings and overall security posture across multiple AWS accounts. With AWS Organizations integration, you can designate a delegated administrator account to centrally manage Security Hub for the organization. Preventive and detective controls from AWS Control Tower complement this, while Security Hub aggregates and displays the security state. AWS Config conformance packs assess compliance but do not provide the centralized security posture dashboard required. Amazon Detective is for investigation of security events, not organization-wide security posture management.
Question 110
A company needs to improve the security of its web-based application on AWS. The application uses Amazon CloudFront with two custom origins. The first custom origin routes requests to an Amazon API Gateway HTTP API. The second custom origin routes traffic to an Application Load Balancer (ALB). The application integrates with an OpenID Connect (OIDC) identity provider (IdP) for user management.
A security audit shows that a JSON Web Token (JWT) authorizer provides access to the API. The security audit also shows that the ALB accepts requests from unauthenticated users.
A solutions architect must design a solution to ensure that all backend services respond to only authenticated users.
Which solution will meet this requirement?
A. Configure the ALB to enforce authentication and authorization by integrating the ALB with the IdP. Allow only authenticated users to access the backend services.
B. Modify the CloudFront configuration to use signed URLs. Implement a permissive signing policy that allows any request to access the backend services.
C. Create an AWS WAF web ACL that filters out unauthenticated requests at the ALB level. Allow only authenticated traffic to reach the backend services.
D. Enable AWS CloudTrail to log all requests that come to the ALB. Create an AWS Lambda function to analyze the logs and block any requests that come from unauthenticated users.
Show Answer
Correct Answer: A
Explanation: The API Gateway HTTP API is already protected by a JWT authorizer. The remaining gap is that the ALB accepts unauthenticated requests. Application Load Balancers natively support user authentication with OpenID Connect identity providers. Configuring the ALB to authenticate users with the existing OIDC IdP ensures only authenticated users can access the ALB-backed services, so both backend paths require authentication. Signed URLs do not authenticate end users, AWS WAF cannot perform OIDC user authentication, and CloudTrail with Lambda is reactive logging rather than request authentication enforcement.
Question 111
A company has an application that stores data in a single Amazon S3 bucket. The company must keep all data for 1 year. The company’s security team is concerned that an attacker could gain access to the AWS account through leaked long-term credentials.
Which solution will ensure that existing and future objects in the S3 bucket are protected?
A. Create a new AWS account that is accessible only to the security team through an assumed role. Create an S3 bucket in the new account. Enable S3 Versioning and S3 Object Lock. Configure a default retention period of 1 year. Set up replication from the existing S3 bucket to the new S3 bucket. Create an S3 Batch Replication job to copy all existing data.
B. Use the s3-bucket-versioning-enabled AWS Config managed rule. Configure an automatic remediation action that uses an AWS Lambda function to enable S3 Versioning and MFA Delete on noncompliant resources. Add an S3 Lifecycle rule to delete objects after 1 year.
C. Explicitly deny bucket creation from all users and roles except for an AWS Service Catalog launch constraint role. Define a Service Catalog product for the creation of the S3 bucket to force S3 Versioning and MFA Delete to be enabled. Authorize users to launch the product when they need to create an S3 bucket.
D. Enable Amazon GuardDuty with the S3 protection feature for the account and the AWS Region. Add an S3 Lifecycle rule to delete objects after 1 year.
Show Answer
Correct Answer: A
Explanation: The only option that provides immutable protection for both existing and future objects is to replicate into a separate AWS account with S3 Object Lock enabled and a 1-year default retention period, using versioning and batch replication for existing objects. Object Lock prevents deletion or overwrite during the retention period, and cross-account replication protects against compromise of the source account. The other options either rely on detection (GuardDuty), versioning/MFA Delete without immutable retention, or only govern future bucket creation.
Question 112
A software as a service (SaaS) company has developed a multi-tenant environment. The company uses Amazon DynamoDB tables that the tenants share for the storage layer. The company uses AWS Lambda functions for the application services.
The company wants to offer a tiered subscription model that is based on resource consumption by each tenant. Each tenant is identified by a unique tenant ID that is sent as part of each request to the Lambda functions. The company has created an AWS Cost and Usage Report (AWS CUR) in an AWS account. The company wants to allocate the DynamoDB costs to each tenant to match that tenant's resource consumption.
Which solution will provide a granular view of the DynamoDB cost for each tenant with the LEAST operational effort?
