A company has built a high performance computing (HPC) cluster in AWS for a tightly coupled workload that generates a large number of shared files stored in Amazon EFS. The cluster was performing well when the number of Amazon EC2 instances in the cluster was 100. However, when the company increased the cluster size to 1.000 EC2 instances, overall performance was well below expectations.
Which collection of design choices should a solutions architect make to achieve the maximum performance from the HPC cluster? (Choose three.)
A. Ensure the HPC cluster is launched within a single Availability Zone.
B. Launch the EC2 instances and attach elastic network interfaces in multiples of four.
C. Select EC2 instance types with an Elastic Fabric Adapter (EFA) enabled.
D. Ensure the cluster is launched across multiple Availability Zones.
E. Replace Amazon EFS with multiple Amazon EBS volumes in a RAID array.
F. Replace Amazon EFS with Amazon FSx for Lustre.
Show Answer
Correct Answer: A, C, F
Explanation: For tightly coupled HPC workloads, minimize network latency by keeping the cluster within a single Availability Zone. Use Elastic Fabric Adapter (EFA) to provide low-latency, high-throughput communication between instances. Amazon EFS is a general-purpose shared file system and is not optimized for large-scale HPC metadata and throughput demands; Amazon FSx for Lustre is purpose-built for HPC and high-performance shared file access. Launching across multiple AZs increases latency, ENIs in multiples of four are unrelated, and replacing a shared filesystem with EBS RAID does not provide a shared filesystem for the cluster.
Question 261
A company wants to use AWS for disaster recovery for an on-premises application. The company has hundreds of Windows-based servers that run the application. All the servers mount a common share.
The company has an RTO of 15 minutes and an RPO of 5 minutes. The solution must support native failover and fallback capabilities.
Which solution will meet these requirements MOST cost-effectively?
A. Create an AWS Storage Gateway File Gateway. Schedule daily Windows server backups. Save the data to Amazon S3. During a disaster, recover the on-premises servers from the backup. During tailback, run the on-premises servers on Amazon EC2 instances.
B. Create a set of AWS CloudFormation templates to create infrastructure. Replicate all data to Amazon Elastic File System (Amazon EFS) by using AWS DataSync. During a disaster, use AWS CodePipeline to deploy the templates to restore the on-premises servers. Fail back the data by using DataSync.
C. Create an AWS Cloud Development Kit (AWS CDK) pipeline to stand up a multi-site active-active environment on AWS. Replicate data into Amazon S3 by using the s3 sync command. During a disaster, swap DNS endpoints to point to AWS. Fail back the data by using the s3 sync command.
D. Use AWS Elastic Disaster Recovery to replicate the on-premises servers. Replicate data to an Amazon FSx for Windows File Server file system by using AWS DataSync. Mount the file system to AWS servers. During a disaster, fail over the on-premises servers to AWS. Fail back to new or existing servers by using Elastic Disaster Recovery.
Show Answer
Correct Answer: D
Explanation: AWS Elastic Disaster Recovery (DRS) is purpose-built for low RPO/RTO disaster recovery with native failover and failback for servers. Because the application uses a common Windows file share, Amazon FSx for Windows File Server is the appropriate managed SMB file system. AWS DataSync can continuously replicate the shared data to FSx. Options using backups, EFS, or S3 sync do not meet the required Windows file share compatibility and/or the 15-minute RTO and 5-minute RPO with native failover/failback.
Question 262
A company is migrating its development and production workloads to a new organization in AWS Organizations. The company has created a separate member account for development and a separate member account for production. Consolidated billing is linked to the management account. In the management account, a solutions architect needs to create an IAM user that can stop or terminate resources in both member accounts.
Which solution will meet this requirement?
A. Create an IAM user and a cross-account role in the management account. Configure the cross-account role with least privilege access to the member accounts.
B. Create an IAM user in each member account. In the management account, create a cross-account role that has least privilege access. Grant the IAM users access to the cross-account role by using a trust policy.
C. Create an IAM user in the management account. In the member accounts, create an IAM group that has least privilege access. Add the IAM user from the management account to each IAM group in the member accounts.
