A large company runs workloads in VPCs that are deployed across hundreds of AWS accounts. Each VPC consists of public subnets and private subnets that span across multiple Availability Zones. NAT gateways are deployed in the public subnets and allow outbound connectivity to the internet from the private subnets.
A solutions architect is working on a hub-and-spoke design. All private subnets in the spoke VPCs must route traffic to the internet through an egress VPC. The solutions architect already has deployed a NAT gateway in an egress VPC in a central AWS account.
Which set of additional steps should the solutions architect take to meet these requirements?
A. Create peering connections between the egress VPC and the spoke VPCs. Configure the required routing to allow access to the internet.
B. Create a transit gateway, and share it with the existing AWS accounts. Attach existing VPCs to the transit gateway. Configure the required routing to allow access to the internet.
C. Create a transit gateway in every account. Attach the NAT gateway to the transit gateways. Configure the required routing to allow access to the internet.
D. Create an AWS PrivateLink connection between the egress VPC and the spoke VPCs. Configure the required routing to allow access to the internet.
Show Answer
Correct Answer: B
Explanation: AWS Transit Gateway is the appropriate hub-and-spoke networking service for connecting hundreds of VPCs across multiple AWS accounts. Share the transit gateway with the accounts (typically via AWS RAM), attach the spoke VPCs and the egress VPC, and configure route tables so spoke private subnet traffic is sent through the transit gateway to the egress VPC's NAT gateway for internet access. VPC peering does not scale well for hundreds of VPCs and does not provide a centralized hub. PrivateLink is for private service access, not general internet egress routing. Creating a transit gateway in every account is unnecessary and not the intended architecture.
Question 251
A company has developed a hybrid solution between its data center and AWS. The company uses Amazon VPC and Amazon EC2 instances that send application logs to Amazon CloudWatch. The EC2 instances read data from multiple relational databases that are hosted on premises.
The company wants to monitor which EC2 instances are connected to the databases in near-real time. The company already has a monitoring solution that uses Splunk on premises. A solutions architect needs to determine how to send networking traffic to Splunk.
How should the solutions architect meet these requirements?
A. Enable VPC flows logs, and send them to CloudWatch. Create an AWS Lambda function to periodically export the CloudWatch logs to an Amazon S3 bucket by using the pre-defined export function. Generate ACCESS_KEY and SECRET_KEY AWS credentials. Configure Splunk to pull the logs from the S3 bucket by using those credentials.
B. Create an Amazon Kinesis Data Firehose delivery stream with Splunk as the destination. Configure a pre-processing AWS Lambda function with a Kinesis Data Firehose stream processor that extracts individual log events from records sent by CloudWatch Logs subscription filters. Enable VPC flows logs, and send them to CloudWatch. Create a CloudWatch Logs subscription that sends log events to the Kinesis Data Firehose delivery stream.
C. Ask the company to log every request that is made to the databases along with the EC2 instance IP address. Export the CloudWatch logs to an Amazon S3 bucket. Use Amazon Athena to query the logs grouped by database name. Export Athena results to another S3 bucket. Invoke an AWS Lambda function to automatically send any new file that is put in the S3 bucket to Splunk.
D. Send the CloudWatch logs to an Amazon Kinesis data stream with Amazon Kinesis Data Analytics for SQL Applications. Configure a 1-minute sliding window to collect the events. Create a SQL query that uses the anomaly detection template to monitor any networking traffic anomalies in near-real time. Send the result to an Amazon Kinesis Data Firehose delivery stream with Splunk as the destination.
Show Answer
Correct Answer: B
Explanation: VPC Flow Logs are the correct source for network traffic visibility. To deliver them to an existing on-premises Splunk deployment in near real time, configure VPC Flow Logs to CloudWatch Logs, create a CloudWatch Logs subscription filter, and forward events to an Amazon Kinesis Data Firehose delivery stream with Splunk as the destination. A Firehose Lambda processor can transform CloudWatch log records into individual events before delivery. The other options either rely on batch exports to S3 (not near real time), use unnecessary database logging and Athena, or focus on anomaly detection rather than forwarding network traffic to Splunk.
Question 252
A solutions architect is planning to migrate critical Microsoft SQL Server databases to AWS. Because the databases are legacy systems, the solutions architect will move the databases to a modern data architecture. The solutions architect must migrate the databases with near-zero downtime.
