A company wants to use Amazon WorkSpaces in combination with thin client devices to replace aging desktops. Employees use the desktops to access applications that work with Clinical trial data. Corporate security policy states that access to the applications must be restricted to only company branch office locations. The company is considering adding an additional branch office in the next 6 months.
Which solution meets these requirements with the MOST operational efficiency?
A. Create an IP access control group rule with the list of public addresses from the branch offices. Associate the IP access control group with the WorkSpaces directory.
B. Use AWS Firewall Manager to create a web ACL rule with an IPSet with the list of public addresses from the branch office locations. Associate the web ACL with the WorkSpaces directory.
C. Use AWS Certificate Manager (ACM) to issue trusted device certificates to the machines deployed in the branch office locations. Enable restricted access on the WorkSpaces directory.
D. Create a custom WorkSpace image with Windows Firewall configured to restrict access to the public addresses of the branch offices. Use the image to deploy the WorkSpaces.
Show Answer
Correct Answer: A
Explanation: Amazon WorkSpaces natively supports IP access control groups that restrict client access to specific source IP ranges and can be associated directly with a WorkSpaces directory. This precisely meets the requirement to allow access only from branch office locations and can be easily updated when a new branch office is added, providing the highest operational efficiency. AWS WAF/Firewall Manager cannot be associated with WorkSpaces, ACM device certificates are not required for this use case, and custom images with Windows Firewall add unnecessary operational overhead.
Question 61
A company wants to establish a dedicated connection between its on-premises infrastructure and AWS. The company is setting up a 1 Gbps AWS Direct Connect connection to its account VPC. The architecture includes a transit gateway and a Direct Connect gateway to connect multiple VPCs and the on-premises infrastructure.
The company must connect to VPC resources over a transit VIF by using the Direct Connect connection.
Which combination of steps will meet these requirements? (Choose two.)
A. Update the 1 Gbps Direct Connect connection to 10 Gbps.
B. Advertise the on-premises network prefixes over the transit VIF.
C. Advertise the VPC prefixes from the Direct Connect gateway to the on-premises network over the transit VIF.
D. Update the Direct Connect connection's MACsec encryption mode attribute to must_encrypt.
E. Associate a MACsec Connection Key Name/Connectivity Association Key (CKN/CAK) pair with the Direct Connect connection.
Show Answer
Correct Answer: B, C
Explanation: To connect on-premises networks to multiple VPCs through a Direct Connect gateway and transit gateway using a transit VIF, routing must be exchanged in both directions. Advertising on-premises prefixes over the transit VIF allows AWS to route traffic back to on-premises. Advertising VPC prefixes from the Direct Connect gateway to on-premises allows on-premises networks to reach VPC resources. Bandwidth upgrades and MACsec options are not required for basic connectivity.
Question 62
A company deploys workloads in multiple AWS accounts. Each account has a VPC with VPC flow logs published in text log format to a centralized Amazon S3 bucket. Each log file is compressed with gzip compression. The company must retain the log files indefinitely.
A security engineer occasionally analyzes the logs by using Amazon Athena to query the VPC flow logs. The query performance is degrading over time as the number of ingested logs is growing. A solutions architect must improve the performance of the log analysis and reduce the storage space that the VPC flow logs use.
Which solution will meet these requirements with the LARGEST performance improvement?
A. Create an AWS Lambda function to decompress the gzip files and to compress the files with bzip2 compression. Subscribe the Lambda function to an s3:ObjectCreated:Put S3 event notification for the S3 bucket.
B. Enable S3 Transfer Acceleration for the S3 bucket. Create an S3 Lifecycle configuration to move files to the S3 Intelligent-Tiering storage class as soon as the files are uploaded.
C. Update the VPC flow log configuration to store the files in Apache Parquet format. Specify hourly partitions for the log files.
D. Create a new Athena workgroup without data usage control limits. Use Athena engine version 2.
Show Answer
Correct Answer: C
Explanation: Storing VPC flow logs in Apache Parquet format with time-based (hourly) partitions provides the largest performance improvement for Athena queries. Parquet is a columnar, compressed format that allows Athena to scan only required columns, significantly reducing data scanned and query time. Partitioning by hour further limits the amount of data Athena must read for time-bounded queries. This approach also reduces storage usage compared to text-based gzip logs. Other options do not materially improve Athena query performance.