D. Create an IAM user in the management account. In the member accounts, create cross-account roles that have least privilege access. Grant the IAM user access to the roles by using a trust policy.
Show Answer
Correct Answer: D
Explanation: For cross-account access, the IAM user should exist in the management account, while each member account contains an IAM role with the required least-privilege permissions. The role's trust policy allows the IAM principal from the management account to assume it. IAM groups cannot contain users from other accounts, and creating the cross-account role only in the management account does not grant permissions into member accounts.
Question 263
A company needs to establish a connection from its on-premises data center to AWS. The company needs to connect all of its VPCs that are located in different AWS Regions with transitive routing capabilities between VPC networks. The company also must reduce network outbound traffic costs, increase bandwidth throughput, and provide a consistent network experience for end users.
Which solution will meet these requirements?
A. Create an AWS Site-to-Site VPN connection between the on-premises data center and a new central VPC. Create VPC peering connections that initiate from the central VPC to all other VPCs.
B. Create an AWS Direct Connect connection between the on-premises data center and AWS. Provision a transit VIF, and connect it to a Direct Connect gateway. Connect the Direct Connect gateway to all the other VPCs by using a transit gateway in each Region.
C. Create an AWS Site-to-Site VPN connection between the on-premises data center and a new central VPUse a transit gateway with dynamic routing. Connect the transit gateway to all other VPCs.
D. Create an AWS Direct Connect connection between the on-premises data center and AWS. Establish an AWS Site-to-Site VPN connection between all VPCs in each Region. Create VPC peering connections that initiate from the central VPC to all other VPCs.
Show Answer
Correct Answer: B
Explanation: AWS Direct Connect provides higher bandwidth, lower and more consistent latency, and reduced outbound data transfer costs compared with VPN. To provide transitive routing across multiple VPCs in different Regions, use AWS Transit Gateway in each Region with inter-Region connectivity, and attach them through a Direct Connect gateway using a transit virtual interface (transit VIF). VPC peering is not transitive, so options A and D do not meet the routing requirement, and VPN-based options do not satisfy the bandwidth and consistent network experience requirements.
Question 264
A company has an on-premises Microsoft SQL Server database that writes a nightly 200 GB export to a local drive. The company wants to move the backups to more robust cloud storage on Amazon S3. The company has set up a 10 Gbps AWS Direct Connect connection between the on-premises data center and AWS.
Which solution meets these requirements MOST cost-effectively?
A. Create a new S3 bucket. Deploy an AWS Storage Gateway file gateway within the VPC that is connected to the Direct Connect connection. Create a new SMB file share. Write nightly database exports to the new SMB file share.
B. Create an Amazon FSx for Windows File Server Single-AZ file system within the VPC that is connected to the Direct Connect connection. Create a new SMB file share. Write nightly database exports to an SMB file share on the Amazon FSx file system. Enable nightly backups.
C. Create an Amazon FSx for Windows File Server Multi-AZ file system within the VPC that is connected to the Direct Connect connection. Create a new SMB file share. Write nightly database exports to an SMB file share on the Amazon FSx file system. Enable nightly backups.
D. Create a new S3 bucket. Deploy an AWS Storage Gateway volume gateway within the VPC that is connected to the Direct Connect connection. Create a new SMB file share. Write nightly database exports to the new SMB file share on the volume gateway, and automate copies of this data to an S3 bucket.
Show Answer
Correct Answer: A
Explanation: AWS Storage Gateway File Gateway presents SMB/NFS file shares backed directly by Amazon S3, making it the appropriate and most cost-effective choice for writing nightly database export files to S3. FSx for Windows File Server stores data on managed Windows file systems rather than directly in S3 and incurs higher ongoing costs. Volume Gateway exposes iSCSI block storage, not SMB file shares, so it does not fit the stated access method.
Question 265
A company has Linux-based Amazon EC2 instances. Users must access the instances by using SSH with EC2 SSH key pairs. Each machine requires a unique EC2 key pair.
The company wants to implement a key rotation policy that will, upon request, automatically rotate all the EC2 key pairs and keep the keys in a securely encrypted place. The company will accept less than 1 minute of downtime during key rotation.