Which solution will meet these requirements?
A. Use AWS Application Migration Service and the AWS Schema Conversion Tool (AWS SCT). Perform an in-place upgrade before the migration. Export the migrated data to Amazon Aurora Serverless after cutover. Repoint the applications to Amazon Aurora.
B. Use AWS Database Migration Service (AWS DMS) to rehost the database. Set Amazon S3 as a target. Set up change data capture (CDC) replication. When the source and destination are fully synchronized, load the data from Amazon S3 into an Amazon RDS for Microsoft SQL Server DB instance.
C. Use native database high availability tools. Connect the source system to an Amazon RDS for Microsoft SQL Server DB instance. Configure replication accordingly. When data replication is finished, transition the workload to an Amazon RDS for Microsoft SQL Server DB instance.
D. Use AWS Application Migration Service. Rehost the database server on Amazon EC2. When data replication is finished, detach the database and move the database to an Amazon RDS for Microsoft SQL Server DB instance. Reattach the database and then cut over all networking.
Show Answer
Correct Answer: C
Explanation: Native SQL Server high availability/replication (such as transactional replication or Always On where supported) to Amazon RDS for SQL Server enables continuous synchronization and a very small cutover window, meeting the near-zero downtime requirement. Option B unnecessarily stages through Amazon S3, which is not the right architecture for near-zero downtime migration to RDS. Options A and D misuse AWS Application Migration Service for database modernization/migration and include unsupported or impractical steps.
Question 253
A solutions architect needs to define a reference architecture for a solution for three-tier applications with web. application, and NoSQL data layers. The reference architecture must meet the following requirements:
• High availability within an AWS Region
• Able to fail over in 1 minute to another AWS Region for disaster recovery
• Provide the most efficient solution while minimizing the impact on the user experience
Which combination of steps will meet these requirements? (Choose three.)
A. Use an Amazon Route 53 weighted routing policy set to 100/0 across the two selected Regions. Set Time to Live (TTL) to 1 hour.
B. Use an Amazon Route 53 failover routing policy for failover from the primary Region to the disaster recovery Region. Set Time to Live (TTL) to 30 seconds.
C. Use a global table within Amazon DynamoDB so data can be accessed in the two selected Regions.
D. Back up data from an Amazon DynamoDB table in the primary Region every 60 minutes and then write the data to Amazon S3. Use S3 cross-Region replication to copy the data from the primary Region to the disaster recovery Region. Have a script import the data into DynamoDB in a disaster recovery scenario.
E. Implement a hot standby model using Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use zonal Reserved Instances for the minimum number of servers and On-Demand Instances for any additional resources.
F. Use Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use Spot Instances for the required resources.
Show Answer
Correct Answer: B, C, E
Explanation: Use Route 53 failover routing with a low TTL to enable rapid regional failover. DynamoDB Global Tables provide active multi-Region replication for the NoSQL data layer. A hot standby deployment across Regions with Auto Scaling groups supports high availability and enables disaster recovery with approximately 1-minute failover while minimizing user impact. Weighted routing with 100/0 and a 1-hour TTL delays failover, S3 backup/restore is too slow for a 1-minute RTO, and Spot Instances are not appropriate for a hot standby architecture.
Question 254
A company wants to run a custom network analysis software package to inspect traffic as traffic leaves and enters a VPC. The company has deployed the solution by using AWS CloudFormation on three Amazon EC2 instances in an Auto Scaling group. All network routing has been established to direct traffic to the EC2 instances.
Whenever the analysis software stops working, the Auto Scaling group replaces an instance. The network routes are not updated when the instance replacement occurs.
Which combination of steps will resolve this issue? (Choose three.)
A. Create alarms based on EC2 status check metrics that will cause the Auto Scaling group to replace the failed instance.
B. Update the CloudFormation template to install the Amazon CloudWatch agent on the EC2 instances. Configure the CloudWatch agent to send process metrics for the application.
C. Update the CloudFormation template to install AWS Systems Manager Agent on the EC2 instances. Configure Systems Manager Agent to send process metrics for the application.
D. Create an alarm for the custom metric in Amazon CloudWatch for the failure scenarios. Configure the alarm to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic.
E. Create an AWS Lambda function that responds to the Amazon Simple Notification Service (Amazon SNS) message to take the instance out of service. Update the network routes to point to the replacement instance.