Question 63
A company that is developing a mobile game is making game assets available in two AWS Regions. Game assets are served from a set of Amazon EC2 instances behind an Application Load Balancer (ALB) in each Region. The company requires game assets to be fetched from the closest Region. If game assets become unavailable in the closest Region, they should be fetched from the other Region.
What should a solutions architect do to meet these requirements?
A. Create an Amazon CloudFront distribution. Create an origin group with one origin for each ALB. Set one of the origins as primary.
B. Create an Amazon Route 53 health check for each ALCreate a Route 53 failover routing record pointing to the two ALBs. Set the Evaluate Target Health value to Yes.
C. Create two Amazon CloudFront distributions, each with one ALB as the origin. Create an Amazon Route 53 failover routing record pointing to the two CloudFront distributions. Set the Evaluate Target Health value to Yes.
D. Create an Amazon Route 53 health check for each ALB. Create a Route 53 latency alias record pointing to the two ALBs. Set the Evaluate Target Health value to Yes.
Show Answer
Correct Answer: D
Explanation: The requirement is to route users to the closest AWS Region and automatically fail over if that Region becomes unavailable. Amazon Route 53 latency-based routing is designed to send users to the Region with the lowest network latency. By creating health checks for each ALB and enabling Evaluate Target Health, Route 53 will stop returning unhealthy ALBs and route traffic to the other Region. CloudFront origin groups (Option A) always use a primary origin and do not select the closest Region for origin fetches, so they do not meet the requirement.
Question 64
A company wants to migrate virtual Microsoft workloads from an on-premises data center to AWS. The company has successfully tested a few sample workloads on AWS. The company also has created an AWS Site-to-Site VPN connection to a VPC. A solutions architect needs to generate a total cost of ownership (TCO) report for the migration of all the workloads from the data center.
Simple Network Management Protocol (SNMP) has been enabled on each VM in the data center. The company cannot add more VMs in the data center and cannot install additional software on the VMs. The discovery data must be automatically imported into AWS Migration Hub.
Which solution will meet these requirements?
A. Use the AWS Application Migration Service agentless service and the AWS Migration Hub Strategy Recommendations to generate the TCO report.
B. Launch a Windows Amazon EC2 instance. Install the Migration Evaluator agentless collector on the EC2 instance. Configure Migration Evaluator to generate the TCO report.
C. Launch a Windows Amazon EC2 instance. Install the Migration Evaluator agentless collector on the EC2 instance. Configure Migration Hub to generate the TCO report.
D. Use the AWS Migration Readiness Assessment tool inside the VPC. Configure Migration Evaluator to generate the TCO report.
Show Answer
Correct Answer: B
Explanation: The requirement is to generate a TCO report using automatically imported discovery data without installing agents on existing VMs. AWS Migration Evaluator is specifically designed to produce TCO and cost comparison reports. Its agentless collector can use SNMP to discover on‑premises VMs, which fits the constraint that no additional software can be installed on those VMs. Deploying the collector on a Windows EC2 instance allows data collection over the existing Site‑to‑Site VPN and automatic import into AWS Migration Hub. Other options either do not generate TCO reports or use services not intended for cost analysis.
Question 65
A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company hosts some applications in a VPC in the company's shared services account.
The company has attached a transit gateway to the VPC in the shared services account.
The company is developing a new capability and has created a development environment that requires access to the applications that are in the shared services account. The company intends to delete and recreate resources frequently in the development account. The company also wants to give a development team the ability to recreate the team's connection to the shared services account as required.
Which solution will meet these requirements?
A. Create a transit gateway in the development account. Create a transit gateway peering request to the shared services account. Configure the shared services transit gateway to automatically accept peering connections.
B. Turn on automatic acceptance for the transit gateway in the shared services account. Use AWS Resource Access Manager (AWS RAM) to share the transit gateway resource in the shared services account with the development account. Accept the resource in the development account. Create a transit gateway attachment in the development account.
C. Turn on automatic acceptance for the transit gateway in the shared services account. Create a VPC endpoint. Use the endpoint policy to grant permissions on the VPC endpoint for the development account. Configure the endpoint service to automatically accept connection requests. Provide the endpoint details to the development team.
D. Create an Amazon EventBridge rule to invoke an AWS Lambda function that accepts the transit gateway attachment when the development account makes an attachment request. Use AWS Network Manager to share the transit gateway in the shared services account with the development account. Accept the transit gateway in the development account.
