A company has used infrastructure as code (IaC) to provision a set of two Amazon EC2 instances. The instances have remained the same for several years.
The company's business has grown rapidly in the past few months. In response, the company’s operations team has implemented an Auto Scaling group to manage the sudden increases in traffic. Company policy requires a monthly installation of security updates on all operating systems that are running.
The most recent security update required a reboot. As a result, the Auto Scaling group terminated the instances and replaced them with new, unpatched instances.
Which combination of steps should a solutions architect recommend to avoid a recurrence of this issue? (Choose two.)
A. Modify the Auto Scaling group by setting the Update policy to target the oldest launch configuration for replacement.
B. Create a new Auto Scaling group before the next patch maintenance. During the maintenance window, patch both groups and reboot the instances.
C. Create an Elastic Load Balancer in front of the Auto Scaling group. Configure monitoring to ensure that target group health checks return healthy after the Auto Scaling group replaces the terminated instances.
D. Create automation scripts to patch an AMI, update the launch configuration, and invoke an Auto Scaling instance refresh.
E. Create an Elastic Load Balancer in front of the Auto Scaling group. Configure termination protection on the instances.
Show Answer
Correct Answer: A, D
Explanation: The intended solution is to ensure new instances are launched from an updated image and that the Auto Scaling group preferentially replaces instances using the oldest launch configuration. In practice, this means automating creation of a patched AMI, creating a new launch configuration (or launch template version), updating the ASG, and performing an instance refresh. Although the wording about updating a launch configuration is technically imprecise, this is the clear exam intent. The other options either do not address the root cause (B, C) or interfere with Auto Scaling behavior (E).
Question 189
A company is running an application on Amazon EC2 instances in the AWS Cloud. The application is using a MongoDB database with a replica set as its data tier. The MongoDB database is installed on systems in the company’s on-premises data center and is accessible through an AWS Direct Connect connection to the data center environment.
A solutions architect must migrate the on-premises MongoDB database to Amazon DocumentDB (with MongoDB compatibility).
Which strategy should the solutions architect choose to perform this migration?
A. Create a fleet of EC2 instances. Install MongoDB Community Edition on the EC2 instances, and create a database. Configure continuous synchronous replication with the database that is running in the on-premises data center.
B. Create an AWS Database Migration Service (AWS DMS) replication instance. Create a source endpoint for the on-premises MongoDB database by using change data capture (CDC). Create a target endpoint for the Amazon DocumentDB database. Create and run a DMS migration task.
C. Create a data migration pipeline by using AWS Data Pipeline. Define data nodes for the on-premises MongoDB database and the Amazon DocumentDB database. Create a scheduled task to run the data pipeline.
D. Create a source endpoint for the on-premises MongoDB database by using AWS Glue crawlers. Configure continuous asynchronous replication between the MongoDB database and the Amazon DocumentDB database.
Show Answer
Correct Answer: B
Explanation: AWS Database Migration Service (AWS DMS) supports migrations from MongoDB to Amazon DocumentDB. Configure a DMS replication instance, define the on-premises MongoDB as the source with change data capture (CDC) to capture ongoing changes, define Amazon DocumentDB as the target, and run a migration task for initial load plus continuous replication to minimize downtime.
Question 190
A solutions architect has launched multiple Amazon EC2 instances in a placement group within a single Availability Zone. Because of additional load on the system, the solutions architect attempts to add new instances to the placement group. However, the solutions architect receives an insufficient capacity error.
What should the solutions architect do to troubleshoot this issue?
A. Use a spread placement group. Set a minimum of eight instances for each Availability Zone.
B. Stop and start all the instances in the placement group. Try the launch again.
C. Create a new placement group. Merge the new placement group with the original placement group.
D. Launch the additional instances as Dedicated Hosts in the placement groups.
Show Answer
Correct Answer: B
Explanation: For a cluster placement group, an insufficient capacity error can occur when adding instances later because AWS cannot find contiguous capacity. AWS recommends stopping and starting all instances in the placement group, then retrying the launch so the instances may be placed on hardware with sufficient capacity for the entire group. The other options are incorrect: spread placement groups have different use cases and limits, placement groups cannot be merged, and Dedicated Hosts do not address this troubleshooting scenario.
