A company wants to migrate its website from an on-premises data center onto AWS. At the same time, it wants to migrate the website to a containerized microservice-based architecture to improve the availability and cost efficiency. The company’s security policy states that privileges and network permissions must be configured according to best practice, using least privilege.
A solutions architect must create a containerized architecture that meets the security requirements and has deployed the application to an Amazon ECS cluster.
What steps are required after the deployment to meet the requirements? (Choose two.)
A. Create tasks using the bridge network mode.
B. Create tasks using the awsvpc network mode.
C. Apply security groups to Amazon EC2 instances, and use IAM roles for EC2 instances to access other resources.
D. Apply security groups to the tasks, and pass IAM credentials into the container at launch time to access other resources.
E. Apply security groups to the tasks, and use IAM roles for tasks to access other resources.
Show Answer
Correct Answer: B, E
Explanation: To follow AWS security best practices and least privilege with Amazon ECS, tasks should use the awsvpc network mode so each task gets its own elastic network interface (ENI). This allows security groups to be applied at the task level for fine-grained network control. Additionally, IAM roles for tasks should be used so containers can securely access AWS resources without embedding or passing credentials, ensuring least-privilege access.
Question 153
A company needs to store and process image data that will be uploaded from mobile devices using a custom mobile app. Usage peaks between 8 AM and 5 PM on weekdays, with thousands of uploads per minute. The app is rarely used at any other time. A user is notified when image processing is complete.
Which combination of actions should a solutions architect take to ensure image processing can scale to handle the load? (Choose three.)
A. Upload files from the mobile software directly to Amazon S3. Use S3 event notifications to create a message in an Amazon MQ queue.
B. Upload files from the mobile software directly to Amazon S3. Use S3 event notifications to create a message in an Amazon Simple Queue Service (Amazon SQS) standard queue.
C. Invoke an AWS Lambda function to perform image processing when a message is available in the queue.
D. Invoke an S3 Batch Operations job to perform image processing when a message is available in the queue.
E. Send a push notification to the mobile app by using Amazon Simple Notification Service (Amazon SNS) when processing is complete.
F. Send a push notification to the mobile app by using Amazon Simple Email Service (Amazon SES) when processing is complete.
Show Answer
Correct Answer: B, C, E
Explanation: To handle large, spiky upload volumes and scale automatically, the architecture should decouple ingestion, processing, and notification. Uploading images directly to Amazon S3 scales effortlessly, and S3 event notifications to an Amazon SQS standard queue buffer bursts and smooth traffic. AWS Lambda can then scale horizontally to process images as messages arrive in the queue without managing servers. Once processing is complete, Amazon SNS is the appropriate service to notify users via push notifications or other subscriber endpoints. Amazon MQ is unnecessary overhead, S3 Batch Operations is for offline bulk jobs, and SES is designed for email rather than mobile push notifications.
Question 154
A company owns a chain of travel agencies and is running an application in the AWS Cloud. Company employees use the application to search for information about travel destinations. Destination content is updated four times each year.
Two fixed Amazon EC2 instances serve the application. The company uses an Amazon Route 53 public hosted zone with a multivalue record of travel.example.com that returns the Elastic IP addresses for the EC2 instances. The application uses Amazon DynamoDB as its primary data store. The company uses a self-hosted Redis instance as a caching solution.
During content updates, the load on the EC2 instances and the caching solution increases drastically. This increased load has led to downtime on several occasions. A solutions architect must update the application so that the application is highly available and can handle the load that is generated by the content updates.
Which solution will meet these requirements?
A. Set up DynamoDB Accelerator (DAX) as in-memory cache. Update the application to use DAX. Create an Auto Scaling group for the EC2 instances. Create an Application Load Balancer (ALB). Set the Auto Scaling group as a target for the ALB. Update the Route 53 record to use a simple routing policy that targets the ALB's DNS alias. Configure scheduled scaling for the EC2 instances before the content updates.
B. Set up Amazon ElastiCache for Redis. Update the application to use ElastiCache. Create an Auto Scaling group for the EC2 instances. Create an Amazon CloudFront distribution, and set the Auto Scaling group as an origin for the distribution. Update the Route 53 record to use a simple routing policy that targets the CloudFront distribution’s DNS alias. Manually scale up EC2 instances before the content updates.
