A solutions architect is reviewing an application's resilience before launch. The application runs on an Amazon EC2 instance that is deployed in a private subnet of a VPC. The EC2 instance is provisioned by an Auto Scaling group that has a minimum capacity of 1 and a maximum capacity of 1. The application stores data on an Amazon RDS for MySQL DB instance. The VPC has subnets configured in three Availability Zones and is configured with a single NAT gateway.
The solutions architect needs to recommend a solution to ensure that the application will operate across multiple Availability Zones.
Which solution will meet this requirement?
A. Deploy an additional NAT gateway in the other Availability Zones. Update the route tables with appropriate routes. Modify the RDS for MySQL DB instance to a Multi-AZ configuration. Configure the Auto Scaling group to launch the instances across Availability Zones. Set the minimum capacity and maximum capacity of the Auto Scaling group to 3.
B. Replace the NAT gateway with a virtual private gateway. Replace the RDS for MySQL DB instance with an Amazon Aurora MySQL DB cluster. Configure the Auto Scaling group to launch instances across all subnets in the VPC. Set the minimum capacity and maximum capacity of the Auto Scaling group to 3.
C. Replace the NAT gateway with a NAT instance. Migrate the RDS for MySQL DB instance to an RDS for PostgreSQL DB instance. Launch a new EC2 instance in the other Availability Zones.
D. Deploy an additional NAT gateway in the other Availability Zones. Update the route tables with appropriate routes. Modify the RDS for MySQL DB instance to turn on automatic backups and retain the backups for 7 days. Configure the Auto Scaling group to launch instances across all subnets in the VPC. Keep the minimum capacity and the maximum capacity of the Auto Scaling group at 1.
Show Answer
Correct Answer: A
Explanation: To operate across multiple Availability Zones, all tiers must be highly available. The EC2 layer must run instances in multiple AZs, which requires configuring the Auto Scaling group to span AZs and increasing min/max capacity above 1. The database must be resilient to AZ failure, which is achieved by enabling Multi-AZ on the RDS for MySQL instance. Because private subnets in multiple AZs require outbound internet access without a single point of failure, a NAT gateway should be deployed in each AZ with appropriate route tables. Option A is the only choice that addresses compute, database, and networking multi-AZ resilience correctly.
Question 185
A company has a project that is launching Amazon EC2 instances that are larger than required. The project's account cannot be part of the company's organization in AWS Organizations due to policy restrictions to keep this activity outside of corporate IT. The company wants to allow only the launch of t3.small EC2 instances by developers in the project's account. These EC2 instances must be restricted to the us-east-2 Region.
What should a solutions architect do to meet these requirements?
A. Create a new developer account. Move all EC2 instances, users, and assets into us-east-2. Add the account to the company's organization in AWS Organizations. Enforce a tagging policy that denotes Region affinity.
B. Create an SCP that denies the launch of all EC2 instances except t3.small EC2 instances in us-east-2. Attach the SCP to the project's account.
C. Create and purchase a t3.small EC2 Reserved Instance for each developer in us-east-2. Assign each developer a specific EC2 instance with their name as the tag.
D. Create an IAM policy than allows the launch of only t3.small EC2 instances in us-east-2. Attach the policy to the roles and groups that the developers use in the project's account.
Show Answer
Correct Answer: D
Explanation: The project account cannot be part of AWS Organizations, so Service Control Policies (SCPs) cannot be used, which eliminates option B. Reserved Instances do not restrict what instance types or Regions developers can launch, so option C does not enforce the requirement. Option A violates the requirement by adding the account to an organization and does not technically enforce instance type or Region. An IAM policy within the standalone account can explicitly allow only t3.small instance launches and restrict actions to the us-east-2 Region, making option D the correct solution.
Question 186
A team of data scientists is using Amazon SageMaker instances and SageMaker APIs to train machine learning (ML) models. The SageMaker instances are deployed in a VPC that does not have access to or from the internet. Datasets for ML model training are stored in an Amazon S3 bucket. Interface VPC endpoints provide access to Amazon S3 and the SageMaker APIs.
Occasionally, the data scientists require access to the Python Package Index (PyPI) repository to update Python packages that they use as part of their workflow. A solutions architect must provide access to the PyPI repository while ensuring that the SageMaker instances remain isolated from the internet.
