A company migrated to AWS and uses AWS Business Support. The company wants to monitor the cost-effectiveness of Amazon EC2 instances across AWS accounts. The EC2 instances have tags for department, business unit, and environment. Development EC2 instances have high cost but low utilization.
The company needs to detect and stop any underutilized development EC2 instances. Instances are underutilized if they had 10% or less average daily CPU utilization and 5 MB or less network I/O for at least 4 of the past 14 days.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure Amazon CloudWatch dashboards to monitor EC2 instance utilization based on tags for department, business unit, and environment. Create an Amazon EventBridge rule that invokes an AWS Lambda function to stop underutilized development EC2 instances.
B. Configure AWS Systems Manager to track EC2 instance utilization and report underutilized instances to Amazon CloudWatch. Filter the CloudWatch data by tags for department, business unit, and environment. Create an Amazon EventBridge rule that invokes an AWS Lambda function to stop underutilized development EC2 instances.
C. Create an Amazon EventBridge rule to detect low utilization of EC2 instances reported by AWS Trusted Advisor. Configure the rule to invoke an AWS Lambda function that filters the data by tags for department, business unit, and environment and stops underutilized development EC2 instances.
D. Create an AWS Lambda function to run daily to retrieve utilization data for all EC2 instances. Save the data to an Amazon DynamoDB table. Create an Amazon QuickSight dashboard that uses the DynamoDB table as a data source to identify and stop underutilized development EC2 instances.
Show Answer
Correct Answer: C
Explanation: AWS Trusted Advisor (available with Business Support) already identifies low-utilization EC2 instances using the specified criteria (10% or less average daily CPU utilization and 5 MB or less network I/O for at least 4 of the past 14 days). Using EventBridge to react to Trusted Advisor check results and invoking a Lambda function to filter by tags and stop only development instances provides the least operational overhead compared with building custom monitoring, storage, or dashboards.
Question 6
A company is developing a web application that runs on Amazon EC2 instances in an Auto Scaling group behind a public-facing Application Load Balancer (ALB). Only users from a specific country are allowed to access the application. The company needs the ability to log the access requests that have been blocked. The solution should require the least possible maintenance.
Which solution meets these requirements?
A. Create an IPSet containing a list of IP ranges that belong to the specified country. Create an AWS WAF web ACL. Configure a rule to block any requests that do not originate from an IP range in the IPSet. Associate the rule with the web ACL. Associate the web ACL with the ALB.
B. Create an AWS WAF web ACL. Configure a rule to block any requests that do not originate from the specified country. Associate the rule with the web ACL. Associate the web ACL with the AL
C. Configure AWS Shield to block any requests that do not originate from the specified country. Associate AWS Shield with the ALB.
D. Create a security group rule that allows ports 80 and 443 from IP ranges that belong to the specified country. Associate the security group with the ALB.
Show Answer
Correct Answer: B
Explanation: AWS WAF provides native geo match rules that can allow or block requests based on the originating country without maintaining IP ranges manually. AWS WAF also supports logging of allowed and blocked requests. Associating the web ACL with the Application Load Balancer satisfies the requirements with the least operational maintenance. Using an IPSet would require managing country IP ranges, AWS Shield does not provide geo-blocking, and security groups cannot reliably implement country-based filtering and do not provide the required request logging.
Question 7
A company is hosting an application on AWS for a project that will run for the next 3 years. The application consists of 20 Amazon EC2 On-Demand Instances that are registered in a target group for a Network Load Balancer (NLB). The instances are spread across two Availability Zones. The application is stateless and runs 24 hours a day, 7 days a week.
The company receives reports from users who are experiencing slow responses from the application. Performance metrics show that the instances are at 10% CPU utilization during normal application use. However, the CPU utilization increases to 100% at busy times, which typically last for a few hours.
The company needs a new architecture to resolve the problem of slow responses from the application.
Which solution will meet these requirements MOST cost-effectively?
A. Create an Auto Scaling group. Attach the Auto Scaling group to the target group of the NLB. Set the minimum capacity to 20 and the desired capacity to 28. Purchase Reserved Instances for 20 instances.
B. Create a Spot Fleet that has a request type of request. Set the TotalTargetCapacity parameter to 20. Set the DefaultTargetCapacityType parameter to On-Demand. Specify the NLB when creating the Spot Fleet.
