A software development company has multiple engineers who are working remotely. The company is running Active Directory Domain Services (AD DS) on an Amazon EC2 instance. The company's security policy states that all internal, nonpublic services that are deployed in a VPC must be accessible through a VPN. Multi-factor authentication (MFA) must be used for access to a VPN.
What should a solutions architect do to meet these requirements?
A. Create an AWS Site-to-Site VPN connection. Configure integration between a VPN and AD DS. Use an Amazon WorkSpaces client with MFA support enabled to establish a VPN connection.
B. Create an AWS Client VPN endpoint. Create an AD Connector directory for integration with AD DS. Enable MFA for AD Connector. Use AWS Client VPN to establish a VPN connection.
C. Create multiple AWS Site-to-Site VPN connections by using AWS VPN CloudHub. Configure integration between AWS VPN CloudHub and AD DS. Use AWS Copilot to establish a VPN connection.
D. Create an Amazon WorkLink endpoint. Configure integration between Amazon WorkLink and AD DS. Enable MFA in Amazon WorkLink. Use AWS Client VPN to establish a VPN connection.
Show Answer
Correct Answer: B
Explanation: AWS Client VPN is the managed remote-access VPN service for individual users. It supports user authentication through AWS Directory Service integration (including AD Connector) and MFA. Site-to-Site VPN and VPN CloudHub are for network-to-network connectivity, not remote users. Amazon WorkSpaces and WorkLink are not VPN solutions.
Question 55
A company is planning a migration from an on-premises data center to the AWS Cloud. The company plans to use multiple AWS accounts that are managed in an organization in AWS Organizations. The company will create a small number of accounts initially and will add accounts as needed. A solutions architect must design a solution that turns on AWS CloudTrail in all AWS accounts.
What is the MOST operationally efficient solution that meets these requirements?
A. Create an AWS Lambda function that creates a new CloudTrail trail in all AWS accounts in the organization. Invoke the Lambda function daily by using a scheduled action in Amazon EventBridge.
B. Create a new CloudTrail trail in the organization's management account. Configure the trail to log all events for all AWS accounts in the organization.
C. Create a new CloudTrail trail in all AWS accounts in the organization. Create new trails whenever a new account is created. Define an SCP that prevents deletion or modification of trails. Apply the SCP to the root OU.
D. Create an AWS Systems Manager Automation runbook that creates a CloudTrail trail in all AWS accounts in the organization. Invoke the automation by using Systems Manager State Manager.
Show Answer
Correct Answer: B
Explanation: An organization trail created from the AWS Organizations management account can apply automatically to all existing and newly added member accounts. This provides centralized CloudTrail management with the least operational overhead, making it the most operationally efficient solution. The other options require custom automation or per-account trail management, which is unnecessary.
Question 56
A retail company wants to improve its application architecture. The company's applications register new orders, handle returns of merchandise, and provide analytics. The applications store retail data in a MySQL database and an Oracle OLAP analytics database. All the applications and databases are hosted on Amazon EC2 instances.
Each application consists of several components that handle different parts of the order process. These components use incoming data from different sources. A separate ETL job runs every week and copies data from each application to the analytics database.
A solutions architect must redesign the architecture into an event-driven solution that uses serverless services. The solution must provide updated analytics in near real time.
Which solution will meet these requirements?
A. Migrate the individual applications as microservices to Amazon Elastic Container Service (Amazon ECS) containers that use AWS Fargate. Keep the retail MySQL database on Amazon EC2. Move the analytics database to Amazon Neptune. Use Amazon Simple Queue Service (Amazon SQS) to send all the incoming data to the microservices and the analytics database.
B. Create an Auto Scaling group for each application. Specify the necessary number of EC2 instances in each Auto Scaling group. Migrate the retail MySQL database and the analytics database to Amazon Aurora MySQL. Use Amazon Simple Notification Service (Amazon SNS) to send all the incoming data to the correct EC2 instances and the analytics database.