Which solution will meet these requirements?
A. Create an AWS CodeCommit repository for each package that the data scientists need to access. Configure code synchronization between the PyPI repository and the CodeCommit repository. Create a VPC endpoint for CodeCommit.
B. Create a NAT gateway in the VPC. Configure VPC routes to allow access to the internet with a network ACL that allows access to only the PyPI repository endpoint.
C. Create a NAT instance in the VPConfigure VPC routes to allow access to the internet. Configure SageMaker notebook instance firewall rules that allow access to only the PyPI repository endpoint.
D. Create an AWS CodeArtifact domain and repository. Add an external connection for public:pypi to the CodeArtifact repository. Configure the Python client to use the CodeArtifact repository. Create a VPC endpoint for CodeArtifact.
Show Answer
Correct Answer: D
Explanation: The SageMaker instances must remain isolated from the internet while still allowing occasional access to PyPI packages. AWS CodeArtifact can act as a private package repository inside AWS. By creating a CodeArtifact repository with an external connection to public:pypi, packages can be fetched from PyPI by CodeArtifact, not directly by the SageMaker instances. Access to CodeArtifact can be provided privately through a VPC interface endpoint, so no internet or NAT access is required. The Python client can be configured to install packages from CodeArtifact, satisfying both isolation and functionality requirements.
Question 187
A company is rearchitecting its applications to run on AWS. The company’s infrastructure includes multiple Amazon EC2 instances. The company's development team needs different levels of access. The company wants to implement a policy that requires all Windows EC2 instances to be joined to an Active Directory domain on AWS. The company also wants to implement enhanced security processes such as multi-factor authentication (MFA). The company wants to use managed AWS services wherever possible.
Which solution will meet these requirements?
A. Create an AWS Directory Service for Microsoft Active Directory implementation. Launch an Amazon Workspace. Connect to and use the Workspace for domain security configuration tasks.
B. Create an AWS Directory Service for Microsoft Active Directory implementation. Launch an EC2 instance. Connect to and use the EC2 instance for domain security configuration tasks.
C. Create an AWS Directory Service Simple AD implementation. Launch an EC2 instance. Connect to and use the EC2 instance for domain security configuration tasks.
D. Create an AWS Directory Service Simple AD implementation. Launch an Amazon Workspace. Connect to and use the Workspace for domain security configuration tasks.
Show Answer
Correct Answer: B
Explanation: The requirements are to join Windows EC2 instances to an Active Directory domain, support enhanced security such as MFA, and use managed AWS services where possible. AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) is required because it provides full AD features, domain join for Windows EC2, and integration with MFA (for example, via RADIUS). Administration of the domain is best done from a Windows EC2 instance using standard AD tools. Amazon WorkSpaces are managed user desktops and are not required by the problem, which focuses on EC2 infrastructure rather than end-user VDI. Simple AD does not meet the full AD and MFA requirements. Therefore, option B best meets all requirements.
Question 188
A company has used infrastructure as code (IaC) to provision a set of two Amazon EC2 instances. The instances have remained the same for several years.
The company's business has grown rapidly in the past few months. In response, the company’s operations team has implemented an Auto Scaling group to manage the sudden increases in traffic. Company policy requires a monthly installation of security updates on all operating systems that are running.
The most recent security update required a reboot. As a result, the Auto Scaling group terminated the instances and replaced them with new, unpatched instances.
Which combination of steps should a solutions architect recommend to avoid a recurrence of this issue? (Choose two.)
A. Modify the Auto Scaling group by setting the Update policy to target the oldest launch configuration for replacement.
B. Create a new Auto Scaling group before the next patch maintenance. During the maintenance window, patch both groups and reboot the instances.
C. Create an Elastic Load Balancer in front of the Auto Scaling group. Configure monitoring to ensure that target group health checks return healthy after the Auto Scaling group replaces the terminated instances.
D. Create automation scripts to patch an AMI, update the launch configuration, and invoke an Auto Scaling instance refresh.
E. Create an Elastic Load Balancer in front of the Auto Scaling group. Configure termination protection on the instances.
