A company runs an ecommerce web application on AWS. The web application is hosted as a static website on Amazon S3 with Amazon CloudFront for content delivery. An Amazon API
Gateway API invokes AWS Lambda functions to handle user requests and order processing for the web application The Lambda functions store data in an Amazon ROS for MySQL DB cluster that uses On-Demand instances. The DB cluster usage has been consistent in the past 12 months.
Recently, the website has experienced SQL injection and web exploit attempts. Customers also report that order processing time has increased during periods of peak usage. During these periods, the Lambda functions often have cold starts. As the company grows, the company needs to ensure scalability and low-latency access during traffic peaks. The company also must optimize the database costs and add protection against the SQL injection and web exploit attempts.
Which solution will meet these requirements?
A. Configure the Lambda functions to have an increased timeout value during peak periods. Use RDS Reserved Instances for the database. Use CloudFront and subscribe to AWS Shield Advanced to protect against the SQL injection and web exploit attempts.
B. Increase the memory of the Lambda functions, Transition to Amazon Redshift for the database. Integrate Amazon Inspector with CloudFront to protect against the SQL injection and web exploit attempts.
C. Use Lambda functions with provisioned concurrency for compute during peak periods, Transition to Amazon Aurora Serverless for the database. Use CloudFront and subscribe to AWS Shield Advanced to protect against the SQL injection and web exploit attempts.
D. Use Lambda functions with provisioned concurrency for compute during peak periods. Use RDS Reserved Instances for the database. Integrate AWS WAF with CloudFront to protect against the SQL injection and web exploit attempts.
Show Answer
Correct Answer: D
Explanation: Provisioned Concurrency addresses Lambda cold starts during peak traffic. Because the RDS workload has been consistent for the past 12 months, Reserved Instances optimize database costs compared with On-Demand. AWS WAF integrated with CloudFront is the correct service to protect against SQL injection and common web exploits; AWS Shield Advanced focuses on DDoS protection, not SQL injection. Aurora Serverless is not the best cost optimization for a consistently utilized database.
Question 34
A company has an application that stores user-uploaded videos in an Amazon S3 bucket that uses S3 Standard storage. Users access the videos frequently in the first 180 days after the videos are uploaded. Access after 180 days is rare. Named users and anonymous users access the videos.
Most of the videos are more than 100 MB in size. Users often have poor internet connectivity when they upload videos, resulting in failed uploads. The company uses multipart uploads for the videos.
A solutions architect needs to optimize the S3 costs of the application.
Which combination of actions will meet these requirements? (Choose two.)
A. Configure the S3 bucket to be a Requester Pays bucket.
B. Use S3 Transfer Acceleration to upload the videos to the S3 bucket.
C. Create an S3 Lifecycle configuration o expire incomplete multipart uploads 7 days after initiation.
D. Create an S3 Lifecycle configuration to transition objects to S3 Glacier Instant Retrieval after 1 day.
E. Create an S3 Lifecycle configuration to transition objects to S3 Standard-infrequent Access (S3 Standard- IA) after 180 days.
Show Answer
Correct Answer: C, E
Explanation: Expire incomplete multipart uploads to eliminate charges for abandoned upload parts, which is a direct S3 cost optimization. Transition objects to S3 Standard-IA after 180 days because objects are frequently accessed for the first 180 days and only rarely afterward, reducing storage costs while maintaining rapid retrieval. Requester Pays shifts request costs to requesters but is unsuitable with anonymous users. S3 Transfer Acceleration adds transfer costs rather than optimizing S3 storage costs. Transitioning to Glacier Instant Retrieval after 1 day conflicts with the stated frequent access during the first 180 days and would increase retrieval costs.
Question 35
A company hosts an application that uses several Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). During the initial startup of the EC2 instances, the EC2 instances run user data scripts to download critical content for the application from an Amazon S3 bucket.
The EC2 instances are launching correctly. However, after a period of time, the EC2 instances are terminated with the following error message: “An instance was taken out of service in response to an ELB system health check failure.” EC2 instances continue to launch and be terminated because of Auto Scaling events in an endless loop.
The only recent change to the deployment is that the company added a large amount of critical content to the S3 bucket. The company does not want to alter the user data scripts in production.
What should a solutions architect do so that the production environment can deploy successfully?
