A company is migrating its blog platform to AWS. The company's on-premises servers connect to AWS through an AWS Site-to-Site VPN connection. The blog content is updated several times a day by multiple authors and is served from a file share on a network-attached storage (NAS) server.
The company needs to migrate the blog platform without delaying the content updates. The company has deployed Amazon EC2 instances across multiple Availability Zones to run the blog platform behind an Application Load Balancer. The company also needs to move 200 TB of archival data from its on-premises servers to Amazon S3 as soon as possible.
Which combination of stops will meet these requirements? (Choose two.)
A. Create a weekly cron job in Amazon EventBridge. Use the cron job to invoke an AWS Lambda function to update the EC2 instances from the NAS server.
B. Configure an Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume for the EC2 instances to share for content access. Write code to synchronize the EBS volume with the NAS server weekly.
C. Mount an Amazon Elastic File System (Amazon EFS) file system to the on-premises servers to act as the NAS server. Copy the blog data to the EFS file system. Mount the EFS file system to the C2 instances to serve the content.
D. Order an AWS Snowball Edge Storage Optimized device. Copy the static data artifacts to the device. Ship the device to AWS.
E. Order an AWS Snowcons SSD device. Copy the static data artifacts to the device. Ship the device to AWS.
Show Answer
Correct Answer: C, D
Explanation: The blog content is updated frequently by multiple authors and must be shared concurrently by EC2 instances across Availability Zones without synchronization delays. Amazon EFS provides a managed, shared file system that can be mounted both on-premises (over the VPN) and on EC2, enabling continuous updates with no disruption. For migrating 200 TB of archival data to Amazon S3 as quickly as possible, an AWS Snowball Edge Storage Optimized device is the appropriate choice because it supports very large data transfers efficiently. Other options either do not support multi-AZ shared access, require complex synchronization, or lack sufficient capacity.
Question 31
A company needs to migrate its on-premises database fleet to Amazon RDS. The company is currently using a mixture of Microsoft SQL Server, MySQL, and Oracle databases. Some of the databases have custom schemas and stored procedures.
Which combination of steps should the company take for the migration? (Choose two.)
A. Use Migration Evaluator Quick Insights to analyze the source databases and to identify the stored procedures that need to be migrated.
B. Use AWS Application Migration Service to analyze the source databases and to identify the stored procedures that need to be migrated.
C. Use the AWS Schema Conversion Tool (AWS SCT) to analyze the source databases for changes that are required
D. Use AWS Database Migration Service (AWS DMS) to migrate the source databases to Amazon RDS.
E. Use AWS DataSync to migrate the data from the source databases to Amazon RDS.
Show Answer
Correct Answer: C, D
Explanation: AWS Schema Conversion Tool (AWS SCT) is used first to analyze heterogeneous source databases, assess compatibility, and identify required changes for schemas and stored procedures when moving to Amazon RDS. AWS Database Migration Service (AWS DMS) is then used to migrate the actual data from the on‑premises databases to Amazon RDS with minimal downtime. Other options focus on VM migration or file transfer and are not suitable for database schema analysis and migration.
Question 32
A company requires that all internal application connectivity use private IP addresses. To facilitate this policy, a solutions architect has created interface endpoints to connect to AWS Public services. Upon testing, the solutions architect notices that the service names are resolving to public IP addresses, and that internal services cannot connect to the interface endpoints.
Which step should the solutions architect take to resolve this issue?
A. Update the subnet route table with a route to the interface endpoint.
B. Enable the private DNS option on the VPC attributes.
C. Configure the security group on the interface endpoint to allow connectivity to the AWS services.
D. Configure an Amazon Route 53 private hosted zone with a conditional forwarder for the internal application.
Show Answer
Correct Answer: B
Explanation: Interface endpoints rely on AWS PrivateLink private DNS to override the public service DNS names and resolve them to the private IP addresses of the endpoint ENIs. Because the service names are still resolving to public IPs, private DNS is not enabled. Enabling the private DNS option on the VPC (and for the endpoint) ensures standard AWS service names resolve to the endpoint’s private IPs, allowing internal services to connect using private addresses.
