A company is migrating its infrastructure to the AWS Cloud. The company must comply with a variety of regulatory standards for different projects. The company needs a multi-account environment.
A solutions architect needs to prepare the baseline infrastructure. The solution must provide a consistent baseline of management and security, but it must allow flexibility for different compliance requirements within various AWS accounts. The solution also needs to integrate with the existing on-premises Active Directory Federation Services (AD FS) server.
Which solution meets these requirements with the LEAST amount of operational overhead?
A. Create an organization in AWS Organizations. Create a single SCP for least privilege access across all accounts. Create a single OU for all accounts. Configure an IAM identity provider for federation with the on-premises AD FS server. Configure a central logging account with a defined process for log generating services to send log events to the central account. Enable AWS Config in the central account with conformance packs for all accounts.
B. Create an organization in AWS Organizations. Enable AWS Control Tower on the organization. Review included controls (guardrails) for SCPs. Check AWS Config for areas that require additions. Add OUs as necessary. Connect AWS IAM Identity Center (AWS Single Sign-On) to the on-premises AD FS server.
C. Create an organization in AWS Organizations. Create SCPs for least privilege access. Create an OU structure, and use it to group AWS accounts. Connect AWS IAM Identity Center (AWS Single Sign-On) to the on-premises AD FS server. Configure a central logging account with a defined process for log generating services to send log events to the central account. Enable AWS Config in the central account with aggregators and conformance packs.
D. Create an organization in AWS Organizations. Enable AWS Control Tower on the organization. Review included controls (guardrails) for SCPs. Check AWS Config for areas that require additions. Configure an IAM identity provider for federation with the on-premises AD FS server.
Show Answer
Correct Answer: B
Explanation: AWS Control Tower provides the lowest operational overhead for establishing and governing a multi-account AWS environment with built-in landing zone, guardrails, account factory, logging, and AWS Config integration. It supports organizing accounts into OUs for differing compliance requirements. IAM Identity Center is the recommended workforce access solution and can integrate with an existing AD FS environment via external identity federation, satisfying the authentication requirement with less manual management than configuring IAM identity providers per account.
Question 201
A company recently migrated a web application from an on-premises data center to the AWS Cloud. The web application infrastructure consists of an Amazon CloudFront distribution that routes to an Application Load Balancer (ALB), with Amazon Elastic Container Service (Amazon ECS) to process requests. A recent security audit revealed that the web application is accessible by using both CloudFront and ALB endpoints. However, the company requires that the web application must be accessible only by using the CloudFront endpoint.
Which solution will meet this requirement with the LEAST amount of effort?
A. Create a new security group and attach it to the CloudFront distribution. Update the ALB security group ingress to allow access only from the CloudFront security group.
B. Update ALB security group ingress to allow access only from the com.amazonaws.global.cloudfront.origin-facing CloudFront managed prefix list.
C. Create a com.amazonaws.region.elasticloadbalancing VPC interface endpoint for Elastic Load Balancing. Update the ALB scheme from internet-facing to internal.
D. Extract CloudFront IPs from the AWS provided ip-ranges.json document. Update ALB security group ingress to allow access only from CloudFront IPs.
Show Answer
Correct Answer: B
Explanation: CloudFront does not support attaching security groups, so A is impossible. The simplest and recommended approach is to restrict the ALB's security group to allow ingress only from the AWS-managed CloudFront origin-facing prefix list (com.amazonaws.global.cloudfront.origin-facing), ensuring only CloudFront can reach the ALB. Making the ALB internal via a VPC endpoint (C) does not fit CloudFront's public origin model. Manually maintaining CloudFront IP ranges from ip-ranges.json (D) is more operationally complex than using the managed prefix list.
Question 202
A company is migrating an application to the AWS Cloud. The application runs in an on-premises data center and writes thousands of images into a mounted NFS file system each night. After the company migrates the application, the company will host the application on an Amazon EC2 instance with a mounted Amazon Elastic File System (Amazon EFS) file system.
The company has established an AWS Direct Connect connection to AWS. Before the migration cutover, a solutions architect must build a process that will replicate the newly created on-premises images to the EFS file system.
What is the MOST operationally efficient way to replicate the images?
A. Configure a periodic process to run the aws s3 sync command from the on-premises file system to Amazon S3. Configure an AWS Lambda function to process event notifications from Amazon S3 and copy the images from Amazon S3 to the EFS file system.
