A company operates a static content distribution platform that serves customers globally. The customers consume content from their own AWS accounts.
The company serves its content from an Amazon S3 bucket. The company uploads the content from its on-premises environment to the S3 bucket by using an S3 File Gateway.
The company wants to improve the platform’s performance and reliability by serving content from the AWS Region that is geographically closest to customers. The company must route the on-premises data to Amazon S3 with minimal latency and without public internet exposure.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
A. Implement S3 Multi-Region Access Points
B. Use S3 Cross-Region Replication (CRR) to copy content to different Regions
C. Create an AWS Lambda function that tracks the routing of clients to Regions
D. Use an AWS Site-to-Site VPN connection to connect to a Multi-Region Access Point.
E. Use AWS PrivateLink and AWS Direct Connect to connect to a Multi-Region Access Point.
Show Answer
Correct Answer: A, B
Explanation: To serve content from the geographically closest AWS Region with minimal operational overhead, the platform needs both global routing and data availability in multiple Regions. Amazon S3 Multi-Region Access Points (A) automatically route customer requests to the closest healthy Region, improving performance and reliability without custom routing logic. S3 Cross-Region Replication (B) is required to replicate the static content into multiple regional buckets so that Multi-Region Access Points actually have data to serve in those Regions. Options involving Direct Connect or PrivateLink (E) add significant operational complexity and are not required, since the on-premises upload path is already handled by S3 File Gateway and replication occurs entirely within AWS without public internet exposure.
Question 20
A company wants to create a single Amazon S3 bucket for its data scientists to store work-related documents. The company uses AWS IAM Identity Center to authenticate all users. A group for the data scientists was created.
The company wants to give the data scientists access to only their own work. The company also wants to create monthly reports that show which documents each user accessed.
Which combination of steps will meet these requirements? (Choose two.)
A. Create a custom IAM Identity Center permission set to grant the data scientists access to an S3 bucket prefix that matches their username tag. Use a policy to limit access to paths with the ${aws:PrincipalTag/userName}/* condition.
B. Create an IAM Identity Center role for the data scientists group that has Amazon S3 read access and write access. Add an S3 bucket policy that allows access to the IAM Identity Center role.
C. Configure AWS CloudTrail to log S3 data events and deliver the logs to an S3 bucket. Use Amazon Athena to run queries on the CloudTrail logs in Amazon S3 and generate reports.
D. Configure AWS CloudTrail to log S3 management events to CloudWatch. Use Amazon Athena’s CloudWatch connector to query the logs and generate reports.
E. Enable S3 access logging to EMR File System (EMRFS). Use Amazon S3 Select to query logs and generate reports.
Show Answer
Correct Answer: A, C
Explanation: The requirement has two parts: per-user isolation within a single S3 bucket and detailed reporting of which documents each user accessed.
Option A is correct because IAM Identity Center permission sets can use principal tags (such as the username) and S3 prefix conditions. Using ${aws:PrincipalTag/userName}/* restricts each data scientist to only their own folder within the shared bucket.
Option C is correct because S3 object-level access (who accessed which document) is captured only by CloudTrail data events. Storing those logs in S3 and querying them with Amazon Athena is the standard and supported way to produce monthly access reports.
The other options either lack per-user isolation (B), do not log object-level access (D), or are not appropriate for this reporting use case (E).
Question 21
A company is using a single AWS Region for its ecommerce website. The website includes a web application that runs on several Amazon EC2 instances behind an Application Load Balancer (ALB). The website also includes an Amazon DynamoDB table. A custom domain name in Amazon Route 53 is linked to the ALB. The company created an SSL/TLS certificate in AWS Certificate Manager (ACM) and attached the certificate to the ALB. The company is not using a content delivery network as part of its design.
The company wants to replicate its entire application stack in a second Region to provide disaster recovery, plan for future growth, and provide improved access time to users. A solutions architect needs to implement a solution that achieves these goals and minimizes administrative overhead.
Which combination of steps should the solutions architect take to meet these requirements? (Choose three.)
A. Create an AWS CloudFormation template for the current infrastructure design. Use parameters for important system values, including Region. Use the CloudFormation template to create the new infrastructure in the second Region.
B. Use the AWS Management Console to document the existing infrastructure design in the first Region and to create the new infrastructure in the second Region.
C. Update the Route 53 hosted zone record for the application to use weighted routing. Send 50% of the traffic to the ALB in each Region.
D. Update the Route 53 hosted zone record for the application to use latency-based routing. Send traffic to the ALB in each Region.
E. Update the configuration of the existing DynamoDB table by enabling DynamoDB Streams. Add the second Region to create a global table.
