A company runs its sales reporting application in an AWS Region in the United States. The application uses an Amazon API Gateway Regional API and AWS Lambda functions to generate on-demand reports from data in an Amazon RDS for MySQL database. The frontend of the application is hosted on Amazon S3 and is accessed by users through an Amazon CloudFront distribution. The company is using Amazon Route 53 as the DNS service for the domain. Route 53 is configured with a simple routing policy to route traffic to the API Gateway API.
In the next 6 months, the company plans to expand operations to Europe. More than 90% of the database traffic is read-only traffic. The company has already deployed an API Gateway API and Lambda functions in the new Region.
A solutions architect must design a solution that minimizes latency for users who download reports.
Which solution will meet these requirements?
A. Use an AWS Database Migration Service (AWS DMS) task with full load to replicate the primary database in the original Region to the database in the new Region. Change the Route 53 record to latency-based routing to connect to the API Gateway API.
B. Use an AWS Database Migration Service (AWS DMS) task with full load plus change data capture (CDC) to replicate the primary database in the original Region to the database in the new Region. Change the Route 53 record to geolocation routing to connect to the API Gateway API.
C. Configure a cross-Region read replica for the RDS database in the new Region Change the Route 53 record to latency-based routing to connect to the API Gateway API.
D. Configure a cross-Region read replica for the RDS database in the new Region. Change the Route 53 record to geolocation routing to connect to the API Gateway API.
Show Answer
Correct Answer: C
Explanation: More than 90% of the database traffic is read-only, which makes an Amazon RDS cross-Region read replica the most appropriate way to serve data closer to European users while keeping a single primary database. This minimizes read latency without introducing the complexity of bidirectional writes. Using Route 53 latency-based routing ensures users are directed to the API Gateway endpoint that provides the lowest network latency rather than routing strictly by geography, which best meets the requirement to minimize latency for users downloading reports.
Question 217
A company uses AWS Organizations to manage a multi-account structure. The company has hundreds of AWS accounts and expects the number of accounts to increase. The company is building a new application that uses Docker images. The company will push the Docker images to Amazon Elastic Container Registry (Amazon ECR). Only accounts that are within the company’s organization should have access to the images.
The company has a CI/CD process that runs frequently. The company wants to retain all the tagged images. However, the company wants to retain only the five most recent untagged images.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a private repository in Amazon ECR. Create a permissions policy for the repository that allows only required ECR operations. Include a condition to allow the ECR operations if the value of the aws:PrincipalOrglD condition key is equal to the ID of the company’s organization. Add a lifecycle rule to the ECR repository that deletes all untagged images over the count of five
B. Create a public repository in Amazon ECR. Create an IAM role in the ECR account. Set permissions so that any account can assume the role if the value of the aws:PrincipalOrglD condition key is equal to the ID of the company’s organization. Add a lifecycle rule to the ECR repository that deletes all untagged images over the count of five.
C. Create a private repository in Amazon ECR. Create a permissions policy for the repository that includes only required ECR operations. Include a condition to allow the ECR operations for all account IDs in the organization Schedule a daily Amazon EventBridge rule to invoke an AWS Lambda function that deletes all untagged images over the count of five.
D. Create a public repository in Amazon ECR. Configure Amazon ECR to use an interface VPC endpoint with an endpoint policy that includes the required permissions for images that the company needs to pull. Include a condition to allow the ECR operations for all account IDs in the company’s organization. Schedule a daily Amazon EventBridge rule to invoke an AWS Lambda function that deletes all untagged images over the count of five.
Show Answer
Correct Answer: A
Explanation: A private Amazon ECR repository supports resource-based policies that can restrict access using the aws:PrincipalOrgID condition key, which automatically scales as accounts are added to AWS Organizations. This meets the access requirement with minimal management. Amazon ECR lifecycle policies natively support retaining all tagged images while limiting untagged images to the most recent five, avoiding custom automation. The other options introduce unnecessary public repositories or Lambda/EventBridge management, increasing operational overhead.
Question 218
A research center is migrating to the AWS Cloud and has moved its on-premises 1 PB object storage to an Amazon S3 bucket. One hundred scientists are using this object storage to store their work-related documents. Each scientist has a personal folder on the object store. All the scientists are members of a single IAM user group.
The research center's compliance officer is worried that scientists will be able to access each other's work. The research center has a strict obligation to report on which scientist accesses which documents. The team that is responsible for these reports has little AWS experience and wants a ready-to-use solution that minimizes operational overhead.
Which combination of actions should a solutions architect take to meet these requirements? (Choose two.)
A. Create an identity policy that grants the user read and write access. Add a condition that specifies that the S3 paths must be prefixed with $(aws:username). Apply the policy on the scientists’ IAM user group.
