A company runs an application in an on-premises data center. The application gives users the ability to upload media files. The files persist in a file server. The web application has many users. The application server is overutilized, which causes data uploads to fail occasionally. The company frequently adds new storage to the file server. The company wants to resolve these challenges by migrating the application to AWS.
Users from across the United States and Canada access the application. Only authenticated users should have the ability to access the application to upload files. The company will consider a solution that refactors the application, and the company needs to accelerate application development.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS Application Migration Service to migrate the application server to Amazon EC2 instances. Create an Auto Scaling group for the EC2 instances. Use an Application Load Balancer to distribute the requests. Modify the application to use Amazon S3 to persist the files. Use Amazon Cognito to authenticate users.
B. Use AWS Application Migration Service to migrate the application server to Amazon EC2 instances. Create an Auto Scaling group for the EC2 instances. Use an Application Load Balancer to distribute the requests. Set up AWS IAM Identity Center (AWS Single Sign-On) to give users the ability to sign in to the application. Modify the application to use Amazon S3 to persist the files.
C. Create a static website for uploads of media files. Store the static assets in Amazon S3. Use AWS AppSync to create an API. Use AWS Lambda resolvers to upload the media files to Amazon S3. Use Amazon Cognito to authenticate users.
D. Use AWS Amplify to create a static website for uploads of media files. Use Amplify Hosting to serve the website through Amazon CloudFront. Use Amazon S3 to store the uploaded media files. Use Amazon Cognito to authenticate users.
Show Answer
Correct Answer: D
Explanation: The requirements emphasize least operational overhead, willingness to refactor, and accelerating application development. AWS Amplify is designed to rapidly build and host full-stack web applications with built-in integration for Amazon Cognito authentication and Amazon S3 storage. Amplify Hosting uses CloudFront for low-latency delivery across the US and Canada. Options A and B retain EC2 infrastructure and operational management, while C introduces AppSync and Lambda components that are unnecessary for a straightforward upload application and increase complexity.
Question 241
A media storage application uploads user photos to Amazon S3 for processing by AWS Lambda functions. Application state is stored in Amazon DynamoDB tables. Users are reporting that some uploaded photos are not being processed properly. The application developers trace the logs and find that Lambda is experiencing photo processing issues when thousands of users upload photos simultaneously. The issues are the result of Lambda concurrency limits and the performance of DynamoDB when data is saved.
Which combination of actions should a solutions architect take to increase the performance and reliability of the application? (Choose two.)
A. Evaluate and adjust the RCUs for the DynamoDB tables.
B. Evaluate and adjust the WCUs for the DynamoDB tables.
C. Add an Amazon ElastiCache layer to increase the performance of Lambda functions.
D. Add an Amazon Simple Queue Service (Amazon SQS) queue and reprocessing logic between Amazon S3 and the Lambda functions.
E. Use S3 Transfer Acceleration to provide lower latency to users.
Show Answer
Correct Answer: B, D
Explanation: The workload spikes cause two distinct bottlenecks. DynamoDB performance problems occur when data is being saved, so increasing and tuning write capacity (WCUs) addresses write throttling. Lambda concurrency limits during large bursts of S3 uploads are best mitigated by decoupling the upload event from processing with an Amazon SQS queue, which buffers requests, smooths traffic, and supports retries/reprocessing for reliability. RCUs affect reads rather than writes, ElastiCache does not solve Lambda concurrency or DynamoDB write throughput, and S3 Transfer Acceleration improves upload latency but not backend processing reliability.
Question 242
A company manufactures smart vehicles. The company uses a custom application to collect vehicle data. The vehicles use the MQTT protocol to connect to the application. The company processes the data in 5-minute intervals. The company then copies vehicle telematics data to on-premises storage. Custom applications analyze this data to detect anomalies.
The number of vehicles that send data grows constantly. Newer vehicles generate high volumes of data. The on-premises storage solution is not able to scale for peak traffic, which results in data loss. The company must modernize the solution and migrate the solution to AWS to resolve the scaling challenges.
Which solution will meet these requirements with the LEAST operational overhead?
