A retail company is operating its ecommerce application on AWS. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The company uses an Amazon RDS DB instance as the database backend. Amazon CloudFront is configured with one origin that points to the ALB. Static content is cached. Amazon Route 53 is used to host all public zones.
After an update of the application, the ALB occasionally returns a 502 status code (Bad Gateway) error. The root cause is malformed HTTP headers that are returned to the ALB. The webpage returns successfully when a solutions architect reloads the webpage immediately after the error occurs.
While the company is working on the problem, the solutions architect needs to provide a custom error page instead of the standard ALB error page to visitors.
Which combination of steps will meet this requirement with the LEAST amount of operational overhead? (Choose two.)
A. Create an Amazon S3 bucket. Configure the S3 bucket to host a static webpage. Upload the custom error pages to Amazon S3.
B. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function if the ALB health check response Target.FailedHealthChecks is greater than 0. Configure the Lambda function to modify the forwarding rule at the ALB to point to a publicly accessible web server.
C. Modify the existing Amazon Route 53 records by adding health checks. Configure a fallback target if the health check fails. Modify DNS records to point to a publicly accessible webpage.
D. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function if the ALB health check response Elb.InternalError is greater than 0. Configure the Lambda function to modify the forwarding rule at the ALB to point to a public accessible web server.
E. Add a custom error response by configuring a CloudFront custom error page. Modify DNS records to point to a publicly accessible web page.
Show Answer
Correct Answer: A, E
Explanation: Use Amazon S3 static website hosting to store and serve the custom error page. Then configure CloudFront custom error responses so that when the origin (the ALB) returns a 502 error, CloudFront serves the custom error page from the specified location. This requires minimal operational overhead and avoids complex failover or ALB rule changes. Route 53 health checks and Lambda-based ALB modifications are unnecessary for transient 502 responses caused by malformed headers.
Question 118
A company has multiple lines of business (LOBs) that roll up to the parent company. The company has asked its solutions architect to develop a solution with the following requirements:
• Produce a single AWS invoice for all of the AWS accounts used by its LOBs.
• The costs for each LOB account should be broken out on the invoice.
• Provide the ability to restrict services and features in the LOB accounts, as defined by the company's governance policy.
• Each LOB account should be delegated full administrator permissions, regardless of the governance policy.
Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
A. Use AWS Organizations to create an organization in the parent account for each LOB. Then invite each LOB account to the appropriate organization.
B. Use AWS Organizations to create a single organization in the parent account. Then, invite each LOB's AWS account to join the organization.
C. Implement service quotas to define the services and features that are permitted and apply the quotas to each LOB. as appropriate.
D. Create an SCP that allows only approved services and features, then apply the policy to the LOB accounts.
E. Enable consolidated billing in the parent account's billing console and link the LOB accounts.
Show Answer
Correct Answer: B, D
Explanation: A single AWS Organization provides consolidated billing with one invoice and per-account cost visibility. Service Control Policies (SCPs) are the AWS Organizations mechanism to restrict available services and features according to governance. Account administrators can still have full administrator permissions within the maximum permissions allowed by the SCPs. Creating an organization already enables consolidated billing (with all features), so a separate consolidated billing step is not required.
Question 119
A company is deploying a third-party web application on AWS. The application is packaged as a Docker image. The company has deployed the Docker image as an AWS Fargate service in Amazon Elastic Container Service (Amazon ECS). An Application Load Balancer (ALB) directs traffic to the application.
The company needs to give only a specific list of users the ability to access the application from the internet. The company cannot change the application and cannot integrate the application with an identity provider. All users must be authenticated through multi-factor authentication (MFA).
Which solution will meet these requirements?
A. Create a user pool in Amazon Cognito. Configure the pool for the application. Populate the pool with the required users. Configure the pool to require MFConfigure a listener rule on the ALB to require authentication through the Amazon Cognito hosted UI.
B. Configure the users in AWS Identity and Access Management (IAM). Attach a resource policy to the Fargate service to require users to use MFA. Configure a listener rule on the ALB to require authentication through IAM.
C. Configure the users in AWS Identity and Access Management (IAM). Enable AWS IAM Identity Center (AWS Single Sign-On). Configure resource protection for the ALB. Create a resource protection rule to require users to use MFA.
D. Create a user pool in AWS Amplify. Configure the pool for the application. Populate the pool with the required users. Configure the pool to require MFA. Configure a listener rule on the ALB to require authentication through the Amplify hosted UI.
Show Answer
Correct Answer: A
Explanation: Application Load Balancers support built-in user authentication with Amazon Cognito (or OIDC) before forwarding requests to targets. A Cognito user pool can be populated with the approved users and configured to require MFA. This satisfies the requirement without modifying the application. IAM authentication/resource policies do not protect internet users accessing an ECS/Fargate web application through an ALB, and AWS Amplify is not the service used for ALB authentication.