B. Configure a trail with AWS CloudTrail to capture all object-level events in the S3 bucket. Store the trail output in another S3 bucket. Use Amazon Athena to query the logs and generate reports.
C. Enable S3 server access logging. Configure another S3 bucket as the target for log delivery. Use Amazon Athena to query the logs and generate reports.
D. Create an S3 bucket policy that grants read and write access to users in the scientists’ IAM user group.
E. Configure a trail with AWS CloudTrail to capture all object-level events in the S3 bucket and write the events to Amazon CloudWatch. Use the Amazon Athena CloudWatch connector to query the logs and generate reports.
Show Answer
Correct Answer: A, B
Explanation: To prevent scientists from accessing each other’s documents, access must be restricted to each user’s own folder. Using an IAM identity policy with an S3 key prefix condition based on the IAM username enforces per-user folder isolation with minimal overhead. For compliance reporting on who accessed which objects, AWS CloudTrail object-level logging provides complete, auditable records of S3 data events. Storing CloudTrail logs in S3 and querying them with Athena offers a ready-to-use, low-operations reporting solution. S3 server access logs are best-effort and not sufficient for strict compliance, and the other options do not both enforce isolation and provide reliable access auditing.
Question 219
A company is migrating mobile banking applications to run on Amazon EC2 instances in a VPC. Backend service applications run in an on-premises data center. The data center has an AWS Direct Connect connection into AWS. The applications that run in the VPC need to resolve DNS requests to an on-premises Active Directory domain that runs in the data center.
Which solution will meet these requirements with the LEAST administrative overhead?
A. Provision a set of EC2 instances across two Availability Zones in the VPC as caching DNS servers to resolve DNS queries from the application servers within the VPC.
B. Provision an Amazon Route 53 private hosted zone. Configure NS records that point to on-premises DNS servers.
C. Create DNS endpoints by using Amazon Route 53 Resolver. Add conditional forwarding rules to resolve DNS namespaces between the on-premises data center and the VP
D. Provision a new Active Directory domain controller in the VPC with a bidirectional trust between this new domain and the on-premises Active Directory domain.
Show Answer
Correct Answer: C
Explanation: The requirement is for EC2 instances in a VPC to resolve DNS names in an on‑premises Active Directory domain over Direct Connect with the least administrative overhead. Amazon Route 53 Resolver is a managed service designed for hybrid DNS. By creating outbound resolver endpoints and conditional forwarding rules, DNS queries for the on‑premises AD domain are automatically forwarded to the on‑premises DNS servers without managing EC2-based DNS infrastructure or additional domain controllers. Other options either require managing servers (A, D) or are not suitable for resolving on‑premises AD DNS namespaces (B).
Question 220
A company is deploying a third-party firewall appliance solution from AWS Marketplace to monitor and protect traffic that leaves the company's AWS environments. The company wants to deploy this appliance into a shared services VPC and route all outbound internet-bound traffic through the appliances.
A solutions architect needs to recommend a deployment method that prioritizes reliability and minimizes failover time between firewall appliances within a single AWS Region. The company has set up routing from the shared services VPC to other VPCs.
Which steps should the solutions architect recommend to meet these requirements? (Choose three.)
A. Deploy two firewall appliances into the shared services VPC, each in a separate Availability Zone.
B. Create a new Network Load Balancer in the shared services VPC. Create a new target group, and attach it to the new Network Load Balancer. Add each of the firewall appliance instances to the target group.
C. Create a new Gateway Load Balancer in the shared services VPCreate a new target group, and attach it to the new Gateway Load Balancer Add each of the firewall appliance instances to the target group.
D. Create a VPC interface endpoint. Add a route to the route table in the shared services VPC. Designate the new endpoint as the next hop for traffic that enters the shared services VPC from other VPCs.
E. Deploy two firewall appliances into the shared services VPC, each in the same Availability Zone.
F. Create a VPC Gateway Load Balancer endpoint. Add a route to the route table in the shared services VPC. Designate the new endpoint as the next hop for traffic that enters the shared services VPC from other VPCs.
Show Answer
Correct Answer: A, C, F
Explanation: To achieve high reliability and fast failover for third-party firewall appliances in a shared services VPC, the correct architecture is based on AWS Gateway Load Balancer (GWLB).
A is required because deploying firewall appliances across multiple Availability Zones provides high availability and resilience within a single AWS Region.
C is required because a Gateway Load Balancer is purpose-built to deploy, scale, and manage third-party network appliances such as firewalls. It performs health checks and distributes traffic at Layer 3, minimizing failover time compared to custom routing or NLB-based designs.
