A company has five development teams that have each created five AWS accounts to develop and host applications. To track spending, the development teams log in to each account every month, record the current cost from the AWS Billing and Cost Management console, and provide the information to the company's finance team.
The company has strict compliance requirements and needs to ensure that resources are created only in AWS Regions in the United States. However, some resources have been created in other Regions.
A solutions architect needs to implement a solution that gives the finance team the ability to track and consolidate expenditures for all the accounts. The solution also must ensure that the company can create resources only in Regions in the United States.
Which combination of steps will meet these requirements in the MOST operationally efficient way? (Choose three.)
A. Create a new account to serve as a management account. Create an Amazon S3 bucket for the finance team. Use AWS Cost and Usage Reports to create monthly reports and to store the data in the finance team's S3 bucket.
B. Create a new account to serve as a management account. Deploy an organization in AWS Organizations with all features enabled. Invite all the existing accounts to the organization. Ensure that each account accepts the invitation.
C. Create an OU that includes all the development teams. Create an SCP that allows the creation of resources only in Regions that are in the United States. Apply the SCP to the OU.
D. Create an OU that includes all the development teams. Create an SCP that denies the creation of resources in Regions that are outside the United States. Apply the SCP to the OU.
E. Create an IAM role in the management account. Attach a policy that includes permissions to view the Billing and Cost Management console. Allow the finance team users to assume the role. Use AWS Cost Explorer and the Billing and Cost Management console to analyze cost.
F. Create an IAM role in each AWS account. Attach a policy that includes permissions to view the Billing and Cost Management console. Allow the finance team users to assume the role.
Show Answer
Correct Answer: B, D, E
Explanation: B: AWS Organizations with all features enabled is required to centrally manage multiple existing accounts and enable consolidated billing and SCPs.
D: SCPs are enforced through explicit denies. Denying resource creation in non‑US Regions ensures no account can create resources outside the United States, which an allow‑only SCP would not reliably enforce.
E: The finance team can access consolidated billing and cost data from the management account using Cost Explorer and the Billing and Cost Management console by assuming a single IAM role, which is far more operationally efficient than managing roles in every account.
Question 237
A company has a data lake in Amazon S3 that needs to be accessed by hundreds of applications across many AWS accounts. The company's information security policy states that the S3 bucket must not be accessed over the public internet and that each application should have the minimum permissions necessary to function.
To meet these requirements, a solutions architect plans to use an S3 access point that is restricted to specific VPCs for each application.
Which combination of steps should the solutions architect take to implement this solution? (Choose two.)
A. Create an S3 access point for each application in the AWS account that owns the S3 bucket. Configure each access point to be accessible only from the application’s VPC. Update the bucket policy to require access from an access point.
B. Create an interface endpoint for Amazon S3 in each application's VPC. Configure the endpoint policy to allow access to an S3 access point. Create a VPC gateway attachment for the S3 endpoint.
C. Create a gateway endpoint for Amazon S3 in each application's VPConfigure the endpoint policy to allow access to an S3 access point. Specify the route table that is used to access the access point.
D. Create an S3 access point for each application in each AWS account and attach the access points to the S3 bucket. Configure each access point to be accessible only from the application's VPC. Update the bucket policy to require access from an access point.
E. Create a gateway endpoint for Amazon S3 in the data lake's VPC. Attach an endpoint policy to allow access to the S3 bucket. Specify the route table that is used to access the bucket.
Show Answer
Correct Answer: A, C
Explanation: The bucket must be accessed privately and with least privilege across many accounts. Creating an S3 access point per application in the bucket-owning account allows fine-grained, application-specific policies and supports restricting access to specific VPCs; updating the bucket policy to require access via access points enforces this (A). To ensure traffic does not traverse the public internet, each application VPC must use an Amazon S3 gateway VPC endpoint, which is the correct endpoint type for S3 and works with access points; the endpoint policy and route table ensure private connectivity (C). Interface endpoints are not required for S3, and creating access points in each consuming account is unnecessary.
Question 238
A company's solutions architect is analyzing costs of a multi-application environment. The environment is deployed across multiple Availability Zones in a single AWS Region. After a recent acquisition, the company manages two organizations in AWS Organizations. The company has created multiple service provider applications as AWS PrivateLink-powered VPC endpoint services in one organization. The company has created multiple service consumer applications in the other organization.
Data transfer charges are much higher than the company expected, and the solutions architect needs to reduce the costs. The solutions architect must recommend guidelines for developers to follow when they deploy services. These guidelines must minimize data transfer charges for the whole environment.
