A company built an ecommerce website on AWS using a three-tier web architecture. The application is Java-based and composed of an Amazon CloudFront distribution, an Apache web server layer of Amazon EC2 instances in an Auto Scaling group, and a backend Amazon Aurora MySQL database.
Last month, during a promotional sales event, users reported errors and timeouts while adding items to their shopping carts. The operations team recovered the logs created by the web servers and reviewed Aurora DB cluster performance metrics. Some of the web servers were terminated before logs could be collected and the Aurora metrics were not sufficient for query performance analysis.
Which combination of steps must the solutions architect take to improve application performance visibility during peak traffic events? (Choose three.)
A. Configure the Aurora MySQL DB cluster to publish slow query and error logs to Amazon CloudWatch Logs.
B. Implement the AWS X-Ray SDK to trace incoming HTTP requests on the EC2 instances and implement tracing of SQL queries with the X-Ray SDK for Java.
C. Configure the Aurora MySQL DB cluster to stream slow query and error logs to Amazon Kinesis.
D. Install and configure an Amazon CloudWatch Logs agent on the EC2 instances to send the Apache logs to CloudWatch Logs.
E. Enable and configure AWS CloudTrail to collect and analyze application activity from Amazon EC2 and Aurora
F. Enable Aurora MySQL DB cluster performance benchmarking and publish the stream to AWS X-Ray.
Show Answer
Correct Answer: A, B, D
Explanation: To improve visibility during peak traffic, the team needs durable log collection and end-to-end request tracing. Publishing Aurora MySQL slow query and error logs to CloudWatch Logs enables detailed database query analysis beyond basic metrics (A). Implementing AWS X-Ray on the Java application allows tracing of HTTP requests through the web tier and into SQL calls, helping identify latency bottlenecks across tiers (B). Installing the CloudWatch Logs agent on EC2 ensures Apache logs are centrally collected and retained even if instances are terminated by Auto Scaling (D). Other options either add unnecessary complexity, focus on API auditing rather than performance, or describe non-existent features.
Question 163
A company that provisions job boards for a seasonal workforce is seeing an increase in traffic and usage. The backend services run on a pair of Amazon EC2 instances behind an Application Load Balancer with Amazon DynamoDB as the datastore. Application read and write traffic is slow during peak seasons.
Which option provides a scalable application architecture to handle peak seasons with the LEAST development effort?
A. Migrate the backend services to AWS Lambda. Increase the read and write capacity of DynamoDB.
B. Migrate the backend services to AWS Lambda. Configure DynamoDB to use global tables.
C. Use Auto Scaling groups for the backend services. Use DynamoDB auto scaling.
D. Use Auto Scaling groups for the backend services. Use Amazon Simple Queue Service (Amazon SQS) and an AWS Lambda function to write to DynamoDB.
Show Answer
Correct Answer: C
Explanation: The requirement is to handle peak seasonal traffic with the least development effort. Adding Auto Scaling groups to the existing EC2-based backend preserves the current architecture while allowing horizontal scaling under load. Enabling DynamoDB auto scaling automatically adjusts read and write capacity to match demand. Other options require significant refactoring (migrating to Lambda) or introduce additional components and complexity (SQS and Lambda), which increases development effort.
Question 164
A company has a solution that analyzes weather data from thousands of weather stations. The weather stations send the data over an Amazon API Gateway REST API that has an AWS Lambda function integration. The Lambda function calls a third-party service for data pre-processing. The third-party service gets overloaded and fails the pre-processing, causing a loss of data.
A solutions architect must improve the resiliency of the solution. The solutions architect must ensure that no data is lost and that data can be processed later if failures occur.
What should the solutions architect do to meet these requirements?
A. Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure the queue as the dead-letter queue for the API.
B. Create two Amazon Simple Queue Service (Amazon SQS) queues: a primary queue and a secondary queue. Configure the secondary queue as the dead-letter queue for the primary queue. Update the API to use a new integration to the primary queue. Configure the Lambda function as the invocation target for the primary queue.
C. Create two Amazon EventBridge event buses: a primary event bus and a secondary event bus. Update the API to use a new integration to the primary event bus. Configure an EventBridge rule to react to all events on the primary event bus. Specify the Lambda function as the target of the rule. Configure the secondary event bus as the failure destination for the Lambda function.
D. Create a custom Amazon EventBridge event bus. Configure the event bus as the failure destination for the Lambda function.
