A company has an application that uses Amazon EC2 instances in an Auto Scaling group. The quality assurance (QA) department needs to launch a large number of short-lived environments to test the application. The application environments are currently launched by the manager of the department using an AWS CloudFormation template. To launch the stack, the manager uses a role with permission to use CloudFormation, EC2, and Auto Scaling APIs. The manager wants to allow testers to launch their own environments, but does not want to grant broad permissions to each user.
Which set up would achieve these goals?
A. Upload the AWS CloudFormation template to Amazon S3. Give users in the QA department permission to assume the manager’s role and add a policy that restricts the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console.
B. Create an AWS Service Catalog product from the environment template. Add a launch constraint to the product with the existing role. Give users in the QA department permission to use AWS Service Catalog APIs only. Train users to launch the template from the AWS Service Catalog console.
C. Upload the AWS CloudFormation template to Amazon S3. Give users in the QA department permission to use CloudFormation and S3 APIs, with conditions that restrict the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console.
D. Create an AWS Elastic Beanstalk application from the environment template. Give users in the QA department permission to use Elastic Beanstalk permissions only. Train users to launch Elastic Beanstalk environments with the Elastic Beanstalk CLI, passing the existing role to the environment as a service role.
Show Answer
Correct Answer: B
Explanation: AWS Service Catalog is designed for self-service provisioning of approved CloudFormation-based products. A launch constraint allows end users to provision resources using a designated IAM role without granting them broad EC2, Auto Scaling, or CloudFormation permissions directly. This satisfies the requirement to let QA testers launch environments while keeping permissions tightly scoped.
Question 23
An entertainment company hosts a ticketing service on a fleet of Linux Amazon EC2 instances that are in an Auto Scaling group. The ticketing service uses a pricing file. The pricing file is stored in an Amazon S3 bucket that has S3 Standard storage. A central pricing solution that is hosted by a third party updates the pricing file.
The pricing file is updated every 1-15 minutes and has several thousand line items. The pricing file is downloaded to each EC2 instance when the instance launches.
The EC2 instances occasionally use outdated pricing information that can result in incorrect charges for customers.
Which solution will resolve this problem MOST cost-effectively?
A. Create an AWS Lambda function to update an Amazon DynamoDB table with new prices each time the pricing file is updated. Update the ticketing service to use DynramoDB to look up pricing
B. Create an AWS Lambda function to update an Amazon Elastic File System (Amazon EFS) file share with the pricing file each time the file is updated. Update the ticketing service to use Amazon EFS to access the pricing file.
C. Load Mountpoint for Amazon S3 onto the AMI of the EC2 instances. Configure Mountpoint for Amazon S3 to mount the S3 bucket that contains the pricing file. Update the ticketing service to point to the mount point and path to access the $3 object,
D. Create an Amazon Elastic Block Store (Amazon EBS) volume. Use EBS Multi-Attach to attach the volume to every EC2 instance. When a new EC2 instance launches, configure the new instance to update the pricing file on the EBS volume. Update the ticketing service to point to the new local source.
Show Answer
Correct Answer: C
Explanation: The issue is that instances download the pricing file only at launch and then use a stale local copy. Mountpoint for Amazon S3 allows the application to access the object directly from S3 as a mounted filesystem, so all instances read the latest version of the pricing file without introducing additional storage services or data synchronization. This is the simplest and most cost-effective option. DynamoDB and EFS add extra infrastructure and application changes, while EBS Multi-Attach is not an appropriate shared file distribution mechanism for this use case.
Question 24
A company creates an Amazon API Gateway API and shares the API with an external development team. The API uses AWS Lambda functions and is deployed to a stage that is named Production.
The external development team is the sole consumer of the API. The API experiences sudden increases of usage at specific times, leading to concerns about increased costs. The company needs to limit cost and usage without reworking the Lambda functions.
Which solution will meet these requirements MOST cost-effectively?
A. Configure the API to send requests to Amazon Simple Queue Service (Amazon SQS) queues instead of directly to the Lambda functions. Update the Lambda functions to consume messages from the queues and to process the requests. Set up the queues to invoke the Lambda functions when new messages arrive.
B. Configure provisioned concurrency for each Lambda function. Use AWS Application Auto Scaling to register the Lambda functions as targets. Set up scaling schedules to increase and decrease capacity to match changes in API usage.