B. Deploy an AWS Storage Gateway file gateway with an NFS mount point. Mount the file gateway file system on the on-premises server. Configure a process to periodically copy the images to the mount point.
C. Deploy an AWS DataSync agent to an on-premises server that has access to the NFS file system. Send data over the Direct Connect connection to an S3 bucket by using a public VIF. Configure an AWS Lambda function to process event notifications from Amazon S3 and copy the images from Amazon S3 to the EFS file system.
D. Deploy an AWS DataSync agent to an on-premises server that has access to the NFS file system. Send data over the Direct Connect connection to an AWS PrivateLink interface VPC endpoint for Amazon EFS by using a private VIF. Configure a DataSync scheduled task to send the images to the EFS file system every 24 hours.
Show Answer
Correct Answer: D
Explanation: AWS DataSync is the managed service designed to efficiently and incrementally transfer data from an on-premises NFS file system directly to Amazon EFS on a schedule. It avoids unnecessary intermediate storage such as Amazon S3 or custom Lambda workflows, making it the most operationally efficient solution. Although the wording about PrivateLink is imprecise for EFS data transfer, the intended exam answer is the DataSync-to-EFS option.
Question 203
A company has developed a mobile game. The backend for the game runs on several virtual machines located in an on-premises data center. The business logic is exposed using a REST API with multiple functions. Player session data is stored in central file storage. Backend services use different API keys for throttling and to distinguish between live and test traffic.
The load on the game backend varies throughout the day. During peak hours, the server capacity is not sufficient. There are also latency issues when fetching player session data. Management has asked a solutions architect to present a cloud architecture that can handle the game’s varying load and provide low-latency data access. The API model should not be changed.
Which solution meets these requirements?
A. Implement the REST API using a Network Load Balancer (NLB). Run the business logic on an Amazon EC2 instance behind the NLB. Store player session data in Amazon Aurora Serverless.
B. Implement the REST API using an Application Load Balancer (ALB). Run the business logic in AWS Lambda. Store player session data in Amazon DynamoDB with on-demand capacity.
C. Implement the REST API using Amazon API Gateway. Run the business logic in AWS Lambda. Store player session data in Amazon DynamoDB with on-demand capacity.
D. Implement the REST API using AWS AppSync. Run the business logic in AWS Lambda. Store player session data in Amazon Aurora Serverless.
Show Answer
Correct Answer: C
Explanation: API Gateway is purpose-built for exposing REST APIs and supports API keys and usage plans for throttling and separating live/test traffic without changing the API model. AWS Lambda provides automatic scaling to handle variable load, eliminating capacity issues during peak hours. DynamoDB with on-demand capacity offers low-latency access and automatically scales for highly variable workloads, making it well suited for player session data. The other options either use less appropriate API front ends (ALB/NLB), rely on EC2, use Aurora for session storage, or AppSync, which is for GraphQL rather than REST.
Question 204
A financial services company runs a complex, multi-tier application on Amazon EC2 instances and AWS Lambda functions. The application stores temporary data in Amazon S3. The S3 objects are valid for only 45 minutes and are deleted after 24 hours.
The company deploys each version of the application by launching an AWS CloudFormation stack. The stack creates all resources that are required to run the application. When the company deploys and validates a new application version, the company deletes the CloudFormation stack of the old version.
The company recently tried to delete the CloudFormation stack of an old application version, but the operation failed. An analysis shows that CloudFormation failed to delete an existing S3 bucket. A solutions architect needs to resolve this issue without making major changes to the application's architecture.
Which solution meets these requirements?
A. Implement a Lambda function that deletes all files from a given S3 bucket. Integrate this Lambda function as a custom resource into the CloudFormation stack. Ensure that the custom resource has a DependsOn attribute that points to the S3 bucket's resource.
B. Modify the CloudFormation template to provision an Amazon Elastic File System (Amazon EFS) file system to store the temporary files there instead of in Amazon S3. Configure the Lambda functions to run in the same VPC as the file system. Mount the file system to the EC2 instances and Lambda functions.
C. Modify the CloudF ormation stack to create an S3 Lifecycle rule that expires all objects 45 minutes after creation. Add a DependsOn attribute that points to the S3 bucket’s resource.
