A solutions architect wants to make sure that only AWS users or roles with suitable permissions can access a new Amazon API Gateway endpoint. The solutions architect wants an end-to-end view of each request to analyze the latency of the request and create service maps.
How can the solutions architect design the API Gateway access control and perform request inspections?
A. For the API Gateway method, set the authorization to AWS_IAM. Then, give the IAM user or role execute-api:Invoke permission on the REST API resource. Enable the API caller to sign requests with AWS Signature when accessing the endpoint. Use AWS X-Ray to trace and analyze user requests to API Gateway.
B. For the API Gateway resource, set CORS to enabled and only return the company's domain in Access-Control-Allow-Origin headers. Then, give the IAM user or role execute-api:Invoke permission on the REST API resource. Use Amazon CloudWatch to trace and analyze user requests to API Gateway.
C. Create an AWS Lambda function as the custom authorizer, ask the API client to pass the key and secret when making the call, and then use Lambda to validate the key/secret pair against the IAM system. Use AWS X-Ray to trace and analyze user requests to API Gateway.
D. Create a client certificate for API Gateway. Distribute the certificate to the AWS users and roles that need to access the endpoint. Enable the API caller to pass the client certificate when accessing the endpoint. Use Amazon CloudWatch to trace and analyze user requests to API Gateway.
Show Answer
Correct Answer: A
Explanation: The requirement is to restrict access to only AWS users or roles with appropriate permissions and to obtain an end-to-end view of requests with latency analysis and service maps. Using AWS_IAM authorization on API Gateway enforces IAM-based access control via execute-api:Invoke and SigV4 request signing. AWS X-Ray integrates natively with API Gateway to provide distributed tracing, latency analysis, and service maps. Other options either do not provide IAM-based authorization, misuse CORS or client certificates, or lack X-Ray’s end-to-end tracing capabilities.
Question 123
An e-commerce company is revamping its IT infrastructure and is planning to use AWS services. The company’s CIO has asked a solutions architect to design a simple, highly available, and loosely coupled order processing application. The application is responsible for receiving and processing orders before storing them in an Amazon DynamoDB table. The application has a sporadic traffic pattern and should be able to scale during marketing campaigns to process the orders with minimal delays.
Which of the following is the MOST reliable approach to meet the requirements?
A. Receive the orders in an Amazon EC2-hosted database and use EC2 instances to process them.
B. Receive the orders in an Amazon SQS queue and invoke an AWS Lambda function to process them.
C. Receive the orders using the AWS Step Functions program and launch an Amazon ECS container to process them.
D. Receive the orders in Amazon Kinesis Data Streams and use Amazon EC2 instances to process them.
Show Answer
Correct Answer: B
Explanation: Option B best meets all requirements. Amazon SQS provides durable, highly available message buffering that decouples order ingestion from processing, ensuring reliability and no data loss during traffic spikes. AWS Lambda automatically scales with sporadic and bursty workloads, requires no server management, and integrates natively with SQS and DynamoDB. This combination is simple, loosely coupled, highly available, and cost-effective, making it more suitable than EC2-, ECS-, Step Functions-, or Kinesis-based approaches for this use case.
Question 124
A company is preparing to deploy an Amazon Elastic Kubernetes Service (Amazon EKS) cluster for a workload. The company expects the cluster to support an unpredictable number of stateless pods. Many of the pods will be created during a short time period as the workload automatically scales the number of replicas that the workload uses.
Which solution will MAXIMIZE node resilience?
A. Use a separate launch template to deploy the EKS control plane into a second cluster that is separate from the workload node groups.
B. Update the workload node groups. Use a smaller number of node groups and larger instances in the node groups.
C. Configure the Kubernetes Cluster Autoscaler to ensure that the compute capacity of the workload node groups stays underprovisioned.
D. Configure the workload to use topology spread constraints that are based on Availability Zone.
Show Answer
Correct Answer: D
Explanation: Topology spread constraints based on Availability Zone ensure that pods are evenly distributed across nodes in different AZs. This maximizes node (and AZ) resilience by reducing the blast radius of node or AZ failures while allowing rapid, bursty scaling of stateless pods. The other options do not directly improve resilience to node or AZ failure.
