A company has application services that have been containerized and deployed on multiple Amazon EC2 instances with public IPs. An Apache Kafka cluster has been deployed to the EC2 instances. A PostgreSQL database has been migrated to Amazon RDS for PostgreSQL. The company expects a significant increase of orders on its platform when a new version of its flagship product is released.
What changes to the current architecture will reduce operational overhead and support the product release?
A. Create an EC2 Auto Scaling group behind an Application Load Balancer. Create additional read replicas for the DB instance. Create Amazon Kinesis data streams and configure the application services to use the data streams. Store and serve static content directly from Amazon S3.
B. Create an EC2 Auto Scaling group behind an Application Load Balancer. Deploy the DB instance in Multi-AZ mode and enable storage auto scaling. Create Amazon Kinesis data streams and configure the application services to use the data streams. Store and serve static content directly from Amazon S3.
C. Deploy the application on a Kubernetes cluster created on the EC2 instances behind an Application Load Balancer. Deploy the DB instance in Multi-AZ mode and enable storage auto scaling. Create an Amazon Managed Streaming for Apache Kafka cluster and configure the application services to use the cluster. Store static content in Amazon S3 behind an Amazon CloudFront distribution.
D. Deploy the application on Amazon Elastic Kubernetes Service (Amazon EKS) with AWS Fargate and enable auto scaling behind an Application Load Balancer. Create additional read replicas for the DB instance. Create an Amazon Managed Streaming for Apache Kafka cluster and configure the application services to use the cluster. Store static content in Amazon S3 behind an Amazon CloudFront distribution.
Show Answer
Correct Answer: D
Explanation: The goal is to reduce operational overhead while handling a significant traffic increase. Amazon EKS with AWS Fargate removes the need to manage EC2 instances for containers and provides built-in scaling behind an Application Load Balancer. Using Amazon MSK replaces self-managed Kafka, reducing operational burden while supporting high throughput. RDS read replicas improve read scalability for increased order volume. Serving static content from Amazon S3 with CloudFront offloads traffic and improves performance globally. Other options either retain self-managed infrastructure (EC2, self-managed Kafka) or provide less operational reduction.
Question 173
A company is using Amazon API Gateway to deploy a private REST API that will provide access to sensitive data. The API must be accessible only from an application that is deployed in a VPC. The company deploys the API successfully. However, the API is not accessible from an Amazon EC2 instance that is deployed in the VPC.
Which solution will provide connectivity between the EC2 instance and the API?
A. Create an interface VPC endpoint for API Gateway. Attach an endpoint policy that allows apigateway:* actions. Disable private DNS naming for the VPC endpoint. Configure an API resource policy that allows access from the VPC. Use the VPC endpoint's DNS name to access the API.
B. Create an interface VPC endpoint for API Gateway. Attach an endpoint policy that allows the execute-api:Invoke action. Enable private DNS naming for the VPC endpoint. Configure an API resource policy that allows access from the VPC endpoint. Use the API endpoint’s DNS names to access the API.
C. Create a Network Load Balancer (NLB) and a VPC link. Configure private integration between API Gateway and the NLB. Use the API endpoint’s DNS names to access the API.
D. Create an Application Load Balancer (ALB) and a VPC Link. Configure private integration between API Gateway and the ALB. Use the ALB endpoint’s DNS name to access the API.
Show Answer
Correct Answer: B
Explanation: For a private REST API in Amazon API Gateway, access from resources inside a VPC requires an interface VPC endpoint (AWS PrivateLink) for API Gateway (execute-api). The EC2 instance must route traffic through this endpoint. The endpoint policy should allow execute-api:Invoke, private DNS must be enabled so the standard API Gateway DNS name resolves to the VPC endpoint, and the API’s resource policy must explicitly allow access from that VPC endpoint. This configuration provides private connectivity without internet access.
Question 174
A large payroll company recently merged with a small staffing company. The unified company now has multiple business units, each with its own existing AWS account.
A solutions architect must ensure that the company can centrally manage the billing and access policies for all the AWS accounts. The solutions architect configures AWS Organizations by sending an invitation to all member accounts of the company from a centralized management account.
What should the solutions architect do next to meet these requirements?
A. Create the OrganizationAccountAccess IAM group in each member account. Include the necessary IAM roles for each administrator.
B. Create the OrganizationAccountAccessPolicy IAM policy in each member account. Connect the member accounts to the management account by using cross-account access.