A. Increase the size of the EC2 instances.
B. Increase the health check timeout for the AL
C. Change the health check path for the ALB.
D. Increase the health check grace period for the Auto Scaling group.
Show Answer
Correct Answer: D
Explanation: The instances now take longer to initialize because the user data downloads a larger amount of content from Amazon S3. Auto Scaling is using ELB health checks, and without sufficient health check grace period, new instances can be marked unhealthy and terminated before startup completes. Increasing the Auto Scaling group's health check grace period gives instances enough time to finish initialization before ELB health check failures are acted upon. Increasing the ALB health check timeout only changes how long the load balancer waits for an individual health check response, not how long Auto Scaling ignores health check failures during instance startup.
Question 36
A company has an application that uses AWS Key Management Service (AWS KMS) to encrypt and decrypt data. The application stores data in an Amazon S3 bucket in an AWS Region. Company security policies require the data to be encrypted before the data is placed into the S3 bucket. The application must decrypt the data when the application reads files from the S3 bucket.
The company replicates the S3 bucket to other Regions. A solutions architect must design a solution so that the application can encrypt and decrypt data across Regions. The application must use the same key to decrypt the data in each Region.
Which solution will meet these requirements?
A. Create a KMS multi-Region primary key. Use the KMS multi-Region primary key to create a KMS multi-Region replica key in each additional Region where the application is running. Update the application code to use the specific replica key in each Region.
B. Create a new customer managed KMS key in each additional Region where the application is running. Update the application code to use the specific KMS key in each Region.
C. Use AWS Private Certificate Authority to create a new certificate authority (CA) in the primary Region. Issue a new private certificate from the CA for the application’s website URL. Share the CA with the additional Regions by using AWS Resource Access Manager (AWS RAM). Update the application code to use the shared CA certificates in each Region.
D. Use AWS Systems Manager Parameter Store to create a parameter in each additional Region where the application is running. Export the key material from the KMS key in the primary Region. Store the key material in the parameter in each Region. Update the application code to use the key data from the parameter in each Region.
Show Answer
Correct Answer: A
Explanation: AWS KMS multi-Region keys are designed for cross-Region cryptographic operations using the same key material. Create a multi-Region primary key and replicate it to each required Region. The application uses the local replica key in each Region for encryption/decryption, while all replicas share the same key material and key ID properties. Separate customer-managed keys do not share key material, AWS Private CA is unrelated to KMS data encryption, and KMS key material cannot be exported to Parameter Store.
Question 37
A global ecommerce company has many data centers around the world. With the growth of its stored data, the company needs to set up a solution to provide scalable storage for legacy on-premises file applications. The company must be able to take point-in-time copies of volumes by using AWS Backup and must retain low-latency access to frequently accessed data. The company also needs to have storage volumes that can be mounted as Internet Small Computer System Interface (iSCSI) devices from the company’s on-premises application servers.
Which solution will meet these requirements?
A. Provision an AWS Storage Gateway tape gateway. Configure the tape gateway to store data in an Amazon S3 bucket. Deploy AWS Backup to take point-in-time copies of the volumes.
B. Provision an Amazon FSx File Gateway and an Amazon S3 File Gateway. Deploy AWS Backup to take point-in-time copies of the data.
C. Provision an AWS Storage Gateway volume gateway in cache mode. Back up the on-premises Storage Gateway volumes with AWS Backup.
D. Provision an AWS Storage Gateway file gateway in cache mode. Deploy AWS Backup to take point-in-time copies of the volumes.
Show Answer
Correct Answer: C
Explanation: AWS Storage Gateway Volume Gateway in cached mode provides iSCSI block storage volumes to on-premises servers, stores primary data in AWS with a local cache for low-latency access to frequently used data, and integrates with AWS Backup for point-in-time backups of gateway volumes. Tape Gateway is for virtual tapes, File Gateway exposes file protocols rather than iSCSI block volumes, and FSx File Gateway does not satisfy the iSCSI volume requirement.
Question 38
A company is using AWS CloudFormation as its deployment tool for all applications. It stages all application binaries and templates within Amazon S3 buckets with versioning enabled. Developers have access to an Amazon EC2 instance that hosts the integrated development environment (IDE). The developers download the application binaries from Amazon S3 to the EC2 instance, make changes, and upload the binaries to an S3 bucket after running the unit tests locally. The developers want to improve the existing deployment mechanism and implement CI/CD using AWS CodePipeline.
