A company uses an Amazon Aurora PostgreSQL DB cluster for applications in a single AWS Region. The company's database team must monitor all data activity on all the databases.
Which solution will achieve this goal?
A. Set up an AWS Database Migration Service (AWS DMS) change data capture (CDC) task. Specify the Aurora DB cluster as the source. Specify Amazon Kinesis Data Firehose as the target. Use Kinesis Data Firehose to upload the data into an Amazon OpenSearch Service cluster for further analysis.
B. Start a database activity stream on the Aurora DB cluster to capture the activity stream in Amazon EventBridge. Define an AWS Lambda function as a target for EventBridge. Program the Lambda function to decrypt the messages from EventBridge and to publish all database activity to Amazon S3 for further analysis.
C. Start a database activity stream on the Aurora DB cluster to push the activity stream to an Amazon Kinesis data stream. Configure Amazon Kinesis Data Firehose to consume the Kinesis data stream and to deliver the data to Amazon S3 for further analysis.
D. Set up an AWS Database Migration Service (AWS DMS) change data capture (CDC) task. Specify the Aurora DB cluster as the source. Specify Amazon Kinesis Data Firehose as the target. Use Kinesis Data Firehose to upload the data into an Amazon Redshift cluster. Run queries on the Amazon Redshift data to determine database activities on the Aurora database.
Show Answer
Correct Answer: C
Explanation: Amazon Aurora Database Activity Streams is the native feature designed to monitor all database activity (logins, queries, DDL/DML) in near real time. Activity Streams for Aurora PostgreSQL delivers encrypted activity records to an Amazon Kinesis data stream, which can then be consumed by Kinesis Data Firehose and stored in Amazon S3 or other analytics destinations.
AWS DMS CDC (options A and D) captures data changes, not full database activity such as authentication and query execution. Option B is incorrect because Aurora Database Activity Streams does not publish directly to Amazon EventBridge; it only integrates with Amazon Kinesis Data Streams.
Question 247
A company has a new application that needs to run on five Amazon EC2 instances in a single AWS Region. The application requires high-throughput, low-latency network connections between all of the EC2 instances where the application will run. There is no requirement for the application to be fault tolerant.
Which solution will meet these requirements?
A. Launch five new EC2 instances into a cluster placement group. Ensure that the EC2 instance type supports enhanced networking.
B. Launch five new EC2 instances into an Auto Scaling group in the same Availability Zone. Attach an extra elastic network interface to each EC2 instance.
C. Launch five new EC2 instances into a partition placement group. Ensure that the EC2 instance type supports enhanced networking.
D. Launch five new EC2 instances into a spread placement group. Attach an extra elastic network interface to each EC2 instance.
Show Answer
Correct Answer: A
Explanation: Cluster placement groups place EC2 instances physically close together within a single Availability Zone, providing the highest possible network throughput and lowest latency for tightly coupled workloads. Enhanced networking further optimizes network performance. Partition and spread placement groups focus on fault isolation and availability, which are not required, and Auto Scaling groups or additional ENIs do not guarantee low-latency, high-throughput inter-instance networking.
Question 248
An education company is running a web application used by college students around the world. The application runs in an Amazon Elastic Container Service (Amazon ECS) cluster in an Auto Scaling group behind an Application Load Balancer (ALB). A system administrator detects a weekly spike in the number of failed login attempts, which overwhelm the application's authentication service. All the failed login attempts originate from about 500 different IP addresses that change each week. A solutions architect must prevent the failed login attempts from overwhelming the authentication service.
Which solution meets these requirements with the MOST operational efficiency?
A. Use AWS Firewall Manager to create a security group and security group policy to deny access from the IP addresses.
B. Create an AWS WAF web ACL with a rate-based rule, and set the rule action to Block. Connect the web ACL to the AL
C. Use AWS Firewall Manager to create a security group and security group policy to allow access only to specific CIDR ranges.
D. Create an AWS WAF web ACL with an IP set match rule, and set the rule action to Block. Connect the web ACL to the ALB.
Show Answer
Correct Answer: B
Explanation: The attack consists of excessive failed login attempts from many IP addresses that change weekly. An AWS WAF rate-based rule can automatically detect and block clients that exceed a defined request rate, without requiring manual IP updates. Associating the WAF web ACL with the Application Load Balancer stops malicious traffic before it reaches the ECS service, protecting the authentication backend with minimal ongoing operational effort. IP-based rules or security group policies would require constant updates and are therefore less operationally efficient.