Show Answer
Correct Answer: C, D
Explanation: The root cause is that Auto Scaling replaces instances that reboot for patching and then launches new instances from an unpatched AMI. To prevent recurrence, the patching process must be built into the instance lifecycle. Automating AMI patching and updating the launch configuration, followed by an Auto Scaling instance refresh, ensures all new instances are launched already patched (D). Placing an Elastic Load Balancer in front of the Auto Scaling group and relying on health checks ensures traffic is only sent to healthy instances during replacements, maintaining availability while instances are refreshed (C).
Question 189
A company is running an application on Amazon EC2 instances in the AWS Cloud. The application is using a MongoDB database with a replica set as its data tier. The MongoDB database is installed on systems in the company’s on-premises data center and is accessible through an AWS Direct Connect connection to the data center environment.
A solutions architect must migrate the on-premises MongoDB database to Amazon DocumentDB (with MongoDB compatibility).
Which strategy should the solutions architect choose to perform this migration?
A. Create a fleet of EC2 instances. Install MongoDB Community Edition on the EC2 instances, and create a database. Configure continuous synchronous replication with the database that is running in the on-premises data center.
B. Create an AWS Database Migration Service (AWS DMS) replication instance. Create a source endpoint for the on-premises MongoDB database by using change data capture (CDC). Create a target endpoint for the Amazon DocumentDB database. Create and run a DMS migration task.
C. Create a data migration pipeline by using AWS Data Pipeline. Define data nodes for the on-premises MongoDB database and the Amazon DocumentDB database. Create a scheduled task to run the data pipeline.
D. Create a source endpoint for the on-premises MongoDB database by using AWS Glue crawlers. Configure continuous asynchronous replication between the MongoDB database and the Amazon DocumentDB database.
Show Answer
Correct Answer: B
Explanation: AWS Database Migration Service (AWS DMS) natively supports migrating MongoDB databases to Amazon DocumentDB using change data capture (CDC). This approach enables continuous replication from the on-premises MongoDB replica set to Amazon DocumentDB with minimal downtime. The other options either involve unsupported tools for this use case (AWS Data Pipeline, AWS Glue), or propose running MongoDB on EC2 instead of migrating to the managed Amazon DocumentDB service.
Question 190
A solutions architect has launched multiple Amazon EC2 instances in a placement group within a single Availability Zone. Because of additional load on the system, the solutions architect attempts to add new instances to the placement group. However, the solutions architect receives an insufficient capacity error.
What should the solutions architect do to troubleshoot this issue?
A. Use a spread placement group. Set a minimum of eight instances for each Availability Zone.
B. Stop and start all the instances in the placement group. Try the launch again.
C. Create a new placement group. Merge the new placement group with the original placement group.
D. Launch the additional instances as Dedicated Hosts in the placement groups.
Show Answer
Correct Answer: B
Explanation: For EC2 cluster placement groups, an insufficient capacity error can occur when adding instances later. AWS documentation recommends stopping and starting all instances in the placement group and then retrying the launch, which can cause instances to be placed on hardware with sufficient contiguous capacity. Other options do not address this specific capacity behavior (you cannot merge placement groups, spread groups change the placement strategy, and Dedicated Hosts are unnecessary for troubleshooting).
Question 191
A company has a legacy application that runs on multiple NET Framework components. The components share the same Microsoft SQL Server database and communicate with each other asynchronously by using Microsoft Message Queueing (MSMQ).
The company is starting a migration to containerized .NET Core components and wants to refactor the application to run on AWS. The .NET Core components require complex orchestration. The company must have full control over networking and host configuration. The application's database model is strongly relational.
Which solution will meet these requirements?
A. Host the INET Core components on AWS App Runner. Host the database on Amazon RDS for SQL Server. Use Amazon EventBiridge for asynchronous messaging.
B. Host the .NET Core components on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. Host the database on Amazon DynamoDUse Amazon Simple Notification Service (Amazon SNS) for asynchronous messaging.
C. Host the .NET Core components on AWS Elastic Beanstalk. Host the database on Amazon Aurora PostgreSQL Serverless v2. Use Amazon Managed Streaming for Apache Kafka (Amazon MSK) for asynchronous messaging.
D. Host the NET Core components on Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type. Host the database on Amazon Aurora MySQL Serverless v2. Use Amazon Simple Queue Service (Amazon SQS) for asynchronous messaging.
