A company is collecting data from a large set of IoT devices. The data is stored in an Amazon S3 data lake. Data scientists perform analytics on Amazon EC2 instances that run in two public subnets in a VPC in a separate AWS account.
The data scientists need access to the data lake from the EC2 instances. The EC2 instances already have an assigned role with permissions to access Amazon S3.
According to company policies, only authorized networks are allowed to have access to the IoT data.
Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)
A. Create a gateway VPC endpoint for Amazon S3 in the data scientists’ VPC.
B. Create an S3 access point in the data scientists' AWS account for the data lake.
C. Update the EC2 instance role. Add a policy with a condition that allows the s3:GetObject action when the value for the s3:DataAccessPointArn condition key is a valid access point ARN.
D. Update the VPC route table to route S3 traffic to an S3 access point.
E. Add an S3 bucket policy with a condition that allows the s3:GetObject action when the value for the s3:DataAccessPointArn condition key is a valid access point ARN.
Show Answer
Correct Answer: A, E
Explanation: The requirement is to allow S3 access only from authorized networks while EC2 instances already have IAM permissions.
A. A gateway VPC endpoint for Amazon S3 ensures that S3 access from the EC2 instances stays within the AWS network and can be enforced at the network level.
E. An S3 bucket policy is required to restrict access to the data lake so that only requests that meet specific conditions are allowed. Using conditions tied to controlled access paths (such as access points or endpoint-based restrictions) ensures that only authorized networks can access the data.
Other options are incorrect because access points are not required here, IAM role changes are unnecessary, and VPC route tables cannot route traffic to S3 access points.
Question 10
A company wants to migrate its website to AWS. The website uses containers that are deployed in an on-premises, self-managed Kubernetes cluster. All data for the website is stored in an on-premises PostgreSQL database.
The company has decided to migrate the on-premises Kubernetes cluster to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster will use EKS managed node groups with a static number of nodes. The company will also migrate the on-premises database to an Amazon RDS for PostgreSQL database.
A solutions architect needs to estimate the total cost of ownership (TCO) for this workload before the migration.
Which solution will provide the required TCO information?
A. Request access to Migration Evaluator. Run the Migration Evaluator Collector and import the data. Configure a scenario. Export a Quick Insights report from Migration Evaluator.
B. Launch AWS Database Migration Service (AWS DMS) for the on-premises database. Generate an assessment report. Create an estimate in AWS Pricing Calculator for the costs of the EKS migration.
C. Initialize AWS Application Migration Service. Add the on-premises servers as source servers. Launch a test instance. Output a TCO report from Application Migration Service.
D. Access the AWS Cloud Economics Center webpage to assess the AWS Cloud Value Framework. Create an AWS Cost and Usage report from the Cloud Value Framework.
Show Answer
Correct Answer: A
Explanation: Migration Evaluator is specifically designed to estimate total cost of ownership for migrating on‑premises workloads to AWS. It collects data from the existing environment, models target AWS services such as Amazon EKS and Amazon RDS, allows scenario configuration, and produces Quick Insights and detailed TCO reports. The other options focus on migration execution or generic cost concepts rather than comprehensive pre‑migration TCO analysis.
Question 11
An events company runs a ticketing platform on AWS. The company’s customers configure and schedule their events on the platform. The events result in large increases of traffic to the platform. The company knows the date and time of each customer’s events.
The company runs the platform on an Amazon Elastic Container Service (Amazon ECS) cluster. The ECS cluster consists of Amazon EC2 On-Demand Instances that are in an Auto Scaling group. The Auto Scaling group uses a predictive scaling policy.
The ECS cluster makes frequent requests to an Amazon S3 bucket to download ticket assets. The ECS cluster and the S3 bucket are in the same AWS Region and the same AWS account. Traffic between the ECS cluster and the S3 bucket flows across a NAT gateway.
The company needs to optimize the cost of the platform without decreasing the platform's availability.
Which combination of steps will meet these requirements? (Choose two.)
