An online magazine will launch its latest edition this month. This edition will be the first to be distributed globally. The magazine's dynamic website currently uses an Application Load Balancer in front of the web tier, a fleet of Amazon EC2 instances for web and application servers, and Amazon Aurora MySQL. Portions of the website include static content and almost all traffic is read-only.
The magazine is expecting a significant spike in internet traffic when the new edition is launched. Optimal performance is a top priority for the week following the launch.
Which combination of steps should a solutions architect take to reduce system response times for a global audience? (Choose two.)
A. Use logical cross-Region replication to replicate the Aurora MySQL database to a secondary Region. Replace the web servers with Amazon S3. Deploy S3 buckets in cross-Region replication mode.
B. Ensure the web and application tiers are each in Auto Scaling groups. Introduce an AWS Direct Connect connection. Deploy the web and application tiers in Regions across the world.
C. Migrate the database from Amazon Aurora to Amazon RDS for MySQL. Ensure all three of the application tiers – web, application, and database – are in private subnets.
D. Use an Aurora global database for physical cross-Region replication. Use Amazon S3 with cross-Region replication for static content and resources. Deploy the web and application tiers in Regions across the world.
E. Introduce Amazon Route 53 with latency-based routing and Amazon CloudFront distributions. Ensure the web and application tiers are each in Auto Scaling groups.
Show Answer
Correct Answer: D, E
Explanation: To minimize response times for a global, mostly read-only workload during a traffic spike, content and data must be served as close to users as possible. Using an Aurora Global Database provides low-latency, physical cross-Region read replicas for database access worldwide. Replicating static content with Amazon S3 across Regions further reduces latency. In addition, Amazon CloudFront caches static and dynamic content at edge locations, and Route 53 latency-based routing directs users to the nearest healthy Region. Together, these steps optimize global performance and scalability.
Question 196
A company operates a fleet of servers on premises and operates a fleet of Amazon EC2 instances in its organization in AWS Organizations. The company's AWS accounts contain hundreds of VPCs. The company wants to connect its AWS accounts to its on-premises network. AWS Site-to-Site VPN connections are already established to a single AWS account. The company wants to control which VPCs can communicate with other VPCs.
Which combination of steps will achieve this level of control with the LEAST operational effort? (Choose three.)
A. Create a transit gateway in an AWS account. Share the transit gateway across accounts by using AWS Resource Access Manager (AWS RAM).
B. Configure attachments to all VPCs and VPNs.
C. Setup transit gateway route tables. Associate the VPCs and VPNs with the route tables.
D. Configure VPC peering between the VPCs.
E. Configure attachments between the VPCs and VPNs.
F. Setup route tables on the VPCs and VPNs.
Show Answer
Correct Answer: A, B, C
Explanation: Using an AWS Transit Gateway provides a scalable hub-and-spoke model for hundreds of VPCs and existing Site-to-Site VPNs with minimal operational overhead. Creating the transit gateway and sharing it across accounts with AWS RAM enables centralized connectivity (A). Attaching all VPCs and the existing VPNs to the transit gateway is required to bring them into the hub (B). Fine-grained control over which VPCs can communicate is achieved by creating and associating transit gateway route tables to specific attachments, enabling segmentation without complex per-VPC management (C). VPC peering does not scale, and attachments/routes are managed on the transit gateway rather than directly between VPCs and VPNs.
Question 198
A company needs to aggregate Amazon CloudWatch logs from its AWS accounts into one central logging account. The collected logs must remain in the AWS Region of creation. The central logging account will then process the logs, normalize the logs into standard output format, and stream the output logs to a security tool for more processing.
A solutions architect must design a solution that can handle a large volume of logging data that needs to be ingested. Less logging will occur outside normal business hours than during normal business hours. The logging solution must scale with the anticipated load. The solutions architect has decided to use an AWS Control Tower design to handle the multi-account logging process.
Which combination of steps should the solutions architect take to meet the requirements? (Choose three.)
A. Create a destination Amazon Kinesis data stream in the central logging account.
B. Create a destination Amazon Simple Queue Service (Amazon SQS) queue in the central logging account.
C. Create an IAM role that grants Amazon CloudWatch Logs the permission to add data to the Amazon Kinesis data stream. Create a trust policy. Specify the trust policy in the IAM role. In each member account, create a subscription filter for each log group to send data to the Kinesis data stream.