A. Use AWS IoT Greengrass to send the vehicle data to Amazon Managed Streaming for Apache Kafka (Amazon MSK). Create an Apache Kafka application to store the data in Amazon S3. Use a pretrained model in Amazon SageMaker to detect anomalies.
B. Use AWS IoT Core to receive the vehicle data. Configure rules to route data to an Amazon Kinesis Data Firehose delivery stream that stores the data in Amazon S3. Create an Amazon Kinesis Data Analytics application that reads from the delivery stream to detect anomalies.
C. Use AWS IoT FleetWise to collect the vehicle data. Send the data to an Amazon Kinesis data stream. Use an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Use the built-in machine learning transforms in AWS Glue to detect anomalies.
D. Use Amazon MQ for RabbitMQ to collect the vehicle data. Send the data to an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Use Amazon Lookout for Metrics to detect anomalies.
Show Answer
Correct Answer: B
Explanation: AWS IoT Core natively supports MQTT device connectivity with minimal changes. IoT Core rules can route incoming telemetry to Amazon Kinesis Data Firehose, which automatically scales and delivers data to Amazon S3 with very low operational overhead. Amazon Kinesis Data Analytics can process streaming data and perform anomaly detection (for example, using managed analytics capabilities). The other options either introduce unnecessary operational complexity (Greengrass, MSK, custom Kafka), misuse services (Glue ML transforms are not the right anomaly detection service), or use a messaging service that is not the best fit for MQTT IoT ingestion (Amazon MQ).
Question 243
A company operates an on-premises software-as-a-service (SaaS) solution that ingests several files daily. The company provides multiple public SFTP endpoints to its customers to facilitate the file transfers. The customers add the SFTP endpoint IP addresses to their firewall allow list for outbound traffic. Changes to the SFTP endpoint IP addresses are not permitted.
The company wants to migrate the SaaS solution to AWS and decrease the operational overhead of the file transfer service.
Which solution meets these requirements?
A. Register the customer-owned block of IP addresses in the company's AWS account. Create Elastic IP addresses from the address pool and assign them to an AWS Transfer for SFTP endpoint. Use AWS Transfer to store the files in Amazon S3.
B. Add a subnet containing the customer-owned block of IP addresses to a VPC. Create Elastic IP addresses from the address pool and assign them to an Application Load Balancer (ALB). Launch EC2 instances hosting FTP services in an Auto Scaling group behind the ALStore the files in attached Amazon Elastic Block Store (Amazon EBS) volumes.
C. Register the customer-owned block of IP addresses with Amazon Route 53. Create alias records in Route 53 that point to a Network Load Balancer (NLB). Launch EC2 instances hosting FTP services in an Auto Scaling group behind the NLB. Store the files in Amazon S3.
D. Register the customer-owned block of IP addresses in the company’s AWS account. Create Elastic IP addresses from the address pool and assign them to an Amazon S3 VPC endpoint. Enable SFTP support on the S3 bucket.
Show Answer
Correct Answer: A
Explanation: AWS Transfer Family for SFTP is the managed service designed for SFTP workloads and can store uploaded files directly in Amazon S3, minimizing operational overhead. To preserve existing allow-listed public IP addresses, the company can bring its own IP address (BYOIP), create Elastic IPs from that pool, and assign them to the AWS Transfer for SFTP endpoint. The other options either require managing EC2-based file transfer infrastructure, incorrectly use FTP instead of SFTP, misuse Route 53, or rely on unsupported S3 functionality.
Question 244
A financial services company loaded millions of historical stock trades into an Amazon DynamoDB table. The table uses on-demand capacity mode. Once each day at midnight, a few million new records are loaded into the table. Application read activity against the table happens in bursts throughout the day. and a limited set of keys are repeatedly looked up. The company needs to reduce costs associated with DynamoDB.
Which strategy should a solutions architect recommend to meet this requirement?
A. Deploy an Amazon ElastiCache cluster in front of the DynamoDB table
B. Deploy DynamoDB Accelerator (DAX). Configure DynamoDB auto scaling. Purchase Savings Plans in Cost Explorer.
C. Use provisioned capacity mode. Purchase Savings Plans in Cost Explorer.
D. Deploy DynamoDB Accelerator (DAX). Use provisioned capacity mode. Configure DynamoDB auto scaling.
Show Answer
Correct Answer: D
Explanation: The workload has predictable daily write activity (large batch at midnight) and bursty reads with a small set of frequently accessed keys. Provisioned capacity with auto scaling is typically more cost-effective than on-demand for predictable traffic patterns. DAX caches frequently accessed items, reducing read requests to DynamoDB and lowering read capacity consumption. Savings Plans do not apply to DynamoDB capacity, so options including them are incorrect.