D. Modify the CloudFormation stack to attach a DeletionPolicy attribute with a value of Delete to the S3 bucket.
Show Answer
Correct Answer: A
Explanation: CloudFormation cannot delete a non-empty S3 bucket. The stack deletion fails because objects remain in the bucket. A Lambda-backed custom resource can empty the bucket during stack deletion, allowing CloudFormation to delete the bucket afterward. Option B is a major architectural change. Option C is invalid because S3 Lifecycle expiration has a minimum granularity of days, not 45 minutes, and would not guarantee an empty bucket at deletion time. Option D's DeletionPolicy: Delete does not override the requirement that an S3 bucket must be empty before deletion.
Question 205
A company wants to migrate its on-premises application to AWS. The database for the application stores structured product data and temporary user session data. The company needs to decouple the product data from the user session data. The company also needs to implement replication in another AWS Region for disaster recovery.
Which solution will meet these requirements with the HIGHEST performance?
A. Create an Amazon RDS DB instance with separate schemas to host the product data and the user session data. Configure a read replica for the DB instance in another Region.
B. Create an Amazon RDS DB instance to host the product data. Configure a read replica for the DB instance in another Region. Create a global datastore in Amazon ElastiCache for Memcached to host the user session data.
C. Create two Amazon DynamoDB global tables. Use one global table to host the product data. Use the other global table to host the user session data. Use DynamoDB Accelerator (DAX) for caching.
D. Create an Amazon RDS DB instance to host the product data. Configure a read replica for the DB instance in another Region. Create an Amazon DynamoDB global table to host the user session data.
Show Answer
Correct Answer: D
Explanation: Use Amazon RDS for the structured product data, which is the best fit for relational structured data, and configure a cross-Region read replica for disaster recovery. Store temporary user session data in a DynamoDB global table, which is well suited for session state and provides multi-Region replication. Option B is invalid because ElastiCache Global Datastore supports Redis, not Memcached. Option A does not truly decouple the data because both reside in the same database instance. Option C offers very high performance but is not the best fit for relational structured product data in this migration scenario.
Question 206
A company is migrating a legacy application from an on-premises data center to AWS. The application uses MongoDB as a key-value database. According to the company's technical guidelines, all Amazon EC2 instances must be hosted in a private subnet without an internet connection. In addition, all connectivity between applications and databases must be encrypted. The database must be able to scale based on demand.
Which solution will meet these requirements?
A. Create new Amazon DocumentDB (with MongoDB compatibility) tables for the application with Provisioned IOPS volumes. Use the instance endpoint to connect to Amazon DocumentDB.
B. Create new Amazon DynamoDB tables for the application with on-demand capacity. Use a gateway VPC endpoint for DynamoDB to connect to the DynamoDB tables.
C. Create new Amazon DynamoDB tables for the application with on-demand capacity. Use an interface VPC endpoint for DynamoDB to connect to the DynamoDB tables.
D. Create new Amazon DocumentDB (with MongoDB compatibility) tables for the application with Provisioned IOPS volumes. Use the cluster endpoint to connect to Amazon DocumentDB.
Show Answer
Correct Answer: B
Explanation: The workload only uses MongoDB as a key-value database, so Amazon DynamoDB is an appropriate managed replacement. DynamoDB on-demand capacity scales automatically based on demand. EC2 instances in private subnets can access DynamoDB privately through a gateway VPC endpoint without requiring internet connectivity, and DynamoDB supports encryption in transit. The DocumentDB options specify Provisioned IOPS volumes (which is not an appropriate characterization for DocumentDB) and do not best satisfy the scaling requirement; additionally, if using DocumentDB, the cluster endpoint would be preferred over an instance endpoint.
Sources:
https://aws.amazon.com/blogs/database/migrate-from-mongodb-to-amazon-documentdb-using-the-offline-method
Question 207
A company processes environmental data. The company has set up sensors to provide a continuous stream of data from different areas in a city. The data is available in JSON format.
The company wants to use an AWS solution to send the data to a database that does not require fixed schemas for storage. The data must be sent in real time.
Which solution will meet these requirements?