F. Create a new DynamoDB table. Enable DynamoDB Streams for the new table. Add the second Region to create a global table. Copy the data from the existing DynamoDB table to the new table as a one-time operation.
Show Answer
Correct Answer: A, D, E
Explanation: To replicate the stack across Regions with minimal overhead and better user experience: Use AWS CloudFormation to templatize and deploy identical infrastructure in a second Region efficiently (A). Use Route 53 latency-based routing to direct users to the closest ALB, improving access time and supporting multi-Region DR (D). Use DynamoDB global tables by enabling replication from the existing table to the second Region to keep data synchronized automatically and support Regional failover (E).
Question 22
A company has an application that uses Amazon EC2 instances in an Auto Scaling group. The quality assurance (QA) department needs to launch a large number of short-lived environments to test the application. The application environments are currently launched by the manager of the department using an AWS CloudFormation template. To launch the stack, the manager uses a role with permission to use CloudFormation, EC2, and Auto Scaling APIs. The manager wants to allow testers to launch their own environments, but does not want to grant broad permissions to each user.
Which set up would achieve these goals?
A. Upload the AWS CloudFormation template to Amazon S3. Give users in the QA department permission to assume the manager’s role and add a policy that restricts the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console.
B. Create an AWS Service Catalog product from the environment template. Add a launch constraint to the product with the existing role. Give users in the QA department permission to use AWS Service Catalog APIs only. Train users to launch the template from the AWS Service Catalog console.
C. Upload the AWS CloudFormation template to Amazon S3. Give users in the QA department permission to use CloudFormation and S3 APIs, with conditions that restrict the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console.
D. Create an AWS Elastic Beanstalk application from the environment template. Give users in the QA department permission to use Elastic Beanstalk permissions only. Train users to launch Elastic Beanstalk environments with the Elastic Beanstalk CLI, passing the existing role to the environment as a service role.
Show Answer
Correct Answer: B
Explanation: AWS Service Catalog is designed for controlled self-service provisioning. By creating a Service Catalog product from the CloudFormation template and applying a launch constraint that uses the existing privileged role, testers can launch environments without being granted direct EC2, Auto Scaling, or CloudFormation permissions. Users only need Service Catalog access, satisfying the requirement to avoid broad permissions while enabling many short-lived, standardized environments.
Question 23
An entertainment company hosts a ticketing service on a fleet of Linux Amazon EC2 instances that are in an Auto Scaling group. The ticketing service uses a pricing file. The pricing file is stored in an Amazon S3 bucket that has S3 Standard storage. A central pricing solution that is hosted by a third party updates the pricing file.
The pricing file is updated every 1-15 minutes and has several thousand line items. The pricing file is downloaded to each EC2 instance when the instance launches.
The EC2 instances occasionally use outdated pricing information that can result in incorrect charges for customers.
Which solution will resolve this problem MOST cost-effectively?
A. Create an AWS Lambda function to update an Amazon DynamoDB table with new prices each time the pricing file is updated. Update the ticketing service to use DynramoDB to look up pricing
B. Create an AWS Lambda function to update an Amazon Elastic File System (Amazon EFS) file share with the pricing file each time the file is updated. Update the ticketing service to use Amazon EFS to access the pricing file.
C. Load Mountpoint for Amazon S3 onto the AMI of the EC2 instances. Configure Mountpoint for Amazon S3 to mount the S3 bucket that contains the pricing file. Update the ticketing service to point to the mount point and path to access the $3 object,
D. Create an Amazon Elastic Block Store (Amazon EBS) volume. Use EBS Multi-Attach to attach the volume to every EC2 instance. When a new EC2 instance launches, configure the new instance to update the pricing file on the EBS volume. Update the ticketing service to point to the new local source.
Show Answer
Correct Answer: C
Explanation: The problem occurs because each EC2 instance downloads the pricing file only at launch and then continues using a stale local copy while the file is updated frequently in Amazon S3. The most cost‑effective fix is to have instances always read the current file directly from S3. Mountpoint for Amazon S3 lets Linux EC2 instances mount the S3 bucket and access the object like a file, ensuring every read reflects the latest version (S3 provides strong read‑after‑write consistency). This avoids additional services and costs associated with DynamoDB or EFS, and is simpler and cheaper than EBS Multi‑Attach, which is not well suited for shared, frequently updated files.
Question 24
A company creates an Amazon API Gateway API and shares the API with an external development team. The API uses AWS Lambda functions and is deployed to a stage that is named Production.
The external development team is the sole consumer of the API. The API experiences sudden increases of usage at specific times, leading to concerns about increased costs. The company needs to limit cost and usage without reworking the Lambda functions.
