A company is migrating a legacy application from an on-premises data center to AWS. The application uses MongoDB as a key-value database. According to the company's technical guidelines, all Amazon EC2 instances must be hosted in a private subnet without an internet connection. In addition, all connectivity between applications and databases must be encrypted. The database must be able to scale based on demand.
Which solution will meet these requirements?
A. Create new Amazon DocumentDB (with MongoDB compatibility) tables for the application with Provisioned IOPS volumes. Use the instance endpoint to connect to Amazon DocumentDB.
B. Create new Amazon DynamoDB tables for the application with on-demand capacity. Use a gateway VPC endpoint for DynamoDB to connect to the DynamoDB tables.
C. Create new Amazon DynamoDB tables for the application with on-demand capacity. Use an interface VPC endpoint for DynamoDB to connect to the DynamoDB tables.
D. Create new Amazon DocumentDB (with MongoDB compatibility) tables for the application with Provisioned IOPS volumes. Use the cluster endpoint to connect to Amazon DocumentDB.
Show Answer
Correct Answer: B
Explanation: The requirements are: no internet connectivity from private subnets, encrypted connectivity, and the ability to scale based on demand. Amazon DynamoDB with on-demand capacity inherently scales automatically with demand and encrypts data in transit and at rest. Access from private subnets without internet access is achieved using a **gateway VPC endpoint**, which is the correct and supported endpoint type for DynamoDB. Although the legacy app uses MongoDB, it is described as a key-value database, making DynamoDB an acceptable replacement. Amazon DocumentDB options are weaker because scaling is manual and the options incorrectly emphasize Provisioned IOPS, which does not meet the "scale based on demand" requirement as well as DynamoDB on-demand.
Question 207
A company processes environmental data. The company has set up sensors to provide a continuous stream of data from different areas in a city. The data is available in JSON format.
The company wants to use an AWS solution to send the data to a database that does not require fixed schemas for storage. The data must be sent in real time.
Which solution will meet these requirements?
A. Use Amazon Kinesis Data Firehose to send the data to Amazon Redshift.
B. Use Amazon Kinesis Data Streams to send the data to Amazon DynamoD
C. Use Amazon Managed Streaming for Apache Kafka (Amazon MSK) to send the data to Amazon Aurora.
D. Use Amazon Kinesis Data Firehose to send the data to Amazon Keyspaces (for Apache Cassandra).
Show Answer
Correct Answer: B
Explanation: The requirements are real-time ingestion and a database without a fixed schema. Amazon DynamoDB is a NoSQL database with flexible (schema-less) items and supports JSON-like data. Amazon Kinesis Data Streams is designed for real-time streaming ingestion. Together, they meet the real-time and schema-flexibility requirements. The other options use destinations that either enforce schemas (Redshift, Aurora) or are not valid native Firehose targets (Keyspaces).
Question 208
A solutions architect needs to migrate an on-premises legacy application to AWS. The application runs on two servers behind a load balancer. The application requires a license file that is associated with the MAC address of the server's network adapter It takes the software vendor 12 hours to send new license files. The application also uses configuration files with a static IP address to access a database server, host names are not supported.
Given these requirements, which combination of steps should be taken to implement highly available architecture for the application servers in AWS? (Choose two.)
A. Create a pool of ENIs. Request license files from the vendor for the pool, and store the license files in Amazon S3. Create a bootstrap automation script to download a license file and attach the corresponding ENI to an Amazon EC2 instance.
B. Create a pool of ENIs. Request license files from the vendor for the pool, store the license files on an Amazon EC2 instance. Create an AMI from the instance and use this AMI for all future EC2 instances.
C. Create a bootstrap automation script to request a new license file from the vendor .When the response is received, apply the license file to an Amazon EC2 instance.
D. Edit the bootstrap automation script to read the database server IP address from the AWS Systems Manager Parameter Store, and inject the value into the local configuration files.
E. Edit an Amazon EC2 instance to include the database server IP address in the configuration files and re-create the AMI to use for all future EC2 stances.
Show Answer
Correct Answer: A, D
Explanation: The application license is bound to a MAC address and takes 12 hours to obtain, so using a pool of prelicensed ENIs allows instances to be replaced quickly while retaining the same MAC address; storing licenses in S3 and attaching the corresponding ENI at boot supports high availability (A). The application requires a static IP for the database and does not support hostnames, so using a bootstrap script to retrieve the IP from AWS Systems Manager Parameter Store and inject it into configuration files enables flexible, highly available deployments without rebuilding AMIs (D).