Question 125
A company has deployed an Amazon Connect contact center. Contact center agents are reporting large numbers of computer-generated calls. The company is concerned about the cost and productivity effects of these calls. The company wants a solution that will allow agents to flag the call as spam and automatically block the numbers from going to an agent in the future.
What is the MOST operationally efficient solution to meet these requirements?
A. Customize the Contact Control Panel (CCP) by adding a flag call button that will invoke an AWS Lambda function that calls the UpdateContactAttributes API. Use an Amazon DynamoDB table to store the spam numbers. Modify the contact flows to look for the updated attribute and to use a Lambda function to read and write to the DynamoDB table.
B. Use a Contact Lens for Amazon Connect rule that will look for spam calls. Use an Amazon DynamoDB table to store the spam numbers. Modify the contact flows to look for the rule and to invoke an AWS Lambda function to read and write to the DynamoDB table.
C. Use an Amazon DynamoDB table to store the spam numbers. Create a quick connect that the agents can transfer the spam call to from the Contact Control Panel (CCP). Modify the quick connect contact flow to invoke an AWS Lambda function to write to the DynamoDB table.
D. Modify the initial contact flow to ask for caller input. If the agent does not receive input, the agent should mark the caller as spam. Use an Amazon DynamoDB table to store the spam numbers. Use an AWS Lambda function to read and write to the DynamoDB table.
Show Answer
Correct Answer: A
Explanation: Option A is the most operationally efficient because it directly integrates spam flagging into the agent workflow. By customizing the Contact Control Panel with a flag button, agents can mark spam calls in real time without call transfers or extra steps. The button can invoke a Lambda function to update contact attributes and persist the caller number in a DynamoDB deny list. Contact flows can then automatically check this list on future calls and prevent routing to agents. This approach minimizes agent effort, avoids additional call handling constructs, and aligns with AWS-recommended patterns for implementing a deny list in Amazon Connect.
Question 126
A company is creating a solution that can move 400 employees into a remote working environment in the event of an unexpected disaster. The user desktops have a mix of Windows and Linux operating systems. Multiple types of software, such as web browsers and mail clients, are installed on each desktop.
A solutions architect needs to implement a solution that can be integrated with the company’s on-premises Active Directory to allow employees to use their existing identity credentials. The solution must provide multifactor authentication (MFA) and must replicate the user experience from the existing desktops.
Which solution will meet these requirements?
A. Use Amazon WorkSpaces for the cloud desktop service. Set up a VPN connection to the on-premises network. Create an AD Connector, and connect to the on-premises Active Directory. Activate MFA for Amazon WorkSpaces by using the AWS Management Console.
B. Use Amazon AppStream 2.0 as an application streaming service. Configure Desktop View for the employees. Set up a VPN connection to the on-premises network. Set up Active Directory Federation Services (AD FS) on premises. Connect the VPC network to AD FS through the VPN connection.
C. Use Amazon WorkSpaces for the cloud desktop service. Set up a VPN connection to the on-premises network. Create an AD Connector, and connect to the on-premises Active Directory. Configure a RADIUS server for MFA.
D. Use Amazon AppStream 2.0 as an application streaming service. Set up Active Directory Federation Services on premises. Configure MFA to grant users access on AppStream 2.0.
Show Answer
Correct Answer: C
Explanation: The requirement is to replicate full desktop user experience across Windows and Linux, integrate with on‑premises Active Directory using existing credentials, and enforce MFA. Amazon WorkSpaces provides full persistent cloud desktops that best replicate existing desktops, unlike AppStream 2.0 which primarily streams applications. Integration with on‑premises AD is achieved using an AD Connector over a VPN. For Amazon WorkSpaces, MFA is not enabled directly from the console; it requires integration with a RADIUS-based MFA solution. Therefore, configuring a RADIUS server for MFA with WorkSpaces satisfies all requirements.
Question 127
A company wants to design a disaster recovery (DR) solution for an application that runs in the company’s data center. The application writes to an SMB file share and creates a copy on a second file share. Both file shares are in the data center. The application uses two types of files: metadata files and image files.