C. Create the OrganizationAccountAccessRole IAM role in each member account. Grant permission to the management account to assume the IAM role.
D. Create the OrganizationAccountAccessRole IAM role in the management account. Attach the AdministratorAccess AWS managed policy to the IAM role. Assign the IAM role to the administrators in each member account.
Show Answer
Correct Answer: C
Explanation: After inviting existing accounts into AWS Organizations, the next step for centralized access management is to enable cross-account administration. This is done by creating the OrganizationAccountAccessRole in each member account and allowing the management account to assume that role. This role (typically with AdministratorAccess) lets administrators in the management account manage resources and policies in all member accounts while keeping access centralized and auditable. The other options place roles or policies in the wrong accounts or do not follow AWS Organizations best practices.
Question 175
A company is running a workload that consists of thousands of Amazon EC2 instances. The workload is running in a VPC that contains several public subnets and private subnets. The public subnets have a route for 0.0.0.0/0 to an existing internet gateway. The private subnets have a route for 0.0.0.0/0 to an existing NAT gateway.
A solutions architect needs to migrate the entire fleet of EC2 instances to use IPv6. The EC2 instances that are in private subnets must not be accessible from the public internet.
What should the solutions architect do to meet these requirements?
A. Update the existing VPC, and associate a custom IPv6 CIDR block with the VPC and all subnets. Update all the VPC route tables, and add a route for ::/0 to the internet gateway.
B. Update the existing VPC, and associate an Amazon-provided IPv6 CIDR block with the VPC and all subnets. Update the VPC route tables for all private subnets, and add a route for ::/0 to the NAT gateway.
C. Update the existing VPC, and associate an Amazon-provided IPv6 CIDR block with the VPC and all subnets. Create an egress-only internet gateway. Update the VPC route tables for all private subnets, and add a route for ::/0 to the egress-only internet gateway.
D. Update the existing VPC, and associate a custom IPV6 CIDR block with the VPC and all subnets. Create a new NAT gateway, and enable IPV6 support. Update the VPC route tables for all private subnets, and add a route for ::/0 to the IPv6-enabled NAT gateway.
Show Answer
Correct Answer: C
Explanation: To migrate to IPv6, the VPC and subnets must be associated with an IPv6 CIDR block. For private subnets, IPv6 traffic cannot use a NAT gateway because NAT gateways do not provide native IPv6 outbound-only behavior. Instead, an egress-only internet gateway is specifically designed for IPv6 to allow outbound traffic while blocking inbound connections from the internet. Using an Amazon-provided IPv6 CIDR block and routing ::/0 from private subnets to an egress-only internet gateway ensures IPv6 connectivity while keeping private instances inaccessible from the public internet.
Question 176
A company is managing many AWS accounts by using an organization in AWS Organizations. Different business units in the company run applications on Amazon EC2 instances. All the EC2 instances must have a BusinessUnit tag so that the company can track the cost for each business unit.
A recent audit revealed that some instances were missing this tag. The company manually added the missing tag to the instances.
What should a solutions architect do to enforce the tagging requirement in the future?
A. Enable tag policies in the organization. Create a tag policy for the BusinessUnit tag. Ensure that compliance with tag key capitalization is turned off. Implement the tag policy for the ec2:instance resource type. Attach the tag policy to the root of the organization.
B. Enable tag policies in the organization. Create a tag policy for the BusinessUnit tag. Ensure that compliance with tag key capitalization is turned on. Implement the tag policy for the ec2:instance resource type. Attach the tag policy to the organization's management account.
C. Create an SCP and attach the SCP to the root of the organization. Include the following statement in the SCP:
D. Create an SCP and attach the SCP to the organization’s management account. Include the following statement in the SCP:
Show Answer
Correct Answer: C
Explanation: To enforce mandatory tagging going forward, the company must prevent the creation of EC2 instances that do not include the required BusinessUnit tag. AWS Organizations tag policies only provide governance and reporting; they do not block resource creation when tags are missing. Service Control Policies (SCPs), however, can explicitly deny API actions such as ec2:RunInstances if a required tag is not present in the request. Attaching an SCP with a condition that requires the BusinessUnit tag to the root of the organization ensures that all member accounts are enforced consistently.
Question 177
A company’s CISO has asked a solutions architect to re-engineer the company's current CI/CD practices to make sure patch deployments to its application can happen as quickly as possible with minimal downtime if vulnerabilities are discovered. The company must also be able to quickly roll back a change in case of errors.