Question 209
A solutions architect is determining the DNS strategy for an existing VPC. The VPC is provisioned to use the 10.24.34.0/24 CIDR block. The VPC also uses Amazon Route 53 Resolver for DNS. New requirements mandate that DNS queries must use private hosted zones. Additionally instances that have public IP addresses must receive corresponding public hostnames
Which solution will meet these requirements to ensure that the domain names are correctly resolved within the VPC?
A. Create a private hosted zone. Activate the enableDnsSupport attribute and the enableDnsHostnames attribute for the VPC. Update the VPC DHCP options set to include domain-name-servers=10.24.34.2.
B. Create a private hosted zone Associate the private hosted zone with the VPC. Activate the enableDnsSupport attribute and the enableDnsHostnames attribute for the VPC. Create a new VPC DHCP options set, and configure domain-name-servers=AmazonProvidedDNS. Associate the new DHCP options set with the VPC.
C. Deactivate the enableDnsSupport attribute for the VPActivate the enableDnsHostnames attribute for the VPCreate a new VPC DHCP options set, and configure doman-name-servers=10.24.34.2. Associate the new DHCP options set with the VP
D. Create a private hosted zone. Associate the private hosted zone with the VPC. Activate the enableDnsSupport attribute for the VPC. Deactivate the enableDnsHostnames attribute for the VPC. Update the VPC DHCP options set to include domain-name-servers=AmazonProvidedDNS.
Show Answer
Correct Answer: B
Explanation: Private hosted zones require Amazon Route 53 Resolver, which is used only when enableDnsSupport is enabled and instances use AmazonProvidedDNS via the VPC DHCP options set. Associating the private hosted zone with the VPC ensures private DNS resolution. Enabling enableDnsHostnames is required so instances with public IP addresses receive corresponding public DNS hostnames. Option B correctly configures all of these elements.
Question 210
An online retail company hosts its stateful web-based application and MySQL database in an on-premises data center on a single server. The company wants to increase its customer base by conducting more marketing campaigns and promotions. In preparation, the company wants to migrate its application and database to AWS to increase the reliability of its architecture.
Which solution should provide the HIGHEST level of reliability?
A. Migrate the database to an Amazon RDS MySQL Multi-AZ DB instance. Deploy the application in an Auto Scaling group on Amazon EC2 instances behind an Application Load Balancer. Store sessions in Amazon Neptune
B. Migrate the database to Amazon Aurora MySQL. Deploy the application in an Auto Scaling group on Amazon EC2 instances behind an Application Load Balancer. Store sessions in an Amazon ElastiCache for Redis replication group.
C. Migrate the database to Amazon DocumentDB (with MongoDB compatibility). Deploy the application in an Auto Scaling group on Amazon EC2 instances behind a Network Load Balancer Store sessions in Amazon Kinesis Data Firehose.
D. Migrate the database to an Amazon RDS MariaDB Multi-AZ DB instance. Deploy the application in an Auto Scaling group on Amazon EC2 instances behind an Application Load Balancer. Store sessions in Amazon ElastiCache for Memcached.
Show Answer
Correct Answer: B
Explanation: The goal is the highest reliability. Amazon Aurora MySQL provides built-in multi-AZ, highly durable storage with automatic failover and faster recovery than standard RDS engines. Running the application on EC2 Auto Scaling behind an Application Load Balancer distributes traffic across multiple AZs and replaces unhealthy instances automatically. Storing session state in Amazon ElastiCache for Redis using a replication group provides in-memory performance with replication and automatic failover, removing state from the application tier. Other options include inappropriate services for session storage or less reliable caching choices, making this architecture the most reliable overall.
Question 211
A research company is running daily simulations in the AWS Cloud to meet high demand. The simulations run on several hundred Amazon EC2 instances that are based on Amazon Linux 2. Occasionally, a simulation gets stuck and requires a cloud operations engineer to solve the problem by connecting to an EC2 instance through SSH.
Company policy states that no EC2 instance can use the same SSH key and that all connections must be logged in AWS CloudTrail.
How can a solutions architect meet these requirements?
A. Launch new EC2 instances, and generate an individual SSH key for each instance. Store the SSH key in AWS Secrets Manager. Create a new IAM policy, and attach it to the engineers’ IAM role with an Allow statement for the GetSecretValue action. Instruct the engineers to fetch the SSH key from Secrets Manager when they connect through any SSH client.
B. Create an AWS Systems Manager document to run commands on EC2 instances to set a new unique SSH key. Create a new IAM policy, and attach it to the engineers’ IAM role with an Allow statement to run Systems Manager documents. Instruct the engineers to run the document to set an SSH key and to connect through any SSH client.