F is required because a Gateway Load Balancer endpoint is how traffic is steered to the GWLB. Adding the GWLB endpoint as the next hop in the route tables ensures that all outbound and inter-VPC traffic is transparently routed through the firewall appliances.
Options involving Network Load Balancers or interface endpoints are incorrect because they are not designed for transparent traffic inspection and appliance insertion. Deploying appliances in the same AZ would not meet reliability requirements.
Question 221
A company is launching a new online game on Amazon EC2 instances. The game must be available globally. The company plans to run the game in three AWS Regions us-east-1, eu-west-1, and ap-southeast-1. The game's leaderboards, player inventory and event status must be available across Regions.
A solutions architect must design a solution that will give any Region the ability to scale to handle the load of all Regions. Additionally, users must automatically connect to the Region that provides the least latency.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an EC2 Spot Fleet. Attach the Spot Fleet to a Network Load Balancer (NLB) in each Region. Create an AWS Global Accelerator IP address that points to the NLB. Create an Amazon Route 53 latency-based routing entry for the Global Accelerator IP address. Save the game metadata to an Amazon RDS for MySQL DB instance in each Region. Set up a read replica in the other Regions.
B. Create an Auto Scaling group for the EC2 instances Attach the Auto Scaling group to a Network Load Balancer (NLB) in each Region. For each Region, create an Amazon Route 53 entry that uses geoproximity routing and points to the NLB in that Region. Save the game metadata to MySQL databases on EC2 instances in each Region. Set up replication between the database EC2 instances in each Region.
C. Create an Auto Scaling group for the EC2 instances. Attach the Auto Scaling group to a Network Load Balancer (NLB) in each Region. For each Region, create an Amazon Route 53 entry that uses latency-based routing and points to the NLB in that Region. Save the game metadata to an Amazon DynamoDB global table.
D. Use EC2 Global View. Deploy the EC2 instances to each Region. Attach the instances to a Network Load Balancer (NLB). Deploy a DNS server on an EC2 instance in each Region. Set up custom logic on each DNS server to redirect the user to the Region that provides the lowest latency. Save the game metadata to an Amazon Aurora global database.
Show Answer
Correct Answer: C
Explanation: The solution must provide global low-latency access, allow any Region to scale independently, and keep game state synchronized across Regions with minimal operational overhead. Route 53 latency-based routing automatically directs players to the Region with the lowest latency. Auto Scaling groups with NLBs allow each Region to scale to handle traffic. Amazon DynamoDB global tables provide fully managed, multi-Region active-active replication for leaderboards and inventory without custom replication logic. Other options introduce higher operational overhead through self-managed databases, replicas, custom DNS logic, or unnecessary services.
Question 222
A company runs its application on Amazon EC2 instances and AWS Lambda functions. The EC2 instances experience a continuous and stable load. The Lambda functions experience a varied and unpredictable load. The application includes a caching layer that uses an Amazon MemoryDB for Redis cluster.
A solutions architect must recommend a solution to minimize the company's overall monthly costs.
Which solution will meet these requirements?
A. Purchase an EC2 instance Savings Plan to cover the EC2 instances. Purchase a Compute Savings Plan for Lambda to cover the minimum expected consumption of the Lambda functions. Purchase reserved nodes to cover the MemoryDB cache nodes.
B. Purchase a Compute Savings Plan to cover the EC2 instances. Purchase Lambda reserved concurrency to cover the expected Lambda usage. Purchase reserved nodes to cover the MemoryDB cache nodes.
C. Purchase a Compute Savings Plan to cover the entire expected cost of the EC2 instances, Lambda functions, and MemoryDB cache nodes.
D. Purchase a Compute Savings Plan to cover the EC2 instances and the MemoryDB cache nodes. Purchase Lambda reserved concurrency to cover the expected Lambda usage.
Show Answer
Correct Answer: A
Explanation: EC2 instances have a continuous, stable load, so an EC2 Instance Savings Plan provides the best cost optimization. Lambda has variable and unpredictable usage, which benefits from a Compute Savings Plan that applies automatically to Lambda execution without requiring fixed capacity; reserved concurrency does not reduce cost. Amazon MemoryDB supports reserved nodes for predictable, long-running cache capacity, which lowers costs. Compute Savings Plans do not cover MemoryDB, so options that rely on that are invalid.
Question 223
A company wants to use Amazon S3 to back up its on-premises file storage solution. The company’s on-premises file storage solution supports NFS, and the company wants its new solution to support NFS. The company wants to archive the backup files after 5 days. If the company needs archived files for disaster recovery, the company is willing to wait a few days for the retrieval of those files.
Which solution meets these requirements MOST cost-effectively?