D. Create an IAM role that grants Amazon CloudWatch Logs the permission to add data to the Amazon Simple Queue Service (Amazon SQS) queue. Create a trust policy. Specify the trust policy in the IAM role. In each member account, create a single subscription filter for all log groups to send data to the SQS queue.
E. Create an AWS Lambda function. Program the Lambda function to normalize the logs in the central logging account and to write the logs to the security tool.
F. Create an AWS Lambda function. Program the Lambda function to normalize the logs in the member accounts and to write the logs to the security tool.
Show Answer
Correct Answer: A, C, E
Explanation: CloudWatch Logs supports subscription filters that can deliver log data directly to Amazon Kinesis Data Streams across accounts and Regions, while keeping logs in their Region of creation. Kinesis Data Streams can handle high, variable ingestion rates and scale to meet peak business-hour demand. An IAM role with an appropriate trust policy is required to allow CloudWatch Logs in member accounts to put records into the central Kinesis stream via subscription filters. Processing and normalization should occur centrally, so a Lambda function in the central logging account can consume from the Kinesis stream, normalize the logs, and forward them to the security tool.
Question 199
A company runs applications in hundreds of production AWS accounts. The company uses AWS Organizations with all features enabled and has a centralized backup operation that uses AWS Backup.
The company is concerned about ransomware attacks. To address this concern, the company has created a new policy that all backups must be resilient to breaches of privileged-user credentials in any production account.
Which combination of steps will meet this new requirement? (Choose three.)
A. Implement cross-account backup with AWS Backup vaults in designated non-production accounts.
B. Add an SCP that restricts the modification of AWS Backup vaults.
C. Implement AWS Backup Vault Lock in compliance mode. Implement least privilege access for the IAM service role that is assigned to AWS Backup.
D. Configure the backup frequency, lifecycle, and retention period to ensure that at least one backup always exists in the cold tier.
E. Configure AWS Backup to write all backups to an Amazon S3 bucket in a designated non-production account. Ensure that the S3 bucket has S3 Object Lock enabled.
Show Answer
Correct Answer: A, B, C
Explanation: The requirement is that backups remain resilient even if privileged credentials in a production account are compromised. Cross-account backups (A) isolate copies in separate accounts so a breach in a production account cannot delete all backups. SCPs that restrict AWS Backup vault modification (B) prevent users in production accounts from disabling or deleting backups, even with high privileges. AWS Backup Vault Lock in compliance mode with least-privilege roles (C) enforces immutability so backups cannot be altered or deleted before retention expires, protecting against ransomware. Options D and E do not directly provide credential-compromise resilience or are not supported as described.
Question 200
A company is migrating its infrastructure to the AWS Cloud. The company must comply with a variety of regulatory standards for different projects. The company needs a multi-account environment.
A solutions architect needs to prepare the baseline infrastructure. The solution must provide a consistent baseline of management and security, but it must allow flexibility for different compliance requirements within various AWS accounts. The solution also needs to integrate with the existing on-premises Active Directory Federation Services (AD FS) server.
Which solution meets these requirements with the LEAST amount of operational overhead?
A. Create an organization in AWS Organizations. Create a single SCP for least privilege access across all accounts. Create a single OU for all accounts. Configure an IAM identity provider for federation with the on-premises AD FS server. Configure a central logging account with a defined process for log generating services to send log events to the central account. Enable AWS Config in the central account with conformance packs for all accounts.
B. Create an organization in AWS Organizations. Enable AWS Control Tower on the organization. Review included controls (guardrails) for SCPs. Check AWS Config for areas that require additions. Add OUs as necessary. Connect AWS IAM Identity Center (AWS Single Sign-On) to the on-premises AD FS server.
C. Create an organization in AWS Organizations. Create SCPs for least privilege access. Create an OU structure, and use it to group AWS accounts. Connect AWS IAM Identity Center (AWS Single Sign-On) to the on-premises AD FS server. Configure a central logging account with a defined process for log generating services to send log events to the central account. Enable AWS Config in the central account with aggregators and conformance packs.
D. Create an organization in AWS Organizations. Enable AWS Control Tower on the organization. Review included controls (guardrails) for SCPs. Check AWS Config for areas that require additions. Configure an IAM identity provider for federation with the on-premises AD FS server.