C. Launch new EC2 instances without setting up any SSH key for the instances. Set up EC2 Instance Connect on each instance. Create a new IAM policy, and attach it to the engineers’ IAM role with an Allow statement for the SendSSHPublicKey action. Instruct the engineers to connect to the instance by using a browser-based SSH client from the EC2 console.
D. Set up AWS Secrets Manager to store the EC2 SSH key. Create a new AWS Lambda function to create a new SSH key and to call AWS Systems Manager Session Manager to set the SSH key on the EC2 instance. Configure Secrets Manager to use the Lambda function for automatic rotation once daily. Instruct the engineers to fetch the SSH key from Secrets Manager when they connect through any SSH client.
Show Answer
Correct Answer: C
Explanation: The requirements are that no EC2 instances share the same SSH key and that all access is logged in AWS CloudTrail. EC2 Instance Connect meets both: it uses short‑lived, one‑time SSH public keys that are pushed to the instance at connection time, so there are no shared or long‑term keys. The SendSSHPublicKey API call is recorded in CloudTrail, providing an auditable log of every connection. The other options rely on long‑lived keys or manual key management and do not reliably ensure per‑connection uniqueness with full CloudTrail visibility.
Question 212
A company's compliance audit reveals that some Amazon Elastic Block Store (Amazon EBS) volumes that were created in an AWS account were not encrypted. A solutions architect must implement a solution to encrypt all new EBS volumes at rest.
Which solution will meet this requirement with the LEAST effort?
A. Create an Amazon EventBridge rule to detect the creation of unencrypted EBS volumes. Invoke an AWS Lambda function to delete noncompliant volumes.
B. Use AWS Audit Manager with data encryption.
C. Create an AWS Config rule to detect the creation of a new EBS volume. Encrypt the volume by using AWS Systems Manager Automation.
D. Turn on EBS encryption by default in all AWS Regions.
Show Answer
Correct Answer: D
Explanation: The requirement is to encrypt all *new* EBS volumes at rest with the least effort. Enabling EBS encryption by default ensures that every newly created EBS volume is automatically encrypted without additional automation, monitoring, or remediation. Other options involve detection and post-creation actions, which require more setup and operational overhead.
Question 213
A company’s solutions architect needs to provide secure Remote Desktop connectivity to users for Amazon EC2 Windows instances that are hosted in a VPC. The solution must integrate centralized user management with the company's on-premises Active Directory. Connectivity to the VPC is through the internet. The company has hardware that can be used to establish an AWS Site-to-Site VPN connection.
Which solution will meet these requirements MOST cost-effectively?
A. Deploy a managed Active Directory by using AWS Directory Service for Microsoft Active Directory. Establish a trust with the on-premises Active Directory. Deploy an EC2 instance as a bastion host in the VPC. Ensure that the EC2 instance is joined to the domain. Use the bastion host to access the target instances through RDP.
B. Configure AWS IAM Identity Center (AWS Single Sign-On) to integrate with the on-premises Active Directory by using the AWS Directory Service for Microsoft Active Directory AD Connector. Configure permission sets against user groups for access to AWS Systems Manager. Use Systems Manager Fleet Manager to access the target instances through RDP.
C. Implement a VPN between the on-premises environment and the target VPEnsure that the target instances are joined to the on-premises Active Directory domain over the VPN connection. Configure RDP access through the VPN. Connect from the company’s network to the target instances.
D. Deploy a managed Active Directory by using AWS Directory Service for Microsoft Active Directory. Establish a trust with the on-premises Active Directory. Deploy a Remote Desktop Gateway on AWS by using an AWS Quick Start. Ensure that the Remote Desktop Gateway is joined to the domain. Use the Remote Desktop Gateway to access the target instances through RDP.
Show Answer
Correct Answer: B
Explanation: The key requirements are secure RDP access over the internet, centralized user management integrated with on‑premises Active Directory, and the MOST cost‑effective approach.
Option B uses AWS IAM Identity Center integrated with on‑premises AD via AD Connector and provides RDP access through AWS Systems Manager Fleet Manager. This avoids exposing RDP ports, eliminates the need for bastion hosts, Remote Desktop Gateways, or additional EC2 infrastructure, and does not require running or trusting a full AWS Managed Microsoft AD. AD Connector is lower cost than managed AD, and Systems Manager access has no additional instance cost.
Option C, while workable, relies on direct RDP over VPN and does not provide centralized access control and auditing through AWS services. It also does not leverage AWS-native secure access mechanisms and is not the preferred exam answer when Systems Manager can replace VPN-based RDP access more cost-effectively.