The web application is deployed in a fleet of Amazon EC2 instances behind an Application Load Balancer. The company is currently using GitHub to host the application source code, and has configured an AWS CodeBuild project to build the application. The company also intends to use AWS CodePipeline to trigger builds from GitHub commits using the existing CodeBuild project.
What CI/CD configuration meets all of the requirements?
A. Configure CodePipeline with a deploy stage using AWS CodeDeploy configured for in-place deployment. Monitor the newly deployed code, and, if there are any issues, push another code update
B. Configure CodePipeline with a deploy stage using AWS CodeDeploy configured for blue/green deployments. Monitor the newly deployed code, and, if there are any issues, trigger a manual rollback using CodeDeploy.
C. Configure CodePipeline with a deploy stage using AWS CloudFormation to create a pipeline for test and production stacks. Monitor the newly deployed code, and, if there are any issues, push another code update.
D. Configure the CodePipeline with a deploy stage using AWS OpsWorks and in-place deployments. Monitor the newly deployed code, and, if there are any issues, push another code update.
Show Answer
Correct Answer: B
Explanation: The requirements emphasize rapid patch deployment, minimal downtime, and the ability to quickly roll back if errors occur. AWS CodeDeploy blue/green deployments are designed for exactly this scenario with EC2 instances behind an Application Load Balancer. Blue/green allows traffic to be shifted to a new environment with the updated version while the old version remains intact. If issues are detected, CodeDeploy can quickly roll back by redirecting traffic to the previous environment, resulting in minimal downtime. In-place deployments, CloudFormation stack updates, or OpsWorks do not provide the same fast, low-risk rollback capability.
Question 178
A company needs to monitor a growing number of Amazon S3 buckets across two AWS Regions. The company also needs to track the percentage of objects that are encrypted in Amazon S3. The company needs a dashboard to display this information for internal compliance teams.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a new 3 Storage Lens dashboard in each Region to track bucket and encryption metrics. Aggregate data from both Region dashboards into a single dashboard in Amazon QuickSight for the compliance teams.
B. Deploy an AWS Lambda function in each Region to list the number of buckets and the encryption status of objects. Store this data in Amazon S3. Use Amazon Athena queries to display the data on a custom dashboard in Amazon QuickSight for the compliance teams.
C. Use the S3 Storage Lens default dashboard to track bucket and encryption metrics. Give the compliance teams access to the dashboard directly in the S3 console.
D. Create an Amazon EventBridge rule to detect AWS CloudTrail events for S3 object creation. Configure the rule to invoke an AWS Lambda function to record encryption metrics in Amazon DynamoDB. Use Amazon QuickSight to display the metrics in a dashboard for the compliance teams.
Show Answer
Correct Answer: C
Explanation: Amazon S3 Storage Lens provides a built-in, default dashboard that automatically aggregates metrics across buckets and Regions, including the percentage of encrypted objects. Granting compliance teams access to this dashboard requires no custom development, no additional services, and no data pipelines, resulting in the least operational overhead compared to building custom dashboards with Lambda, Athena, EventBridge, or QuickSight.
Question 180
A financial services company has an asset management product that thousands of customers use around the world. The customers provide feedback about the product through surveys. The company is building a new analytical solution that runs on Amazon EMR to analyze the data from these surveys. The following user personas need to access the analytical solution to perform different actions:
• Administrator: Provisions the EMR cluster for the analytics team based on the team’s requirements
• Data engineer: Runs ETL scripts to process, transform, and enrich the datasets
• Data analyst: Runs SQL and Hive queries on the data
A solutions architect must ensure that all the user personas have least privilege access to only the resources that they need. The user personas must be able to launch only applications that are approved and authorized. The solution also must ensure tagging for all resources that the user personas create.
Which solution will meet these requirements?
A. Create IAM roles for each user persona. Attach identity-based policies to define which actions the user who assumes the role can perform. Create an AWS Config rule to check for noncompliant resources. Configure the rule to notify the administrator to remediate the noncompliant resources.
B. Setup Kerberos-based authentication for EMR clusters upon launch. Specify a Kerberos security configuration along with cluster-specific Kerberos options.
C. Use AWS Service Catalog to control the Amazon EMR versions available for deployment, the cluster configuration, and the permissions for each user persona.
D. Launch the EMR cluster by using AWS CloudFormation, Attach resource-based policies to the EMR cluster during cluster creation. Create an AWS. Config rule to check for noncompliant clusters and noncompliant Amazon S3 buckets. Configure the rule to notify the administrator to remediate the noncompliant resources.