Which solution will meet these requirements MOST cost-effectively?
A. Configure the API to send requests to Amazon Simple Queue Service (Amazon SQS) queues instead of directly to the Lambda functions. Update the Lambda functions to consume messages from the queues and to process the requests. Set up the queues to invoke the Lambda functions when new messages arrive.
B. Configure provisioned concurrency for each Lambda function. Use AWS Application Auto Scaling to register the Lambda functions as targets. Set up scaling schedules to increase and decrease capacity to match changes in API usage.
C. Create an API Gateway API key and an AWS WAF Regional web ACL. Associate the web ACL with the Production stage. Add a rate-based rule to the web ACL. In the rule, specify the rate limit and a custom request aggregation that uses the X-API-Key header. Share the API key with the external development team.
D. Create an API Gateway API Key and usage plan. Define throttling limits and quotas in the usage plan. Associate the usage plan with the Production stage and the API key. Share the API key with the external development team.
Show Answer
Correct Answer: D
Explanation: API Gateway usage plans with an API key allow the company to enforce throttling limits (requests per second/burst) and quotas (daily/monthly requests) for the sole external consumer. This directly limits usage spikes and associated Lambda invocations and costs without changing the existing Lambda functions or architecture, making it the most cost-effective solution.
Question 25
A company is migrating its on-premises IoT platform to AWS. The platform consists of the following components:
• A MongoDB cluster as a data store for all collected and processed IoT data.
• An application that uses Message Queuing Telemetry Transport (MQTT) to connect to IoT devices every 5 minutes to collect data.
• An application that runs jobs periodically to generate reports from the IoT data. The jobs take 120-600 seconds to finish running.
• A web application that runs on a web server. End users use the web application to generate reports that are accessible to the general public.
The company needs to migrate the platform to AWS to reduce operational overhead while maintaining performance.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)
A. Create AWS Step Functions state machines with AUS Lambda tasks to prepare the reports and to write the reports to Amazon S3. Configure an Amazon CloudFront distribution that has an S3 origin to serve the reports
B. Create an AWS Lambda function. Program the Lambda function to connect to the IoT devices. process the data, and write the data to the data store. Configure a Lambda layer to temporarily store messages for processing.
C. Configure an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with Amazon EC2 instances to prepare the reports. Create an ingress controller on the EKS cluster to serve the reports.
D. Connect the IoT devices to AWS IoT Core to publish messages. Create an AWS IoT rule that runs when a message is received. Configure the rule to call an AWS Lambda function. Program the Lambda function to parse, transform, and store device message data to the data store.
E. Migrate the MongoDB cluster to Amazon DocumentDB (with MongoDB compatibility).
F. Migrate the MongoDB cluster to Amazon EC2 instances.
Show Answer
Correct Answer: A, D, E
Explanation: The goal is to minimize operational overhead while maintaining performance.
D: AWS IoT Core natively supports MQTT and device connectivity. Using IoT rules to invoke Lambda offloads device management, scaling, and message ingestion to managed services with minimal ops effort.
E: Amazon DocumentDB provides a fully managed, MongoDB-compatible data store, eliminating the need to operate and maintain MongoDB clusters on EC2 while preserving application compatibility.
A: Report-generation jobs run for minutes (120–600 seconds), which fits Step Functions with Lambda orchestration. Storing reports in Amazon S3 and serving them via CloudFront provides a highly scalable, serverless, low-ops solution for public access.
Other options increase operational overhead (EKS or EC2) or misuse Lambda for persistent MQTT connections.
Question 26
A company plans to migrate a legacy on-premises application to AWS. The application is a Java web application that runs on Apache Tomcat with a PostgreSQL database.
The company does not have access to the source code but can deploy the application Java Archive (JAR) files. The application has increased traffic at the end of each month.
Which solution will meet these requirements with the LEAST operational overhead?
A. Launch Amazon EC2 instances in multiple Availability Zones. Deploy Tomcat and PostgreSQL to all the instances by using Amazon Elastic File System (Amazon EFS) mount points. Use AWS Step Functions to deploy additional EC2 instances to scale for increased traffic.
B. Provision Amazon Elastic Kubernetes Service (Amazon EKS) in an Auto Scaling group across multiple AWS Regions. Deploy Tomcat and PostgreSQL in the container images. Use a Network Load Balancer to scale for increased traffic.
C. Refactor the Java application into Python-based containers. Use AWS Lambda functions for the application logic. Store application data in Amazon DynamoDB global tables. Use AWS Storage Gateway and Lambda concurrency to scale for increased traffic.