Question 245
An entertainment company recently launched a new game. To ensure a good experience for players during the launch period, the company deployed a static quantity of 12 r6g.16xlarge (memory optimized) Amazon EC2 instances behind a Network Load Balancer. The company's operations team used the Amazon CloudWatch agent and a custom metric to include memory utilization in its monitoring strategy.
Analysis of the CloudWatch metrics from the launch period showed consumption at about one quarter of the CPU and memory that the company expected. Initial demand for the game has subsided and has become more variable. The company decides to use an Auto Scaling group that monitors the CPU and memory consumption to dynamically scale the instance fleet. A solutions architect needs to configure the Auto Scaling group to meet demand in the most cost-effective way.
Which solution will meet these requirements?
A. Configure the Auto Scaling group to deploy c6g.4xlarge (compute optimized) instances. Configure a minimum capacity of 3, a desired capacity of 3, and a maximum capacity of 12.
B. Configure the Auto Scaling group to deploy m6g.4xlarge (general purpose) instances. Configure a minimum capacity of 3, a desired capacity of 3, and a maximum capacity of 12.
C. Configure the Auto Scaling group to deploy r6g.4xlarge (memory optimized) instances. Configure a minimum capacity of 3, a desired capacity of 3, and a maximum capacity of 12.
D. Configure the Auto Scaling group to deploy r6g.8xlarge (memory optimized) instances. Configure a minimum capacity of 2, a desired capacity of 2, and a maximum capacity of 6.
Show Answer
Correct Answer: C
Explanation: The original fleet used 12 r6g.16xlarge memory-optimized instances, but monitoring showed both CPU and memory usage were only about 25% of expected. A quarter-sized instance (r6g.4xlarge) provides one quarter of the vCPU and memory of an r6g.16xlarge, so starting with 3 instances preserves approximately the observed required capacity (3 × 4xlarge = 0.25 × 12 × 16xlarge). Because the workload is monitored on both CPU and memory, retaining the memory-optimized family is appropriate. Using compute-optimized or general-purpose instances changes the memory-to-CPU ratio without evidence that memory optimization is unnecessary. Option D has the same aggregate maximum capacity but a higher minimum cost (2 × 8xlarge vs. 3 × 4xlarge) and coarser scaling increments, making it less cost-effective for variable demand.
Question 246
A company uses an Amazon Aurora PostgreSQL DB cluster for applications in a single AWS Region. The company's database team must monitor all data activity on all the databases.
Which solution will achieve this goal?
A. Set up an AWS Database Migration Service (AWS DMS) change data capture (CDC) task. Specify the Aurora DB cluster as the source. Specify Amazon Kinesis Data Firehose as the target. Use Kinesis Data Firehose to upload the data into an Amazon OpenSearch Service cluster for further analysis.
B. Start a database activity stream on the Aurora DB cluster to capture the activity stream in Amazon EventBridge. Define an AWS Lambda function as a target for EventBridge. Program the Lambda function to decrypt the messages from EventBridge and to publish all database activity to Amazon S3 for further analysis.
C. Start a database activity stream on the Aurora DB cluster to push the activity stream to an Amazon Kinesis data stream. Configure Amazon Kinesis Data Firehose to consume the Kinesis data stream and to deliver the data to Amazon S3 for further analysis.
D. Set up an AWS Database Migration Service (AWS DMS) change data capture (CDC) task. Specify the Aurora DB cluster as the source. Specify Amazon Kinesis Data Firehose as the target. Use Kinesis Data Firehose to upload the data into an Amazon Redshift cluster. Run queries on the Amazon Redshift data to determine database activities on the Aurora database.
