A company is developing a gene reporting device that will collect genomic information to assist researchers with collecting large samples of data from a diverse population. The device will push 8 KB of genomic data every second to a data platform that will need to process and analyze the data and provide information back to researchers. The data platform must meet the following requirements:
• Provide near-real-time analytics of the inbound genomic data
• Ensure the data is flexible, parallel, and durable
• Deliver results of processing to a data warehouse
Which strategy should a solutions architect use to meet these requirements?
A. Use Amazon Kinesis Data Firehose to collect the inbound sensor data, analyze the data with Kinesis clients, and save the results to an Amazon RDS instance.
B. Use Amazon Kinesis Data Streams to collect the inbound sensor data, analyze the data with Kinesis clients, and save the results to an Amazon Redshift cluster using Amazon EMR.
C. Use Amazon S3 to collect the inbound device data, analyze the data from Amazon SQS with Kinesis, and save the results to an Amazon Redshift cluster.
D. Use an Amazon API Gateway to put requests into an Amazon SQS queue, analyze the data with an AWS Lambda function, and save the results to an Amazon Redshift cluster using Amazon EMR.
Show Answer
Correct Answer: B
Explanation: The requirements call for near-real-time analytics, a flexible and parallel streaming architecture, durable ingestion, and delivery of processed results to a data warehouse. Amazon Kinesis Data Streams supports near-real-time streaming, shard-based parallelism, and durable data retention. Processing can be done by Kinesis consumers (for example, via EMR or custom applications), and Amazon Redshift is the appropriate AWS data warehouse target. The other options either use non-warehouse targets (RDS), incorrect service combinations, or services that are not well suited for near-real-time streaming analytics.
Question 257
A company recently started hosting new application workloads in the AWS Cloud. The company is using Amazon EC2 instances. Amazon Elastic File System (Amazon EFS) file systems, and Amazon RDS DB instances.
To meet regulatory and business requirements, the company must make the following changes for data backups:
• Backups must be retained based on custom daily, weekly, and monthly requirements.
• Backups must be replicated to at least one other AWS Region immediately after capture.
• The backup solution must provide a single source of backup status across the AWS environment.
• The backup solution must send immediate notifications upon failure of any resource backup.
Which combination of steps will meet these requirements with the LEAST amount of operational overhead? (Choose three.)
A. Create an AWS Backup plan with a backup rule for each of the retention requirements.
B. Configure an AWS Backup plan to copy backups to another Region.
C. Create an AWS Lambda function to replicate backups to another Region and send notification if a failure occurs.
D. Add an Amazon Simple Notification Service (Amazon SNS) topic to the backup plan to send a notification for finished jobs that have any status except BACKUP_JOB_COMPLETE
E. Create an Amazon Data Lifecycle Manager (Amazon DLM) snapshot lifecycle policy for each of the retention requirements.
F. Set up RDS snapshots on each database.
Show Answer
Correct Answer: A, B, D
Explanation: AWS Backup natively supports EC2, EFS, and RDS with centralized management and status reporting. Creating a single AWS Backup plan with multiple rules satisfies custom daily, weekly, and monthly retention requirements (A). AWS Backup can automatically copy backups to another AWS Region immediately after creation, meeting cross-Region replication with minimal overhead (B). AWS Backup integrates with Amazon SNS to send notifications for backup job failures, providing immediate alerts without custom code (D). Other options add unnecessary operational overhead or do not meet all service coverage requirements.
Question 258
A company has more than 10,000 sensors that send data to an on-premises Apache Kafka server by using the Message Queuing Telemetry Transport (MQTT) protocol. The on-premises Kafka server transforms the data and then stores the results as objects in an Amazon S3 bucket.
Recently, the Kafka server crashed. The company lost sensor data while the server was being restored. A solutions architect must create a new design on AWS that is highly available and scalable to prevent a similar occurrence.
Which solution will meet these requirements?
A. Launch two Amazon EC2 instances to host the Kafka server in an active/standby configuration across two Availability Zones. Create a domain name in Amazon Route 53. Create a Route 53 failover policy. Route the sensors to send the data to the domain name.
B. Migrate the on-premises Kafka server to Amazon Managed Streaming for Apache Kafka (Amazon MSK). Create a Network Load Balancer (NLB) that points to the Amazon MSK broker. Enable NLB health checks. Route the sensors to send the data to the NL
C. Deploy AWS IoT Core, and connect it to an Amazon Kinesis Data Firehose delivery stream. Use an AWS Lambda function to handle data transformation. Route the sensors to send the data to AWS IoT Core.