Which guidelines meet these requirements? (Choose two.)
A. Use AWS Resource Access Manager to share the subnets that host the service provider applications with other accounts in the organization.
B. Place the service provider applications and the service consumer applications in AWS accounts in the same organization.
C. Turn off cross-zone load balancing for the Network Load Balancer in all service provider application deployments.
D. Ensure that service consumer compute resources use the Availability Zone-specific endpoint service by using the endpoint's local DNS name.
E. Create a Savings Plan that provides adequate coverage for the organization's planned inter-Availability Zone data transfer usage.
Show Answer
Correct Answer: C, D
Explanation: The primary driver of unexpected cost in a PrivateLink architecture is inter–Availability Zone (AZ) data transfer. Guideline D ensures that service consumers use AZ-specific endpoint service DNS names so traffic stays within the same AZ, directly eliminating inter-AZ data transfer charges. Guideline C further reduces inter-AZ traffic by disabling cross-zone load balancing on the Network Load Balancer that fronts the PrivateLink endpoint service, preventing requests from being forwarded to targets in other AZs. Options A and B do not directly affect data transfer pricing, and E does not apply because Savings Plans do not cover data transfer charges.
Question 239
A company has an application that is deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are part of an Auto Scaling group. The application has unpredictable workloads and frequently scales out and in. The company’s development team wants to analyze application logs to find ways to improve the application's performance. However, the logs are no longer available after instances scale in.
Which solution will give the development team the ability to view the application logs after a scale-in event?
A. Enable access logs for the ALB. Store the logs in an Amazon S3 bucket.
B. Configure the EC2 instances to publish logs to Amazon CloudWatch Logs by using the unified CloudWatch agent.
C. Modify the Auto Scaling group to use a step scaling policy.
D. Instrument the application with AWS X-Ray tracing.
Show Answer
Correct Answer: B
Explanation: The problem is that application logs are lost when EC2 instances in the Auto Scaling group are terminated during scale-in events. To retain and analyze application logs beyond the lifecycle of individual instances, the logs must be sent to a centralized, persistent service. Configuring the EC2 instances to publish application logs to Amazon CloudWatch Logs using the unified CloudWatch agent ensures logs are stored independently of the instances and remain available after scale-in. ALB access logs do not contain application-level logs, step scaling does not address log retention, and AWS X-Ray provides tracing rather than log storage.
Question 240
A company runs an application in an on-premises data center. The application gives users the ability to upload media files. The files persist in a file server. The web application has many users. The application server is overutilized, which causes data uploads to fail occasionally. The company frequently adds new storage to the file server. The company wants to resolve these challenges by migrating the application to AWS.
Users from across the United States and Canada access the application. Only authenticated users should have the ability to access the application to upload files. The company will consider a solution that refactors the application, and the company needs to accelerate application development.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS Application Migration Service to migrate the application server to Amazon EC2 instances. Create an Auto Scaling group for the EC2 instances. Use an Application Load Balancer to distribute the requests. Modify the application to use Amazon S3 to persist the files. Use Amazon Cognito to authenticate users.
B. Use AWS Application Migration Service to migrate the application server to Amazon EC2 instances. Create an Auto Scaling group for the EC2 instances. Use an Application Load Balancer to distribute the requests. Set up AWS IAM Identity Center (AWS Single Sign-On) to give users the ability to sign in to the application. Modify the application to use Amazon S3 to persist the files.
C. Create a static website for uploads of media files. Store the static assets in Amazon S3. Use AWS AppSync to create an API. Use AWS Lambda resolvers to upload the media files to Amazon S3. Use Amazon Cognito to authenticate users.
D. Use AWS Amplify to create a static website for uploads of media files. Use Amplify Hosting to serve the website through Amazon CloudFront. Use Amazon S3 to store the uploaded media files. Use Amazon Cognito to authenticate users.
Show Answer
Correct Answer: D
Explanation: The goal is to minimize operational overhead while allowing refactoring and accelerating development. A serverless, managed approach best fits these requirements. AWS Amplify provides an opinionated development framework that quickly builds and hosts a static web application, integrates natively with Amazon Cognito for authentication, uses Amazon S3 for highly scalable file storage, and serves content globally through CloudFront. This eliminates the need to manage servers, Auto Scaling groups, load balancers, or custom APIs, unlike the EC2-based options. Compared to building the stack manually, Amplify abstracts most infrastructure and speeds development, resulting in the least operational overhead.