Show Answer
Correct Answer: B
Explanation: To prevent data loss and improve resiliency, the ingestion layer must durably store incoming data and decouple it from downstream processing. Integrating API Gateway with an Amazon SQS primary queue ensures all weather data is persisted even if downstream systems fail. Configuring a secondary SQS queue as a dead-letter queue captures messages that cannot be processed after retries by the Lambda function (for example, when the third-party service is overloaded). This allows failed data to be reprocessed later. The other options do not provide the same durable buffering and retry/DLQ semantics directly at the ingestion point.
Question 165
A company has a web application that securely uploads pictures and videos to an Amazon S3 bucket. The company requires that only authenticated users are allowed to post content. The application generates a presigned URL that is used to upload objects through a browser interface. Most users are reporting slow upload times for objects larger than 100 MB.
What can a solutions architect do to improve the performance of these uploads while ensuring only authenticated users are allowed to post content?
A. Set up an Amazon API Gateway with an edge-optimized API endpoint that has a resource as an S3 service proxy. Configure the PUT method for this resource to expose the S3 PutObject operation. Secure the API Gateway using a COGNITO_USER_POOLS authorizer. Have the browser interface use API Gateway instead of the presigned URL to upload objects.
B. Set up an Amazon API Gateway with a regional API endpoint that has a resource as an S3 service proxy. Configure the PUT method for this resource to expose the S3 PutObject operation. Secure the API Gateway using an AWS Lambda authorizer. Have the browser interface use API Gateway instead of the presigned URL to upload objects.
C. Enable an S3 Transfer Acceleration endpoint on the S3 bucket. Use the endpoint when generating the presigned URL. Have the browser interface upload the objects to this URL using the S3 multipart upload API.
D. Configure an Amazon CloudFront distribution for the destination S3 bucket. Enable PUT and POST methods for the CloudFront cache behavior. Update the CloudFront origin to use an origin access identity (OAI). Give the OAI user 3: PutObject permissions in the bucket policy. Have the browser interface upload objects using the CloudFront distribution.
Show Answer
Correct Answer: C
Explanation: Large uploads are slow when sent directly over long distances. Amazon S3 Transfer Acceleration uses AWS edge locations to speed up data transfer to S3, which is ideal for objects larger than 100 MB. Presigned URLs continue to ensure that only authenticated users can upload, and using multipart upload further improves performance and reliability for large files. API Gateway options are unsuitable due to payload size limits, and CloudFront is not designed for accelerating uploads to S3 in this way.
Question 166
A large company is migrating its entire IT portfolio to AWS. Each business unit in the company has a standalone AWS account that supports both development and test environments. New accounts to support production workloads will be needed soon.
The finance department requires a centralized method for payment but must maintain visibility into each group's spending to allocate costs.
The security team requires a centralized mechanism to control IAM usage in all the company’s accounts.
What combination of the following options meets the company’s needs with the LEAST effort? (Choose two.)
A. Use a collection of parameterized AWS CloudFormation templates defining common IAM permissions that are launched into each account. Require all new and existing accounts to launch the appropriate stacks to enforce the least privilege model.
B. Use AWS Organizations to create a new organization from a chosen payer account and define an organizational unit hierarchy. Invite the existing accounts to join the organization and create new accounts using Organizations.
C. Require each business unit to use its own AWS accounts. Tag each AWS account appropriately and enable Cost Explorer to administer chargebacks.
D. Enable all features of AWS Organizations and establish appropriate service control policies that filter IAM permissions for sub-accounts.
E. Consolidate all of the company's AWS accounts into a single AWS account. Use tags for billing purposes and the IAM’s Access Advisor feature to enforce the least privilege model.
Show Answer
Correct Answer: B, D
Explanation: AWS Organizations provides a centralized payer account with consolidated billing and cost visibility across member accounts, meeting the finance requirement with minimal effort. Enabling all features of AWS Organizations and using Service Control Policies (SCPs) allows the security team to centrally control and restrict IAM and service usage across all accounts. Other options either lack centralized control, increase operational overhead, or violate best practices.
Question 167
A company that provides image storage services wants to deploy a customer-facing solution to AWS. Millions of individual customers will use the solution. The solution will receive batches of large image files, resize the files, and store the files in an Amazon S3 bucket for up to 6 months.