Which solution will meet these requirements?
A. Store all the keys in AWS Secrets Manager. Define a Secrets Manager rotation schedule to invoke an AWS Lambda function to generate new key pairs. Replace public keys on EC2 instances. Update the private keys in Secrets Manager.
B. Store all the keys in Parameter Store, a capability of AWS Systems Manager, as a string. Define a Systems Manager maintenance window to invoke an AWS Lambda function to generate new key pairs. Replace public keys on EC2 instances. Update the private keys in Parameter Store.
C. Import the EC2 key pairs into AWS Key Management Service (AWS KMS). Configure automatic key rotation for these key pairs. Create an Amazon EventBridge scheduled rule to invoke an AWS Lambda function to initiate the key rotation in AWS KMS.
D. Add all the EC2 instances to Fleet Manager, a capability of AWS Systems Manager. Define a Systems Manager maintenance window to issue a Systems Manager Run Command document to generate new key pairs and to rotate public keys to all the instances in Fleet Manager.
Show Answer
Correct Answer: A
Explanation: AWS Secrets Manager is the appropriate secure store for sensitive SSH private keys and supports rotation workflows via AWS Lambda. A Lambda function can generate new SSH key pairs, update the instance's authorized_keys (directly or by invoking Systems Manager), and then store the new private key securely in Secrets Manager. AWS KMS does not manage or rotate EC2 SSH key pairs, Parameter Store is not the best fit for secret storage and lacks native secret rotation workflows, and Fleet Manager alone does not provide secure key storage or end-to-end SSH key rotation.
Question 266
A company wants to containerize a multi-tier web application and move the application from an on-premises data center to AWS. The application includes web. application, and database tiers. The company needs to make the application fault tolerant and scalable. Some frequently accessed data must always be available across application servers. Frontend web servers need session persistence and must scale to meet increases in traffic.
Which solution will meet these requirements with the LEAST ongoing operational overhead?
A. Run the application on Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. Use Amazon Elastic File System (Amazon EFS) for data that is frequently accessed between the web and application tiers. Store the frontend web server session data in Amazon Simple Queue Service (Amazon SQS).
B. Run the application on Amazon Elastic Container Service (Amazon ECS) on Amazon EC2. Use Amazon ElastiCache for Redis to cache frontend web server session data. Use Amazon Elastic Block Store (Amazon EBS) with Multi-Attach on EC2 instances that are distributed across multiple Availability Zones.
C. Run the application on Amazon Elastic Kubernetes Service (Amazon EKS). Configure Amazon EKS to use managed node groups. Use ReplicaSets to run the web servers and applications. Create an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system across all EKS pods to store frontend web server session data.
D. Deploy the application on Amazon Elastic Kubernetes Service (Amazon EKS). Configure Amazon EKS to use managed node groups. Run the web servers and application as Kubernetes deployments in the EKS cluster. Store the frontend web server session data in an Amazon DynamoDB table. Create an Amazon Elastic File System (Amazon EFS) volume that all applications will mount at the time of deployment.
Show Answer
Correct Answer: D
Explanation: Option D is the best fit by elimination. Shared frequently accessed data across application servers is appropriately handled with Amazon EFS, which supports multi-AZ access. Frontend session persistence is better implemented with DynamoDB than with SQS or EFS. Option A is invalid because SQS is not a session store. Option B is invalid because EBS Multi-Attach does not provide the required cross-Availability Zone shared storage. Option C stores session data on EFS, which is not the appropriate managed session store compared with DynamoDB or Redis. Although ECS on Fargate would normally have lower operational overhead than EKS, the flaws in the other options make D the only one that reasonably satisfies the stated requirements.
Question 267
A company provides auction services for artwork and has users across North America and Europe. The company hosts its application in Amazon EC2 instances in the us-east-1 Region. Artists upload photos of their work as large-size. high-resolution image files from their mobile phones to a centralized Amazon S3 bucket created in the us-east-1 Region. The users in Europe are reporting slow performance for their image uploads.
How can a solutions architect improve the performance of the image upload process?