Question 120
A company is deploying a distributed in-memory database on a fleet of Amazon EC2 instances. The fleet consists of a primary node and eight worker nodes. The primary node is responsible for monitoring cluster health, accepting user requests, distributing user requests to worker nodes, and sending an aggregate response back to a client. Worker nodes communicate with each other to replicate data partitions.
The company requires the lowest possible networking latency to achieve maximum performance.
Which solution will meet these requirements?
A. Launch memory optimized EC2 instances in a partition placement group.
B. Launch compute optimized EC2 instances in a partition placement group.
C. Launch memory optimized EC2 instances in a cluster placement group.
D. Launch compute optimized EC2 instances in a spread placement group.
Show Answer
Correct Answer: C
Explanation: A distributed in-memory database benefits from memory-optimized EC2 instances because the workload is memory intensive. To achieve the lowest possible network latency and highest throughput between tightly coupled nodes that frequently communicate, a cluster placement group is the appropriate choice. Partition placement groups are for reducing correlated failures across partitions rather than minimizing latency, and spread placement groups maximize isolation, not performance.
Question 121
A solutions architect works for a government agency that has strict disaster recovery requirements. All Amazon Elastic Block Store (Amazon EBS) snapshots are required to be saved in at least two additional AWS Regions. The agency also is required to maintain the lowest possible operational overhead.
Which solution meets these requirements?
A. Configure a policy in Amazon Data Lifecycle Manager (Amazon DLM) to run once daily to copy the EBS snapshots to the additional Regions.
B. Use Amazon EventBridge to schedule an AWS Lambda function to copy the EBS snapshots to the additional Regions.
C. Setup AWS Backup to create the EBS snapshots. Configure Amazon S3 Cross-Region Replication to copy the EBS snapshots to the additional Regions.
D. Schedule Amazon EC2 Image Builder to run once daily to create an AMI and copy the AMI to the additional Regions.
Show Answer
Correct Answer: A
Explanation: Amazon Data Lifecycle Manager (DLM) supports automated creation and cross-Region copying of Amazon EBS snapshots through lifecycle policies, including copying to multiple Regions, which satisfies the disaster recovery requirement with minimal operational overhead. Option B requires custom code and more maintenance. Option C is incorrect because Amazon S3 Cross-Region Replication cannot replicate EBS snapshots, as the underlying S3 storage for snapshots is not directly accessible. Option D creates and copies AMIs rather than managing EBS snapshot replication directly and adds unnecessary complexity.
Question 122
A solutions architect wants to make sure that only AWS users or roles with suitable permissions can access a new Amazon API Gateway endpoint. The solutions architect wants an end-to-end view of each request to analyze the latency of the request and create service maps.
How can the solutions architect design the API Gateway access control and perform request inspections?
A. For the API Gateway method, set the authorization to AWS_IAM. Then, give the IAM user or role execute-api:Invoke permission on the REST API resource. Enable the API caller to sign requests with AWS Signature when accessing the endpoint. Use AWS X-Ray to trace and analyze user requests to API Gateway.
B. For the API Gateway resource, set CORS to enabled and only return the company's domain in Access-Control-Allow-Origin headers. Then, give the IAM user or role execute-api:Invoke permission on the REST API resource. Use Amazon CloudWatch to trace and analyze user requests to API Gateway.
C. Create an AWS Lambda function as the custom authorizer, ask the API client to pass the key and secret when making the call, and then use Lambda to validate the key/secret pair against the IAM system. Use AWS X-Ray to trace and analyze user requests to API Gateway.
D. Create a client certificate for API Gateway. Distribute the certificate to the AWS users and roles that need to access the endpoint. Enable the API caller to pass the client certificate when accessing the endpoint. Use Amazon CloudWatch to trace and analyze user requests to API Gateway.
Show Answer
Correct Answer: A
Explanation: AWS_IAM authorization on the API Gateway method ensures only IAM principals with the execute-api:Invoke permission can access the endpoint, with SigV4-signed requests for authentication. AWS X-Ray provides end-to-end request tracing, latency analysis, and service maps, matching the observability requirements.
Question 123
An e-commerce company is revamping its IT infrastructure and is planning to use AWS services. The company’s CIO has asked a solutions architect to design a simple, highly available, and loosely coupled order processing application. The application is responsible for receiving and processing orders before storing them in an Amazon DynamoDB table. The application has a sporadic traffic pattern and should be able to scale during marketing campaigns to process the orders with minimal delays.
Which of the following is the MOST reliable approach to meet the requirements?
A. Receive the orders in an Amazon EC2-hosted database and use EC2 instances to process them.
B. Receive the orders in an Amazon SQS queue and invoke an AWS Lambda function to process them.
C. Receive the orders using the AWS Step Functions program and launch an Amazon ECS container to process them.
D. Receive the orders in Amazon Kinesis Data Streams and use Amazon EC2 instances to process them.
Show Answer
Correct Answer: B
Explanation: Amazon SQS decouples order ingestion from processing, providing durable buffering for sporadic and bursty traffic. AWS Lambda automatically scales to process queued messages and can write results to DynamoDB without managing servers. This combination is simple, highly available, reliable, and well suited for variable workloads. EC2-based options require infrastructure management and are less loosely coupled, while Step Functions are intended for workflow orchestration and are unnecessary for the described simple processing pipeline.