Therefore, B best meets all requirements at the lowest operational and infrastructure cost.
Question 214
A company is deploying a new API to AWS. The API uses Amazon API Gateway with a Regional API endpoint and an AWS Lambda function for hosting. The API retrieves data from an external vendor API, stores data in an Amazon DynamoDB global table, and retrieves data from the DynamoDB global table The API key for the vendor's API is stored in AWS Secrets Manager and is encrypted with a customer managed key in AWS Key Management Service (AWS KMS). The company has deployed its own API into a single AWS Region.
A solutions architect needs to change the API components of the company’s API to ensure that the components can run across multiple Regions in an active-active configuration.
Which combination of changes will meet this requirement with the LEAST operational overhead? (Choose three.)
A. Deploy the API to multiple Regions. Configure Amazon Route 53 with custom domain names that route traffic to each Regional API endpoint. Implement a Route 53 multivalue answer routing policy.
B. Create a new KMS multi-Region customer managed key. Create a new KMS customer managed replica key in each in-scope Region.
C. Replicate the existing Secrets Manager secret to other Regions. For each in-scope Region's replicated secret, select the appropriate KMS key.
D. Create a new AWS managed KMS key in each in-scope Region. Convert an existing key to a multiRegion key. Use the multi-Region key in other Regions.
E. Create a new Secrets Manager secret in each in-scope Region. Copy the secret value from the existing Region to the new secret in each in-scope Region.
F. Modify the deployment process for the Lambda function to repeat the deployment across in-scope Regions. Turn on the multi-Region option for the existing API. Select the Lambda function that is deployed in each Region as the backend for the multi-Region API.
Show Answer
Correct Answer: A, B, C
Explanation: To run the API in an active-active, multi-Region configuration with the least operational overhead, the API Gateway and its supporting components must be available in each Region, and shared secrets and encryption must work seamlessly across Regions.
A is required because Regional API Gateway endpoints are Region-specific. Deploying the API to multiple Regions and using Route 53 to route traffic across those Regional endpoints enables active-active traffic distribution with minimal additional management.
B is required because the API key is encrypted with a customer managed KMS key. A KMS multi-Region key with replica keys allows the same cryptographic key material to be used in multiple Regions, which is necessary for decrypting secrets locally in each Region.
C is required because Secrets Manager secrets are Region-scoped. Replicating the existing secret to other Regions is the native, low-overhead way to make the vendor API key available to Lambda functions in each Region while selecting the appropriate KMS key.
Other options either add unnecessary manual steps, rely on unsupported conversions (such as converting keys to multi-Region), or describe features that do not exist (such as a multi-Region option for API Gateway).
Question 215
A software company needs to create short-lived test environments to test pull requests as part of its development process. Each test environment consists of a single Amazon EC2 instance that is in an Auto Scaling group.
The test environments must be able to communicate with a central server to report test results. The central server is located in an on-premises data center. A solutions architect must implement a solution so that the company can create and delete test environments without any manual intervention. The company has created a transit gateway with a VPN attachment to the on-premises network.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an AWS CloudFormation template that contains a transit gateway attachment and related routing configurations. Create a CloudFormation stack set that includes this template. Use CloudFormation StackSets to deploy a new stack for each VPC in the account. Deploy a new VPC for each test environment.
B. Create a single VPC for the test environments. Include a transit gateway attachment and related routing configurations. Use AWS CloudFormation to deploy all test environments into the VPC.
C. Create a new OU in AWS Organizations for testing. Create an AWS CioudFormation template that contains a VPC, necessary networking resources, a transit gateway attachment, and related routing configurations. Create a CloudFormation stack set that includes this template. Use CloudFormation StackSets for deployments into each account under the testing OU. Create a new account for each test environment.
D. Convert the test environment EC2 instances into Docker images. Use AWS CloudFormation to configure an Amazon Elastic Kubernetes Service (Amazon EKS) cluster in a new VPC, create a transit gateway attachment, and create related routing configurations. Use Kubernetes to manage the deployment and lifecycle of the test environments.
Show Answer
Correct Answer: B
Explanation: The requirement is to create and delete short-lived test environments automatically with the least operational overhead while maintaining connectivity to an on-premises data center through an existing transit gateway VPN. Using a single VPC for all test environments allows one shared transit gateway attachment and routing configuration, eliminating the need to repeatedly create and manage VPCs, accounts, stack sets, or additional networking components. Each test environment can be created and removed by deploying or deleting an Auto Scaling group and EC2 instance within the same VPC. Other options add unnecessary complexity such as multiple VPCs, multiple accounts, or container orchestration, which increases operational overhead.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.