A. Create a gateway VPC endpoint for the S3 bucket.
B. Add another ECS capacity provider that uses an Auto Scaling group of Spot Instances. Configure the new capacity provider strategy to have the same weight as the existing capacity provider strategy.
C. Create On-Demand Capacity Reservations for the applicable instance type for the time period of the scheduled scaling policies.
D. Enable S3 Transfer Acceleration on the S3 bucket.
E. Replace the predictive scaling policy with scheduled scaling policies for the scheduled events.
Show Answer
Correct Answer: A, E
Explanation: A gateway VPC endpoint for Amazon S3 removes the need for traffic to traverse a NAT gateway, eliminating NAT data processing charges and reducing cost without impacting availability. Because the company knows the exact date and time of traffic spikes from scheduled events, replacing predictive scaling with scheduled scaling allows the Auto Scaling group to add capacity only when needed and avoid unnecessary overprovisioning, optimizing cost while maintaining availability.
Question 12
A company has multiple AWS accounts that are in an organization in AWS Organizations. The company needs to store AWS account activity and query the data from a central location by using SQL.
Which solution will meet these requirements?
A. Create an AWS CloudTraii trail in each account. Specify CloudTrail management events for the trail. Configure CloudTrail to send the events to Amazon CloudWatch Logs. Configure CloudWatch cross-account observability. Query the data in CloudWatch Logs Insights.
B. Use a delegated administrator account to create an AWS CloudTrail Lake data store. Specify CloudTrail management events for the data store. Enable the data store for all accounts in the organization. Query the data in CloudTrail Lake.
C. Use a delegated administrator account to create an AWS CloudTral trail. Specify CloudTrail management events for the trail. Enable the trail for all accounts in the organization. Keep all other settings as default. Query the CloudTrail data from the CloudTrail event history page.
D. Use AWS CloudFormation StackSets to deploy AWS CloudTrail Lake data stores in each account. Specify CloudTrail management events for the data stores. Keep all other settings as default, Query the data in CloudTrail Lake.
Show Answer
Correct Answer: B
Explanation: The requirement is to centrally store AWS account activity from multiple accounts in an AWS Organization and query it using SQL. AWS CloudTrail Lake is designed for this purpose, providing managed, centralized storage and SQL-based querying. By using a delegated administrator account, CloudTrail Lake can be enabled for all accounts in the organization and queried from a single central location. Other options either lack SQL querying (event history), add unnecessary complexity, or are not centrally managed at the organization level.
Question 13
A company is using AWS to develop and manage its production web application. The application includes an Amazon API Gateway HTTP API that invokes an AWS Lambda function. The Lambda function processes and then stores data in a database.
The company wants to implement user authorization for the web application in an integrated way. The company already uses a third-party identity provider that issues OAuth tokens for the company’s other applications.
Which solution will meet these requirements?
A. Integrate the company’s third-party identity provider with API Gateway. Configure an API Gateway Lambda authorizer to validate tokens from the identity provider. Require the Lambda authorizer on all API routes. Update the web application to get tokens from the identity provider and include the tokens in the Authorization header when calling the API Gateway HTTP API.
B. Integrate the company's third-party identity provider with AWS Directory Service. Configure Directory Service as an API Gateway authorizer to validate tokens from the identity provider. Require the Directory Service authorizer on all API routes. Configure AWS IAM Identity Center as a SAML 2.0 identity Provider. Configure the web application as a custom SAML 2.0 application.
C. Integrate the company’s third-party identity provider with AWS IAM Identity Center. Configure API Gateway to use IAM Identity Center for zero-configuration authentication and authorization. Update the web application to retrieve AWS Security Token Service (AWS STS) tokens from IAM Identity Center and include the tokens in the Authorization header when calling the API Gateway HTTP API.
D. Integrate the company’s third-party identity provider with AWS IAM Identity Center. Configure IAM users with permissions to call the API Gateway HTTP API. Update the web application to extract request parameters from the IAM users and include the parameters in the Authorization header when calling the API Gateway HTTP API.