The company wants to store the copy on AWS. The company needs the ability to use SMB to access the data from either the data center or AWS if a disaster occurs. The copy of the data is rarely accessed but must be available within 5 minutes.
A. Deploy AWS Outposts with Amazon S3 storage. Configure a Windows Amazon EC2 instance on Outposts as a file server.
B. Deploy an Amazon FSx File Gateway. Configure an Amazon FSx for Windows File Server Multi-AZ file system that uses SSD storage.
C. Deploy an Amazon S3 File Gateway. Configure the S3 File Gateway to use Amazon S3 Standard-Infrequent Access (S3 Standard-IA) for the metadata files and to use S3 Glacier Deep Archive for the image files.
D. Deploy an Amazon S3 File Gateway. Configure the S3 File Gateway to use Amazon S3 Standard-Infrequent Access (S3 Standard-IA) for the metadata files and image files.
Show Answer
Correct Answer: D
Explanation: The requirement is to store a rarely accessed copy of SMB data in AWS that can be accessed within 5 minutes during a disaster. Amazon S3 File Gateway supports SMB access to data stored in Amazon S3 and is designed for backup and DR use cases. Using S3 Standard‑Infrequent Access provides low-cost storage with immediate access, meeting the recovery time requirement. FSx for Windows File Server (option B) provides higher performance but is unnecessary and more expensive for infrequently accessed DR data, while Glacier Deep Archive (option C) cannot meet the 5‑minute access requirement.
Question 128
Accompany is deploying a new cluster for big data analytics on AWS. The cluster will run across many Linux Amazon EC2 instances that are spread across multiple Availability Zones.
All of the nodes in the cluster must have read and write access to common underlying file storage. The file storage must be highly available, must be resilient, must be compatible with the Portable Operating System Interface (POSIX), and must accommodate high levels of throughput.
Which storage solution will meet these requirements?
A. Provision an AWS Storage Gateway file gateway NFS file share that is attached to an Amazon S3 bucket. Mount the NFS file share on each EC2 instance in the cluster.
B. Provision a new Amazon Elastic File System (Amazon EFS) file system that uses General Purpose performance mode. Mount the EFS file system on each EC2 instance in the cluster.
C. Provision a new Amazon Elastic Block Store (Amazon EBS) volume that uses the io2 volume type. Attach the EBS volume to all of the EC2 instances in the cluster.
D. Provision a new Amazon Elastic File System (Amazon EFS) file system that uses Max I/O performance mode. Mount the EFS file system on each EC2 instance in the cluster.
Show Answer
Correct Answer: D
Explanation: The cluster requires a shared, POSIX-compliant file system that is highly available across multiple Availability Zones and can support very high aggregate throughput for big data analytics. Amazon EFS meets the shared, HA, resilient, POSIX requirements. For analytics workloads with many EC2 instances performing parallel I/O, the Max I/O performance mode is designed to deliver the highest aggregate throughput and IOPS, which best matches the stated requirement. EBS cannot be shared across many instances, and Storage Gateway is intended for hybrid use cases, not high-performance analytics clusters.
Question 129
A company is currently in the design phase of an application that will need an RPO of less than 5 minutes and an RTO of less than 10 minutes. The solutions architecture team is forecasting that the database will store approximately 10 TB of data. As part of the design, they are looking for a database solution that will provide the company with the ability to fail over to a secondary Region.
Which solution will meet these business requirements at the LOWEST cost?
A. Deploy an Amazon Aurora DB cluster and take snapshots of the cluster every 5 minutes. Once a snapshot is complete, copy the snapshot to a secondary Region to serve as a backup in the event of a failure.
B. Deploy an Amazon RDS instance with a cross-Region read replica in a secondary Region. In the event of a failure, promote the read replica to become the primary.
C. Deploy an Amazon Aurora DB cluster in the primary Region and another in a secondary Region. Use AWS DMS to keep the secondary Region in sync.
D. Deploy an Amazon RDS instance with a read replica in the same Region. In the event of a failure, promote the read replica to become the primary.