C. Create a Spot Fleet that has a request type of maintain. Set the TotalTargetCapacity parameter to 20. Set the DefaultTargetCapacityType parameter to Spot. Replace the NLB with an Application Load Balancer.
D. Create an Auto Scaling group. Attach the Auto Scaling group to the target group of the NLB. Set the minimum capacity to 4 and the maximum capacity to 28. Purchase Reserved Instances for four instances.
Show Answer
Correct Answer: D
Explanation: The workload is heavily overprovisioned during normal operation: 20 instances at 10% CPU implies roughly 2 instances' worth of average compute, so a small baseline with Auto Scaling is more cost-effective than permanently running 20 instances. An Auto Scaling group behind the existing Network Load Balancer can scale out during peak periods to address latency. Purchasing Reserved Instances only for the always-running baseline minimizes long-term cost, while burst capacity can use On-Demand instances. Spot Fleet options are not appropriate for this continuously available application, and replacing the load balancer is unnecessary.
Question 7
A company built an ecommerce website on AWS using a three-tier web architecture. The application is Java-based and composed of an Amazon CloudFront distribution, an Apache web server layer of Amazon EC2 instances in an Auto Scaling group, and a backend Amazon Aurora MySQL database.
Last month, during a promotional sales event, users reported errors and timeouts while adding items to their shopping carts. The operations team recovered the logs created by the web servers and reviewed Aurora DB cluster performance metrics. Some of the web servers were terminated before logs could be collected and the Aurora metrics were not sufficient for query performance analysis.
Which combination of steps must the solutions architect take to improve application performance visibility during peak traffic events? (Choose three.)
A. Configure the Aurora MySQL DB cluster to publish slow query and error logs to Amazon CloudWatch Logs.
B. Implement the AWS X-Ray SDK to trace incoming HTTP requests on the EC2 instances and implement tracing of SQL queries with the X-Ray SDK for Java.
C. Configure the Aurora MySQL DB cluster to stream slow query and error logs to Amazon Kinesis.
D. Install and configure an Amazon CloudWatch Logs agent on the EC2 instances to send the Apache logs to CloudWatch Logs.
E. Enable and configure AWS CloudTrail to collect and analyze application activity from Amazon EC2 and Aurora
F. Enable Aurora MySQL DB cluster performance benchmarking and publish the stream to AWS X-Ray.
Show Answer
Correct Answer: A, B, D
Explanation: Publish Aurora slow query and error logs to CloudWatch Logs for persistent database diagnostics, send Apache logs from EC2 instances to CloudWatch Logs so logs survive instance termination, and instrument the application with AWS X-Ray to trace HTTP requests and SQL calls for end-to-end performance analysis. Kinesis is unnecessary for this use case, CloudTrail records AWS API activity rather than application performance, and the Aurora benchmarking/X-Ray option is not a valid feature.
Question 8
Accompany is building an application to collect and transmit sensor data from a factory. The application will use AWS IoT Core to send data from hundreds of devices to an Amazon S3 data lake. The company must enrich the data before loading the data into Amazon S3.
The application will transmit the sensor data every 5 seconds. New sensor data must be available in Amazon S3 less than 30 minutes after the application collects the data. No other applications are processing the sensor data from AWS IoT Core.
Which solution will meet these requirements MOST cost-effectively?
A. Create a topic in AWS IoT Core to ingest the sensor data. Create an AWS Lambda function to enrich the data and to write the data to Amazon S3. Configure an AWS IoT rule action to invoke the Lambda function.
B. Use AWS IoT Core Basic Ingest to ingest the sensor data. Configure an AWS IoT rule action to write the data to Amazon Kinesis Data Firehose. Set the Kinesis Data Firehose buffering interval to 900 seconds. Use Kinesis Data Firehose to invoke an AWS Lambda function to enrich the data, Configure Kinesis Data Firehose to deliver the data to Amazon S3.
C. Create a topic in AWS IoT Core to ingest the sensor data. Configure an AWS IoT rule action to send the data to an Amazon Timestream table. Create an AWS Lambda, function to read the data from Timestream. Configure the Lambda function to enrich the data and to write the data to Amazon S3.
D. Use AWS loT Core Basic Ingest to ingest the sensor data. Configure an AWS IoT rule action to write the data to Amazon Kinesis Data Streams. Create a consumer AWS Lambda function to process the data from Kinesis Data Streams and to enrich the data. Call the S3 PutObject API operation from the Lambda function to write the data to Amazon S3.