C. Migrate the individual applications as microservices to Amazon Elastic Kubernetes Service (Amazon EKS) containers that use AWS Fargate. Migrate the retail MySQL database to Amazon Aurora Serverless MySQL. Migrate the analytics database to Amazon Redshift Serverless. Use Amazon EventBridge to send all the incoming data to the microservices and the analytics database.
D. Migrate the individual applications as microservices to Amazon AppStream 2.0. Migrate the retail MySQL database to Amazon Aurora MySQL. Migrate the analytics database to Amazon Redshift Serverless. Use AWS IoT Core to send all the incoming data to the microservices and the analytics database.
Show Answer
Correct Answer: C
Explanation: The requirements call for an event-driven, serverless architecture with near real-time analytics. Option C uses EventBridge for event routing, Aurora Serverless for the transactional MySQL workload, and Redshift Serverless for analytics. EKS on Fargate provides serverless container compute for the microservices. The other options either retain EC2-based components, use services that are not appropriate for analytics (Neptune), or use unrelated services (AppStream 2.0, IoT Core).
Question 57
An ecommerce company runs an application on AWS. The application has an Amazon API Gateway API that invokes an AWS Lambda function. The data is stored in an Amazon RDS for PostgreSQL DB instance.
During the company’s most recent flash sale, a sudden increase in API calls negatively affected the application's performance. A solutions architect reviewed the Amazon CloudWatch metrics during that time and noticed a significant increase in Lambda invocations and database connections. The CPU utilization also was high on the DB instance.
What should the solutions architect recommend to optimize the application's performance?
A. Increase the memory of the Lambda function. Modify the Lambda function to close the database connections when the data is retrieved.
B. Add an Amazon ElastiCache for Redis cluster to store the frequently accessed data from the RDS database.
C. Create an RDS proxy by using the Lambda console. Modify the Lambda function to use the proxy endpoint.
D. Modify the Lambda function to connect to the database outside of the function's handler. Check for an existing database connection before creating a new connection.
Show Answer
Correct Answer: C
Explanation: The bottleneck is a surge in concurrent Lambda invocations causing many database connections and high CPU utilization on the RDS instance. Amazon RDS Proxy is designed for Lambda workloads by pooling and reusing database connections, reducing connection storms and database overhead. Updating the Lambda function to use the proxy endpoint addresses the observed increase in connections. While reusing connections outside the handler (D) is a best practice, it does not solve high concurrency across many execution environments as effectively as RDS Proxy.
Question 58
A solutions architect must implement a multi-Region architecture for an Amazon RDS for PostgreSQL database that supports a web application. The database launches from an AWS CloudFormation template that includes AWS services and features that are present in both the primary and secondary Regions.
The database is configured for automated backups, and it has an RTO of 15 minutes and an RPO of 2 hours. The web application is configured to use an Amazon Route 53 record to route traffic to the database.
Which combination of steps will result in a highly available architecture that meets all the requirements? (Choose two.)
A. Create a cross-Region read replica of the database in the secondary Region. Configure an AWS Lambda function in the secondary Region to promote the read replica during a failover event.
B. In the primary Region, create a health check on the database that will invoke an AWS Lambda function when a failure is detected. Program the Lambda function to recreate the database from the latest database snapshot in the secondary Region and update the Route 53 host records for the database.
C. Create an AWS Lambda function to copy the latest automated backup to the secondary Region every 2 hours.
D. Create a failover routing policy in Route 53 for the database DNS record. Set the primary and secondary endpoints to the endpoints in each Region.
E. Create a hot standby database in the secondary Region. Use an AWS Lambda function to restore the secondary database to the latest RDS automatic backup in the event that the primary database fails.
Show Answer
Correct Answer: A, D
Explanation: A cross-Region read replica provides near-real-time replication to satisfy the 2-hour RPO and can be promoted quickly to meet the 15-minute RTO. Route 53 failover routing directs clients to the promoted database endpoint in the secondary Region during an outage. Recreating from snapshots or copying backups would generally not satisfy the required RTO, and the hot standby option described is not a valid RDS PostgreSQL feature in this context.