Show Answer
Correct Answer: B
Explanation: The requirements are cross-Region failover with RPO < 5 minutes, RTO < 10 minutes, ~10 TB data, at lowest cost. A cross-Region RDS read replica provides near-real-time asynchronous replication, typically meeting the RPO, and can be promoted within minutes to meet the RTO, while avoiding restore times. Snapshot-based recovery (A) cannot meet the RTO/RPO for 10 TB. Two Aurora clusters with DMS (C) can meet requirements but is significantly more expensive. Same-Region read replica (D) does not provide secondary-Region failover.
Question 130
A company is migrating an application from on-premises infrastructure to the AWS Cloud. During migration design meetings, the company expressed concerns about the availability and recovery options for its legacy Windows file server. The file server contains sensitive business-critical data that cannot be recreated in the event of data corruption or data loss. According to compliance requirements, the data must not travel across the public internet. The company wants to move to AWS managed services where possible.
The company decides to store the data in an Amazon FSx for Windows File Server file system. A solutions architect must design a solution that copies the data to another AWS Region for disaster recovery (DR) purposes.
Which solution will meet these requirements?
A. Create a destination Amazon S3 bucket in the DR Region. Establish connectivity between the FSx for Windows File Server file system in the primary Region and the S3 bucket in the DR Region by using Amazon FSx File Gateway. Configure the S3 bucket as a continuous backup source in FSx File Gateway.
B. Create an FSx for Windows File Server file system in the DR Region. Establish connectivity between the VPC the primary Region and the VPC in the DR Region by using AWS Site-to-Site VPN. Configure AWS DataSync to communicate by using VPN endpoints.
C. Create an FSx for Windows File Server file system in the DR Region. Establish connectivity between the VPC in the primary Region and the VPC in the DR Region by using VPC peering. Configure AWS DataSync to communicate by using interface VPC endpoints with AWS PrivateLink.
D. Create an FSx for Windows File Server file system in the DR Region. Establish connectivity between the VPC in the primary Region and the VPC in the DR Region by using AWS Transit Gateway in each Region. Use AWS Transfer Family to copy files between the FSx for Windows File Server file system in the primary Region and the FSx for Windows File Server file system in the DR Region over the private AWS backbone network.
Show Answer
Correct Answer: C
Explanation: The solution must keep data off the public internet and use AWS managed services to replicate FSx for Windows File Server data cross-Region. Using AWS DataSync with interface VPC endpoints (AWS PrivateLink) ensures traffic stays on the AWS private network. VPC peering provides private connectivity between the two VPCs across Regions without internet exposure. Other options either risk internet traversal, add unnecessary components, or use services not suited for FSx-to-FSx replication.
Question 131
A company deploys a new web application. As part of the setup, the company configures AWS WAF to log to Amazon S3 through Amazon Kinesis Data Firehose. The company develops an Amazon Athena query that runs once daily to return AWS WAF log data from the previous 24 hours. The volume of daily logs is constant. However, over time, the same query is taking more time to run.
A solutions architect needs to design a solution to prevent the query time from continuing to increase. The solution must minimize operational overhead.
Which solution will meet these requirements?
A. Create an AWS Lambda function that consolidates each day's AWS WAF logs into one log file.
B. Reduce the amount of data scanned by configuring AWS WAF to send logs to a different S3 bucket each day.
C. Update the Kinesis Data Firehose configuration to partition the data in Amazon S3 by date and time. Create external tables for Amazon Redshift. Configure Amazon Redshift Spectrum to query the data source.
D. Modify the Kinesis Data Firehose configuration and Athena table definition to partition the data by date and time. Change the Athena query to view the relevant partitions.
Show Answer
Correct Answer: D
Explanation: The query runtime increases because Athena scans more data as logs accumulate in S3. Partitioning the data by date and time allows Athena to read only the relevant partitions for the last 24 hours, keeping scan size and query time constant. Kinesis Data Firehose supports dynamic partitioning to S3, and Athena natively supports partition pruning with minimal operational overhead. Other options either do not reduce scanned data effectively or add unnecessary complexity.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.