Show Answer
Correct Answer: B
Explanation: Option B is the most cost-effective. AWS IoT Core Basic Ingest reduces IoT messaging costs when no other subscribers need the messages. Kinesis Data Firehose is purpose-built to buffer, optionally transform records with Lambda in batches, and deliver them to Amazon S3 efficiently. A 900-second (15-minute) buffering interval keeps data available in S3 well within the required 30 minutes while reducing S3 PUT operations and Lambda invocation overhead. Option A invokes Lambda per message, increasing cost at high message rates. Option C adds unnecessary Timestream storage, and Option D uses Kinesis Data Streams, which is more operationally complex and less cost-effective than Firehose for direct delivery to S3.
Question 8
A company that provisions job boards for a seasonal workforce is seeing an increase in traffic and usage. The backend services run on a pair of Amazon EC2 instances behind an Application Load Balancer with Amazon DynamoDB as the datastore. Application read and write traffic is slow during peak seasons.
Which option provides a scalable application architecture to handle peak seasons with the LEAST development effort?
A. Migrate the backend services to AWS Lambda. Increase the read and write capacity of DynamoDB.
B. Migrate the backend services to AWS Lambda. Configure DynamoDB to use global tables.
C. Use Auto Scaling groups for the backend services. Use DynamoDB auto scaling.
D. Use Auto Scaling groups for the backend services. Use Amazon Simple Queue Service (Amazon SQS) and an AWS Lambda function to write to DynamoDB.
Show Answer
Correct Answer: C
Explanation: The application already runs on EC2 behind an Application Load Balancer, so enabling an Auto Scaling group for the EC2 backend requires minimal application changes while allowing compute capacity to scale with demand. DynamoDB auto scaling automatically adjusts read and write capacity to handle peak traffic. Migrating to Lambda would require application changes, global tables address multi-Region replication rather than throughput, and adding SQS/Lambda introduces architectural complexity not required for this problem.
Question 9
A company is using Amazon API Gateway to deploy a private REST API that will provide access to sensitive data. The API must be accessible only from an application that is deployed in a VPC. The company deploys the API successfully. However, the API is not accessible from an Amazon EC2 instance that is deployed in the VPC.
Which solution will provide connectivity between the EC2 instance and the API?
A. Create an interface VPC endpoint for API Gateway. Attach an endpoint policy that allows apigateway:* actions. Disable private DNS naming for the VPC endpoint. Configure an API resource policy that allows access from the VPC. Use the VPC endpoint's DNS name to access the API.
B. Create an interface VPC endpoint for API Gateway. Attach an endpoint policy that allows the execute-api:Invoke action. Enable private DNS naming for the VPC endpoint. Configure an API resource policy that allows access from the VPC endpoint. Use the API endpoint’s DNS names to access the API.
C. Create a Network Load Balancer (NLB) and a VPC link. Configure private integration between API Gateway and the NLB. Use the API endpoint’s DNS names to access the API.
D. Create an Application Load Balancer (ALB) and a VPC Link. Configure private integration between API Gateway and the ALB. Use the ALB endpoint’s DNS name to access the API.
Show Answer
Correct Answer: B
Explanation: Private REST APIs in API Gateway are accessed through an interface VPC endpoint (AWS PrivateLink) for execute-api. The VPC endpoint policy should allow execute-api:Invoke, private DNS should be enabled so the standard API hostname resolves to the private endpoint, and the API resource policy should allow access from the specific VPC endpoint (aws:SourceVpce). Options C and D describe private integrations (API Gateway to backend), not client connectivity to a private API. Option A is incorrect because it uses the wrong permissions, disables private DNS, and references allowing the VPC instead of the VPC endpoint.
Question 9
A company is collecting data from a large set of IoT devices. The data is stored in an Amazon S3 data lake. Data scientists perform analytics on Amazon EC2 instances that run in two public subnets in a VPC in a separate AWS account.
The data scientists need access to the data lake from the EC2 instances. The EC2 instances already have an assigned role with permissions to access Amazon S3.
According to company policies, only authorized networks are allowed to have access to the IoT data.
Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)
A. Create a gateway VPC endpoint for Amazon S3 in the data scientists’ VPC.
B. Create an S3 access point in the data scientists' AWS account for the data lake.
C. Update the EC2 instance role. Add a policy with a condition that allows the s3:GetObject action when the value for the s3:DataAccessPointArn condition key is a valid access point ARN.