C. Set up Amazon ElastiCache for Memcached. Update the application to use ElastiCache. Create an Auto Scaling group for the EC2 instances. Create an Application Load Balancer (ALB). Set the Auto Scaling group as a target for the ALB. Update the Route 53 record to use a simple routing policy that targets the ALB's DNS alias. Configure scheduled scaling for the application before the content updates.
D. Set up DynamoDB Accelerator (DAX) as in-memory cache. Update the application to use DAX. Create an Auto Scaling group for the EC2 instances. Create an Amazon CloudFront distribution, and set the Auto Scaling group as an origin for the distribution. Update the Route 53 record to use a simple routing policy that targets the CloudFront distribution's DNS alias. Manually scale up EC2 instances before the content updates.
Show Answer
Correct Answer: A
Explanation: The application experiences load spikes during content updates that overwhelm both the EC2 instances and the cache layer. Using DynamoDB Accelerator (DAX) provides a fully managed, in-memory cache that is natively optimized for DynamoDB access patterns, reducing read load during spikes. Replacing fixed EC2 instances with an Auto Scaling group behind an Application Load Balancer ensures high availability and automatic capacity adjustment. Scheduled scaling prepares capacity ahead of predictable update events. Route 53 pointing to the ALB is the correct highly available routing approach. Other options either use less appropriate caching for DynamoDB, rely on manual scaling, or introduce CloudFront where it does not address the primary bottleneck.
Question 155
A company hosts a software as a service (SaaS) solution on AWS. The solution has an Amazon API Gateway API that serves an HTTPS endpoint. The API uses AWS Lambda functions for compute. The Lambda functions store data in an Amazon Aurora Serverless v1 database.
The company used the AWS Serverless Application Model (AWS SAM) to deploy the solution. The solution extends across multiple Availability Zones and has no disaster recovery (DR) plan.
A solutions architect must design a DR strategy that can recover the solution in another AWS Region. The solution has an RTO of 5 minutes and an RPO of 1 minute.
What should the solutions architect do to meet these requirements?
A. Create a read replica of the Aurora Serverless v1 database in the target Region. Use AWS SAM to create a runbook to deploy the solution to the target Region. Promote the read replica to primary in case of disaster.
B. Change the Aurora Serverless v1 database to a standard Aurora MySQL global database that extends across the source Region and the target Region. Use AWS SAM to create a runbook to deploy the solution to the target Region.
C. Create an Aurora Serverless v1 DB cluster that has multiple writer instances in the target Region. Launch the solution in the target Region. Configure the two Regional solutions to work in an active-passive configuration.
D. Change the Aurora Serverless v1 database to a standard Aurora MySQL global database that extends across the source Region and the target Region. Launch the solution in the target Region. Configure the two Regional solutions to work in an active-passive configuration.
Show Answer
Correct Answer: D
Explanation: Aurora Serverless v1 does not support cross-Region replicas or global databases, so it cannot meet a 5-minute RTO and 1-minute RPO for regional disaster recovery. To achieve near-real-time cross-Region replication and fast failover, the database must be changed to a standard Aurora MySQL global database. Launching the application stack in the target Region and configuring the two Regions in an active-passive setup ensures the standby environment is ready for rapid promotion, meeting both the RTO and RPO requirements.
Question 156
A company is migrating an on-premises application and a MySQL database to AWS. The application processes highly sensitive data, and new data is constantly updated in the database. The data must not be transferred over the internet. The company also must encrypt the data in transit and at rest.
The database is 5 TB in size. The company already has created the database schema in an Amazon RDS for MySQL DB instance. The company has set up a 1 Gbps AWS Direct Connect connection to AWS. The company also has set up a public VIF and a private VIF. A solutions architect needs to design a solution that will migrate the data to AWS with the least possible downtime.
Which solution will meet these requirements?
A. Perform a database backup. Copy the backup files to an AWS Snowball Edge Storage Optimized device. Import the backup to Amazon S3. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) for encryption at rest. Use TLS for encryption in transit. Import the data from Amazon S3 to the DB instance.
B. Use AWS Database Migration Service (AWS DMS) to migrate the data to AWS. Create a DMS replication instance in a private subnet. Create VPC endpoints for AWS DMS. Configure a DMS task to copy data from the on-premises database to the DB instance by using full load plus change data capture (CDC). Use the AWS Key Management Service (AWS KMS) default key for encryption at rest. Use TLS for encryption in transit.