Question 191
A company has a legacy application that runs on multiple NET Framework components. The components share the same Microsoft SQL Server database and communicate with each other asynchronously by using Microsoft Message Queueing (MSMQ).
The company is starting a migration to containerized .NET Core components and wants to refactor the application to run on AWS. The .NET Core components require complex orchestration. The company must have full control over networking and host configuration. The application's database model is strongly relational.
Which solution will meet these requirements?
A. Host the INET Core components on AWS App Runner. Host the database on Amazon RDS for SQL Server. Use Amazon EventBiridge for asynchronous messaging.
B. Host the .NET Core components on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. Host the database on Amazon DynamoDUse Amazon Simple Notification Service (Amazon SNS) for asynchronous messaging.
C. Host the .NET Core components on AWS Elastic Beanstalk. Host the database on Amazon Aurora PostgreSQL Serverless v2. Use Amazon Managed Streaming for Apache Kafka (Amazon MSK) for asynchronous messaging.
D. Host the NET Core components on Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type. Host the database on Amazon Aurora MySQL Serverless v2. Use Amazon Simple Queue Service (Amazon SQS) for asynchronous messaging.
Show Answer
Correct Answer: D
Explanation: The key requirement is full control over networking and host configuration, which points to Amazon ECS with the EC2 launch type rather than Fargate, App Runner, or Elastic Beanstalk. The workload requires container orchestration, which ECS provides. The database must remain strongly relational, so DynamoDB is unsuitable. Although Aurora MySQL requires a database migration from SQL Server, it is still a relational database. Amazon SQS is the AWS service that most closely matches MSMQ's asynchronous queueing pattern. Option A lacks the required host control, B uses a NoSQL database, and C does not provide the required host control.
Question 192
A North American company with headquarters on the East Coast is deploying a new web application running on Amazon EC2 in the us-east-1 Region. The application should dynamically scale to meet user demand and maintain resiliency. Additionally, the application must have disaster recovery capabilities in an active-passive configuration with the us-west-1 Region.
Which steps should a solutions architect take after creating a VPC in the us-east-1 Region?
A. Create a VPC in the us-west-1 Region. Use inter-Region VPC peering to connect both VPCs. Deploy an Application Load Balancer (ALB) spanning multiple Availability Zones (AZs) to the VPC in the us-east-1 Region. Deploy EC2 instances across multiple AZs in each Region as part of an Auto Scaling group spanning both VPCs and served by the ALB.
B. Deploy an Application Load Balancer (ALB) spanning multiple Availability Zones (AZs) to the VPC in the us-east-1 Region. Deploy EC2 instances across multiple AZs as part of an Auto Scaling group served by the ALDeploy the same solution to the us-west-1 Region. Create an Amazon Route 53 record set with a failover routing policy and health checks enabled to provide high availability across both Regions.
C. Create a VPC in the us-west-1 Region. Use inter-Region VPC peering to connect both VPCs. Deploy an Application Load Balancer (ALB) that spans both VPCs. Deploy EC2 instances across multiple Availability Zones as part of an Auto Scaling group in each VPC served by the ALB. Create an Amazon Route 53 record that points to the ALB.
D. Deploy an Application Load Balancer (ALB) spanning multiple Availability Zones (AZs) to the VPC in the us-east-1 Region. Deploy EC2 instances across multiple AZs as part of an Auto Scaling group served by the ALB. Deploy the same solution to the us-west-1 Region. Create separate Amazon Route 53 records in each Region that point to the ALB in the Region. Use Route 53 health checks to provide high availability across both Regions.
Show Answer
Correct Answer: B
Explanation: An ALB is a Regional service and cannot span Regions or VPCs across Regions, so options A and C are invalid. For an active-passive disaster recovery design, deploy the application stack (ALB across multiple AZs plus an Auto Scaling group) independently in both Regions, then use Amazon Route 53 failover routing with health checks to direct traffic to the primary Region and automatically fail over to the secondary Region if the primary becomes unhealthy. Option D mentions separate records and health checks but omits the failover routing policy required for an active-passive configuration.