Question 124
A company is preparing to deploy an Amazon Elastic Kubernetes Service (Amazon EKS) cluster for a workload. The company expects the cluster to support an unpredictable number of stateless pods. Many of the pods will be created during a short time period as the workload automatically scales the number of replicas that the workload uses.
Which solution will MAXIMIZE node resilience?
A. Use a separate launch template to deploy the EKS control plane into a second cluster that is separate from the workload node groups.
B. Update the workload node groups. Use a smaller number of node groups and larger instances in the node groups.
C. Configure the Kubernetes Cluster Autoscaler to ensure that the compute capacity of the workload node groups stays underprovisioned.
D. Configure the workload to use topology spread constraints that are based on Availability Zone.
Show Answer
Correct Answer: D
Explanation: Topology spread constraints based on Availability Zones distribute pods across failure domains, reducing the impact of a node or AZ failure and improving resilience. Option A is incorrect because the EKS control plane is AWS-managed. Option B increases blast radius by using larger instances and fewer node groups. Option C intentionally underprovisions capacity, which reduces resilience during rapid scaling.
Question 125
A company has deployed an Amazon Connect contact center. Contact center agents are reporting large numbers of computer-generated calls. The company is concerned about the cost and productivity effects of these calls. The company wants a solution that will allow agents to flag the call as spam and automatically block the numbers from going to an agent in the future.
What is the MOST operationally efficient solution to meet these requirements?
A. Customize the Contact Control Panel (CCP) by adding a flag call button that will invoke an AWS Lambda function that calls the UpdateContactAttributes API. Use an Amazon DynamoDB table to store the spam numbers. Modify the contact flows to look for the updated attribute and to use a Lambda function to read and write to the DynamoDB table.
B. Use a Contact Lens for Amazon Connect rule that will look for spam calls. Use an Amazon DynamoDB table to store the spam numbers. Modify the contact flows to look for the rule and to invoke an AWS Lambda function to read and write to the DynamoDB table.
C. Use an Amazon DynamoDB table to store the spam numbers. Create a quick connect that the agents can transfer the spam call to from the Contact Control Panel (CCP). Modify the quick connect contact flow to invoke an AWS Lambda function to write to the DynamoDB table.
D. Modify the initial contact flow to ask for caller input. If the agent does not receive input, the agent should mark the caller as spam. Use an Amazon DynamoDB table to store the spam numbers. Use an AWS Lambda function to read and write to the DynamoDB table.
Show Answer
Correct Answer: A
Explanation: The most operationally efficient approach is to let agents explicitly flag a call as spam from the CCP, invoke a Lambda function to persist the caller number in a DynamoDB deny list, and update contact attributes so future inbound contact flows can check the deny list and block or divert those calls automatically. Contact Lens is not intended for real-time agent-driven spam flagging, quick connects require agents to transfer calls rather than simply flag them, and asking callers for input is unreliable and does not satisfy the requirement that agents flag spam.
Question 126
A company is creating a solution that can move 400 employees into a remote working environment in the event of an unexpected disaster. The user desktops have a mix of Windows and Linux operating systems. Multiple types of software, such as web browsers and mail clients, are installed on each desktop.
A solutions architect needs to implement a solution that can be integrated with the company’s on-premises Active Directory to allow employees to use their existing identity credentials. The solution must provide multifactor authentication (MFA) and must replicate the user experience from the existing desktops.
Which solution will meet these requirements?
A. Use Amazon WorkSpaces for the cloud desktop service. Set up a VPN connection to the on-premises network. Create an AD Connector, and connect to the on-premises Active Directory. Activate MFA for Amazon WorkSpaces by using the AWS Management Console.
B. Use Amazon AppStream 2.0 as an application streaming service. Configure Desktop View for the employees. Set up a VPN connection to the on-premises network. Set up Active Directory Federation Services (AD FS) on premises. Connect the VPC network to AD FS through the VPN connection.
C. Use Amazon WorkSpaces for the cloud desktop service. Set up a VPN connection to the on-premises network. Create an AD Connector, and connect to the on-premises Active Directory. Configure a RADIUS server for MFA.
D. Use Amazon AppStream 2.0 as an application streaming service. Set up Active Directory Federation Services on premises. Configure MFA to grant users access on AppStream 2.0.
Show Answer
Correct Answer: C
Explanation: Amazon WorkSpaces is the appropriate service because the requirement is to replicate full desktop experiences (Windows and Linux) integrated with on-premises Active Directory. AD Connector enables authentication against the existing on-premises AD over the VPN. For Amazon WorkSpaces, MFA is implemented through a RADIUS server integrated with the directory; it is not simply enabled in the AWS Management Console. AppStream 2.0 is primarily an application streaming service rather than the best fit for full desktop replacement in this scenario.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.