The solution must handle significant variance in demand. The solution must also be reliable at enterprise scale and have the ability to rerun processing jobs in the event of failure.
Which solution will meet these requirements MOST cost-effectively?
A. Use AWS Step Functions to process the S3 event that occurs when a user stores an image. Run an AWS Lambda function that resizes the image in place and replaces the original file in the S3 bucket. Create an S3 Lifecycle expiration policy to expire all stored images after 6 months.
B. Use Amazon EventBridge to process the S3 event that occurs when a user uploads an image. Run an AWS Lambda function that resizes the image in place and replaces the original file in the S3 bucket. Create an S3 Lifecycle expiration policy to expire all stored images after 6 months.
C. Use S3 Event Notifications to invoke an AWS Lambda function when a user stores an image. Use the Lambda function to resize the image in place and to store the original file in the S3 bucket. Create an S3 Lifecycle policy to move all stored images to S3 Standard-Infrequent Access (S3 Standard-IA) after 6 months.
D. Use Amazon Simple Queue Service (Amazon SQS) to process the S3 event that occurs when a user stores an image. Run an AWS Lambda function that resizes the image and stores the resized file in an S3 bucket that uses S3 Standard-Infrequent Access (S3 Standard-IA). Create an S3 Lifecycle policy to move all stored images to S3 Glacier Deep Archive after 6 months.
Show Answer
Correct Answer: D
Explanation: The key requirements are massive scale with bursty demand, enterprise reliability, and the ability to rerun processing jobs after failures. Using SQS to decouple S3 ingestion from processing provides durable buffering, retry semantics, and dead-letter queues, which directly supports rerunning failed jobs and handling traffic spikes cost‑effectively. Lambda scales automatically for image resizing, and S3 lifecycle policies reduce storage cost over time. Options A, B, and C invoke Lambda directly from events, which offers limited retry control and no straightforward job replay mechanism at scale. Therefore, option D best satisfies all requirements most cost‑effectively.
Question 168
A company runs an intranet application on premises. The company wants to configure a cloud backup of the application. The company has selected AWS Elastic Disaster Recovery for this solution.
The company requires that replication traffic does not travel through the public internet. The application also must not be accessible from the internet. The company does not want this solution to consume all available network bandwidth because other applications require bandwidth.
Which combination of steps will meet these requirements? (Choose three.)
A. Create a VPC that has at least two private subnets, two NAT gateways, and a virtual private gateway.
B. Create a VPC that has at least two public subnets, a virtual private gateway, and an internet gateway.
C. Create an AWS Site-to-Site VPN connection between the on-premises network and the target AWS network.
D. Create an AWS Direct Connect connection and a Direct Connect gateway between the on-premises network and the target AWS network.
E. During configuration of the replication servers, select the option to use private IP addresses for data replication.
F. During configuration of the launch settings for the target servers, select the option to ensure that the Recovery instance’s private IP address matches the source server's private IP address.
Show Answer
Correct Answer: A, D, E
Explanation: Replication traffic must not traverse the public internet and bandwidth consumption must be controlled. AWS Direct Connect provides a dedicated private connection that avoids the public internet and prevents saturation of existing internet bandwidth (D). Elastic Disaster Recovery must be configured to use private IP addresses for replication so traffic stays on the private connection (E). To ensure the application is not internet-accessible, the target environment should use private subnets within a VPC (A); the presence of NAT gateways does not allow inbound internet access and does not violate the requirement.
Question 169
A live-events company is designing a scaling solution for its ticket application on AWS. The application has high peaks of utilization during sale events. Each sale event is a one-time event that is scheduled. The application runs on Amazon EC2 instances that are in an Auto Scaling group. The application uses PostgreSQL for the database layer.
The company needs a scaling solution to maximize availability during the sale events.
Which solution will meet these requirements?
A. Use a predictive scaling policy for the EC2 instances. Host the database on an Amazon Aurora PostgreSQL Serverless v2 Multi-AZ DB instance with automatically scaling read replicas. Create an AWS Step Functions state machine to run parallel AWS Lambda functions to pre-warm the database before a sale event. Create an Amazon EventBridge rule to invoke the state machine.
B. Use a scheduled scaling policy for the EC2 instances. Host the database on an Amazon RDS for PostgreSQL Mulli-AZ DB instance with automatically scaling read replicas. Create an Amazon EventBridge rule that invokes an AWS Lambda function to create a larger read replica before a sale event. Fail over to the larger read replica. Create another EventBridge rule that invokes another Lambda function to scale down the read replica after the sale event.