Question 193
An online gaming company needs to optimize the cost of its workloads on AWS. The company uses a dedicated account to host the production environment for its online gaming application and an analytics application.
Amazon EC2 instances host the gaming application and must always be available. The EC2 instances run all year. The analytics application uses data that is stored in Amazon S3. The analytics application can be interrupted and resumed without issue.
Which solution will meet these requirements MOST cost-effectively?
A. Purchase an EC2 Instance Savings Plan for the online gaming application instances. Use On-Demand Instances for the analytics application.
B. Purchase an EC2 Instance Savings Plan for the online gaming application instances. Use Spot Instances for the analytics application.
C. Use Spot Instances for the online gaming application and the analytics application. Set up a catalog in AWS Service Catalog to provision services at a discount.
D. Use On-Demand Instances for the online gaming application. Use Spot Instances for the analytics application. Set up a catalog in AWS Service Catalog to provision services at a discount.
Show Answer
Correct Answer: B
Explanation: The production gaming application runs continuously and must always be available, making an EC2 Instance Savings Plan a cost-effective choice over the long term while maintaining availability. The analytics workload is fault-tolerant and can be interrupted and resumed, making EC2 Spot Instances the most cost-effective option. AWS Service Catalog does not provide compute discounts, so options including it for cost savings are incorrect.
Question 194
An online magazine will launch its latest edition this month. This edition will be the first to be distributed globally. The magazine's dynamic website currently uses an Application Load Balancer in front of the web tier, a fleet of Amazon EC2 instances for web and application servers, and Amazon Aurora MySQL. Portions of the website include static content and almost all traffic is read-only.
The magazine is expecting a significant spike in internet traffic when the new edition is launched. Optimal performance is a top priority for the week following the launch.
Which combination of steps should a solutions architect take to reduce system response times for a global audience? (Choose two.)
A. Use logical cross-Region replication to replicate the Aurora MySQL database to a secondary Region. Replace the web servers with Amazon S3. Deploy S3 buckets in cross-Region replication mode.
B. Ensure the web and application tiers are each in Auto Scaling groups. Introduce an AWS Direct Connect connection. Deploy the web and application tiers in Regions across the world.
C. Migrate the database from Amazon Aurora to Amazon RDS for MySQL. Ensure all three of the application tiers – web, application, and database – are in private subnets.
D. Use an Aurora global database for physical cross-Region replication. Use Amazon S3 with cross-Region replication for static content and resources. Deploy the web and application tiers in Regions across the world.
E. Introduce Amazon Route 53 with latency-based routing and Amazon CloudFront distributions. Ensure the web and application tiers are each in Auto Scaling groups.
Show Answer
Correct Answer: D, E
Explanation: For a global launch with mostly read-only traffic, use Aurora Global Database to provide low-latency cross-Region read replicas and fast replication. Store static assets in Amazon S3 with cross-Region replication to support regional deployments. Add Amazon CloudFront and Route 53 latency-based routing to direct users to the lowest-latency endpoints and cache static/dynamic content at the edge. Auto Scaling on the web and application tiers helps absorb the expected traffic spike. Direct Connect is unrelated to internet user performance, replacing the web tier entirely with S3 is not feasible because dynamic application logic remains, and migrating from Aurora to RDS would reduce capabilities rather than improve them.
Question 196
A company operates a fleet of servers on premises and operates a fleet of Amazon EC2 instances in its organization in AWS Organizations. The company's AWS accounts contain hundreds of VPCs. The company wants to connect its AWS accounts to its on-premises network. AWS Site-to-Site VPN connections are already established to a single AWS account. The company wants to control which VPCs can communicate with other VPCs.
Which combination of steps will achieve this level of control with the LEAST operational effort? (Choose three.)
A. Create a transit gateway in an AWS account. Share the transit gateway across accounts by using AWS Resource Access Manager (AWS RAM).