D. Deploy AWS IoT Core, and launch an Amazon EC2 instance to host the Kafka server. Configure AWS IoT Core to send the data to the EC2 instance. Route the sensors to send the data to AWS IoT Core.
Show Answer
Correct Answer: C
Explanation: The sensors already use MQTT, and the main problem was data loss caused by a single, self-managed Kafka server failure. AWS IoT Core is a fully managed, highly available, and scalable MQTT broker designed for massive numbers of devices. Integrating IoT Core with Kinesis Data Firehose provides durable buffering and automatic delivery to Amazon S3, while AWS Lambda performs data transformation without managing servers. This design removes single points of failure, scales automatically, and directly addresses reliability and availability requirements. The other options either retain Kafka operational risk, do not natively fit MQTT ingestion, or are not fully highly available.
Question 259
A company is designing an AWS Organizations structure. The company wants to standardize a process to apply tags across the entire organization. The company will require tags with specific values when a user creates a new resource. Each of the company's OUs will have unique tag values.
Which solution will meet these requirements?
A. Use an SCP to deny the creation of resources that do not have the required tags. Create a tag policy that includes the tag values that the company has assigned to each OU. Attach the tag policies to the OUs.
B. Use an SCP to deny the creation of resources that do not have the required tags. Create a tag policy that includes the tag values that the company has assigned to each OU. Attach the tag policies to the organization's management account.
C. Use an SCP to allow the creation of resources only when the resources have the required tags. Create a tag policy that includes the tag values that the company has assigned to each OU. Attach the tag policies to the OUs.
D. Use an SCP to deny the creation of resources that do not have the required tags. Define the list of tags. Attach the SCP to the OUs.
Show Answer
Correct Answer: A
Explanation: The requirement is to enforce mandatory tags at resource creation and to have different allowed tag values per OU. SCPs are used to deny actions that don’t meet conditions, so an SCP can deny resource creation if required tags are missing. Tag policies define and validate allowed tag keys and values, and because each OU has unique tag values, separate tag policies must be attached to each OU. Attaching them to the management account would apply the same values everywhere, which does not meet the requirement.
Question 260
A company has built a high performance computing (HPC) cluster in AWS for a tightly coupled workload that generates a large number of shared files stored in Amazon EFS. The cluster was performing well when the number of Amazon EC2 instances in the cluster was 100. However, when the company increased the cluster size to 1.000 EC2 instances, overall performance was well below expectations.
Which collection of design choices should a solutions architect make to achieve the maximum performance from the HPC cluster? (Choose three.)
A. Ensure the HPC cluster is launched within a single Availability Zone.
B. Launch the EC2 instances and attach elastic network interfaces in multiples of four.
C. Select EC2 instance types with an Elastic Fabric Adapter (EFA) enabled.
D. Ensure the cluster is launched across multiple Availability Zones.
E. Replace Amazon EFS with multiple Amazon EBS volumes in a RAID array.
F. Replace Amazon EFS with Amazon FSx for Lustre.
Show Answer
Correct Answer: A, C, F
Explanation: For tightly coupled HPC workloads, maximum performance depends on low-latency networking and a high-performance shared file system. Launching the cluster in a single Availability Zone minimizes network latency and avoids inter-AZ bandwidth limits. Using EC2 instance types with Elastic Fabric Adapter (EFA) provides the low-latency, high-bandwidth interconnect required for large-scale HPC clusters. Amazon EFS does not scale well for this pattern at thousands of nodes; replacing it with Amazon FSx for Lustre, which is purpose-built for HPC and high-throughput shared file access, delivers significantly better performance.
Question 261
A company wants to use AWS for disaster recovery for an on-premises application. The company has hundreds of Windows-based servers that run the application. All the servers mount a common share.
The company has an RTO of 15 minutes and an RPO of 5 minutes. The solution must support native failover and fallback capabilities.
Which solution will meet these requirements MOST cost-effectively?
A. Create an AWS Storage Gateway File Gateway. Schedule daily Windows server backups. Save the data to Amazon S3. During a disaster, recover the on-premises servers from the backup. During tailback, run the on-premises servers on Amazon EC2 instances.