C. Create an API Gateway API key and an AWS WAF Regional web ACL. Associate the web ACL with the Production stage. Add a rate-based rule to the web ACL. In the rule, specify the rate limit and a custom request aggregation that uses the X-API-Key header. Share the API key with the external development team.
D. Create an API Gateway API Key and usage plan. Define throttling limits and quotas in the usage plan. Associate the usage plan with the Production stage and the API key. Share the API key with the external development team.
Show Answer
Correct Answer: D
Explanation: API Gateway usage plans with API keys are the native mechanism to enforce per-consumer throttling and request quotas. Because the external development team is the only consumer, assigning them an API key and associating it with a usage plan on the Production stage limits request rate and total usage, directly controlling Lambda invocations and costs without modifying the Lambda functions. Option A requires architectural and code changes. Option B increases cost by using provisioned concurrency and does not limit usage. Option C uses AWS WAF rate limiting, which is intended for web protection rather than consumer-specific API quotas and adds unnecessary cost and complexity compared to API Gateway usage plans.
Question 25
A company is migrating its on-premises IoT platform to AWS. The platform consists of the following components:
• A MongoDB cluster as a data store for all collected and processed IoT data.
• An application that uses Message Queuing Telemetry Transport (MQTT) to connect to IoT devices every 5 minutes to collect data.
• An application that runs jobs periodically to generate reports from the IoT data. The jobs take 120-600 seconds to finish running.
• A web application that runs on a web server. End users use the web application to generate reports that are accessible to the general public.
The company needs to migrate the platform to AWS to reduce operational overhead while maintaining performance.
Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)
A. Create AWS Step Functions state machines with AUS Lambda tasks to prepare the reports and to write the reports to Amazon S3. Configure an Amazon CloudFront distribution that has an S3 origin to serve the reports
B. Create an AWS Lambda function. Program the Lambda function to connect to the IoT devices. process the data, and write the data to the data store. Configure a Lambda layer to temporarily store messages for processing.
C. Configure an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with Amazon EC2 instances to prepare the reports. Create an ingress controller on the EKS cluster to serve the reports.
D. Connect the IoT devices to AWS IoT Core to publish messages. Create an AWS IoT rule that runs when a message is received. Configure the rule to call an AWS Lambda function. Program the Lambda function to parse, transform, and store device message data to the data store.
E. Migrate the MongoDB cluster to Amazon DocumentDB (with MongoDB compatibility).
F. Migrate the MongoDB cluster to Amazon EC2 instances.
Show Answer
Correct Answer: A, D, E
Explanation: Use managed AWS services to minimize operational overhead. AWS IoT Core natively supports MQTT device connectivity and can invoke Lambda through IoT rules to process and store incoming data. Amazon DocumentDB provides a managed MongoDB-compatible database, reducing database administration compared with self-managed MongoDB on EC2. For report generation and public access, Step Functions can orchestrate long-running workflows with Lambda tasks, storing generated reports in Amazon S3 and serving them efficiently through CloudFront. The alternatives either misuse Lambda for MQTT polling, require unnecessary Kubernetes management, or increase operational overhead with EC2-managed databases.
Question 26
A company plans to migrate a legacy on-premises application to AWS. The application is a Java web application that runs on Apache Tomcat with a PostgreSQL database.
The company does not have access to the source code but can deploy the application Java Archive (JAR) files. The application has increased traffic at the end of each month.
Which solution will meet these requirements with the LEAST operational overhead?
A. Launch Amazon EC2 instances in multiple Availability Zones. Deploy Tomcat and PostgreSQL to all the instances by using Amazon Elastic File System (Amazon EFS) mount points. Use AWS Step Functions to deploy additional EC2 instances to scale for increased traffic.
B. Provision Amazon Elastic Kubernetes Service (Amazon EKS) in an Auto Scaling group across multiple AWS Regions. Deploy Tomcat and PostgreSQL in the container images. Use a Network Load Balancer to scale for increased traffic.
C. Refactor the Java application into Python-based containers. Use AWS Lambda functions for the application logic. Store application data in Amazon DynamoDB global tables. Use AWS Storage Gateway and Lambda concurrency to scale for increased traffic.
D. Use AWS Elastic Beanstalk to deploy the Tomcat servers with auto scaling in multiple Availability Zones. Store application data in an Amazon RDS for PostgreSQL database. Deploy Amazon CloudFront and an Application Load Balancer to scale for increased traffic.