Show Answer
Correct Answer: A
Explanation: The company already uses a third-party OAuth identity provider and wants integrated user authorization for an API Gateway HTTP API. API Gateway Lambda authorizers are designed to validate external OAuth/JWT tokens and integrate directly with third-party identity providers. The web app can obtain tokens from the existing provider and pass them in the Authorization header, while the Lambda authorizer enforces authorization on all routes. The other options introduce unnecessary services or do not align with OAuth-based user authorization for API Gateway.
Question 14
A company needs to optimize the cost of an AWS environment that contains multiple accounts in an organization in AWS Organizations. The company conducted cost optimization activities 3 years ago and purchased Amazon EC2 Standard Reserved Instances that recently expired.
The company needs EC2 instances for 3 more years. Additionally, the company has deployed a new serverless workload.
Which strategy will provide the company with the MOST cost savings?
A. Purchase the same Reserved Instances for an additional 3-year term with All Upfront payment. Purchase a 3-year Compute Savings Plan with All Upfront payment in the management account to cover any additional compute costs
B. Purchase a 1-year Compute Savings Plan with No Upfront payment in each member account. Use the Savings Plans recommendations in the AWS Cost Management console to choose the Compute Savings Plan.
C. Purchase a 3-year EC2 Instance Savings Plan with No Upfront payment in the management account to cover EC2 costs in each AWS Region. Purchase a 3-year Compute Savings Plan with No Upfront payment in the management account to cover any additional compute costs.
D. Purchase a 3-year EC2 Instance Savings Plan with All Upfront payment in each member account. Use the Savings Plans recommendations in the AWS Cost Management console to choose the EC2 Instance Savings Plan.
Show Answer
Correct Answer: A
Explanation: The goal is maximum cost savings for a stable EC2 workload over the next 3 years plus a new serverless workload across an AWS Organization. A 3‑year, All Upfront EC2 Reserved Instance provides the highest possible discount for predictable EC2 usage. Serverless services (such as AWS Lambda, Fargate) are not covered by Reserved Instances but are covered by Compute Savings Plans. A 3‑year, All Upfront Compute Savings Plan purchased in the management account can apply across accounts and services, maximizing discount and flexibility. Other options use shorter terms, No Upfront payments, or less optimal combinations, all of which result in lower overall savings.
Question 15
A media company has a 30-T8 repository of digital news videos. These videos are stored on tape in an on-premises tape library and referenced by a Media Asset Management (MAM) system. The company wants to enrich the metadata for these videos in an automated fashion and put them into a searchable catalog by using a MAM feature. The company must be able to search based on information in the video, such as objects, scenery items, or people’s faces. A catalog is available that contains faces of people who have appeared in the videos that include an image of each person. The company would like to migrate these videos to AWS.
The company has a high-speed AWS Direct Connect connection with AWS and would like to move the MAM solution video content directly from its current file system.
How can these requirements be met by using the LEAST amount of ongoing management overhead and causing MINIMAL disruption to the existing system?
A. Set up an AWS Storage Gateway, file gateway appliance on-premises. Use the MAM solution to extract the videos from the current archive and push them into the file gateway. Use the catalog of faces to build a collection in Amazon Rekognition. Build an AWS Lambda function that invokes the Rekognition Javascript SDK to have Rekognition pull the video from the Amazon S3 files backing the file gateway, retrieve the required metadata, and push the metadata into the MAM solution.
B. Set up an AWS Storage Gateway, tape gateway appliance on-premises. Use the MAM solution to extract the videos from the current archive and push them into the tape gateway. Use the catalog of faces to build a collection in Amazon Rekognition. Build an AWS Lambda function that invokes the Rekognition Javascript SDK to have Amazon Rekognition process the video in the tape gateway, retrieve the required metadata, and push the metadata into the MAM solution.
C. Configure a video ingestion stream by using Amazon Kinesis Video Streams. Use the catalog of faces to build a collection in Amazon Rekognition. Stream the videos from the MAM solution into Kinesis Video Streams. Configure Amazon Rekognition to process the streamed videos. Then, use a stream consumer to retrieve the required metadata, and push the metadata into the MAM solution. Configure the stream to store the videos in Amazon S3.