B. Create a set of AWS CloudFormation templates to create infrastructure. Replicate all data to Amazon Elastic File System (Amazon EFS) by using AWS DataSync. During a disaster, use AWS CodePipeline to deploy the templates to restore the on-premises servers. Fail back the data by using DataSync.
C. Create an AWS Cloud Development Kit (AWS CDK) pipeline to stand up a multi-site active-active environment on AWS. Replicate data into Amazon S3 by using the s3 sync command. During a disaster, swap DNS endpoints to point to AWS. Fail back the data by using the s3 sync command.
D. Use AWS Elastic Disaster Recovery to replicate the on-premises servers. Replicate data to an Amazon FSx for Windows File Server file system by using AWS DataSync. Mount the file system to AWS servers. During a disaster, fail over the on-premises servers to AWS. Fail back to new or existing servers by using Elastic Disaster Recovery.
Show Answer
Correct Answer: D
Explanation: The application runs on hundreds of Windows servers that share a common file system and requires very low RTO (15 minutes) and RPO (5 minutes) with native failover and failback. AWS Elastic Disaster Recovery provides continuous block-level replication and automated failover/failback for Windows servers that meets the RTO/RPO targets cost-effectively. Amazon FSx for Windows File Server is the correct managed file system for Windows shared storage and supports native Windows semantics. DataSync enables near-real-time replication of the shared file data. The other options rely on backups, manual deployment, or inappropriate storage (S3/EFS) and cannot meet the RTO/RPO or native failover requirements.
Question 262
A company is migrating its development and production workloads to a new organization in AWS Organizations. The company has created a separate member account for development and a separate member account for production. Consolidated billing is linked to the management account. In the management account, a solutions architect needs to create an IAM user that can stop or terminate resources in both member accounts.
Which solution will meet this requirement?
A. Create an IAM user and a cross-account role in the management account. Configure the cross-account role with least privilege access to the member accounts.
B. Create an IAM user in each member account. In the management account, create a cross-account role that has least privilege access. Grant the IAM users access to the cross-account role by using a trust policy.
C. Create an IAM user in the management account. In the member accounts, create an IAM group that has least privilege access. Add the IAM user from the management account to each IAM group in the member accounts.
D. Create an IAM user in the management account. In the member accounts, create cross-account roles that have least privilege access. Grant the IAM user access to the roles by using a trust policy.
Show Answer
Correct Answer: D
Explanation: To allow an IAM user in the management account to stop or terminate resources in member accounts, the correct pattern is to use cross-account roles that are created in the target (member) accounts. Each member account creates an IAM role with least-privilege permissions (for stopping/terminating resources) and a trust policy that allows the IAM user in the management account to assume the role. This is the standard and secure AWS cross-account access model. Other options are incorrect because cross-account roles must be defined in the destination accounts, IAM users cannot be added to groups across accounts, and creating roles only in the management account cannot grant permissions inside member accounts.
Question 263
A company needs to establish a connection from its on-premises data center to AWS. The company needs to connect all of its VPCs that are located in different AWS Regions with transitive routing capabilities between VPC networks. The company also must reduce network outbound traffic costs, increase bandwidth throughput, and provide a consistent network experience for end users.
Which solution will meet these requirements?
A. Create an AWS Site-to-Site VPN connection between the on-premises data center and a new central VPC. Create VPC peering connections that initiate from the central VPC to all other VPCs.
B. Create an AWS Direct Connect connection between the on-premises data center and AWS. Provision a transit VIF, and connect it to a Direct Connect gateway. Connect the Direct Connect gateway to all the other VPCs by using a transit gateway in each Region.
C. Create an AWS Site-to-Site VPN connection between the on-premises data center and a new central VPUse a transit gateway with dynamic routing. Connect the transit gateway to all other VPCs.
D. Create an AWS Direct Connect connection between the on-premises data center and AWS. Establish an AWS Site-to-Site VPN connection between all VPCs in each Region. Create VPC peering connections that initiate from the central VPC to all other VPCs.
Show Answer
Correct Answer: B
Explanation: The requirements call for transitive routing across multiple VPCs in different Regions, higher and more consistent bandwidth, and reduced outbound traffic costs. AWS Direct Connect provides dedicated, high-throughput, low-latency connectivity with more consistent performance and lower data transfer costs than VPN. Using a transit VIF attached to a Direct Connect gateway allows on‑premises connectivity to multiple VPCs. Integrating the Direct Connect gateway with AWS Transit Gateway (and inter-Region TGW peering) enables scalable, transitive routing between all VPCs across Regions. VPN- and VPC-peering-based options do not meet the throughput, cost, or transitive routing requirements.