Show Answer
Correct Answer: C
Explanation: AWS Service Catalog allows the company to define preapproved Amazon EMR products (specific EMR versions, applications, and cluster configurations) and control which user personas can provision or use them. This ensures users can launch only approved and authorized applications. Permissions can be scoped per persona to enforce least privilege without granting direct EMR access. Service Catalog also supports mandatory and automatic tagging of all provisioned resources, meeting governance and compliance requirements. Other options either lack control over approved applications or only detect noncompliance after deployment.
Question 181
A company is planning to migrate to the AWS Cloud. The company hosts many applications on Windows servers and Linux servers. Some of the servers are physical, and some of the servers are virtual. The company uses several types of databases in its on-premises environment. The company does not have an accurate inventory of its on-premises servers and applications.
The company wants to rightsize its resources during migration. A solutions architect needs to obtain information about the network connections and the application relationships. The solutions architect must assess the company’s current environment and develop a migration plan.
Which solution will provide the solutions architect with the required information to develop the migration plan?
A. Use Migration Evaluator to request an evaluation of the environment from AWS. Use the AWS Application Discovery Service Agentless Collector to import the details into a Migration Evaluator Quick Insights report.
B. Use AWS Migration Hub and install the AWS Application Discovery Agent on the servers. Deploy the Migration Hub Strategy Recommendations application data collector. Generate a report by using Migration Hub Strategy Recommendations.
C. Use AWS Migration Hub and run the AWS Application Discovery Service Agentless Collector on the servers. Group the servers and databases by using AWS Application Migration Service. Generate a report by using Migration Hub Strategy Recommendations.
D. Use the AWS Migration Hub import tool to load the details of the company’s on-premises environment. Generate a report by using Migration Hub Strategy Recommendations.
Show Answer
Correct Answer: B
Explanation: The company lacks an accurate inventory and needs detailed information about network connections, application dependencies, system performance, and relationships across both physical and virtual Windows and Linux servers. AWS Application Discovery Service **Agent** (not agentless) is required to collect process-level and network dependency data and to support physical servers. Using AWS Migration Hub with the Discovery Agent and Migration Hub Strategy Recommendations provides comprehensive discovery, dependency mapping, and rightsizing insights to assess the environment and build a migration plan. Other options rely on agentless collection or data import, which are insufficient without an existing inventory or physical server support.
Question 182
A company is planning to migrate its on-premises transaction-processing application to AWS. The application runs inside Docker containers that are hosted on VMs in the company's data center. The Docker containers have shared storage where the application records transaction data.
The transactions are time sensitive. The volume of transactions inside the application is unpredictable. The company must implement a low-latency storage solution that will automatically scale throughput to meet increased demand. The company cannot develop the application further and cannot continue to administer the Docker hosting environment.
How should the company migrate the application to AWS to meet these requirements?
A. Migrate the containers that run the application to Amazon Elastic Kubernetes Service (Amazon EKS). Use Amazon S3 to store the transaction data that the containers share.
B. Migrate the containers that run the application to AWS Fargate for Amazon Elastic Container Service (Amazon ECS). Create an Amazon Elastic File System (Amazon EFS) file system. Create a Fargate task definition. Add a volume to the task definition to point to the EFS file system.
C. Migrate the containers that run the application to AWS Fargate for Amazon Elastic Container Service (Amazon ECS). Create an Amazon Elastic Block Store (Amazon EBS) volume. Create a Fargate task definition. Attach the EBS volume to each running task.
D. Launch Amazon EC2 instances. Install Docker on the EC2 instances. Migrate the containers to the EC2 instances. Create an Amazon Elastic File System (Amazon EFS) file system. Add a mount point to the EC2 instances for the EFS file system.
Show Answer
Correct Answer: B
Explanation: The company needs a managed container runtime (no Docker host administration), shared storage across containers, low latency, and automatic scaling of throughput for unpredictable, time-sensitive transactions. AWS Fargate removes the need to manage servers or the container hosting environment. Amazon EFS provides shared, low-latency file storage that automatically scales throughput with demand and supports concurrent access by multiple containers. Integrating EFS with ECS Fargate via a task definition directly meets all requirements. Other options fail because S3 has higher latency, EBS cannot be shared across multiple Fargate tasks, or EC2 requires ongoing infrastructure administration.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.