D. Set up an Amazon EC2 instance that runs the OpenCV libraries. Copy the videos, images, and face catalog from the on-premises library into an Amazon EBS volume mounted on this EC2 instance. Process the videos to retrieve the required metadata, and push the metadata into the MAM solution, while also copying the video files to an Amazon S3 bucket.
Show Answer
Correct Answer: A
Explanation: Amazon Rekognition can analyze videos only when they are stored in Amazon S3 (or streamed via Kinesis Video Streams). Option A uses an AWS Storage Gateway **file gateway** to expose S3 as a file system, allowing the existing MAM workflow to extract videos from tape and write them as files with minimal change. Once in S3, Rekognition can perform object, scene, and face recognition using a prebuilt face collection, with Lambda handling orchestration and metadata updates.
Option B relies on a **tape gateway**, which emulates virtual tapes for backup/archive use cases and adds workflow and operational complexity. Rekognition cannot directly process video from a tape gateway, so this option does not meet the requirements with minimal disruption or management overhead. Options C and D introduce unnecessary complexity and management. Therefore, A best satisfies all requirements.
Question 16
A company hosts a data-processing application on Amazon EC2 instances. The application polls an Amazon Elastic File System (Amazon EFS) file system for newly uploaded files. When a new file is detected, the application extracts data from the file and runs logic to select a Docker container image to process the file. The application starts the appropriate container image and passes the file location as a parameter.
The data processing that the container performs can take up to 2 hours. When the processing is complete, the code that runs inside the container writes the file back to Amazon EFS and exits.
The company needs to refactor the application to eliminate the EC2 instances that are running the containers.
Which solution will meet these requirements?
A. Create an Amazon Elastic Container Service (Amazon ECS) cluster. Configure the processing to run as AWS Fargate tasks. Extract the container selection logic to run as an Amazon EventBridge rule that starts the appropriate Fargate task. Configure the EventBridge rule to run when files are added to the EFS file system.
B. Create an Amazon Elastic Container Service (Amazon ECS) cluster. Configure the processing to run as AWS Fargate tasks. Update and containerize the container selection logic to run as a Fargate service that starts the appropriate Fargate task. Configure an EFS event notification to invoke the Fargate service when files are added to the EFS file system.
C. Create an Amazon Elastic Container Service (Amazon ECS) cluster. Configure the processing to run as AWS Fargate tasks. Extract the container selection logic to run as an AWS Lambda function that starts the appropriate Fargate task. Migrate the storage of file uploads to an Amazon S3 bucket. Update the processing code to use Amazon S3. Configure an S3 event notification to invoke the Lambda function when objects are created.
D. Create AWS Lambda container images for the processing. Configure Lambda functions to use the container images. Extract the container selection logic to run as a decision Lambda function that invokes the appropriate Lambda processing function. Migrate the storage of file uploads to an Amazon S3 bucket. Update the processing code to use Amazon S3. Configure an S3 event notification to invoke the decision Lambda function when objects are created.
Show Answer
Correct Answer: C
Explanation: The application must eliminate EC2 instances, support long-running (up to 2 hours) containerized processing, and react to new file uploads. Amazon EFS does not natively generate event notifications, so options that rely on EFS triggering EventBridge or ECS services are not viable. AWS Lambda is also unsuitable for the 2-hour processing workload due to its maximum execution time.
Option C correctly refactors the architecture by moving file storage to Amazon S3, which provides native event notifications. An S3 event triggers a Lambda function that contains the container-selection logic and starts the appropriate Amazon ECS task running on AWS Fargate. Fargate supports long-running containers without EC2 management, and S3 replaces EFS as an event-driven storage layer. This fully meets the requirements while eliminating EC2 instances.
Question 17
A company has deployed applications to thousands of Amazon EC2 instances in an AWS account. A security audit discovers that several unencrypted Amazon Elastic Block Store (Amazon EBS) volumes are attached to the EC2 instances. The company’s security policy requires the EBS volumes to be encrypted.
The company needs to implement an automated solution to encrypt the EBS volumes. The solution also must prevent development teams from creating unencrypted EBS volumes.