A. Use Amazon Kinesis Data Firehose to send the data to Amazon Redshift.
B. Use Amazon Kinesis Data Streams to send the data to Amazon DynamoD
C. Use Amazon Managed Streaming for Apache Kafka (Amazon MSK) to send the data to Amazon Aurora.
D. Use Amazon Kinesis Data Firehose to send the data to Amazon Keyspaces (for Apache Cassandra).
Show Answer
Correct Answer: B
Explanation: Amazon DynamoDB is a NoSQL database that supports flexible JSON-like items without requiring a fixed schema. Amazon Kinesis Data Streams is designed for real-time streaming ingestion. Although production architectures commonly use a consumer such as AWS Lambda between Kinesis Data Streams and DynamoDB, among the provided options this is the only one that satisfies the real-time streaming and schema-flexible database requirements. Redshift and Aurora are relational databases, and Kinesis Data Firehose does not natively deliver to Amazon Keyspaces.
Question 208
A solutions architect needs to migrate an on-premises legacy application to AWS. The application runs on two servers behind a load balancer. The application requires a license file that is associated with the MAC address of the server's network adapter It takes the software vendor 12 hours to send new license files. The application also uses configuration files with a static IP address to access a database server, host names are not supported.
Given these requirements, which combination of steps should be taken to implement highly available architecture for the application servers in AWS? (Choose two.)
A. Create a pool of ENIs. Request license files from the vendor for the pool, and store the license files in Amazon S3. Create a bootstrap automation script to download a license file and attach the corresponding ENI to an Amazon EC2 instance.
B. Create a pool of ENIs. Request license files from the vendor for the pool, store the license files on an Amazon EC2 instance. Create an AMI from the instance and use this AMI for all future EC2 instances.
C. Create a bootstrap automation script to request a new license file from the vendor .When the response is received, apply the license file to an Amazon EC2 instance.
D. Edit the bootstrap automation script to read the database server IP address from the AWS Systems Manager Parameter Store, and inject the value into the local configuration files.
E. Edit an Amazon EC2 instance to include the database server IP address in the configuration files and re-create the AMI to use for all future EC2 stances.
Show Answer
Correct Answer: A, D
Explanation: The licensing is tied to the MAC address, so using a pool of Elastic Network Interfaces (ENIs) with pre-issued license files allows replacement EC2 instances to attach an ENI with the correct MAC address and corresponding license. Storing the license files in Amazon S3 makes them available to bootstrap automation. For the database configuration, reading the database IP from AWS Systems Manager Parameter Store during bootstrap and injecting it into the application's configuration files avoids baking a static IP into the AMI while still supporting an application that cannot use hostnames.
Question 209
A solutions architect is determining the DNS strategy for an existing VPC. The VPC is provisioned to use the 10.24.34.0/24 CIDR block. The VPC also uses Amazon Route 53 Resolver for DNS. New requirements mandate that DNS queries must use private hosted zones. Additionally instances that have public IP addresses must receive corresponding public hostnames
Which solution will meet these requirements to ensure that the domain names are correctly resolved within the VPC?
A. Create a private hosted zone. Activate the enableDnsSupport attribute and the enableDnsHostnames attribute for the VPC. Update the VPC DHCP options set to include domain-name-servers=10.24.34.2.
B. Create a private hosted zone Associate the private hosted zone with the VPC. Activate the enableDnsSupport attribute and the enableDnsHostnames attribute for the VPC. Create a new VPC DHCP options set, and configure domain-name-servers=AmazonProvidedDNS. Associate the new DHCP options set with the VPC.
C. Deactivate the enableDnsSupport attribute for the VPActivate the enableDnsHostnames attribute for the VPCreate a new VPC DHCP options set, and configure doman-name-servers=10.24.34.2. Associate the new DHCP options set with the VP
D. Create a private hosted zone. Associate the private hosted zone with the VPC. Activate the enableDnsSupport attribute for the VPC. Deactivate the enableDnsHostnames attribute for the VPC. Update the VPC DHCP options set to include domain-name-servers=AmazonProvidedDNS.
Show Answer
Correct Answer: B
Explanation: A private hosted zone must be created and explicitly associated with the VPC. To use Route 53 Resolver (AmazonProvidedDNS), the VPC must have both enableDnsSupport and enableDnsHostnames enabled. Instances with public IP addresses receive public DNS hostnames only when enableDnsHostnames is enabled. The DHCP options set should specify AmazonProvidedDNS rather than a hardcoded IP. Options A and C incorrectly use a specific DNS IP instead of AmazonProvidedDNS (and C disables DNS support). D disables enableDnsHostnames, preventing public hostnames.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.