Show Answer
Correct Answer: C
Explanation: Amazon Aurora Database Activity Streams is the feature designed to monitor and audit all database activity. It streams encrypted activity events to Amazon Kinesis Data Streams in near real time. Kinesis Data Firehose can then deliver the records to Amazon S3 for analysis. AWS DMS CDC captures data changes, not all database activity, and Aurora Database Activity Streams does not publish directly to EventBridge.
Question 247
A company has a new application that needs to run on five Amazon EC2 instances in a single AWS Region. The application requires high-throughput, low-latency network connections between all of the EC2 instances where the application will run. There is no requirement for the application to be fault tolerant.
Which solution will meet these requirements?
A. Launch five new EC2 instances into a cluster placement group. Ensure that the EC2 instance type supports enhanced networking.
B. Launch five new EC2 instances into an Auto Scaling group in the same Availability Zone. Attach an extra elastic network interface to each EC2 instance.
C. Launch five new EC2 instances into a partition placement group. Ensure that the EC2 instance type supports enhanced networking.
D. Launch five new EC2 instances into a spread placement group. Attach an extra elastic network interface to each EC2 instance.
Show Answer
Correct Answer: A
Explanation: A cluster placement group places instances close together within a single Availability Zone to provide the highest possible packet-per-second performance and low-latency, high-throughput networking. Using EC2 instance types that support enhanced networking further improves network performance. Partition placement groups prioritize fault isolation, spread placement groups maximize separation for resilience, and Auto Scaling with extra ENIs does not provide the required low-latency placement.
Question 248
An education company is running a web application used by college students around the world. The application runs in an Amazon Elastic Container Service (Amazon ECS) cluster in an Auto Scaling group behind an Application Load Balancer (ALB). A system administrator detects a weekly spike in the number of failed login attempts, which overwhelm the application's authentication service. All the failed login attempts originate from about 500 different IP addresses that change each week. A solutions architect must prevent the failed login attempts from overwhelming the authentication service.
Which solution meets these requirements with the MOST operational efficiency?
A. Use AWS Firewall Manager to create a security group and security group policy to deny access from the IP addresses.
B. Create an AWS WAF web ACL with a rate-based rule, and set the rule action to Block. Connect the web ACL to the AL
C. Use AWS Firewall Manager to create a security group and security group policy to allow access only to specific CIDR ranges.
D. Create an AWS WAF web ACL with an IP set match rule, and set the rule action to Block. Connect the web ACL to the ALB.
Show Answer
Correct Answer: B
Explanation: A rate-based AWS WAF rule attached to the Application Load Balancer automatically detects and blocks IP addresses that exceed a configured request threshold. Because the attacking IP addresses change weekly, a dynamic rate-based rule is far more operationally efficient than maintaining IP block lists. Security groups cannot practically block large, changing internet IP lists for an ALB, and IP set match rules require ongoing manual updates.
Question 249
A company needs to create and manage multiple AWS accounts for a number of departments from a central location. The security team requires read-only access to all accounts from its own AWS account. The company is using AWS Organizations and created an account for the security team.
How should a solutions architect meet these requirements?
A. Use the OrganizationAccountAccessRole IAM role to create a new IAM policy with read-only access in each member account. Establish a trust relationship between the IAM policy in each member account and the security account. Ask the security team to use the IAM policy to gain access.
B. Use the OrganizationAccountAccessRole IAM role to create a new IAM role with read-only access in each member account. Establish a trust relationship between the IAM role in each member account and the security account. Ask the security team to use the IAM role to gain access.
C. Ask the security team to use AWS Security Token Service (AWS STS) to call the AssumeRole API for the OrganizationAccountAccessRole IAM role in the management account from the security account. Use the generated temporary credentials to gain access.
D. Ask the security team to use AWS Security Token Service (AWS STS) to call the AssumeRole API for the OrganizationAccountAccessRole IAM role in the member account from the security account. Use the generated temporary credentials to gain access.
Show Answer
Correct Answer: B
Explanation: Use the existing OrganizationAccountAccessRole (with admin access from the management account) to create a dedicated cross-account IAM role in each member account that has the ReadOnlyAccess policy attached. Configure the role's trust policy to trust the security account so users there can assume it. IAM policies cannot have trust relationships, and assuming OrganizationAccountAccessRole directly would grant broader administrator permissions than required.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.