A. Associate a new tag that is named tenant ID with each table in DynamoDB. Activate the tag as a cost allocation tag in the AWS Billing and Cost Management console. Deploy new Lambda function code to log the tenant ID in Amazon CloudWatch Logs. Use the AWS CUR to separate DynamoDB consumption cost for each tenant ID.
B. Configure the Lambda functions to log the tenant ID and the number of RCUs and WCUs consumed from DynamoDB for each transaction to Amazon CloudWatch Logs. Deploy another Lambda function to calculate the tenant costs by using the logged capacity units and the overall DynamoDB cost from the AWS Cost Explorer API. Create an Amazon EventBridge rule to invoke the calculation Lambda function on a schedule.
C. Create a new partition key that associates DynamoDB items with individual tenants. Deploy a Lambda function to populate the new column as part of each transaction. Deploy another Lambda function to calculate the tenant costs by using Amazon Athena to calculate the number of tenant items from DynamoDB and the overall DynamoDB cost from the AWS CUR. Create an Amazon EventBridge rule to invoke the calculation Lambda function on a schedule.
D. Deploy a Lambda function to log the tenant ID, the size of each response, and the duration of the transaction call as custom metrics to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query the custom metrics for each tenant. Use AWS Pricing Calculator to obtain the overall DynamoDB costs and to calculate the tenant costs.
Show Answer
Correct Answer: B
Explanation: Because all tenants share the same DynamoDB tables, table tags cannot attribute costs per tenant. The practical way to allocate shared-table costs is to record per-request DynamoDB consumption (RCUs/WCUs) together with the tenant ID, then periodically apportion the overall DynamoDB cost based on each tenant's consumed capacity. This provides tenant-level granularity with relatively low operational effort compared to building item-count-based estimations or using unrelated metrics.
Question 113
A startup company recently migrated a large ecommerce website to AWS. The website has experienced a 70% increase in sales. Software engineers are using a private GitHub repository to manage code. The DevOps team is using Jenkins for builds and unit testing. The engineers need to receive notifications for bad builds and zero downtime during deployments. The engineers also need to ensure any changes to production are seamless for users and can be rolled back in the event of a major issue.
The software engineers have decided to use AWS CodePipeline to manage their build and deployment process.
Which solution will meet these requirements?
A. Use GitHub websockets to trigger the CodePipeline pipeline. Use the Jenkins plugin for AWS CodeBuild to conduct unit testing. Send alerts to an Amazon SNS topic for any bad builds. Deploy in an in-place, all-at-once deployment configuration using AWS CodeDeploy.
B. Use GitHub webhooks to trigger the CodePipeline pipeline. Use the Jenkins plugin for AWS CodeBuild to conduct unit testing. Send alerts to an Amazon SNS topic for any bad builds. Deploy in a blue/green deployment using AWS CodeDeploy.
C. Use GitHub websockets to trigger the CodePipeline pipeline. Use AWS X-Ray for unit testing and static code analysis. Send alerts to an Amazon SNS topic for any bad builds. Deploy in a blue/green deployment using AWS CodeDeploy.
D. Use GitHub webhooks to trigger the CodePipeline pipeline. Use AWS X-Ray for unit testing and static code analysis. Send alerts to an Amazon SNS topic for any bad builds. Deploy in an in-place, all-at-once deployment configuration using AWS CodeDeploy.
Show Answer
Correct Answer: B
Explanation: GitHub integrates with AWS CodePipeline using webhooks to trigger pipeline executions on code changes. The existing Jenkins environment can integrate with AWS CodeBuild for builds and unit tests via the Jenkins plugin. Amazon SNS can notify on build failures. For zero-downtime deployments with seamless rollback capability, AWS CodeDeploy blue/green deployments are the appropriate choice. X-Ray is for application tracing and debugging, not unit testing or static code analysis.
Question 114
A retail company is mounting IoT sensors in all of its stores worldwide. During the manufacturing of each sensor, the company’s private certificate authority (CA) issues an X.509 certificate that contains a unique serial number. The company then deploys each certificate to its respective sensor.
A solutions architect needs to give the sensors the ability to send data to AWS after they are installed. Sensors must not be able to send data to AWS until they are installed.
Which solution will meet these requirements?
A. Create an AWS Lambda function that can validate the serial number. Create an AWS IoT Core provisioning template. Include the SerialNumber parameter in the Parameters section. Add the Lambda function as a pre-provisioning hook. During manufacturing, call the RegisterThing API operation and specify the template and parameters.