Which solution will meet these requirements?
A. Configure the AWS Config managed rule that identifies unencrypted EBS volumes. Configure an automatic remediation action. Associate an AWS Systems Manager Automation runbook that includes the steps to create a new encrypted EBS volume. Create an AWS Key Management Service (AWS KMS) customer managed key. In the key policy, include a statement to deny the creation of unencrypted EBS volumes.
B. Use AWS Systems Manager Fleet Manager to create a list of unencrypted EBS volumes, Create a Systems Manager Automation runbook that includes the steps to create a new encrypted EBS volume. Create an SCP to deny the creation of unencrypted EBS volumes.
C. Use AWS Systems Manager Fleet Manager to create a list of unencrypted EBS volumes. Create a Systems Manager Automation runbook that includes the steps to create a new encrypted EBS volume. Modify the AWS account setting for EBS encryption to always encrypt new EBS volumes.
D. Configure the AWS Config managed rule that identifies unencrypted EBS volumes. Configure an automatic remediation action. Associate an AWS Systems Manager Automation runbook that includes the steps to create a new encrypted EBS volume. Modify the AWS account setting for EBS encryption to always encrypt new EBS volumes.
Show Answer
Correct Answer: D
Explanation: The requirements are to automatically remediate existing unencrypted EBS volumes and to prevent future creation of unencrypted volumes. AWS Config can continuously detect unencrypted EBS volumes, and an automatic remediation using an AWS Systems Manager Automation runbook can replace them with encrypted volumes. Enabling the account-level EBS default encryption setting ensures that all new EBS volumes are encrypted by default, preventing development teams from creating unencrypted volumes. Other options either rely on unsupported mechanisms (KMS key policy), inappropriate services (Fleet Manager), or SCPs that require AWS Organizations.
Question 18
A company is migrating its data center to the AWS Cloud and needs to complete the migration as quickly as possible. The company has many applications that are running on hundreds of VMware VMs in the data center. Each VM is configured with a shared Windows folder that contains common shared files. The file share is larger than 100 GB in size.
The company’s compliance team requires a change request to be fled and approved for every software installation and modification to each VM. The company has an AWS Direct Connect connection with 10 GB of bandwidth between AWS and the data center.
Which set of steps should the company take to complete the migration in the LEAST amount of time?
A. Use VM ImporvExport to create images of each VM. Use AWS Application Migration Service to manage and view the images. Copy the Windows file share data to an Amazon Elastic File System (Amazon EFS) file system. After migration, remap the file share to the EFS file system.
B. Deploy the AWS Application Discovery Service agentless appliance to VMware vCenter. Review the portfolio of discovered VMs in AWS Migration Hub.
C. Deploy the AWS Application Migration Service agentless appliance to VMware vCenter. Copy the Windows file share data to a new Amazon FSx for Windows File Server file system. After migration, remap the file share on each VM to the FSx for Windows File Server file system. Create and review a portfolio in AWS Migration Hub. Order an AWS Snowcone device. Deploy AWS Application Migration Service to VMware vCenter and export all the VMs to the Snowcone device. Copy all Windows file share data to the Snowcone device. Ship the Snowcone device to AWS. Use Application Migration Service to deploy all the migrated instances.
D. Deploy the AWS Application Discovery Service Agent and the AWS Application Migration Service Agent onto each VMware hypervisor directly. Review the portfolio in AWS Migration Hub. Copy each VM’s file share data to a new Amazon FSx for Windows File Server file system. After migration, remap the file share on each VM to the FSx for Windows File Server file system.
Show Answer
Correct Answer: C
Explanation: The fastest approach avoids installing agents on each VM (which would require change approvals) and minimizes data transfer time. AWS Application Migration Service agentless via vCenter enables rapid VM migration without per-VM changes. Migrating the large shared Windows file share to Amazon FSx for Windows File Server preserves native Windows semantics and allows simple remapping after cutover. Using offline transfer (Snowcone) for large VM and file-share data further reduces migration time compared to transferring everything over the network, even with Direct Connect.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.