B. Configure attachments to all VPCs and VPNs.
C. Setup transit gateway route tables. Associate the VPCs and VPNs with the route tables.
D. Configure VPC peering between the VPCs.
E. Configure attachments between the VPCs and VPNs.
F. Setup route tables on the VPCs and VPNs.
Show Answer
Correct Answer: A, B, C
Explanation: Use AWS Transit Gateway as the central hub, share it across AWS accounts with AWS RAM, create Transit Gateway attachments for the VPCs and the existing Site-to-Site VPN connections, and use Transit Gateway route tables with associations/propagations to control which VPCs can communicate. VPC peering does not scale to hundreds of VPCs, and options describing attachments between VPCs and VPNs or configuring route tables on the VPCs/VPNs are not the primary mechanism for centralized connectivity control.
Question 198
A company needs to aggregate Amazon CloudWatch logs from its AWS accounts into one central logging account. The collected logs must remain in the AWS Region of creation. The central logging account will then process the logs, normalize the logs into standard output format, and stream the output logs to a security tool for more processing.
A solutions architect must design a solution that can handle a large volume of logging data that needs to be ingested. Less logging will occur outside normal business hours than during normal business hours. The logging solution must scale with the anticipated load. The solutions architect has decided to use an AWS Control Tower design to handle the multi-account logging process.
Which combination of steps should the solutions architect take to meet the requirements? (Choose three.)
A. Create a destination Amazon Kinesis data stream in the central logging account.
B. Create a destination Amazon Simple Queue Service (Amazon SQS) queue in the central logging account.
C. Create an IAM role that grants Amazon CloudWatch Logs the permission to add data to the Amazon Kinesis data stream. Create a trust policy. Specify the trust policy in the IAM role. In each member account, create a subscription filter for each log group to send data to the Kinesis data stream.
D. Create an IAM role that grants Amazon CloudWatch Logs the permission to add data to the Amazon Simple Queue Service (Amazon SQS) queue. Create a trust policy. Specify the trust policy in the IAM role. In each member account, create a single subscription filter for all log groups to send data to the SQS queue.
E. Create an AWS Lambda function. Program the Lambda function to normalize the logs in the central logging account and to write the logs to the security tool.
F. Create an AWS Lambda function. Program the Lambda function to normalize the logs in the member accounts and to write the logs to the security tool.
Show Answer
Correct Answer: A, C, E
Explanation: Use Amazon Kinesis Data Streams as the cross-account CloudWatch Logs subscription destination. CloudWatch Logs supports subscription filters to Kinesis Data Streams, not directly to SQS. Configure an IAM role with the required trust and permissions so CloudWatch Logs in member accounts can put records into the central Kinesis stream. Then use a Lambda function in the central logging account to normalize the logs and forward them to the downstream security tool. This centralizes processing while keeping logs in their Region of creation by using regional resources.
Question 199
A company runs applications in hundreds of production AWS accounts. The company uses AWS Organizations with all features enabled and has a centralized backup operation that uses AWS Backup.
The company is concerned about ransomware attacks. To address this concern, the company has created a new policy that all backups must be resilient to breaches of privileged-user credentials in any production account.
Which combination of steps will meet this new requirement? (Choose three.)
A. Implement cross-account backup with AWS Backup vaults in designated non-production accounts.
B. Add an SCP that restricts the modification of AWS Backup vaults.
C. Implement AWS Backup Vault Lock in compliance mode. Implement least privilege access for the IAM service role that is assigned to AWS Backup.
D. Configure the backup frequency, lifecycle, and retention period to ensure that at least one backup always exists in the cold tier.
E. Configure AWS Backup to write all backups to an Amazon S3 bucket in a designated non-production account. Ensure that the S3 bucket has S3 Object Lock enabled.
Show Answer
Correct Answer: A, B, C
Explanation: Use cross-account backups to isolated backup vaults in separate accounts so compromised production account credentials cannot directly destroy backups. Protect backup vault administration with AWS Organizations SCPs to prevent modification or deletion actions. Enable AWS Backup Vault Lock in compliance mode to make recovery points immutable for the configured retention period; least-privilege for the AWS Backup service role further limits permissions. Cold-tier retention does not address credential-compromise resilience, and AWS Backup does not write backups to arbitrary S3 buckets as a backup destination.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.