Show Answer
Correct Answer: D
Explanation: AWS Elastic Beanstalk supports Java applications running on Apache Tomcat and can deploy packaged application artifacts without requiring source code. It manages provisioning, load balancing, Auto Scaling, and deployments, minimizing operational overhead. Using Amazon RDS for PostgreSQL offloads database management. An Application Load Balancer distributes traffic across multiple Availability Zones, and CloudFront can help absorb traffic spikes and cache static content. The other options introduce significantly more operational complexity or require application refactoring that is not possible without source code.
Question 28
Accompany runs an application on Amazon EC2 and AWS Lambda. The application stores temporary data in Amazon S3. The S3 objects are deleted after 24 hours.
The company deploys new versions of the application by launching AWS CloudFormation stacks. The stacks create the required resources. After validating a new version, the company deletes the old stack. The deletion of an old development stack recently failed. A solutions architect needs to resolve this issue without major architecture changes.
Which solution will meet these requirements?
A. Create a Lambda function to delete objects from an S3 bucket. Add the Lambda function as a custom resource in the CloudFormation stack with a DependsOn attribute that points to the S3 bucket resource.
B. Modify the CloudFormation stack to attach a DeletionPolicy attribute with a value of Delete to the S3 bucket.
C. Update the CloudFormation stack to add a DeletionPolicy attribute with a value of Snapshot for the S3 bucket resource
D. Update the CloudFormation template to create an Amazon Elastic File System (Amazon EFS) file system to store temporary files instead of Amazon S3. Configure the Lambda functions to run in the same VPC as the EFS file system.
Show Answer
Correct Answer: A
Explanation: CloudFormation cannot delete a non-empty Amazon S3 bucket. Although the application deletes objects after 24 hours, stack deletion can fail if objects are still present. A Lambda-backed custom resource can empty the bucket during stack deletion before CloudFormation deletes the bucket. DeletionPolicy: Delete does not empty bucket contents, Snapshot is not supported for S3 buckets, and replacing S3 with Amazon EFS is an unnecessary architectural change.
Question 29
A company needs to move some on-premises Oracle databases to AWS. The company has chosen to keep some of the databases on premises for business compliance reasons.
The on-premises databases contain spatial data and run cron jobs for maintenance. The company needs to connect to the on-premises systems directly from AWS to query data as a foreign table.
Which solution will meet these requirements?
A. Create Amazon DynamoDB global tables with auto scaling enabled. Use the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS) to move the data from on premises to DynamoDB. Create an AWS Lambda function to move the spatial data to Amazon S3. Query the data by using Amazon Athena. Use Amazon EventBridge to schedule jobs in DynamoDB for maintenance. Use Amazon API Gateway for foreign table support.
B. Create an Amazon RDS for Microsoft SQL Server DB instance. Use native replication to move the data from on premises to the DB instance. Use the AWS Schema Conversion Tool (AWS SCT) to modify the SQL Server schema as needed after replication. Move the spatial data to Amazon Redshift. Use stored procedures for system maintenance. Create AWS Glue crawlers to connect to the on-premises Oracle databases for foreign table support.
C. Launch Amazon EC2 instances to host the Oracle databases. Place the EC2 instances in an Auto Scaling group. Use AWS Application Migration Service to move the data from on premises to the EC2 instances and for real-time bidirectional change data capture (CDC) synchronization. Use Oracle native spatial data support. Create an AWS Lambda function to run maintenance jobs as part of an AWS Step Functions workflow. Create an internet gateway for foreign table support.
D. Create an Amazon RDS for PostgreSQL DB instance. Use the AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS) to move the data from on premises to the DB instance. Use PostgreSQL native spatial data support. Run cron jobs on the DB instance for maintenance. Use AWS Direct Connect to connect the DB instance to the on-premises environment for foreign table support.
Show Answer
Correct Answer: D
Explanation: Amazon RDS for PostgreSQL is a supported migration target from Oracle using AWS SCT and AWS DMS. PostgreSQL supports spatial data via the PostGIS extension, and RDS for PostgreSQL supports the pg_cron extension for scheduled maintenance jobs. PostgreSQL also supports foreign data wrappers (oracle_fdw) to query Oracle as foreign tables, and AWS Direct Connect provides the required private connectivity to the remaining on-premises Oracle databases. The other options rely on incompatible database engines, incorrect migration tools, or unsupported features.