Question 33
A company runs an ecommerce web application on AWS. The web application is hosted as a static website on Amazon S3 with Amazon CloudFront for content delivery. An Amazon API
Gateway API invokes AWS Lambda functions to handle user requests and order processing for the web application The Lambda functions store data in an Amazon ROS for MySQL DB cluster that uses On-Demand instances. The DB cluster usage has been consistent in the past 12 months.
Recently, the website has experienced SQL injection and web exploit attempts. Customers also report that order processing time has increased during periods of peak usage. During these periods, the Lambda functions often have cold starts. As the company grows, the company needs to ensure scalability and low-latency access during traffic peaks. The company also must optimize the database costs and add protection against the SQL injection and web exploit attempts.
Which solution will meet these requirements?
A. Configure the Lambda functions to have an increased timeout value during peak periods. Use RDS Reserved Instances for the database. Use CloudFront and subscribe to AWS Shield Advanced to protect against the SQL injection and web exploit attempts.
B. Increase the memory of the Lambda functions, Transition to Amazon Redshift for the database. Integrate Amazon Inspector with CloudFront to protect against the SQL injection and web exploit attempts.
C. Use Lambda functions with provisioned concurrency for compute during peak periods, Transition to Amazon Aurora Serverless for the database. Use CloudFront and subscribe to AWS Shield Advanced to protect against the SQL injection and web exploit attempts.
D. Use Lambda functions with provisioned concurrency for compute during peak periods. Use RDS Reserved Instances for the database. Integrate AWS WAF with CloudFront to protect against the SQL injection and web exploit attempts.
Show Answer
Correct Answer: D
Explanation: The requirements are to reduce Lambda cold starts and latency during peaks, optimize database costs given historically consistent usage, and protect against SQL injection and web exploits.
Provisioned concurrency directly addresses Lambda cold starts and improves peak-time latency. Because the database workload has been consistent for 12 months, RDS Reserved Instances are the most cost‑effective optimization versus continuing On‑Demand pricing. For security, AWS WAF integrated with CloudFront is the correct service to mitigate SQL injection and common web exploits; AWS Shield Advanced focuses primarily on DDoS protection, not application‑layer attacks.
Option D is the only choice that correctly satisfies all performance, cost, scalability, and security requirements.
Question 34
A company has an application that stores user-uploaded videos in an Amazon S3 bucket that uses S3 Standard storage. Users access the videos frequently in the first 180 days after the videos are uploaded. Access after 180 days is rare. Named users and anonymous users access the videos.
Most of the videos are more than 100 MB in size. Users often have poor internet connectivity when they upload videos, resulting in failed uploads. The company uses multipart uploads for the videos.
A solutions architect needs to optimize the S3 costs of the application.
Which combination of actions will meet these requirements? (Choose two.)
A. Configure the S3 bucket to be a Requester Pays bucket.
B. Use S3 Transfer Acceleration to upload the videos to the S3 bucket.
C. Create an S3 Lifecycle configuration o expire incomplete multipart uploads 7 days after initiation.
D. Create an S3 Lifecycle configuration to transition objects to S3 Glacier Instant Retrieval after 1 day.
E. Create an S3 Lifecycle configuration to transition objects to S3 Standard-infrequent Access (S3 Standard- IA) after 180 days.
Show Answer
Correct Answer: C, E
Explanation: The goal is to optimize S3 storage costs. Incomplete multipart uploads consume storage and are common with large files and unreliable connectivity, so expiring them after 7 days reduces unnecessary costs (C). Videos are frequently accessed for the first 180 days and rarely afterward, making a lifecycle transition from S3 Standard to S3 Standard-IA after 180 days the most cost-effective choice while retaining immediate access (E). Other options either add cost or do not primarily address storage cost optimization.
Question 35
A company hosts an application that uses several Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). During the initial startup of the EC2 instances, the EC2 instances run user data scripts to download critical content for the application from an Amazon S3 bucket.
The EC2 instances are launching correctly. However, after a period of time, the EC2 instances are terminated with the following error message: “An instance was taken out of service in response to an ELB system health check failure.” EC2 instances continue to launch and be terminated because of Auto Scaling events in an endless loop.