Question 59
A company uses AWS Organizations. The company runs two firewall appliances in a centralized networking account. Each firewall appliance runs on a manually configured highly available Amazon EC2 instance. A transit gateway connects the VPC from the centralized networking account to VPCs of member accounts. Each firewall appliance uses a static private IP address that is then used to route traffic from the member accounts to the internet.
During a recent incident, a badly configured script initiated the termination of both firewall appliances. During the rebuild of the firewall appliances, the company wrote a new script to configure the firewall appliances at startup.
The company wants to modernize the deployment of the firewall appliances. The firewall appliances need the ability to scale horizontally to handle increased traffic when the network expands. The company must continue to use the firewall appliances to comply with company policy. The provider of the firewall appliances has confirmed that the latest version of the firewall code will work with all AWS services.
Which combination of steps should the solutions architect recommend to meet these requirements MOST cost-effectively? (Choose three.)
A. Deploy a Gateway Load Balancer in the centralized networking account. Set up an endpoint service that uses AWS PrivateLink.
B. Deploy a Network Load Balancer in the centralized networking account. Set up an endpoint service that uses AWS PrivateLink.
C. Create an Auto Scaling group and a launch template that uses the new script as user data to configure the firewall appliances. Create a target group that uses the instance target type.
D. Create an Auto Scaling group. Configure an AWS Launch Wizard deployment that uses the new script as user data to configure the firewall appliances. Create a target group that uses the IP target type.
E. Create VPC endpoints in each member account. Update the route tables to point to the VPC endpoints.
F. Create VPC endpoints in the centralized networking account. Update the route tables in each member account to point to the VPC endpoints.
Show Answer
Correct Answer: A, C, E
Explanation: Gateway Load Balancer is the correct load balancer for third-party virtual appliances and is exposed through a PrivateLink endpoint service. The firewall instances should be deployed in an Auto Scaling group with a launch template and user data for automated, horizontally scalable replacement. Gateway Load Balancer endpoints (VPC endpoints) are created in the consumer/member VPCs so their route tables can target the local endpoints; route tables cannot target VPC endpoints that exist in a different VPC, making option F internally inconsistent.
Sources:
https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html
Question 60
A company wants to use Amazon WorkSpaces in combination with thin client devices to replace aging desktops. Employees use the desktops to access applications that work with Clinical trial data. Corporate security policy states that access to the applications must be restricted to only company branch office locations. The company is considering adding an additional branch office in the next 6 months.
Which solution meets these requirements with the MOST operational efficiency?
A. Create an IP access control group rule with the list of public addresses from the branch offices. Associate the IP access control group with the WorkSpaces directory.
B. Use AWS Firewall Manager to create a web ACL rule with an IPSet with the list of public addresses from the branch office locations. Associate the web ACL with the WorkSpaces directory.
C. Use AWS Certificate Manager (ACM) to issue trusted device certificates to the machines deployed in the branch office locations. Enable restricted access on the WorkSpaces directory.
D. Create a custom WorkSpace image with Windows Firewall configured to restrict access to the public addresses of the branch offices. Use the image to deploy the WorkSpaces.
Show Answer
Correct Answer: A
Explanation: Amazon WorkSpaces supports IP access control groups that restrict client connections to specified public IP address ranges. Associating an IP access control group with the WorkSpaces directory enforces access only from the company branch offices and is simple to update when a new branch office is added. AWS WAF/Firewall Manager web ACLs do not apply to WorkSpaces directories, ACM device certificates are for certificate-based device trust rather than location-based restriction, and Windows Firewall inside the WorkSpace does not control initial client connection access.
Question 61
A company wants to establish a dedicated connection between its on-premises infrastructure and AWS. The company is setting up a 1 Gbps AWS Direct Connect connection to its account VPC. The architecture includes a transit gateway and a Direct Connect gateway to connect multiple VPCs and the on-premises infrastructure.