Question 30
A company is migrating its blog platform to AWS. The company's on-premises servers connect to AWS through an AWS Site-to-Site VPN connection. The blog content is updated several times a day by multiple authors and is served from a file share on a network-attached storage (NAS) server.
The company needs to migrate the blog platform without delaying the content updates. The company has deployed Amazon EC2 instances across multiple Availability Zones to run the blog platform behind an Application Load Balancer. The company also needs to move 200 TB of archival data from its on-premises servers to Amazon S3 as soon as possible.
Which combination of stops will meet these requirements? (Choose two.)
A. Create a weekly cron job in Amazon EventBridge. Use the cron job to invoke an AWS Lambda function to update the EC2 instances from the NAS server.
B. Configure an Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume for the EC2 instances to share for content access. Write code to synchronize the EBS volume with the NAS server weekly.
C. Mount an Amazon Elastic File System (Amazon EFS) file system to the on-premises servers to act as the NAS server. Copy the blog data to the EFS file system. Mount the EFS file system to the C2 instances to serve the content.
D. Order an AWS Snowball Edge Storage Optimized device. Copy the static data artifacts to the device. Ship the device to AWS.
E. Order an AWS Snowcons SSD device. Copy the static data artifacts to the device. Ship the device to AWS.
Show Answer
Correct Answer: C, D
Explanation: Amazon EFS provides a shared, managed file system that can be mounted by EC2 instances across multiple Availability Zones and accessed from on-premises over the existing VPN, allowing continuous content updates without synchronization delays. For migrating 200 TB of archival data to Amazon S3 as quickly as possible, an AWS Snowball Edge Storage Optimized device is the appropriate offline data transfer service. EventBridge/Lambda weekly syncs and EBS Multi-Attach do not provide continuous shared content access, and Snowcone lacks the capacity for 200 TB.
Question 31
A company needs to migrate its on-premises database fleet to Amazon RDS. The company is currently using a mixture of Microsoft SQL Server, MySQL, and Oracle databases. Some of the databases have custom schemas and stored procedures.
Which combination of steps should the company take for the migration? (Choose two.)
A. Use Migration Evaluator Quick Insights to analyze the source databases and to identify the stored procedures that need to be migrated.
B. Use AWS Application Migration Service to analyze the source databases and to identify the stored procedures that need to be migrated.
C. Use the AWS Schema Conversion Tool (AWS SCT) to analyze the source databases for changes that are required
D. Use AWS Database Migration Service (AWS DMS) to migrate the source databases to Amazon RDS.
E. Use AWS DataSync to migrate the data from the source databases to Amazon RDS.
Show Answer
Correct Answer: C, D
Explanation: AWS Schema Conversion Tool (AWS SCT) assesses heterogeneous database migrations, analyzes schemas, and identifies required changes, including conversion of schema objects such as stored procedures where applicable. AWS Database Migration Service (AWS DMS) migrates the data to Amazon RDS. Migration Evaluator is for assessment/cost analysis rather than stored procedure identification, Application Migration Service is for server migrations, and DataSync is for file/object storage transfers, not database migration.
Question 32
A company requires that all internal application connectivity use private IP addresses. To facilitate this policy, a solutions architect has created interface endpoints to connect to AWS Public services. Upon testing, the solutions architect notices that the service names are resolving to public IP addresses, and that internal services cannot connect to the interface endpoints.
Which step should the solutions architect take to resolve this issue?
A. Update the subnet route table with a route to the interface endpoint.
B. Enable the private DNS option on the VPC attributes.
C. Configure the security group on the interface endpoint to allow connectivity to the AWS services.
D. Configure an Amazon Route 53 private hosted zone with a conditional forwarder for the internal application.
Show Answer
Correct Answer: B
Explanation: Interface VPC endpoints (AWS PrivateLink) require private DNS to have the standard AWS service hostname resolve to the endpoint's private IP addresses. The symptom that service names resolve to public IP addresses directly indicates private DNS/DNS settings are not enabled. Route table changes are not used for interface endpoints, and while security groups must allow traffic, they do not affect DNS resolution to public versus private IPs. A Route 53 private hosted zone is unnecessary for AWS service interface endpoint name resolution.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.