Show Answer
Correct Answer: B
Explanation: Sharing the transit gateway from the shared services account to the development account using AWS RAM allows the development team to create and delete their own VPC attachments as needed. Enabling automatic acceptance on the shared services transit gateway removes the need for manual intervention each time attachments are recreated, which fits frequent rebuilds. Other options add unnecessary complexity (separate TGW and peering), misuse VPC endpoints, or overengineer acceptance with custom automation.
Question 66
A company uses AWS Organizations to manage its AWS accounts. A solutions architect must design a solution in which only administrator roles are allowed to use IAM actions. However, the solutions architect does not have access to all the AWS accounts throughout the company.
Which solution meets these requirements with the LEAST operational overhead?
A. Create an SCP that applies to all the AWS accounts to allow IAM actions only for administrator roles. Apply the SCP to the root OU.
B. Configure AWS CloudTrail to invoke an AWS Lambda function for each event that is related to IAM actions. Configure the function to deny the action if the user who invoked the action is not an administrator.
C. Create an SCP that applies to all the AWS accounts to deny IAM actions for all users except for those with administrator roles. Apply the SCP to the root OU.
D. Set an IAM permissions boundary that allows IAM actions. Attach the permissions boundary to every administrator role across all the AWS accounts.
Show Answer
Correct Answer: C
Explanation: Service control policies (SCPs) are best used to set guardrails by explicitly denying actions. To ensure that only administrator roles can perform IAM actions across all accounts—without needing access to each account—the correct approach is to create an SCP that denies IAM actions for everyone except administrator roles and attach it to the root OU. This is preventive, centrally managed, and has the least operational overhead. Allow-based SCPs (option A) are ineffective unless all other allow SCPs are removed, CloudTrail/Lambda (option B) is reactive, and permissions boundaries (option D) require changes in every account.
Question 67
A company has many services running in its on-premises data center. The data center is connected to AWS using AWS Direct Connect (DX) and an IPSec VPN. The service data is sensitive and connectivity cannot traverse the internet. The company wants to expand into a new market segment and begin offering its services to other companies that are using AWS.
Which solution will meet these requirements?
A. Create a VPC Endpoint Service that accepts TCP traffic, host it behind a Network Load Balancer, and make the service available over DX.
B. Create a VPC Endpoint Service that accepts HTTP or HTTPS traffic, host it behind an Application Load Balancer, and make the service available over DX.
C. Attach an internet gateway to the VPC, and ensure that network access control and security group rules allow the relevant inbound and outbound traffic.
D. Attach a NAT gateway to the VPC, and ensure that network access control and security group rules allow the relevant inbound and outbound traffic.
Show Answer
Correct Answer: A
Explanation: The requirement is to expose sensitive on‑premises services to other AWS customers without traversing the public internet. This is exactly what AWS PrivateLink provides, which is implemented using a VPC Endpoint Service backed by a Network Load Balancer. PrivateLink works at the TCP layer and requires an NLB; an Application Load Balancer cannot be directly used as a VPC endpoint service. Options C and D involve internet connectivity, which violates the requirement. Therefore, creating a VPC Endpoint Service backed by an NLB and making it available over Direct Connect is the correct solution.
Question 68
A company needs to implement disaster recovery for a critical application that runs in a single AWS Region. The application's users interact with a web frontend that is hosted on Amazon EC2 instances behind an Application Load Balancer (ALB). The application writes to an Amazon RDS for MySQL DB instance. The application also outputs processed documents that are stored in an Amazon S3 bucket.
The company’s finance team directly queries the database to run reports. During busy periods, these queries consume resources and negatively affect application performance.
A solutions architect must design a solution that will provide resiliency during a disaster. The solution must minimize data loss and must resolve the performance problems that result from the finance team's queries.
Which solution will meet these requirements?
A. Migrate the database to Amazon DynamoDB and use DynamoDB global tables. Instruct the finance team to query a global table in a separate Region. Create an AWS Lambda function to periodically synchronize the contents of the original S3 bucket to a new S3 bucket in the separate Region. Launch EC2 instances and create an ALB in the separate Region. Configure the application to point to the new S3 bucket.