The only recent change to the deployment is that the company added a large amount of critical content to the S3 bucket. The company does not want to alter the user data scripts in production.
What should a solutions architect do so that the production environment can deploy successfully?
A. Increase the size of the EC2 instances.
B. Increase the health check timeout for the AL
C. Change the health check path for the ALB.
D. Increase the health check grace period for the Auto Scaling group.
Show Answer
Correct Answer: D
Explanation: The instances are failing ALB health checks while still running lengthy user data scripts to download newly added S3 content. Auto Scaling terminates them because ELB health checks fail too early. Increasing the Auto Scaling group health check grace period allows instances sufficient time to complete initialization before health checks are evaluated, without changing user data scripts.
Question 36
A company has an application that uses AWS Key Management Service (AWS KMS) to encrypt and decrypt data. The application stores data in an Amazon S3 bucket in an AWS Region. Company security policies require the data to be encrypted before the data is placed into the S3 bucket. The application must decrypt the data when the application reads files from the S3 bucket.
The company replicates the S3 bucket to other Regions. A solutions architect must design a solution so that the application can encrypt and decrypt data across Regions. The application must use the same key to decrypt the data in each Region.
Which solution will meet these requirements?
A. Create a KMS multi-Region primary key. Use the KMS multi-Region primary key to create a KMS multi-Region replica key in each additional Region where the application is running. Update the application code to use the specific replica key in each Region.
B. Create a new customer managed KMS key in each additional Region where the application is running. Update the application code to use the specific KMS key in each Region.
C. Use AWS Private Certificate Authority to create a new certificate authority (CA) in the primary Region. Issue a new private certificate from the CA for the application’s website URL. Share the CA with the additional Regions by using AWS Resource Access Manager (AWS RAM). Update the application code to use the shared CA certificates in each Region.
D. Use AWS Systems Manager Parameter Store to create a parameter in each additional Region where the application is running. Export the key material from the KMS key in the primary Region. Store the key material in the parameter in each Region. Update the application code to use the key data from the parameter in each Region.
Show Answer
Correct Answer: A
Explanation: AWS KMS multi-Region keys are designed for exactly this use case. A multi-Region primary key can be replicated to other Regions as multi-Region replica keys that share the same key material. This allows data encrypted in one Region to be decrypted in another Region using the corresponding replica key. Updating the application to use the local replica key in each Region meets the requirement to encrypt before storing in S3 and to decrypt across Regions with the same key. The other options either use different keys per Region, do not use KMS for data encryption, or require exporting key material, which is not allowed by KMS.
Question 37
A global ecommerce company has many data centers around the world. With the growth of its stored data, the company needs to set up a solution to provide scalable storage for legacy on-premises file applications. The company must be able to take point-in-time copies of volumes by using AWS Backup and must retain low-latency access to frequently accessed data. The company also needs to have storage volumes that can be mounted as Internet Small Computer System Interface (iSCSI) devices from the company’s on-premises application servers.
Which solution will meet these requirements?
A. Provision an AWS Storage Gateway tape gateway. Configure the tape gateway to store data in an Amazon S3 bucket. Deploy AWS Backup to take point-in-time copies of the volumes.
B. Provision an Amazon FSx File Gateway and an Amazon S3 File Gateway. Deploy AWS Backup to take point-in-time copies of the data.
C. Provision an AWS Storage Gateway volume gateway in cache mode. Back up the on-premises Storage Gateway volumes with AWS Backup.
D. Provision an AWS Storage Gateway file gateway in cache mode. Deploy AWS Backup to take point-in-time copies of the volumes.
Show Answer
Correct Answer: C
Explanation: The requirements include iSCSI-mounted volumes for on-premises servers, low-latency access to frequently accessed data, scalable cloud-backed storage, and point-in-time backups using AWS Backup. AWS Storage Gateway **volume gateway in cache mode** provides iSCSI block storage to on-premises applications, keeps frequently accessed data cached locally for low latency, stores the full dataset durably in AWS, and integrates directly with AWS Backup for point-in-time volume backups. Other options either do not support iSCSI volumes (file or tape gateways) or do not fit the legacy block-storage use case.