C. Perform a database backup. Use AWS DataSync to transfer the backup files to Amazon S3. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) for encryption at rest. Use TLS for encryption in transit. Import the data from Amazon S3 to the DB instance.
D. Use Amazon S3 File Gateway. Set up a private connection to Amazon S3 by using AWS PrivateLink. Perform a database backup. Copy the backup files to Amazon S3. Use server-side encryption with Amazon S3 managed encryption keys (SSE-S3) for encryption at rest. Use TLS for encryption in transit. Import the data from Amazon S3 to the DB instance.
Show Answer
Correct Answer: B
Explanation: AWS Database Migration Service supports full load plus change data capture, which minimizes downtime for a constantly updated 5 TB MySQL database. DMS can run over the existing AWS Direct Connect private VIF so data does not traverse the public internet. It provides encryption in transit using TLS and encryption at rest using AWS KMS. Creating the replication instance in a private subnet and using VPC endpoints meets the security requirements. The other options rely on backups and S3 staging, which increase downtime and do not support continuous replication.
Question 157
A car rental company has built a serverless REST API to provide data to its mobile app. The app consists of an Amazon API Gateway API with a Regional endpoint, AWS Lambda functions, and an Amazon Aurora MySQL Serverless DB cluster. The company recently opened the API to mobile apps of partners. A significant increase in the number of requests resulted, causing sporadic database memory errors.
Analysis of the API traffic indicates that clients are making multiple HTTP GET requests for the same queries in a short period of time. Traffic is concentrated during business hours, with spikes around holidays and other events.
The company needs to improve its ability to support the additional usage while minimizing the increase in costs associated with the solution.
Which strategy meets these requirements?
A. Convert the API Gateway Regional endpoint to an edge-optimized endpoint. Enable caching in the production stage.
B. Implement an Amazon ElastiCache for Redis cache to store the results of the database calls. Modify the Lambda functions to use the cache.
C. Modify the Aurora Serverless DB cluster configuration to increase the maximum amount of available memory.
D. Enable throttling in the API Gateway production stage. Set the rate and burst values to limit the incoming calls.
Show Answer
Correct Answer: A
Explanation: The main issue is repeated identical HTTP GET requests causing excessive read load and memory pressure on Aurora Serverless. Enabling API Gateway caching allows identical GET responses to be served directly from the cache, preventing repeated Lambda invocations and database queries. Converting the API to an edge-optimized endpoint places this cache at CloudFront edge locations, which is well-suited for mobile clients and bursty traffic patterns. This approach significantly reduces backend load while requiring no code changes and adds only incremental caching costs, making it more cost-effective than introducing and operating an ElastiCache cluster or scaling the database. Increasing DB memory only treats the symptom at higher cost, and throttling would reject valid traffic instead of supporting increased usage.
Question 158
A financial company needs to create a separate AWS account for a new digital wallet application. The company uses AWS Organizations to manage its accounts. A solutions architect uses the IAM user Support1 from the management account to create a new member account with
as the email address.
What should the solutions architect do to create IAM users in the new member account?
A. Sign in to the AWS Management Console with AWS account root user credentials by using the 64-character password from the initial AWS Organizations email sent to [email protected] . Set up the IAM users as required.
B. From the management account, switch roles to assume the OrganizationAccountAccessRole role with the account ID of the new member account. Set up the IAM users as required.
C. Go to the AWS Management Console sign-in page. Choose “Sign in using root account credentials.” Sign in in by using the email address finance [email protected] and the management account's root password. Set up the IAM users as required.
D. Go to the AWS Management Console sign-in page. Sign in by using the account ID of the new member account and the Support1 IAM credentials. Set up the IAM users as required.
Show Answer
Correct Answer: B
Explanation: When an AWS Organizations member account is created, AWS automatically creates the OrganizationAccountAccessRole in the new account with full administrative permissions. An IAM user in the management account (Support1) can assume this role to gain administrative access to the member account and create IAM users. No IAM users are automatically created in the member account, and using root credentials or management-account IAM credentials directly to sign in to the member account is not supported or recommended.
Question 159
A company is developing a web application that runs on Amazon EC2 instances in an Auto Scaling group behind a public-facing Application Load Balancer (ALB). Only users from a specific country are allowed to access the application. The company needs the ability to log the access requests that have been blocked. The solution should require the least possible maintenance.