D. Use AWS Elastic Beanstalk to deploy the Tomcat servers with auto scaling in multiple Availability Zones. Store application data in an Amazon RDS for PostgreSQL database. Deploy Amazon CloudFront and an Application Load Balancer to scale for increased traffic.
Show Answer
Correct Answer: D
Explanation: Elastic Beanstalk provides the lowest operational overhead by abstracting infrastructure management while directly supporting Java/Tomcat deployments using JAR files. It handles provisioning, load balancing, health checks, and auto scaling across multiple Availability Zones automatically. Using Amazon RDS for PostgreSQL offloads database administration tasks such as backups, patching, and high availability. This approach fits a lift-and-shift migration with no source code access and easily scales to handle predictable end-of-month traffic spikes.
Question 28
Accompany runs an application on Amazon EC2 and AWS Lambda. The application stores temporary data in Amazon S3. The S3 objects are deleted after 24 hours.
The company deploys new versions of the application by launching AWS CloudFormation stacks. The stacks create the required resources. After validating a new version, the company deletes the old stack. The deletion of an old development stack recently failed. A solutions architect needs to resolve this issue without major architecture changes.
Which solution will meet these requirements?
A. Create a Lambda function to delete objects from an S3 bucket. Add the Lambda function as a custom resource in the CloudFormation stack with a DependsOn attribute that points to the S3 bucket resource.
B. Modify the CloudFormation stack to attach a DeletionPolicy attribute with a value of Delete to the S3 bucket.
C. Update the CloudFormation stack to add a DeletionPolicy attribute with a value of Snapshot for the S3 bucket resource
D. Update the CloudFormation template to create an Amazon Elastic File System (Amazon EFS) file system to store temporary files instead of Amazon S3. Configure the Lambda functions to run in the same VPC as the EFS file system.
Show Answer
Correct Answer: A
Explanation: CloudFormation cannot delete a non-empty S3 bucket. Even with DeletionPolicy: Delete, stack deletion fails if objects remain. Adding a Lambda-backed custom resource to empty the bucket during stack deletion resolves the failure without changing the application architecture. The DependsOn ensures the cleanup runs before CloudFormation attempts to delete the bucket.
Question 29
A company needs to move some on-premises Oracle databases to AWS. The company has chosen to keep some of the databases on premises for business compliance reasons.
The on-premises databases contain spatial data and run cron jobs for maintenance. The company needs to connect to the on-premises systems directly from AWS to query data as a foreign table.
Which solution will meet these requirements?
A. Create Amazon DynamoDB global tables with auto scaling enabled. Use the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS) to move the data from on premises to DynamoDB. Create an AWS Lambda function to move the spatial data to Amazon S3. Query the data by using Amazon Athena. Use Amazon EventBridge to schedule jobs in DynamoDB for maintenance. Use Amazon API Gateway for foreign table support.
B. Create an Amazon RDS for Microsoft SQL Server DB instance. Use native replication to move the data from on premises to the DB instance. Use the AWS Schema Conversion Tool (AWS SCT) to modify the SQL Server schema as needed after replication. Move the spatial data to Amazon Redshift. Use stored procedures for system maintenance. Create AWS Glue crawlers to connect to the on-premises Oracle databases for foreign table support.
C. Launch Amazon EC2 instances to host the Oracle databases. Place the EC2 instances in an Auto Scaling group. Use AWS Application Migration Service to move the data from on premises to the EC2 instances and for real-time bidirectional change data capture (CDC) synchronization. Use Oracle native spatial data support. Create an AWS Lambda function to run maintenance jobs as part of an AWS Step Functions workflow. Create an internet gateway for foreign table support.
D. Create an Amazon RDS for PostgreSQL DB instance. Use the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS) to move the data from on premises to the DB instance. Use PostgreSQL native spatial data support. Run cron jobs on the DB instance for maintenance. Use AWS Direct Connect to connect the DB instance to the on-premises environment for foreign table support.
Show Answer
Correct Answer: D
Explanation: The solution must support Oracle migration, spatial data, cron-style maintenance jobs, and direct connectivity to on-premises databases for foreign table queries. Amazon RDS for PostgreSQL supports spatial data through PostGIS, and AWS SCT plus AWS DMS are designed for Oracle-to-PostgreSQL schema and data migration. PostgreSQL supports scheduled jobs via extensions such as pg_cron. AWS Direct Connect provides a private, low-latency connection to on-premises systems, which enables querying on-premises Oracle databases as foreign tables while meeting compliance requirements. The other options either use incompatible database engines, lack proper spatial or foreign table support, or rely on incorrect services.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.