Question 241
A media storage application uploads user photos to Amazon S3 for processing by AWS Lambda functions. Application state is stored in Amazon DynamoDB tables. Users are reporting that some uploaded photos are not being processed properly. The application developers trace the logs and find that Lambda is experiencing photo processing issues when thousands of users upload photos simultaneously. The issues are the result of Lambda concurrency limits and the performance of DynamoDB when data is saved.
Which combination of actions should a solutions architect take to increase the performance and reliability of the application? (Choose two.)
A. Evaluate and adjust the RCUs for the DynamoDB tables.
B. Evaluate and adjust the WCUs for the DynamoDB tables.
C. Add an Amazon ElastiCache layer to increase the performance of Lambda functions.
D. Add an Amazon Simple Queue Service (Amazon SQS) queue and reprocessing logic between Amazon S3 and the Lambda functions.
E. Use S3 Transfer Acceleration to provide lower latency to users.
Show Answer
Correct Answer: B, D
Explanation: The issue occurs during bursts of simultaneous uploads, causing Lambda concurrency limits to be exceeded and slow writes to DynamoDB. Increasing DynamoDB write capacity units (WCUs) directly addresses performance problems when application state is saved. Adding an SQS queue between S3 and Lambda decouples ingestion from processing, smooths traffic spikes, controls concurrency, and enables retries, improving both performance and reliability.
Question 242
A company manufactures smart vehicles. The company uses a custom application to collect vehicle data. The vehicles use the MQTT protocol to connect to the application. The company processes the data in 5-minute intervals. The company then copies vehicle telematics data to on-premises storage. Custom applications analyze this data to detect anomalies.
The number of vehicles that send data grows constantly. Newer vehicles generate high volumes of data. The on-premises storage solution is not able to scale for peak traffic, which results in data loss. The company must modernize the solution and migrate the solution to AWS to resolve the scaling challenges.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS IoT Greengrass to send the vehicle data to Amazon Managed Streaming for Apache Kafka (Amazon MSK). Create an Apache Kafka application to store the data in Amazon S3. Use a pretrained model in Amazon SageMaker to detect anomalies.
B. Use AWS IoT Core to receive the vehicle data. Configure rules to route data to an Amazon Kinesis Data Firehose delivery stream that stores the data in Amazon S3. Create an Amazon Kinesis Data Analytics application that reads from the delivery stream to detect anomalies.
C. Use AWS IoT FleetWise to collect the vehicle data. Send the data to an Amazon Kinesis data stream. Use an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Use the built-in machine learning transforms in AWS Glue to detect anomalies.
D. Use Amazon MQ for RabbitMQ to collect the vehicle data. Send the data to an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Use Amazon Lookout for Metrics to detect anomalies.
Show Answer
Correct Answer: B
Explanation: Option B uses fully managed, serverless AWS services that natively support MQTT ingestion, large-scale streaming, and analytics with minimal operations. AWS IoT Core directly supports MQTT from vehicles. Kinesis Data Firehose automatically scales and reliably delivers high‑volume data to Amazon S3 without capacity planning. Kinesis Data Analytics provides built‑in, managed anomaly detection (for example, Random Cut Forest) suitable for near‑real‑time, 5‑minute interval processing. Other options introduce higher operational overhead through cluster management (MSK), edge agents and additional integrations (FleetWise), or broker management (Amazon MQ).
Question 243
A company operates an on-premises software-as-a-service (SaaS) solution that ingests several files daily. The company provides multiple public SFTP endpoints to its customers to facilitate the file transfers. The customers add the SFTP endpoint IP addresses to their firewall allow list for outbound traffic. Changes to the SFTP endpoint IP addresses are not permitted.
The company wants to migrate the SaaS solution to AWS and decrease the operational overhead of the file transfer service.
Which solution meets these requirements?
A. Register the customer-owned block of IP addresses in the company's AWS account. Create Elastic IP addresses from the address pool and assign them to an AWS Transfer for SFTP endpoint. Use AWS Transfer to store the files in Amazon S3.
B. Add a subnet containing the customer-owned block of IP addresses to a VPC. Create Elastic IP addresses from the address pool and assign them to an Application Load Balancer (ALB). Launch EC2 instances hosting FTP services in an Auto Scaling group behind the ALStore the files in attached Amazon Elastic Block Store (Amazon EBS) volumes.
C. Register the customer-owned block of IP addresses with Amazon Route 53. Create alias records in Route 53 that point to a Network Load Balancer (NLB). Launch EC2 instances hosting FTP services in an Auto Scaling group behind the NLB. Store the files in Amazon S3.