B. Launch additional EC2 instances that host the application in a separate Region. Add the additional instances to the existing ALIn the separate Region, create a read replica of the RDS DB instance. Instruct the finance team to run queries against the read replica. Use S3 Cross-Region Replication (CRR) from the original S3 bucket to a new S3 bucket in the separate Region. During a disaster, promote the read replica to a standalone DB instance. Configure the application to point to the new S3 bucket and to the newly promoted read replica.
C. Create a read replica of the RDS DB instance in a separate Region. Instruct the finance team to run queries against the read replica. Create AMIs of the EC2 instances that host the application frontend. Copy the AMIs to the separate Region. Use S3 Cross-Region Replication (CRR) from the original S3 bucket to a new S3 bucket in the separate Region. During a disaster, promote the read replica to a standalone DB instance. Launch EC2 instances from the AMIs and create an ALB to present the application to end users. Configure the application to point to the new S3 bucket.
D. Create hourly snapshots of the RDS DB instance. Copy the snapshots to a separate Region. Add an Amazon ElastiCache cluster in front of the existing RDS database. Create AMIs of the EC2 instances that host the application frontend. Copy the AMIs to the separate Region. Use S3 Cross-Region Replication (CRR) from the original S3 bucket to a new S3 bucket in the separate Region. During a disaster, restore the database from the latest RDS snapshot. Launch EC2 instances from the AMIs and create an ALB to present the application to end users. Configure the application to point to the new S3 bucket.
Show Answer
Correct Answer: C
Explanation: Option C best meets the requirements. A cross-Region RDS read replica offloads the finance team’s reporting queries, resolving the performance impact on the primary database, and can be promoted during a disaster to minimize data loss. S3 Cross-Region Replication provides near-real-time replication of processed documents. Creating and copying AMIs allows rapid recovery of the EC2-based web tier with a new ALB in the secondary Region. Other options either introduce higher data loss (snapshots or periodic sync), misuse services (DynamoDB for a relational workload), or rely on invalid architectures such as adding instances from another Region to the same ALB.
Question 69
A company needs to migrate its website from an on-premises data center to AWS. The website consists of a load balancer, a content management system (CMS) that runs on a Linux operating system, and a MySQL database.
The CMS requires persistent NFS-compatible storage for a file system. The new solution on AWS must be able to scale from 2 Amazon EC2 instances to 30 EC2 instances in response to unpredictable traffic increases. The new solution also must require no changes to the website and must prevent data loss.
Which solution will meet these requirements?
A. Create an Amazon Elastic File System (Amazon EFS) file system. Deploy the CMS to AWS Elastic Beanstalk with an Application Load Balancer and an Auto Scaling group. Use .ebextensions to mount the EFS file system to the EC2 instances. Create an Amazon Aurora MySQL database that is separate from the Elastic Beanstalk environment.
B. Create an Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume. Deploy the CMS to AWS Elastic Beanstalk with a Network Load Balancer and an Auto Scaling group. Use .ebextensions to mount the EBS volume to the EC2 instances. Create an Amazon RDS for MySQL database in the Elastic Beanstalk environment.
C. Create an Amazon Elastic File System (Amazon EFS) file system. Create a launch template and an Auto Scaling group to launch EC2 instances to support the CMS. Create a Network Load Balancer to distribute traffic. Create an Amazon Aurora MySQL database. Use an EC2 Auto Scaling scale-in lifecycle hook to mount the EFS file system to the EC2 instances.
D. Create an Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume. Create a launch template and an Auto Scaling group to launch EC2 instances to support the CMS. Create an Application Load Balancer to distribute traffic. Create an Amazon ElastiCache for Redis cluster to support the MySQL database. Use EC2 user data to attach the EBS volume to the EC2 instances.
Show Answer
Correct Answer: A
Explanation: The CMS requires persistent, shared, NFS-compatible storage that can be accessed concurrently by up to 30 EC2 instances without application changes. Amazon EFS is the correct service for this requirement. Elastic Beanstalk with an Application Load Balancer and Auto Scaling natively supports scaling EC2 instances and allows EFS to be mounted using .ebextensions. This approach prevents data loss, supports unpredictable scaling, and requires no website changes. Options using EBS Multi-Attach are invalid because EBS is not NFS-compatible and has attachment and AZ limitations. Option C is incorrect because a scale-in lifecycle hook is not appropriate for mounting EFS, and it adds unnecessary complexity.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.