Question 249
A company needs to create and manage multiple AWS accounts for a number of departments from a central location. The security team requires read-only access to all accounts from its own AWS account. The company is using AWS Organizations and created an account for the security team.
How should a solutions architect meet these requirements?
A. Use the OrganizationAccountAccessRole IAM role to create a new IAM policy with read-only access in each member account. Establish a trust relationship between the IAM policy in each member account and the security account. Ask the security team to use the IAM policy to gain access.
B. Use the OrganizationAccountAccessRole IAM role to create a new IAM role with read-only access in each member account. Establish a trust relationship between the IAM role in each member account and the security account. Ask the security team to use the IAM role to gain access.
C. Ask the security team to use AWS Security Token Service (AWS STS) to call the AssumeRole API for the OrganizationAccountAccessRole IAM role in the management account from the security account. Use the generated temporary credentials to gain access.
D. Ask the security team to use AWS Security Token Service (AWS STS) to call the AssumeRole API for the OrganizationAccountAccessRole IAM role in the member account from the security account. Use the generated temporary credentials to gain access.
Show Answer
Correct Answer: B
Explanation: Cross-account access in AWS Organizations should be implemented with IAM roles, not policies. Creating a read-only IAM role in each member account and establishing a trust relationship with the security account allows the security team to assume the role using STS and get read-only access. OrganizationAccountAccessRole can be used to bootstrap this setup, but the final access must be via a dedicated read-only role trusted by the security account. Other options either misuse policies, grant admin access, or do not ensure read-only permissions.
Question 250
A large company runs workloads in VPCs that are deployed across hundreds of AWS accounts. Each VPC consists of public subnets and private subnets that span across multiple Availability Zones. NAT gateways are deployed in the public subnets and allow outbound connectivity to the internet from the private subnets.
A solutions architect is working on a hub-and-spoke design. All private subnets in the spoke VPCs must route traffic to the internet through an egress VPC. The solutions architect already has deployed a NAT gateway in an egress VPC in a central AWS account.
Which set of additional steps should the solutions architect take to meet these requirements?
A. Create peering connections between the egress VPC and the spoke VPCs. Configure the required routing to allow access to the internet.
B. Create a transit gateway, and share it with the existing AWS accounts. Attach existing VPCs to the transit gateway. Configure the required routing to allow access to the internet.
C. Create a transit gateway in every account. Attach the NAT gateway to the transit gateways. Configure the required routing to allow access to the internet.
D. Create an AWS PrivateLink connection between the egress VPC and the spoke VPCs. Configure the required routing to allow access to the internet.
Show Answer
Correct Answer: B
Explanation: A hub-and-spoke design with hundreds of VPCs across many AWS accounts requires a scalable, centrally managed connectivity solution. AWS Transit Gateway is purpose-built for this use case: it allows multiple VPCs from different accounts to attach to a single gateway that acts as the hub. By sharing the transit gateway with other accounts (for example, through AWS RAM), all spoke VPCs can route their outbound traffic to the egress VPC that hosts the NAT gateway. VPC peering does not scale well to hundreds of VPCs and is operationally complex, PrivateLink is not designed for general internet egress, and creating transit gateways in every account is unnecessary and defeats centralization.
Question 251
A company has developed a hybrid solution between its data center and AWS. The company uses Amazon VPC and Amazon EC2 instances that send application logs to Amazon CloudWatch. The EC2 instances read data from multiple relational databases that are hosted on premises.
The company wants to monitor which EC2 instances are connected to the databases in near-real time. The company already has a monitoring solution that uses Splunk on premises. A solutions architect needs to determine how to send networking traffic to Splunk.
How should the solutions architect meet these requirements?
A. Enable VPC flows logs, and send them to CloudWatch. Create an AWS Lambda function to periodically export the CloudWatch logs to an Amazon S3 bucket by using the pre-defined export function. Generate ACCESS_KEY and SECRET_KEY AWS credentials. Configure Splunk to pull the logs from the S3 bucket by using those credentials.