D. Register the customer-owned block of IP addresses in the company’s AWS account. Create Elastic IP addresses from the address pool and assign them to an Amazon S3 VPC endpoint. Enable SFTP support on the S3 bucket.
Show Answer
Correct Answer: A
Explanation: The requirements are fixed, customer-allowlisted IP addresses and minimal operational overhead after migrating to AWS. AWS Transfer for SFTP is a fully managed service that natively supports SFTP endpoints backed by Amazon S3, eliminating the need to manage EC2 instances, scaling, patching, or storage. By bringing the customer-owned IP address block into the AWS account and allocating Elastic IPs from that pool, the company can assign static, unchanged IP addresses to the AWS Transfer for SFTP endpoint, satisfying firewall constraints. Other options either require managing EC2-based FTP infrastructure, do not support SFTP correctly, or rely on unsupported features (such as S3 SFTP endpoints).
Question 244
A financial services company loaded millions of historical stock trades into an Amazon DynamoDB table. The table uses on-demand capacity mode. Once each day at midnight, a few million new records are loaded into the table. Application read activity against the table happens in bursts throughout the day. and a limited set of keys are repeatedly looked up. The company needs to reduce costs associated with DynamoDB.
Which strategy should a solutions architect recommend to meet this requirement?
A. Deploy an Amazon ElastiCache cluster in front of the DynamoDB table
B. Deploy DynamoDB Accelerator (DAX). Configure DynamoDB auto scaling. Purchase Savings Plans in Cost Explorer.
C. Use provisioned capacity mode. Purchase Savings Plans in Cost Explorer.
D. Deploy DynamoDB Accelerator (DAX). Use provisioned capacity mode. Configure DynamoDB auto scaling.
Show Answer
Correct Answer: D
Explanation: The workload has predictable daily write patterns and bursty reads with repeated access to a small set of keys. Switching from on-demand to provisioned capacity with auto scaling reduces cost for predictable usage compared to on-demand mode. Adding DynamoDB Accelerator (DAX) caches frequently read items in memory, significantly reducing read request costs and smoothing read bursts. Auto scaling ensures capacity adjusts to demand without overprovisioning. Savings Plans are not applicable to DynamoDB, and ElastiCache is not the recommended native cache for DynamoDB access patterns.
Question 245
An entertainment company recently launched a new game. To ensure a good experience for players during the launch period, the company deployed a static quantity of 12 r6g.16xlarge (memory optimized) Amazon EC2 instances behind a Network Load Balancer. The company's operations team used the Amazon CloudWatch agent and a custom metric to include memory utilization in its monitoring strategy.
Analysis of the CloudWatch metrics from the launch period showed consumption at about one quarter of the CPU and memory that the company expected. Initial demand for the game has subsided and has become more variable. The company decides to use an Auto Scaling group that monitors the CPU and memory consumption to dynamically scale the instance fleet. A solutions architect needs to configure the Auto Scaling group to meet demand in the most cost-effective way.
Which solution will meet these requirements?
A. Configure the Auto Scaling group to deploy c6g.4xlarge (compute optimized) instances. Configure a minimum capacity of 3, a desired capacity of 3, and a maximum capacity of 12.
B. Configure the Auto Scaling group to deploy m6g.4xlarge (general purpose) instances. Configure a minimum capacity of 3, a desired capacity of 3, and a maximum capacity of 12.
C. Configure the Auto Scaling group to deploy r6g.4xlarge (memory optimized) instances. Configure a minimum capacity of 3, a desired capacity of 3, and a maximum capacity of 12.
D. Configure the Auto Scaling group to deploy r6g.8xlarge (memory optimized) instances. Configure a minimum capacity of 2, a desired capacity of 2, and a maximum capacity of 6.
Show Answer
Correct Answer: C
Explanation: Launch metrics show the workload used only ~25% of the CPU and memory of r6g.16xlarge instances. Because the application is memory‑sensitive (tracked via a custom memory metric), it should remain on memory‑optimized instances rather than switching to compute‑optimized or general‑purpose types. An r6g.4xlarge provides roughly one quarter of the CPU and memory of an r6g.16xlarge, matching observed utilization. Setting the Auto Scaling group to a minimum/desired capacity of 3 maintains the equivalent steady‑state capacity (¼ of 12 large instances), while scaling up to 12 handles variable demand at the lowest cost per required memory capacity.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.