F. In the CloudFormation template, write a condition that updates the network routes when a replacement instance is launched.
Show Answer
Correct Answer: B, D, E
Explanation: The failure is at the application level, not necessarily the EC2 instance level. Installing the CloudWatch agent allows publishing process-level custom metrics (B). A CloudWatch alarm on those custom metrics can notify an SNS topic when the application fails (D). An AWS Lambda function subscribed to the SNS topic can remove the failed instance from service and update the VPC network routes to point to the replacement instance (E). EC2 status checks (A) only detect infrastructure issues, not application failures. Systems Manager Agent (C) does not publish application process metrics for this purpose. CloudFormation conditions (F) are evaluated during stack operations, not dynamically when Auto Scaling replaces instances.
Question 255
During an audit, a security team discovered that a development team was putting IAM user secret access keys in their code and then committing it to an AWS CodeCommit repository. The security team wants to automatically find and remediate instances of this security vulnerability.
Which solution will ensure that the credentials are appropriately secured automatically?
A. Run a script nightly using AWS Systems Manager Run Command to search for credentials on the development instances. If found, use AWS Secrets Manager to rotate the credentials
B. Use a scheduled AWS Lambda function to download and scan the application code from CodeCommit. If credentials are found, generate new credentials and store them in AWS KMS.
C. Configure Amazon Macie to scan for credentials in CodeCommit repositories. If credentials are found, trigger an AWS Lambda function to disable the credentials and notify the user.
D. Configure a CodeCommit trigger to invoke an AWS Lambda function to scan new code submissions for credentials. If credentials are found, disable them in AWS IAM and notify the user.
Show Answer
Correct Answer: D
Explanation: A CodeCommit trigger can invoke a Lambda function on new commits to scan for exposed IAM access keys or secret access keys. If credentials are detected, the Lambda function can automatically disable or delete the IAM access keys and notify the developer, providing automated detection and remediation close to the commit event. The other options are unsuitable: Systems Manager only scans instances, KMS is not a secret store, and Amazon Macie is designed for discovering sensitive data in supported data stores such as S3, not scanning CodeCommit repositories directly.
Question 256
A company is developing a gene reporting device that will collect genomic information to assist researchers with collecting large samples of data from a diverse population. The device will push 8 KB of genomic data every second to a data platform that will need to process and analyze the data and provide information back to researchers. The data platform must meet the following requirements:
• Provide near-real-time analytics of the inbound genomic data
• Ensure the data is flexible, parallel, and durable
• Deliver results of processing to a data warehouse
Which strategy should a solutions architect use to meet these requirements?
A. Use Amazon Kinesis Data Firehose to collect the inbound sensor data, analyze the data with Kinesis clients, and save the results to an Amazon RDS instance.
B. Use Amazon Kinesis Data Streams to collect the inbound sensor data, analyze the data with Kinesis clients, and save the results to an Amazon Redshift cluster using Amazon EMR.
C. Use Amazon S3 to collect the inbound device data, analyze the data from Amazon SQS with Kinesis, and save the results to an Amazon Redshift cluster.
D. Use an Amazon API Gateway to put requests into an Amazon SQS queue, analyze the data with an AWS Lambda function, and save the results to an Amazon Redshift cluster using Amazon EMR.
Show Answer
Correct Answer: B
Explanation: Amazon Kinesis Data Streams is designed for near-real-time streaming ingestion with durable, scalable, parallel processing. Kinesis clients (KCL-based consumers) can analyze the stream, and the processed results can be loaded into Amazon Redshift, which satisfies the requirement to deliver results to a data warehouse. Option A incorrectly targets Amazon RDS instead of a data warehouse. Option C misuses S3/SQS/Kinesis, and Option D relies on SQS, which is not the appropriate near-real-time streaming service for this workload.
Question 257
A company recently started hosting new application workloads in the AWS Cloud. The company is using Amazon EC2 instances. Amazon Elastic File System (Amazon EFS) file systems, and Amazon RDS DB instances.
To meet regulatory and business requirements, the company must make the following changes for data backups:
• Backups must be retained based on custom daily, weekly, and monthly requirements.
• Backups must be replicated to at least one other AWS Region immediately after capture.
• The backup solution must provide a single source of backup status across the AWS environment.
• The backup solution must send immediate notifications upon failure of any resource backup.
Which combination of steps will meet these requirements with the LEAST amount of operational overhead? (Choose three.)