Show Answer
Correct Answer: B
Explanation: AWS Control Tower provides the lowest operational overhead by automating a multi-account landing zone with built-in guardrails (SCPs), centralized logging, and AWS Config. It establishes a consistent security and management baseline while allowing flexibility through OUs for differing compliance needs. Integrating AWS IAM Identity Center with the existing on‑premises AD FS is the recommended, managed approach for workforce federation, minimizing custom setup and ongoing maintenance compared to manual configurations.
Question 201
A company recently migrated a web application from an on-premises data center to the AWS Cloud. The web application infrastructure consists of an Amazon CloudFront distribution that routes to an Application Load Balancer (ALB), with Amazon Elastic Container Service (Amazon ECS) to process requests. A recent security audit revealed that the web application is accessible by using both CloudFront and ALB endpoints. However, the company requires that the web application must be accessible only by using the CloudFront endpoint.
Which solution will meet this requirement with the LEAST amount of effort?
A. Create a new security group and attach it to the CloudFront distribution. Update the ALB security group ingress to allow access only from the CloudFront security group.
B. Update ALB security group ingress to allow access only from the com.amazonaws.global.cloudfront.origin-facing CloudFront managed prefix list.
C. Create a com.amazonaws.region.elasticloadbalancing VPC interface endpoint for Elastic Load Balancing. Update the ALB scheme from internet-facing to internal.
D. Extract CloudFront IPs from the AWS provided ip-ranges.json document. Update ALB security group ingress to allow access only from CloudFront IPs.
Show Answer
Correct Answer: B
Explanation: To ensure the application is accessible only through CloudFront with the least effort, restrict the ALB’s security group to allow inbound traffic only from the AWS-managed CloudFront origin-facing prefix list (com.amazonaws.global.cloudfront.origin-facing). CloudFront cannot have a security group attached, and manually managing CloudFront IP ranges is error-prone and limited by security group rule counts. The managed prefix list is purpose-built, automatically updated, and the simplest correct solution.
Question 202
A company is migrating an application to the AWS Cloud. The application runs in an on-premises data center and writes thousands of images into a mounted NFS file system each night. After the company migrates the application, the company will host the application on an Amazon EC2 instance with a mounted Amazon Elastic File System (Amazon EFS) file system.
The company has established an AWS Direct Connect connection to AWS. Before the migration cutover, a solutions architect must build a process that will replicate the newly created on-premises images to the EFS file system.
What is the MOST operationally efficient way to replicate the images?
A. Configure a periodic process to run the aws s3 sync command from the on-premises file system to Amazon S3. Configure an AWS Lambda function to process event notifications from Amazon S3 and copy the images from Amazon S3 to the EFS file system.
B. Deploy an AWS Storage Gateway file gateway with an NFS mount point. Mount the file gateway file system on the on-premises server. Configure a process to periodically copy the images to the mount point.
C. Deploy an AWS DataSync agent to an on-premises server that has access to the NFS file system. Send data over the Direct Connect connection to an S3 bucket by using a public VIF. Configure an AWS Lambda function to process event notifications from Amazon S3 and copy the images from Amazon S3 to the EFS file system.
D. Deploy an AWS DataSync agent to an on-premises server that has access to the NFS file system. Send data over the Direct Connect connection to an AWS PrivateLink interface VPC endpoint for Amazon EFS by using a private VIF. Configure a DataSync scheduled task to send the images to the EFS file system every 24 hours.
Show Answer
Correct Answer: D
Explanation: AWS DataSync is purpose-built for efficiently transferring large numbers of files from on-premises NFS to AWS storage services, including Amazon EFS. Option D uses DataSync to directly replicate data from the on-premises NFS file system to EFS on a schedule, minimizing operational overhead. It avoids intermediate storage (such as Amazon S3), removes the need for custom scripts or Lambda functions, and leverages the existing Direct Connect private connectivity for secure, high-throughput transfers. This makes it the most operationally efficient solution.
Question 203
A company has developed a mobile game. The backend for the game runs on several virtual machines located in an on-premises data center. The business logic is exposed using a REST API with multiple functions. Player session data is stored in central file storage. Backend services use different API keys for throttling and to distinguish between live and test traffic.
The load on the game backend varies throughout the day. During peak hours, the server capacity is not sufficient. There are also latency issues when fetching player session data. Management has asked a solutions architect to present a cloud architecture that can handle the game’s varying load and provide low-latency data access. The API model should not be changed.
Which solution meets these requirements?
A. Implement the REST API using a Network Load Balancer (NLB). Run the business logic on an Amazon EC2 instance behind the NLB. Store player session data in Amazon Aurora Serverless.