The developers have the following requirements:
• Use AWS CodeCommit for source control.
• Automate unit testing and security scanning.
• Alert the developers when unit tests fail.
• Turn application features on and off, and customize deployment dynamically as part of CI/CD.
• Have the lead developer provide approval before deploying an application.
Which solution will meet these requirements?
A. Use AWS CodeBuild to run unit tests and security scans. Use an Amazon EventBridge rule to send Amazon SNS alerts to the developers when unit tests fail. Write AWS Cloud Development Kit (AWS CDK) constructs for different solution features, and use a manifest file to tum features on and off in the AWS CDK application. Use a manual approval stage in the pipeline to allow the lead developer to approve applications.
B. Use AWS Lambda to run unit tests and security scans. Use Lambda in a subsequent stage in the pipeline to send Amazon SNS alerts to the developers when unit tests fail. Write AWS Amplify plugins for different solution features and utilize user prompts to tum features on and off. Use Amazon SES in the pipeline to allow the lead developer to approve applications.
C. Use Jenkins to run unit tests and security scans. Use an Amazon EventBridge rule in the pipeline to send Amazon SES alerts to the developers when unit tests fail Use AWS CloudFormation nested stacks for different solution features and parameters to turn features on and off. Use AWS Lambda in the pipeline to allow the lead developer to approve applications.
D. Use AWS CodeDeploy to run unit tests and security scans. Use an Amazon CloudWatch alarm in the pipeline to send Amazon SNS alerts to the developers when unit tests fail. Use Docker images for different solution features and the AWS CLI to turn features on and off. Use a manual approval stage in the pipeline to allow the lead developer to approve applications.
Show Answer
Correct Answer: A
Explanation: AWS CodeBuild is the native service for running automated builds, unit tests, and security scans in CodePipeline. EventBridge can detect CodeBuild state changes and trigger Amazon SNS notifications when builds/tests fail. AWS CDK supports defining infrastructure and application variants, with configuration (such as a manifest/context) to enable or disable features dynamically during deployment. CodePipeline includes a built-in manual approval action that satisfies the lead developer approval requirement.
Question 39
A solutions architect is importing a VM from an on-premises environment by using the Amazon EC2 VM Import feature of AWS Import/Export. The solutions architect has created an AMI and has provisioned an Amazon EC2 instance that is based on that AMI. The EC2 instance runs inside a public subnet in a VPC and has a public IP address assigned.
The EC2 instance does not appear as a managed instance in the AWS Systems Manager console.
Which combination of steps should the solutions architect take to troubleshoot this issue? (Choose two.)
A. Verify that Systems Manager Agent is installed on the instance and is running.
B. Verify that the instance is assigned an appropriate IAM role for Systems Manager.
C. Verify the existence of a VPC endpoint on the VP
D. Verity that the AWS Application Discovery Agent is configured.
E. Verify the correct configuration of service-linked roles for Systems Manager.
Show Answer
Correct Answer: A, B
Explanation: For an EC2 instance to appear as a managed instance in AWS Systems Manager, the SSM Agent must be installed and running, and the instance must have an IAM instance profile/role with the required Systems Manager permissions (such as AmazonSSMManagedInstanceCore). Because the instance is in a public subnet with a public IP, a VPC endpoint is not required if it has internet access. AWS Application Discovery Agent is unrelated to Systems Manager managed instance registration, and service-linked roles are not the primary requirement for this issue.
Question 40
A company is developing a latency-sensitive application. Part of the application includes several AWS Lambda functions that need to initialize as quickly as possible. The Lambda functions are written in Java and contain initialization code outside the handlers to load libraries, initialize classes, and generate unique IDs.
Which solution will meet the startup performance requirement MOST cost-effectively?
A. Move all the initialization code to the handlers for each Lambda function. Activate Lambda SnapStart for each Lambda function. Configure SnapStart to reference the $LATEST version of each Lambda function.
B. Publish a version of each Lambda function. Create an alias for each Lambda function. Configure each alias to point to its corresponding version. Set up a provisioned concurrency configuration for each Lambda function to point to the corresponding alias.
C. Publish a version of each Lambda function. Set up a provisioned concurrency configuration for each Lambda function to point to the corresponding version. Activate Lambda SnapStar for the published versions of the Lambda functions.