Which solution meets these requirements?
A. Create an IPSet containing a list of IP ranges that belong to the specified country. Create an AWS WAF web ACL. Configure a rule to block any requests that do not originate from an IP range in the IPSet. Associate the rule with the web ACL. Associate the web ACL with the ALB.
B. Create an AWS WAF web ACL. Configure a rule to block any requests that do not originate from the specified country. Associate the rule with the web ACL. Associate the web ACL with the AL
C. Configure AWS Shield to block any requests that do not originate from the specified country. Associate AWS Shield with the ALB.
D. Create a security group rule that allows ports 80 and 443 from IP ranges that belong to the specified country. Associate the security group with the ALB.
Show Answer
Correct Answer: B
Explanation: AWS WAF supports geo match rules that can allow or block requests based on the requester’s country without managing IP address lists. A WAF web ACL can be associated directly with an Application Load Balancer and configured to log blocked requests to Amazon CloudWatch Logs, Amazon S3, or Kinesis Data Firehose. This approach meets the geo-restriction and logging requirements with the least ongoing maintenance. Option A requires manual or ongoing management of IP ranges, Option C (AWS Shield) is for DDoS protection and does not provide geo-blocking, and Option D lacks logging and requires IP range maintenance.
Question 160
A company provides a software as a service (SaaS) application that runs in the AWS Cloud. The application runs on Amazon EC2 instances behind a Network Load Balancer (NLB). The instances are in an Auto Scaling group and are distributed across three Availability Zones in a single AWS Region.
The company is deploying the application into additional Regions. The company must provide static IP addresses for the application to customers so that the customers can add the IP addresses to allow lists. The solution must automatically route customers to the Region that is geographically closest to them.
Which solution will meet these requirements?
A. Create an Amazon CloudFront distribution. Create a CloudFront origin group. Add the NLB for each additional Region to the origin group. Provide customers with the IP address ranges of the distribution’s edge locations.
B. Create an AWS Global Accelerator standard accelerator. Create a standard accelerator endpoint for the NLB in each additional Region. Provide customers with the Global Accelerator IP address.
C. Create an Amazon CloudFront distribution. Create a custom origin for the NLB in each additional Region. Provide customers with the IP address ranges of the distribution’s edge locations.
D. Create an AWS Global Accelerator custom routing accelerator. Create a listener for the custom routing accelerator. Add the IP address and ports for the NLB in each additional Region. Provide customers with the Global Accelerator IP address.
Show Answer
Correct Answer: B
Explanation: AWS Global Accelerator standard accelerators provide two static anycast IP addresses that customers can allow list. Global Accelerator automatically routes users to the closest healthy AWS Region based on network latency. Standard accelerators directly support Network Load Balancers as endpoints, making them ideal for multi-Region NLB-based SaaS architectures. CloudFront does not provide fixed IPs suitable for customer allow lists, and custom routing accelerators are for deterministic instance-level routing, not geographic proximity routing.
Question 161
A company is migrating to the cloud. It wants to evaluate the configurations of virtual machines in its existing data center environment to ensure that it can size new Amazon EC2 instances accurately. The company wants to collect metrics, such as CPU, memory, and disk utilization, and it needs an inventory of what processes are running on each instance. The company would also like to monitor network connections to map communications between servers.
Which would enable the collection of this data MOST cost effectively?
A. Use AWS Application Discovery Service and deploy the data collection agent to each virtual machine in the data center.
B. Configure the Amazon CloudWatch agent on all servers within the local environment and publish metrics to Amazon CloudWatch Logs.
C. Use AWS Application Discovery Service and enable agentless discovery in the existing virtualization environment.
D. Enable AWS Application Discovery Service in the AWS Management Console and configure the corporate firewall to allow scans over a VPN.
Show Answer
Correct Answer: A
Explanation: The requirements include collecting CPU, memory, and disk utilization, inventorying running processes, and monitoring network connections between servers. AWS Application Discovery Service with the agent-based discovery is the only option that collects detailed OS-level data such as running processes and inbound/outbound network connections, in addition to utilization metrics. Agentless discovery cannot collect process or network connection details and is limited to certain virtualization platforms. CloudWatch agents are not designed for on-premises discovery and would be more complex and less cost effective. Therefore, deploying the Application Discovery Service agent is the most cost-effective and complete solution.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.