C. Use a predictive scaling policy for the EC2 instances. Host the database on an Amazon RDS for PostgreSQL MultiAZ DB instance with automatically scaling read replicas. Create an AWS Step Functions state machine to run parallel AWS Lambda functions to pre-warm the database before a sale event. Create an Amazon EventBridge rule to invoke the state machine.
D. Use a scheduled scaling policy for the EC2 instances. Host the database on an Amazon Aurora PostgreSQL Multi-AZ DB cluster. Create an Amazon EventBridge rule that invokes an AWS Lambda function to create a larger Aurora Replica before a sale event. Fail over to the larger Aurora Replica. Create another EventBridge rule that invokes another Lambda function to scale down the Aurora Replica after the sale event.
Show Answer
Correct Answer: D
Explanation: Sale events are scheduled, one-time spikes, so scheduled scaling is more appropriate than predictive scaling for the EC2 Auto Scaling group. To maximize availability at the database layer during sudden, extreme load, Amazon Aurora PostgreSQL provides higher availability and faster replica promotion than standard RDS PostgreSQL. Pre-provisioning a larger Aurora Replica before the event and failing over ensures sufficient write and read capacity at peak time, while scaling down afterward optimizes cost. This approach best aligns compute and database capacity with known traffic surges.
Question 170
A company has multiple AWS accounts. The company recently had a security audit that revealed many unencrypted Amazon Elastic Block Store (Amazon EBS) volumes attached to Amazon EC2 instances.
A solutions architect must encrypt the unencrypted volumes and ensure that unencrypted volumes will be detected automatically in the future. Additionally, the company wants a solution that can centrally manage multiple AWS accounts with a focus on compliance and security.
Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)
A. Create an organization in AWS Organizations. Set up AWS Control Tower, and turn on the strongly recommended controls (guardrails). Join all accounts to the organization. Categorize the AWS accounts into OUs.
B. Use the AWS CLI to list all the unencrypted volumes in all the AWS accounts. Run a script to encrypt all the unencrypted volumes in place.
C. Create a snapshot of each unencrypted volume. Create a new encrypted volume from the unencrypted snapshot. Detach the existing volume, and replace it with the encrypted volume.
D. Create an organization in AWS Organizations. Set up AWS Control Tower, and turn on the mandatory controls (guardrails). Join all accounts to the organization. Categorize the AWS accounts into OUs.
E. Turn on AWS CloudTrail. Configure an Amazon EventBridge rule to detect and automatically encrypt unencrypted volumes.
Show Answer
Correct Answer: A, C
Explanation: The company needs centralized, multi-account governance with automatic detection of noncompliant resources and a way to remediate existing unencrypted EBS volumes. AWS Control Tower with strongly recommended guardrails provides centralized account management and continuous detection of unencrypted EBS volumes across accounts. Existing unencrypted EBS volumes cannot be encrypted in place, so the correct remediation is to create snapshots, create new encrypted volumes from those snapshots, and replace the original volumes.
Question 171
A company hosts a VPN in an on-premises data center. Employees currently connect to the VPN to access files in their Windows home directories. Recently, there has been a large growth in the number of employees who work remotely. As a result, bandwidth usage for connections into the data center has begun to reach 100% during business hours.
The company must design a solution on AWS that will support the growth of the company's remote workforce, reduce the bandwidth usage for connections into the data center, and reduce operational overhead.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
A. Create an AWS Storage Gateway Volume Gateway. Mount a volume from the Volume Gateway to the on-premises file server.
B. Migrate the home directories to Amazon FSx for Windows File Server.
C. Migrate the home directories to Amazon FSx for Lustre.
D. Migrate remote users to AWS Client VPN.
E. Create an AWS Direct Connect connection from the on-premises data center to AWS.
Show Answer
Correct Answer: B, D
Explanation: Migrating Windows home directories to Amazon FSx for Windows File Server provides a fully managed, native SMB file system that integrates with Active Directory and removes the need to operate on‑premises file servers, minimizing operational overhead. Moving remote users to AWS Client VPN allows employees to connect directly to AWS-hosted resources instead of backhauling traffic through the on‑premises data center, which significantly reduces inbound data center bandwidth usage and scales easily for a growing remote workforce.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.