D. Update the Lambda functions to add a pre-snapshot hook. Move the code that generates unique IDs into the handlers. Publish a version of each Lambda function. Activate Lambda SnapStart for the published versions of the Lambda functions.
Show Answer
Correct Answer: D
Explanation: SnapStart is the most cost-effective way to reduce Java Lambda cold starts because it restores execution environments from a snapshot instead of keeping them warm like provisioned concurrency. SnapStart applies only to published versions, not $LATEST. Code that generates unique IDs or other uniqueness-sensitive state should not be captured in the snapshot; it should run after restore (for example, in the handler), and a pre-snapshot hook can be used to prepare snapshot-safe initialization. Option A incorrectly uses $LATEST. Option B uses provisioned concurrency, which is more expensive. Option C is invalid because SnapStart and provisioned concurrency cannot be enabled on the same function version.
Question 41
A company is running a serverless ecommerce application on AWS. The application uses Amazon API Gateway to invoke AWS Lambda Java functions. The Lambda functions connect to an Amazon RDS for MySQL database to store data.
During a recent sale event, a sudden increase in web traffic resulted in poor API performance and database connection failures. The company needs to implement a solution to minimize the latency for the Lambda functions and to support bursts in traffic.
Which solution will meet these requirements with the LEAST amount of change to the application?
A. Update the code of the Lambda functions so that the Lambda functions open the database connection outside of the function handler. Increase the provisioned concurrency for the Lambda functions.
B. Create an RDS Proxy endpoint for the database. Store database secrets in AWS Secrets Manager. Set up the required IAM permissions. Update the Lambda functions to connect to the RDS Proxy endpoint. Increase the provisioned concurrency for the Lambda functions.
C. Create a custom parameter group. Increase the value of the max_connections parameter. Associate the custom parameter group with the RDS DB instance and schedule a reboot. Increase the reserved concurrency for the Lambda functions.
D. Create an RDS Proxy endpoint for the database. Store database secrets in AWS Secrets Manager. Set up the required IAM permissions. Update the Lambda functions to connect to the RDS Proxy endpoint. Increase the reserved concurrency for the Lambda functions.
Show Answer
Correct Answer: B
Explanation: RDS Proxy is the AWS-recommended way to handle large numbers of short-lived Lambda database connections by pooling and reusing connections, preventing connection exhaustion during traffic spikes. Provisioned Concurrency reduces Lambda cold starts and minimizes latency during bursts by keeping execution environments initialized. Reserved concurrency only limits or guarantees concurrency; it does not reduce cold-start latency. Opening connections outside the handler alone does not solve connection scaling, and simply increasing MySQL max_connections is a less effective approach that can increase database load.
Question 42
A company hosts its primary API on AWS by using an Amazon API Gateway API and AWS Lambda functions that contain the logic for the API methods. The company’s internal applications use the API for core functionality and business logic. The company’s customers use the API to access data from their accounts. Several customers also have access to a legacy API that is running on a single standalone Amazon EC2 instance.
The company wants to increase the security for these APIs to better prevent denial of service (DoS) attacks, check for vulnerabilities, and guard against common exploits.
What should a solutions architect do to meet these requirements?
A. Use AWS WAF to protect both APIs. Configure Amazon Inspector to analyze the legacy API. Configure Amazon GuardDuty to monitor for malicious attempts to access the APIs.
B. Use AWS WAF to protect the API Gateway API. Configure Amazon Inspector to analyze both APIs. Configure Amazon GuardDuty to block malicious attempts to access the APIs.
C. Use AWS WAF to protect the API Gateway API. Configure Amazon Inspector to analyze the legacy API. Configure Amazon GuardDuty to monitor for malicious attempts to access the APIs.
D. Use AWS WAF to protect the API Gateway AP! Configure Amazon Inspector to protect the legacy API. Configure Amazon GuardDuty to block malicious attempts to access the APIs.
Show Answer
Correct Answer: C
Explanation: AWS WAF can be associated with Amazon API Gateway to help protect against common web exploits and some DoS-related application-layer attacks. The legacy API runs on a standalone EC2 instance, so WAF cannot be attached directly based on the information given. Amazon Inspector assesses the EC2 instance hosting the legacy API for vulnerabilities. Amazon GuardDuty is a threat detection service that monitors for malicious activity; it does not block attacks. Therefore, the combination in option C best matches the requirements.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.