A. Deploy an AWS Storage Gateway file gateway that is associated with an S3 bucket. Move the files from the on-premises file storage solution to the file gateway. Create an S3 Lifecycle rule to move the files to S3 Standard-Infrequent Access (S3 Standard-IA) after 5 days.
B. Deploy an AWS Storage Gateway volume gateway that is associated with an S3 bucket. Move the files from the on-premises file storage solution to the volume gateway. Create an S3 Lifecycle rule to move the files to S3 Glacier Deep Archive after 5 days.
C. Deploy an AWS Storage Gateway tape gateway that is associated with an S3 bucket. Move the files from the on-premises file storage solution to the tape gateway. Create an S3 Lifecycle rule to move the files to S3 Standard-Infrequent Access (S3 Standard-IA) after 5 days.
D. Deploy an AWS Storage Gateway file gateway that is associated with an S3 bucket. Move the files from the on-premises file storage solution to the file gateway. Create an S3 Lifecycle rule to move the files to S3 Glacier Deep Archive after 5 days.
Show Answer
Correct Answer: D
Explanation: The solution must support NFS, archive data after 5 days, and minimize cost while allowing slow retrieval. AWS Storage Gateway **file gateway** is required to provide NFS access. For archiving with the lowest cost and tolerance for multi‑day retrieval, **S3 Glacier Deep Archive** is the most cost‑effective storage class. Option D meets all requirements, whereas volume or tape gateways do not meet the NFS/file use case, and S3 Standard‑IA is more expensive than Glacier Deep Archive.
Question 224
A company is using AWS Organizations with a multi-account architecture. The company's current security configuration for the account architecture includes SCPs, resource-based policies, identity-based policies, trust policies, and session policies.
A solutions architect needs to allow an IAM user in Account A to assume a role in Account B.
Which combination of steps must the solutions architect take to meet this requirement? (Choose three.)
A. Configure the SCP for Account A to allow the action.
B. Configure the resource-based policies to allow the action.
C. Configure the identity-based policy on the user in Account A to allow the action.
D. Configure the identity-based policy on the user in Account B to allow the action.
E. Configure the trust policy on the target role in Account B to allow the action.
F. Configure the session policy to allow the action and to be passed programmatically by the GetSessionToken API operation.
Show Answer
Correct Answer: A, C, E
Explanation: To allow cross-account role assumption, three layers must permit the action. The IAM user in Account A needs an identity-based policy allowing sts:AssumeRole on the target role (C). The role in Account B must trust the principal from Account A via its trust policy (E). Because the environment uses AWS Organizations with SCPs, the SCP applied to Account A must not block sts:AssumeRole; therefore it must allow the action (A). Resource-based policies and session policies are not required for assuming IAM roles.
Question 225
A solutions architect is reviewing a company's process for taking snapshots of Amazon RDS DB instances. The company takes automatic snapshots every day and retains the snapshots for 7 days.
The solutions architect needs to recommend a solution that takes snapshots every 6 hours and retains the snapshots for 30 days. The company uses AWS Organizations to manage all of its AWS accounts. The company needs a consolidated view of the health of the RDS snapshots.
Which solution will meet these requirements with the LEAST operational overhead?
A. Turn on the cross-account management feature in AWS Backup. Create a backup plan that specifies the frequency and retention requirements. Add a tag to the DB instances. Apply the backup plan by using tags. Use AWS Backup to monitor the status of the backups.
B. Turn on the cross-account management feature in Amazon RDS. Create a snapshot global policy that specifies the frequency and retention requirements. Use the RDS console in the management account to monitor the status of the backups.
C. Turn on the cross-account management feature in AWS CloudFormation. From the management account, deploy a CloudFormation stack set that contains a backup plan from AWS Backup that specifies the frequency and retention requirements. Create an AWS Lambda function in the management account to monitor the status of the backups. Create an Amazon EventBridge rule in each account to run the Lambda function on a schedule.
D. Configure AWS Backup in each account. Create an Amazon Data Lifecycle Manager lifecycle policy that specifies the frequency and retention requirements. Specify the DB instances as the target resource Use the Amazon Data Lifecycle Manager console in each member account to monitor the status of the backups.
Show Answer
Correct Answer: A
Explanation: AWS Backup natively supports centralized, cross-account management through AWS Organizations with minimal setup. A backup plan can easily define a 6-hour backup frequency and 30-day retention for Amazon RDS. Tag-based assignment allows automatic inclusion of DB instances without per-account configuration. AWS Backup also provides a consolidated, centralized view of backup and snapshot health across all accounts, resulting in the least operational overhead compared to custom automation or per-account monitoring solutions.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.