A. Create an AWS Backup plan with a backup rule for each of the retention requirements.
B. Configure an AWS Backup plan to copy backups to another Region.
C. Create an AWS Lambda function to replicate backups to another Region and send notification if a failure occurs.
D. Add an Amazon Simple Notification Service (Amazon SNS) topic to the backup plan to send a notification for finished jobs that have any status except BACKUP_JOB_COMPLETE
E. Create an Amazon Data Lifecycle Manager (Amazon DLM) snapshot lifecycle policy for each of the retention requirements.
F. Set up RDS snapshots on each database.
Show Answer
Correct Answer: A, B, D
Explanation: AWS Backup provides centralized backup management across supported services including EC2 (via EBS), Amazon EFS, and Amazon RDS. Create a backup plan with separate rules for daily, weekly, and monthly retention requirements. Configure cross-Region copy within the backup plan to automatically replicate backups immediately after creation. Configure AWS Backup notifications through an Amazon SNS topic for backup job events so failed backup jobs generate immediate notifications. Amazon DLM only manages EBS snapshots/AMIs, Lambda is unnecessary because AWS Backup natively supports cross-Region copy and notifications, and standalone RDS snapshots do not provide centralized management.
Question 258
A company has more than 10,000 sensors that send data to an on-premises Apache Kafka server by using the Message Queuing Telemetry Transport (MQTT) protocol. The on-premises Kafka server transforms the data and then stores the results as objects in an Amazon S3 bucket.
Recently, the Kafka server crashed. The company lost sensor data while the server was being restored. A solutions architect must create a new design on AWS that is highly available and scalable to prevent a similar occurrence.
Which solution will meet these requirements?
A. Launch two Amazon EC2 instances to host the Kafka server in an active/standby configuration across two Availability Zones. Create a domain name in Amazon Route 53. Create a Route 53 failover policy. Route the sensors to send the data to the domain name.
B. Migrate the on-premises Kafka server to Amazon Managed Streaming for Apache Kafka (Amazon MSK). Create a Network Load Balancer (NLB) that points to the Amazon MSK broker. Enable NLB health checks. Route the sensors to send the data to the NL
C. Deploy AWS IoT Core, and connect it to an Amazon Kinesis Data Firehose delivery stream. Use an AWS Lambda function to handle data transformation. Route the sensors to send the data to AWS IoT Core.
D. Deploy AWS IoT Core, and launch an Amazon EC2 instance to host the Kafka server. Configure AWS IoT Core to send the data to the EC2 instance. Route the sensors to send the data to AWS IoT Core.
Show Answer
Correct Answer: C
Explanation: AWS IoT Core is purpose-built for MQTT device ingestion and provides a highly available, scalable managed entry point for thousands of sensors. AWS Lambda can perform the required data transformation, and Amazon Kinesis Data Firehose can reliably deliver the transformed data to Amazon S3. Option B is not appropriate because Amazon MSK does not natively accept MQTT clients, and placing an NLB in front of MSK does not make it an MQTT broker or address the transformation requirement. Options A and D still rely on self-managed Kafka on EC2, leaving unnecessary operational overhead and, in D, a single-instance failure risk.
Question 259
A company is designing an AWS Organizations structure. The company wants to standardize a process to apply tags across the entire organization. The company will require tags with specific values when a user creates a new resource. Each of the company's OUs will have unique tag values.
Which solution will meet these requirements?
A. Use an SCP to deny the creation of resources that do not have the required tags. Create a tag policy that includes the tag values that the company has assigned to each OU. Attach the tag policies to the OUs.
B. Use an SCP to deny the creation of resources that do not have the required tags. Create a tag policy that includes the tag values that the company has assigned to each OU. Attach the tag policies to the organization's management account.
C. Use an SCP to allow the creation of resources only when the resources have the required tags. Create a tag policy that includes the tag values that the company has assigned to each OU. Attach the tag policies to the OUs.
D. Use an SCP to deny the creation of resources that do not have the required tags. Define the list of tags. Attach the SCP to the OUs.
Show Answer
Correct Answer: A
Explanation: Tag policies standardize and validate required tag keys and allowed values, while SCPs can deny resource creation when required tags are missing. Because each OU requires different allowed tag values, separate tag policies should be attached to the respective OUs rather than only at the management account/root. SCPs are used for deny guardrails, not allow-based enforcement.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.