Show Answer
Correct Answer: D
Explanation: The requirements call for complex container orchestration with full control over networking and host configuration, which is best met by Amazon ECS with the EC2 launch type rather than Fargate, App Runner, or Elastic Beanstalk. The application uses a strongly relational database model, making Aurora (or RDS-class engines) appropriate, while DynamoDB is not suitable. For asynchronous messaging as a replacement for MSMQ, Amazon SQS is a natural fit. Therefore, option D best satisfies all stated requirements.
Question 192
A North American company with headquarters on the East Coast is deploying a new web application running on Amazon EC2 in the us-east-1 Region. The application should dynamically scale to meet user demand and maintain resiliency. Additionally, the application must have disaster recovery capabilities in an active-passive configuration with the us-west-1 Region.
Which steps should a solutions architect take after creating a VPC in the us-east-1 Region?
A. Create a VPC in the us-west-1 Region. Use inter-Region VPC peering to connect both VPCs. Deploy an Application Load Balancer (ALB) spanning multiple Availability Zones (AZs) to the VPC in the us-east-1 Region. Deploy EC2 instances across multiple AZs in each Region as part of an Auto Scaling group spanning both VPCs and served by the ALB.
B. Deploy an Application Load Balancer (ALB) spanning multiple Availability Zones (AZs) to the VPC in the us-east-1 Region. Deploy EC2 instances across multiple AZs as part of an Auto Scaling group served by the ALDeploy the same solution to the us-west-1 Region. Create an Amazon Route 53 record set with a failover routing policy and health checks enabled to provide high availability across both Regions.
C. Create a VPC in the us-west-1 Region. Use inter-Region VPC peering to connect both VPCs. Deploy an Application Load Balancer (ALB) that spans both VPCs. Deploy EC2 instances across multiple Availability Zones as part of an Auto Scaling group in each VPC served by the ALB. Create an Amazon Route 53 record that points to the ALB.
D. Deploy an Application Load Balancer (ALB) spanning multiple Availability Zones (AZs) to the VPC in the us-east-1 Region. Deploy EC2 instances across multiple AZs as part of an Auto Scaling group served by the ALB. Deploy the same solution to the us-west-1 Region. Create separate Amazon Route 53 records in each Region that point to the ALB in the Region. Use Route 53 health checks to provide high availability across both Regions.
Show Answer
Correct Answer: B
Explanation: The requirement is dynamic scaling, multi-AZ resiliency, and disaster recovery in an active-passive, multi-Region setup. Each Region must be independent with its own ALB and Auto Scaling group, because ALBs are Regional and cannot span Regions or VPCs. Route 53 failover routing with health checks is the correct way to direct traffic to the primary Region (us-east-1) and fail over to the secondary Region (us-west-1). Option B correctly describes deploying the same scalable, multi-AZ architecture in both Regions and using Route 53 failover routing for active-passive disaster recovery. Other options incorrectly rely on inter-Region VPC peering or ALBs spanning Regions, which are not supported.
Question 193
An online gaming company needs to optimize the cost of its workloads on AWS. The company uses a dedicated account to host the production environment for its online gaming application and an analytics application.
Amazon EC2 instances host the gaming application and must always be available. The EC2 instances run all year. The analytics application uses data that is stored in Amazon S3. The analytics application can be interrupted and resumed without issue.
Which solution will meet these requirements MOST cost-effectively?
A. Purchase an EC2 Instance Savings Plan for the online gaming application instances. Use On-Demand Instances for the analytics application.
B. Purchase an EC2 Instance Savings Plan for the online gaming application instances. Use Spot Instances for the analytics application.
C. Use Spot Instances for the online gaming application and the analytics application. Set up a catalog in AWS Service Catalog to provision services at a discount.
D. Use On-Demand Instances for the online gaming application. Use Spot Instances for the analytics application. Set up a catalog in AWS Service Catalog to provision services at a discount.
Show Answer
Correct Answer: B
Explanation: The gaming application runs continuously and must always be available, making a long-term commitment like an EC2 Instance Savings Plan the most cost-effective option. The analytics application is fault-tolerant and can be interrupted and resumed, which is ideal for Spot Instances that offer the lowest cost. This combination minimizes cost while meeting availability requirements.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.