A. Redeploy the application to use S3 multipart uploads.
B. Create an Amazon CloudFront distribution and point to the application as a custom origin.
C. Configure the buckets to use S3 Transfer Acceleration.
D. Create an Auto Scaling group for the EC2 instances and create a scaling policy.
Show Answer
Correct Answer: C
Explanation: The performance issue is specific to users in Europe uploading to an S3 bucket in us-east-1. Amazon S3 Transfer Acceleration speeds uploads over long geographic distances by routing traffic through the nearest AWS edge location and the AWS backbone. Multipart upload (A) helps with large files in general but does not specifically address cross-continent network latency. CloudFront (B) is for content delivery, not accelerating uploads to S3 in this scenario. Auto Scaling EC2 instances (D) does not improve S3 upload latency.
Question 268
A company has hundreds of AWS accounts. The company uses an organization in AWS Organizations to manage all the accounts. The company has turned on all features.
A finance team has allocated a daily budget for AWS costs. The finance team must receive an email notification if the organization's AWS costs exceed 80% of the allocated budget. A solutions architect needs to implement a solution to track the costs and deliver the notifications.
Which solution will meet these requirements?
A. In the organization's management account, use AWS Budgets to create a budget that has a daily period. Add an alert threshold and set the value to 80%. Use Amazon Simple Notification Service (Amazon SNS) to notify the finance team.
B. In the organization’s management account, set up the organizational view feature for AWS Trusted Advisor. Create an organizational view report for cost optimization. Set an alert threshold of 80%. Configure notification preferences. Add the email addresses of the finance team.
C. Register the organization with AWS Control Tower. Activate the optional cost control (guardrail). Set a control (guardrail) parameter of 80%. Configure control (guardrail) notification preferences. Use Amazon Simple Notification Service (Amazon SNS) to notify the finance team.
D. Configure the member accounts to save a daily AWS Cost and Usage Report to an Amazon S3 bucket in the organization's management account. Use Amazon EventBridge to schedule a daily Amazon Athena query to calculate the organization’s costs. Configure Athena to send an Amazon CloudWatch alert if the total costs are more than 80% of the allocated budget. Use Amazon Simple Notification Service (Amazon SNS) to notify the finance team.
Show Answer
Correct Answer: A
Explanation: AWS Budgets supports creating cost budgets in the AWS Organizations management account that can track consolidated organizational spend. Budgets can be configured with a daily budget period and alert thresholds (such as 80%) and can send notifications through Amazon SNS (or email). Trusted Advisor does not provide budget threshold alerts, Control Tower guardrails do not implement cost budget notifications, and building a custom CUR/Athena solution is unnecessary when AWS Budgets provides the required functionality.
Question 269
A company runs many workloads on AWS and uses AWS Organizations to manage its accounts. The workloads are hosted on Amazon EC2. AWS Fargate. and AWS Lambda. Some of the workloads have unpredictable demand. Accounts record high usage in some months and low usage in other months.
The company wants to optimize its compute costs over the next 3 years. A solutions architect obtains a 6-month average for each of the accounts across the organization to calculate usage.
Which solution will provide the MOST cost savings for all the organization's compute usage?
A. Purchase Reserved Instances for the organization to match the size and number of the most common EC2 instances from the member accounts.
B. Purchase a Compute Savings Plan for the organization from the management account by using the recommendation at the management account level.
C. Purchase Reserved Instances for each member account that had high EC2 usage according to the data from the last 6 months.
D. Purchase an EC2 Instance Savings Plan for each member account from the management account based on EC2 usage data from the last 6 months.
Show Answer
Correct Answer: B
Explanation: A Compute Savings Plan purchased in the AWS Organizations management account provides the broadest coverage and greatest flexibility across the organization's compute usage. It applies to Amazon EC2, AWS Fargate, and AWS Lambda, allowing savings to automatically apply across member accounts. Because demand varies between accounts and over time, an organization-level Compute Savings Plan maximizes utilization of the commitment and typically delivers greater overall savings than EC2-only Reserved Instances or EC2 Instance Savings Plans.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.