The company must connect to VPC resources over a transit VIF by using the Direct Connect connection.
Which combination of steps will meet these requirements? (Choose two.)
A. Update the 1 Gbps Direct Connect connection to 10 Gbps.
B. Advertise the on-premises network prefixes over the transit VIF.
C. Advertise the VPC prefixes from the Direct Connect gateway to the on-premises network over the transit VIF.
D. Update the Direct Connect connection's MACsec encryption mode attribute to must_encrypt.
E. Associate a MACsec Connection Key Name/Connectivity Association Key (CKN/CAK) pair with the Direct Connect connection.
Show Answer
Correct Answer: B, C
Explanation: A transit VIF requires route exchange in both directions: the on-premises network prefixes must be advertised to AWS, and the Direct Connect gateway advertises the associated VPC prefixes (via the transit gateway attachment) back to the on-premises network. Upgrading to 10 Gbps is unnecessary, and MACsec options are unrelated to basic connectivity and are not supported on a 1 Gbps dedicated connection.
Question 62
A company deploys workloads in multiple AWS accounts. Each account has a VPC with VPC flow logs published in text log format to a centralized Amazon S3 bucket. Each log file is compressed with gzip compression. The company must retain the log files indefinitely.
A security engineer occasionally analyzes the logs by using Amazon Athena to query the VPC flow logs. The query performance is degrading over time as the number of ingested logs is growing. A solutions architect must improve the performance of the log analysis and reduce the storage space that the VPC flow logs use.
Which solution will meet these requirements with the LARGEST performance improvement?
A. Create an AWS Lambda function to decompress the gzip files and to compress the files with bzip2 compression. Subscribe the Lambda function to an s3:ObjectCreated:Put S3 event notification for the S3 bucket.
B. Enable S3 Transfer Acceleration for the S3 bucket. Create an S3 Lifecycle configuration to move files to the S3 Intelligent-Tiering storage class as soon as the files are uploaded.
C. Update the VPC flow log configuration to store the files in Apache Parquet format. Specify hourly partitions for the log files.
D. Create a new Athena workgroup without data usage control limits. Use Athena engine version 2.
Show Answer
Correct Answer: C
Explanation: Apache Parquet is a columnar storage format optimized for analytics. Storing VPC Flow Logs directly in Parquet with hourly partitioning allows Athena to scan only the required columns and partitions, significantly reducing data scanned, improving query performance, and reducing storage usage through efficient compression. The other options do not provide comparable query performance improvements for Athena.
Question 63
A company that is developing a mobile game is making game assets available in two AWS Regions. Game assets are served from a set of Amazon EC2 instances behind an Application Load Balancer (ALB) in each Region. The company requires game assets to be fetched from the closest Region. If game assets become unavailable in the closest Region, they should be fetched from the other Region.
What should a solutions architect do to meet these requirements?
A. Create an Amazon CloudFront distribution. Create an origin group with one origin for each ALB. Set one of the origins as primary.
B. Create an Amazon Route 53 health check for each ALCreate a Route 53 failover routing record pointing to the two ALBs. Set the Evaluate Target Health value to Yes.
C. Create two Amazon CloudFront distributions, each with one ALB as the origin. Create an Amazon Route 53 failover routing record pointing to the two CloudFront distributions. Set the Evaluate Target Health value to Yes.
D. Create an Amazon Route 53 health check for each ALB. Create a Route 53 latency alias record pointing to the two ALBs. Set the Evaluate Target Health value to Yes.
Show Answer
Correct Answer: D
Explanation: Latency-based Route 53 routing directs clients to the AWS Region with the lowest network latency (closest in practice). With health checks and Evaluate Target Health enabled, if the selected Region's ALB becomes unhealthy, Route 53 stops returning it and routes clients to the healthy ALB in the other Region. CloudFront origin groups always prefer the primary origin and do not choose origins based on client proximity.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.