B. Create an AWS Step Functions state machine that can validate the serial number. Create an AWS IoT Core provisioning template. Include the SerialNumber parameter in the Parameters section. Specify the Step Functions state machine to validate parameters. Call the StartThingRegistrationTask API operation during installation.
C. Create an AWS Lambda function that can validate the serial number. Create an AWS IoT Core provisioning template. Include the SerialNumber parameter in the Parameters section. Add the Lambda function as a pre-provisioning hook. Register the CA with AWS IoT Core, specify the provisioning template, and set the allow-auto-registration parameter.
D. Create an AWS IoT Core provisioning template. Include the SerialNumber parameter in the Parameters section. Include parameter validation in the template. Provision a claim certificate and a private key for each device that uses the CA. Grant AWS IoT Core service permissions to update AWS IoT things during provisioning.
Show Answer
Correct Answer: C
Explanation: The requirement is to manufacture devices with an existing X.509 certificate from the company's CA but prevent them from accessing AWS until installation. AWS IoT Core Just-in-Time Provisioning (JITP)/fleet auto-registration with a registered CA and a provisioning template supports this pattern. Register the CA with AWS IoT Core, enable auto-registration, and use a Lambda pre-provisioning hook to validate the certificate serial number (or other attributes) before provisioning. Devices are only provisioned and allowed to operate when they first connect after installation and pass validation. Option A incorrectly invokes RegisterThing during manufacturing, which would provision devices too early. Option B uses Step Functions, which is not supported as a provisioning hook. Option D describes claim certificates, which are for fleet provisioning by claim and do not match the scenario where each device already has its own manufacturer-issued certificate.
Question 115
A company has an application that uses an Amazon Aurora PostgreSQL DB cluster for the application's database. The DB cluster contains one small primary instance and three larger replica instances. The application runs on an AWS Lambda function. The application makes many short-lived connections to the database's replica instances to perform read-only operations.
During periods of high traffic, the application becomes unreliable and the database reports that too many connections are being established. The frequency of high-traffic periods is unpredictable.
Which solution will improve the reliability of the application?
A. Use Amazon RDS Proxy to create a proxy for the DB cluster. Configure a read-only endpoint for the proxy. Update the Lambda function to connect to the proxy endpoint.
B. Increase the max_connections setting on the DB cluster's parameter group. Reboot all the instances in the DB cluster. Update the Lambda function to connect to the DB cluster endpoint.
C. Configure instance scaling for the DB cluster to occur when the DatabaseConnections metric is close to the max connections setting. Update the Lambda function to connect to the Aurora reader endpoint.
D. Use Amazon RDS Proxy to create a proxy for the DB cluster. Configure a read-only endpoint for the Aurora Data API on the proxy. Update the Lambda function to connect to the proxy endpoint.
Show Answer
Correct Answer: A
Explanation: AWS Lambda can create many short-lived database connections during traffic spikes, exhausting Aurora connection limits. Amazon RDS Proxy pools and reuses database connections, greatly reducing the number of backend connections. RDS Proxy supports read-only endpoints for Aurora replicas, allowing read traffic to continue going to replicas while benefiting from connection pooling. Increasing max_connections does not solve inefficient connection management, scaling instances does not address connection storms, and the Aurora Data API is not the appropriate solution here.
Question 116
A solutions architect is preparing to deploy a new security tool into several previously unused AWS Regions. The solutions architect will deploy the tool by using an AWS CloudFormation stack set. The stack set's template contains an IAM role that has a custom name. Upon creation of the stack set, no stack instances are created successfully.
What should the solutions architect do to deploy the stacks successfully?
A. Enable the new Regions in all relevant accounts. Specify the CAPABILITY_NAMED_IAM capability during the creation of the stack set.
B. Use the Service Quotas console to request a quota increase for the number of CloudFormation stacks in each new Region in all relevant accounts. Specify the CAPABILITY_IAM capability during the creation of the stack set.
C. Specify the CAPABILITY_NAMED_IAM capability and the SELF_MANAGED permissions model during the creation of the stack set.
D. Specify an administration role ARN and the CAPABILITY_IAM capability during the creation of the stack set.
Show Answer
Correct Answer: A
Explanation: The template contains an IAM role with a custom name, so CloudFormation requires the CAPABILITY_NAMED_IAM acknowledgment. Because the deployment targets previously unused AWS Regions, those Regions must be enabled in the relevant AWS accounts before StackSets can create stack instances there. The other options use the wrong capability (CAPABILITY_IAM instead of CAPABILITY_NAMED_IAM), introduce unrelated quota changes, or unnecessarily require the SELF_MANAGED permissions model.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.