B. Implement the REST API using an Application Load Balancer (ALB). Run the business logic in AWS Lambda. Store player session data in Amazon DynamoDB with on-demand capacity.
C. Implement the REST API using Amazon API Gateway. Run the business logic in AWS Lambda. Store player session data in Amazon DynamoDB with on-demand capacity.
D. Implement the REST API using AWS AppSync. Run the business logic in AWS Lambda. Store player session data in Amazon Aurora Serverless.
Show Answer
Correct Answer: C
Explanation: The solution must handle highly variable load, scale automatically, provide low-latency access to session data, and keep the REST API model unchanged. Amazon API Gateway is purpose-built to expose REST APIs and supports features like API keys and throttling natively. AWS Lambda provides automatic scaling for the business logic during peak and off-peak hours without capacity planning. Amazon DynamoDB with on-demand capacity delivers consistently low-latency data access and scales seamlessly with unpredictable traffic. Together, API Gateway, Lambda, and DynamoDB form a fully serverless, elastic architecture that meets all requirements.
Question 204
A financial services company runs a complex, multi-tier application on Amazon EC2 instances and AWS Lambda functions. The application stores temporary data in Amazon S3. The S3 objects are valid for only 45 minutes and are deleted after 24 hours.
The company deploys each version of the application by launching an AWS CloudFormation stack. The stack creates all resources that are required to run the application. When the company deploys and validates a new application version, the company deletes the CloudFormation stack of the old version.
The company recently tried to delete the CloudFormation stack of an old application version, but the operation failed. An analysis shows that CloudFormation failed to delete an existing S3 bucket. A solutions architect needs to resolve this issue without making major changes to the application's architecture.
Which solution meets these requirements?
A. Implement a Lambda function that deletes all files from a given S3 bucket. Integrate this Lambda function as a custom resource into the CloudFormation stack. Ensure that the custom resource has a DependsOn attribute that points to the S3 bucket's resource.
B. Modify the CloudFormation template to provision an Amazon Elastic File System (Amazon EFS) file system to store the temporary files there instead of in Amazon S3. Configure the Lambda functions to run in the same VPC as the file system. Mount the file system to the EC2 instances and Lambda functions.
C. Modify the CloudF ormation stack to create an S3 Lifecycle rule that expires all objects 45 minutes after creation. Add a DependsOn attribute that points to the S3 bucket’s resource.
D. Modify the CloudFormation stack to attach a DeletionPolicy attribute with a value of Delete to the S3 bucket.
Show Answer
Correct Answer: A
Explanation: CloudFormation cannot delete an S3 bucket that contains objects, which is why the stack deletion failed. A DeletionPolicy does not solve this, and lifecycle rules do not guarantee the bucket will be empty at stack deletion time. Adding a Lambda-backed custom resource that empties the bucket during stack deletion allows CloudFormation to successfully delete the bucket without changing the overall application architecture.
Question 205
A company wants to migrate its on-premises application to AWS. The database for the application stores structured product data and temporary user session data. The company needs to decouple the product data from the user session data. The company also needs to implement replication in another AWS Region for disaster recovery.
Which solution will meet these requirements with the HIGHEST performance?
A. Create an Amazon RDS DB instance with separate schemas to host the product data and the user session data. Configure a read replica for the DB instance in another Region.
B. Create an Amazon RDS DB instance to host the product data. Configure a read replica for the DB instance in another Region. Create a global datastore in Amazon ElastiCache for Memcached to host the user session data.
C. Create two Amazon DynamoDB global tables. Use one global table to host the product data. Use the other global table to host the user session data. Use DynamoDB Accelerator (DAX) for caching.
D. Create an Amazon RDS DB instance to host the product data. Configure a read replica for the DB instance in another Region. Create an Amazon DynamoDB global table to host the user session data.
Show Answer
Correct Answer: D
Explanation: The requirements are to decouple structured product data from temporary session data, replicate to another Region for DR, and achieve the highest performance. Using Amazon RDS for product data fits structured, relational access patterns and supports cross-Region read replicas. User session data is ephemeral and benefits from a highly scalable, low-latency store with native multi-Region replication, which DynamoDB global tables provide. This cleanly decouples workloads and delivers high performance without misusing RDS for sessions or overloading DynamoDB with complex relational queries. Other options either mix both data types in RDS, rely on ElastiCache features that do not meet the replication requirement, or use DynamoDB for relational product data, which is not the best fit in typical exam context.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.