B. Create an Amazon Kinesis Data Firehose delivery stream with Splunk as the destination. Configure a pre-processing AWS Lambda function with a Kinesis Data Firehose stream processor that extracts individual log events from records sent by CloudWatch Logs subscription filters. Enable VPC flows logs, and send them to CloudWatch. Create a CloudWatch Logs subscription that sends log events to the Kinesis Data Firehose delivery stream.
C. Ask the company to log every request that is made to the databases along with the EC2 instance IP address. Export the CloudWatch logs to an Amazon S3 bucket. Use Amazon Athena to query the logs grouped by database name. Export Athena results to another S3 bucket. Invoke an AWS Lambda function to automatically send any new file that is put in the S3 bucket to Splunk.
D. Send the CloudWatch logs to an Amazon Kinesis data stream with Amazon Kinesis Data Analytics for SQL Applications. Configure a 1-minute sliding window to collect the events. Create a SQL query that uses the anomaly detection template to monitor any networking traffic anomalies in near-real time. Send the result to an Amazon Kinesis Data Firehose delivery stream with Splunk as the destination.
Show Answer
Correct Answer: B
Explanation: The requirement is to monitor which EC2 instances are connected to on-premises databases in near-real time using the existing on-premises Splunk solution. Amazon VPC Flow Logs provide network traffic visibility. Sending Flow Logs to CloudWatch Logs and then using a CloudWatch Logs subscription filter to stream the logs to Amazon Kinesis Data Firehose enables near-real-time delivery. Kinesis Data Firehose has native Splunk integration and supports optional Lambda preprocessing, making this the most direct, scalable, and near-real-time solution. Other options introduce unnecessary delays, complexity, or do not align with near-real-time monitoring.
Question 252
A solutions architect is planning to migrate critical Microsoft SQL Server databases to AWS. Because the databases are legacy systems, the solutions architect will move the databases to a modern data architecture. The solutions architect must migrate the databases with near-zero downtime.
Which solution will meet these requirements?
A. Use AWS Application Migration Service and the AWS Schema Conversion Tool (AWS SCT). Perform an in-place upgrade before the migration. Export the migrated data to Amazon Aurora Serverless after cutover. Repoint the applications to Amazon Aurora.
B. Use AWS Database Migration Service (AWS DMS) to rehost the database. Set Amazon S3 as a target. Set up change data capture (CDC) replication. When the source and destination are fully synchronized, load the data from Amazon S3 into an Amazon RDS for Microsoft SQL Server DB instance.
C. Use native database high availability tools. Connect the source system to an Amazon RDS for Microsoft SQL Server DB instance. Configure replication accordingly. When data replication is finished, transition the workload to an Amazon RDS for Microsoft SQL Server DB instance.
D. Use AWS Application Migration Service. Rehost the database server on Amazon EC2. When data replication is finished, detach the database and move the database to an Amazon RDS for Microsoft SQL Server DB instance. Reattach the database and then cut over all networking.
Show Answer
Correct Answer: C
Explanation: Near-zero downtime is best achieved by using native Microsoft SQL Server replication and high availability mechanisms (such as transactional replication or Always On) to continuously synchronize data from the legacy source to Amazon RDS for SQL Server. This allows the source to remain online during migration and enables a very short cutover window. The other options add extra migration stages, intermediate storage, or lift-and-shift steps that increase complexity and downtime risk.
Question 253
A solutions architect needs to define a reference architecture for a solution for three-tier applications with web. application, and NoSQL data layers. The reference architecture must meet the following requirements:
• High availability within an AWS Region
• Able to fail over in 1 minute to another AWS Region for disaster recovery
• Provide the most efficient solution while minimizing the impact on the user experience
Which combination of steps will meet these requirements? (Choose three.)
A. Use an Amazon Route 53 weighted routing policy set to 100/0 across the two selected Regions. Set Time to Live (TTL) to 1 hour.
B. Use an Amazon Route 53 failover routing policy for failover from the primary Region to the disaster recovery Region. Set Time to Live (TTL) to 30 seconds.
C. Use a global table within Amazon DynamoDB so data can be accessed in the two selected Regions.
D. Back up data from an Amazon DynamoDB table in the primary Region every 60 minutes and then write the data to Amazon S3. Use S3 cross-Region replication to copy the data from the primary Region to the disaster recovery Region. Have a script import the data into DynamoDB in a disaster recovery scenario.