Question 38
A company is using AWS CloudFormation as its deployment tool for all applications. It stages all application binaries and templates within Amazon S3 buckets with versioning enabled. Developers have access to an Amazon EC2 instance that hosts the integrated development environment (IDE). The developers download the application binaries from Amazon S3 to the EC2 instance, make changes, and upload the binaries to an S3 bucket after running the unit tests locally. The developers want to improve the existing deployment mechanism and implement CI/CD using AWS CodePipeline.
The developers have the following requirements:
• Use AWS CodeCommit for source control.
• Automate unit testing and security scanning.
• Alert the developers when unit tests fail.
• Turn application features on and off, and customize deployment dynamically as part of CI/CD.
• Have the lead developer provide approval before deploying an application.
Which solution will meet these requirements?
A. Use AWS CodeBuild to run unit tests and security scans. Use an Amazon EventBridge rule to send Amazon SNS alerts to the developers when unit tests fail. Write AWS Cloud Development Kit (AWS CDK) constructs for different solution features, and use a manifest file to tum features on and off in the AWS CDK application. Use a manual approval stage in the pipeline to allow the lead developer to approve applications.
B. Use AWS Lambda to run unit tests and security scans. Use Lambda in a subsequent stage in the pipeline to send Amazon SNS alerts to the developers when unit tests fail. Write AWS Amplify plugins for different solution features and utilize user prompts to tum features on and off. Use Amazon SES in the pipeline to allow the lead developer to approve applications.
C. Use Jenkins to run unit tests and security scans. Use an Amazon EventBridge rule in the pipeline to send Amazon SES alerts to the developers when unit tests fail Use AWS CloudFormation nested stacks for different solution features and parameters to turn features on and off. Use AWS Lambda in the pipeline to allow the lead developer to approve applications.
D. Use AWS CodeDeploy to run unit tests and security scans. Use an Amazon CloudWatch alarm in the pipeline to send Amazon SNS alerts to the developers when unit tests fail. Use Docker images for different solution features and the AWS CLI to turn features on and off. Use a manual approval stage in the pipeline to allow the lead developer to approve applications.
Show Answer
Correct Answer: A
Explanation: Option A uses AWS-native CI/CD services that align exactly with the requirements. AWS CodeCommit provides source control, and AWS CodeBuild is designed to run automated unit tests and security scans. Amazon EventBridge with SNS can notify developers when tests fail. AWS CDK supports dynamic, code-driven infrastructure and feature toggling (for example, via context or manifest files). AWS CodePipeline supports a manual approval stage, allowing the lead developer to approve deployments. The other options rely on non-native tools, misuse services (such as Lambda or CodeDeploy for testing), or provide less appropriate mechanisms for approvals and feature management.
Question 39
A solutions architect is importing a VM from an on-premises environment by using the Amazon EC2 VM Import feature of AWS Import/Export. The solutions architect has created an AMI and has provisioned an Amazon EC2 instance that is based on that AMI. The EC2 instance runs inside a public subnet in a VPC and has a public IP address assigned.
The EC2 instance does not appear as a managed instance in the AWS Systems Manager console.
Which combination of steps should the solutions architect take to troubleshoot this issue? (Choose two.)
A. Verify that Systems Manager Agent is installed on the instance and is running.
B. Verify that the instance is assigned an appropriate IAM role for Systems Manager.
C. Verify the existence of a VPC endpoint on the VP
D. Verity that the AWS Application Discovery Agent is configured.
E. Verify the correct configuration of service-linked roles for Systems Manager.
Show Answer
Correct Answer: A, B
Explanation: For an EC2 instance to appear as a managed instance in AWS Systems Manager, two prerequisites must be met. First, the Systems Manager (SSM) Agent must be installed and running on the instance so it can communicate with the Systems Manager service. Imported VMs do not always have the agent installed by default. Second, the instance must be associated with an IAM role that grants the required Systems Manager permissions (such as AmazonSSMManagedInstanceCore). Without this role, the agent cannot register the instance with Systems Manager. Other options, such as VPC endpoints, discovery agents, or service-linked roles, are not required in this scenario because the instance has a public IP and basic SSM setup depends primarily on the agent and IAM role.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.