D. Update the VPC route table to route S3 traffic to an S3 access point.
E. Add an S3 bucket policy with a condition that allows the s3:GetObject action when the value for the s3:DataAccessPointArn condition key is a valid access point ARN.
Show Answer
Correct Answer: A, E
Explanation: A gateway VPC endpoint for Amazon S3 allows the EC2 instances to access S3 privately over the AWS network, satisfying the requirement that access come from an authorized network rather than the public internet. The S3 bucket policy should then restrict access using a condition tied to the approved access mechanism (the question references s3:DataAccessPointArn, making E the intended policy-based restriction). B is incorrect because the access point location is wrong as stated; access points are associated with the bucket owner's account (or cross-account creation requires explicit setup not described). C is unnecessary because the EC2 role already has S3 permissions. D is invalid because route tables target VPC endpoints, not S3 access points.
Question 10
A company wants to migrate its website to AWS. The website uses containers that are deployed in an on-premises, self-managed Kubernetes cluster. All data for the website is stored in an on-premises PostgreSQL database.
The company has decided to migrate the on-premises Kubernetes cluster to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster will use EKS managed node groups with a static number of nodes. The company will also migrate the on-premises database to an Amazon RDS for PostgreSQL database.
A solutions architect needs to estimate the total cost of ownership (TCO) for this workload before the migration.
Which solution will provide the required TCO information?
A. Request access to Migration Evaluator. Run the Migration Evaluator Collector and import the data. Configure a scenario. Export a Quick Insights report from Migration Evaluator.
B. Launch AWS Database Migration Service (AWS DMS) for the on-premises database. Generate an assessment report. Create an estimate in AWS Pricing Calculator for the costs of the EKS migration.
C. Initialize AWS Application Migration Service. Add the on-premises servers as source servers. Launch a test instance. Output a TCO report from Application Migration Service.
D. Access the AWS Cloud Economics Center webpage to assess the AWS Cloud Value Framework. Create an AWS Cost and Usage report from the Cloud Value Framework.
Show Answer
Correct Answer: A
Explanation: Migration Evaluator is the AWS service designed to estimate Total Cost of Ownership (TCO) for migrations by collecting on-premises infrastructure data, modeling migration scenarios, and generating Quick Insights/TCO reports. AWS DMS assesses database compatibility rather than overall TCO, Application Migration Service focuses on server migration rather than TCO reporting, and the Cloud Economics Center provides guidance rather than workload-specific TCO estimates.
Question 11
An events company runs a ticketing platform on AWS. The company’s customers configure and schedule their events on the platform. The events result in large increases of traffic to the platform. The company knows the date and time of each customer’s events.
The company runs the platform on an Amazon Elastic Container Service (Amazon ECS) cluster. The ECS cluster consists of Amazon EC2 On-Demand Instances that are in an Auto Scaling group. The Auto Scaling group uses a predictive scaling policy.
The ECS cluster makes frequent requests to an Amazon S3 bucket to download ticket assets. The ECS cluster and the S3 bucket are in the same AWS Region and the same AWS account. Traffic between the ECS cluster and the S3 bucket flows across a NAT gateway.
The company needs to optimize the cost of the platform without decreasing the platform's availability.
Which combination of steps will meet these requirements? (Choose two.)
A. Create a gateway VPC endpoint for the S3 bucket.
B. Add another ECS capacity provider that uses an Auto Scaling group of Spot Instances. Configure the new capacity provider strategy to have the same weight as the existing capacity provider strategy.
C. Create On-Demand Capacity Reservations for the applicable instance type for the time period of the scheduled scaling policies.
D. Enable S3 Transfer Acceleration on the S3 bucket.
E. Replace the predictive scaling policy with scheduled scaling policies for the scheduled events.
Show Answer
Correct Answer: A, E
Explanation: A gateway VPC endpoint for Amazon S3 eliminates the need to route S3 traffic through the NAT gateway, reducing NAT data processing charges while maintaining availability. Because the company knows the exact timing of traffic spikes from scheduled events, scheduled scaling policies are a better fit than predictive scaling: they scale capacity at known times, simplifying scaling and potentially avoiding unnecessary capacity while preserving availability. Spot Instances could reduce costs but may be interrupted, which can affect availability. Capacity Reservations increase cost, and S3 Transfer Acceleration is intended for long-distance uploads/downloads and adds cost rather than reducing it.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.