E. Implement a hot standby model using Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use zonal Reserved Instances for the minimum number of servers and On-Demand Instances for any additional resources.
F. Use Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use Spot Instances for the required resources.
Show Answer
Correct Answer: B, C, E
Explanation: The solution must deliver high availability within a Region, sub‑minute regional failover, and minimal user impact. Route 53 failover routing with a low TTL (B) enables rapid DNS-based failover to a secondary Region. DynamoDB global tables (C) provide active-active, multi-Region data replication with low latency and no restore delay, which is far more efficient than periodic backups. A hot standby architecture with Auto Scaling across multiple AZs (E) ensures in-Region high availability and keeps the secondary Region ready to serve traffic immediately, while balancing cost and performance.
Question 254
A company wants to run a custom network analysis software package to inspect traffic as traffic leaves and enters a VPC. The company has deployed the solution by using AWS CloudFormation on three Amazon EC2 instances in an Auto Scaling group. All network routing has been established to direct traffic to the EC2 instances.
Whenever the analysis software stops working, the Auto Scaling group replaces an instance. The network routes are not updated when the instance replacement occurs.
Which combination of steps will resolve this issue? (Choose three.)
A. Create alarms based on EC2 status check metrics that will cause the Auto Scaling group to replace the failed instance.
B. Update the CloudFormation template to install the Amazon CloudWatch agent on the EC2 instances. Configure the CloudWatch agent to send process metrics for the application.
C. Update the CloudFormation template to install AWS Systems Manager Agent on the EC2 instances. Configure Systems Manager Agent to send process metrics for the application.
D. Create an alarm for the custom metric in Amazon CloudWatch for the failure scenarios. Configure the alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic.
E. Create an AWS Lambda function that responds to the Amazon Simple Notification Service (Amazon SNS) message to take the instance out of service. Update the network routes to point to the replacement instance.
F. In the CloudFormation template, write a condition that updates the network routes when a replacement instance is launched.
Show Answer
Correct Answer: B, D, E
Explanation: The core problem is that instance replacement happens, but VPC network routes are not automatically updated when the inspection instance changes. The solution therefore must (1) detect application-level failure, not just EC2 health, and (2) trigger automation to update routes when instances change.
B is correct because installing the CloudWatch agent allows the software process itself to publish custom or process-level metrics, which is necessary to detect when the analysis software stops working.
D is correct because a CloudWatch alarm on those custom metrics can detect failure scenarios and publish notifications through Amazon SNS, providing an event-driven trigger.
E is correct because an AWS Lambda function subscribed to the SNS topic can perform the required remediation: mark the failed instance out of service and update the network routes to point to the replacement instance.
Other options do not solve the routing update problem or rely on mechanisms (such as CloudFormation conditions or EC2 status checks) that are not appropriate for runtime, application-level failures.
Question 255
During an audit, a security team discovered that a development team was putting IAM user secret access keys in their code and then committing it to an AWS CodeCommit repository. The security team wants to automatically find and remediate instances of this security vulnerability.
Which solution will ensure that the credentials are appropriately secured automatically?
A. Run a script nightly using AWS Systems Manager Run Command to search for credentials on the development instances. If found, use AWS Secrets Manager to rotate the credentials
B. Use a scheduled AWS Lambda function to download and scan the application code from CodeCommit. If credentials are found, generate new credentials and store them in AWS KMS.
C. Configure Amazon Macie to scan for credentials in CodeCommit repositories. If credentials are found, trigger an AWS Lambda function to disable the credentials and notify the user.
D. Configure a CodeCommit trigger to invoke an AWS Lambda function to scan new code submissions for credentials. If credentials are found, disable them in AWS IAM and notify the user.
Show Answer
Correct Answer: D
Explanation: The requirement is to automatically detect and remediate IAM credentials committed to AWS CodeCommit. A CodeCommit trigger can invoke a Lambda function on every commit to scan new code submissions for access keys before or immediately after they are stored. If credentials are detected, Lambda can disable or delete the IAM keys and notify the developer, preventing ongoing exposure. Other options are unsuitable: Secrets Manager and KMS do not fix credentials embedded in code, scheduled scans are reactive and delayed, and Amazon Macie is designed primarily for S3 data discovery and does not natively scan CodeCommit repositories for this purpose. Therefore, configuring a CodeCommit trigger with Lambda is the correct solution.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.