Question 264
A company has an on-premises Microsoft SQL Server database that writes a nightly 200 GB export to a local drive. The company wants to move the backups to more robust cloud storage on Amazon S3. The company has set up a 10 Gbps AWS Direct Connect connection between the on-premises data center and AWS.
Which solution meets these requirements MOST cost-effectively?
A. Create a new S3 bucket. Deploy an AWS Storage Gateway file gateway within the VPC that is connected to the Direct Connect connection. Create a new SMB file share. Write nightly database exports to the new SMB file share.
B. Create an Amazon FSx for Windows File Server Single-AZ file system within the VPC that is connected to the Direct Connect connection. Create a new SMB file share. Write nightly database exports to an SMB file share on the Amazon FSx file system. Enable nightly backups.
C. Create an Amazon FSx for Windows File Server Multi-AZ file system within the VPC that is connected to the Direct Connect connection. Create a new SMB file share. Write nightly database exports to an SMB file share on the Amazon FSx file system. Enable nightly backups.
D. Create a new S3 bucket. Deploy an AWS Storage Gateway volume gateway within the VPC that is connected to the Direct Connect connection. Create a new SMB file share. Write nightly database exports to the new SMB file share on the volume gateway, and automate copies of this data to an S3 bucket.
Show Answer
Correct Answer: A
Explanation: The requirement is to move nightly file-based database exports (200 GB) from on premises to durable, low-cost Amazon S3 storage over Direct Connect. AWS Storage Gateway **File Gateway** is purpose-built for this use case: it presents an SMB file share to on-premises systems and stores the data directly as objects in Amazon S3. This avoids running and paying for a managed file system like FSx and avoids unnecessary block storage.
FSx for Windows File Server (options B and C) is significantly more expensive and unnecessary when the end goal is S3 object storage. Storage Gateway **Volume Gateway** (option D) is block-based (iSCSI), not SMB-native, and is intended for volume snapshots rather than simple file backups to S3, making it more complex and less appropriate. Therefore, option A is the most cost-effective and best-aligned solution.
Question 265
A company has Linux-based Amazon EC2 instances. Users must access the instances by using SSH with EC2 SSH key pairs. Each machine requires a unique EC2 key pair.
The company wants to implement a key rotation policy that will, upon request, automatically rotate all the EC2 key pairs and keep the keys in a securely encrypted place. The company will accept less than 1 minute of downtime during key rotation.
Which solution will meet these requirements?
A. Store all the keys in AWS Secrets Manager. Define a Secrets Manager rotation schedule to invoke an AWS Lambda function to generate new key pairs. Replace public keys on EC2 instances. Update the private keys in Secrets Manager.
B. Store all the keys in Parameter Store, a capability of AWS Systems Manager, as a string. Define a Systems Manager maintenance window to invoke an AWS Lambda function to generate new key pairs. Replace public keys on EC2 instances. Update the private keys in Parameter Store.
C. Import the EC2 key pairs into AWS Key Management Service (AWS KMS). Configure automatic key rotation for these key pairs. Create an Amazon EventBridge scheduled rule to invoke an AWS Lambda function to initiate the key rotation in AWS KMS.
D. Add all the EC2 instances to Fleet Manager, a capability of AWS Systems Manager. Define a Systems Manager maintenance window to issue a Systems Manager Run Command document to generate new key pairs and to rotate public keys to all the instances in Fleet Manager.
Show Answer
Correct Answer: A
Explanation: The requirement is automated, on‑request rotation of unique EC2 SSH key pairs, secure encrypted storage of private keys, and minimal downtime. AWS Secrets Manager is designed for securely storing secrets and supports rotation workflows via Lambda. A Lambda function can generate new per‑instance SSH key pairs, update the authorized_keys on each EC2 instance (for example via SSM), and store the new private keys encrypted in Secrets Manager, achieving rotation with negligible downtime. Parameter Store is less suited for secrets rotation, KMS does not manage SSH key pairs, and Fleet Manager/Run Command alone does not provide a secure, centralized, encrypted key store or native rotation capability.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.