A company is running a web-crawling process on a list of target URLs to obtain training documents for machine learning training algorithms. A fleet of Amazon EC2 t2.micro instances pulls the target URLs from an Amazon Simple Queue Service (Amazon SQS) queue. The instances then write the result of the crawling algorithm as a .csv file to an Amazon Elastic File System (Amazon EFS) volume. The EFS volume is mounted on all instances of the fleet.
A separate system adds the URLs to the SQS queue at infrequent rates. The instances crawl each URL in 10 seconds or less.
Metrics indicate that some instances are idle when no URLs are in the SQS queue. A solutions architect needs to redesign the architecture to optimize costs.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
A. Use m5.8xlarge instances instead of t2.micro instances for the web-crawling process. Reduce the number of instances in the fleet by 50%.
B. Convert the web-crawling process into an AWS Lambda function. Configure the Lambda function to pull URLs from the SQS queue.
C. Modify the web-crawling process to store results in Amazon Neptune.
D. Modify the web-crawling process to store results in an Amazon Aurora Serverless MySQL instance.
E. Modify the web-crawling process to store results in Amazon S3.
Show Answer
Correct Answer: B, E
Explanation: The workload is event-driven, short-lived (≤10 seconds per URL), and experiences idle time when the SQS queue is empty. Converting the crawler to AWS Lambda eliminates idle EC2 costs and scales automatically based on SQS messages, making it the most cost-effective compute option. Storing results in Amazon S3 is significantly cheaper and simpler than EFS or databases for CSV output files, while providing high durability and no need for shared file system management.
Question 71
A company is using GitHub Actions to run a CI/CD pipeline that accesses resources on AWS. The company has an IAM user that uses a secret key in the pipeline to authenticate to AWS. An existing IAM role with an attached policy grants the required permissions to deploy resources.
The company’s security team implements a new requirement that pipelines can no longer use long-lived secret keys. A solutions architect must replace the secret key with a short-lived solution.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an IAM SAML 2.0 identity provider (IdP) in AWS Identity and Access Management (IAM). Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRole API call. Attach the existing IAM policy to the new IAM role. Update GitHub to use SAML authentication for the pipeline.
B. Create an IAM OpenID Connect (OIDC) identity provider (IdP) in AWS Identity and Access Management (IAM). Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRoleWithWebIdentity API call from the GitHub OIDC IdP. Update GitHub to assume the role for the pipeline.
C. Create an Amazon Cognito identity pool. Configure the authentication provider to use GitHub. Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRoleWithWebIdentity API call from the GitHub authentication provider. Configure the pipeline to use Cognito as its authentication provider.
D. Create a trust anchor to AWS Private Certificate Authority. Generate a client certificate to use with AWS IAM Roles Anywhere. Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRole API call. Attach the existing IAM policy to the new IAM role. Configure the pipeline to use the credential helper tool and to reference the client certificate public key to assume the new IAM role.
Show Answer
Correct Answer: B
Explanation: GitHub Actions natively supports OpenID Connect (OIDC) to AWS, allowing workflows to assume an IAM role via sts:AssumeRoleWithWebIdentity using short‑lived credentials without storing secrets. This meets the no long‑lived keys requirement with minimal setup and lowest operational overhead compared to SAML, Cognito, or IAM Roles Anywhere.
Question 72
A company wants to record key performance indicators (KPIs) from its application as part of a strategy to convert to a user-based licensing schema. The application is a multi-tier application with a web-based UI. The company saves all log files to Amazon CloudWatch by using the CloudWatch agent. All logins to the application are saved in a log file.
As part of the new license schema, the company needs to find out how many unique users each client has on a daily basis, weekly basis, and monthly basis.
Which solution will provide this information with the LEAST change to the application?
A. Configure an Amazon CloudWatch Logs metric filter that saves each successful login as a metric. Configure the user name and client name as dimensions for the metric.
B. Change the application logic to make each successful login generate a call to the AWS SDK to increment a custom metric that records user name and client name dimensions in CloudWatch.
C. Configure the CloudWatch agent to extract successful login metrics from the logs. Additionally, configure the CloudWatch agent to save the successful login metrics as a custom metric that uses the user name and client name as dimensions for the metric.
D. Configure an AWS Lambda function to consume an Amazon CloudWatch Logs stream of the application logs. Additionally, configure the Lambda function to increment a custom metric in CloudWatch that uses the user name and client name as dimensions for the metric.
Show Answer
Correct Answer: D
Explanation: The requirement is to count **unique users per client** over daily, weekly, and monthly periods. CloudWatch Logs metric filters (A and C) can extract fields and count events, but they cannot deduplicate users across a time window; they only count occurrences. Option B requires application code changes, which violates the “least change to the application” requirement.
Using a Lambda function subscribed to the CloudWatch Logs stream (D) requires no application changes, allows parsing of existing login logs, and enables custom logic to deduplicate users per client for each time period before emitting metrics. This is the only option that both satisfies the uniqueness requirement and minimizes application changes.
Question 73
A company has an application that analyzes and stores image data on premises. The application receives millions of new image files every day. Files are an average of 1 MB in size. The files are analyzed in batches of 1 GB. When the application analyzes a batch, the application zips the images together. The application then archives the images as a single file in an on-premises NFS server for long-term storage.
The company has a Microsoft Hyper-V environment on premises and has compute capacity available. The company does not have storage capacity and wants to archive the images on AWS. The company needs the ability to retrieve archived data within 1 week of a request.
The company has a 10 Gbps AWS Direct Connect connection between its on-premises data center and AWS. The company needs to set bandwidth limits and schedule archived images to be copied to AWS during non-business hours.
Which solution will meet these requirements MOST cost-effectively?
A. Deploy an AWS DataSync agent on a new GPU-based Amazon EC2 instance. Configure the DataSync agent to copy the batch of files from the NFS on-premises server to Amazon S3 Glacier Instant Retrieval. After the successful copy, delete the data from the on-premises storage.
B. Deploy an AWS DataSync agent as a Hyper-V VM on premises. Configure the DataSync agent to copy the batch of files from the NFS on-premises server to Amazon S3 Glacier Deep Archive. After the successful copy, delete the data from the on-premises storage.
C. Deploy an AWS DataSync agent on a new general purpose Amazon EC2 instance. Configure the DataSync agent to copy the batch of files from the NFS on-premises server to Amazon S3 Standard. After the successful copy, delete the data from the on-premises storage. Create an S3 Lifecycle rule to transition objects from S3 Standard to S3 Glacier Deep Archive after 1 day.
D. Deploy an AWS Storage Gateway Tape Gateway on premises in the Hyper-V environment. Connect the Tape Gateway to AWS. Use automatic tape creation. Specify an Amazon S3 Glacier Deep Archive pool. Eject the tape after the batch of images is copied.
Show Answer
Correct Answer: B
Explanation: The requirement is low-cost long-term archiving with retrieval acceptable within 1 week. Amazon S3 Glacier Deep Archive is the most cost-effective storage class that meets this retrieval SLA. AWS DataSync supports direct transfer from on-premises NFS to S3 Glacier Deep Archive and allows scheduling and bandwidth throttling, which fits the need to copy data during non-business hours over Direct Connect. Deploying the DataSync agent as a Hyper-V VM aligns with the existing on-premises environment and avoids unnecessary EC2 or intermediate storage costs. Other options either use more expensive storage classes or add unnecessary complexity.
Question 74
A company needs to run large batch-processing jobs on data that is stored in an Amazon S3 bucket. The jobs perform simulations. The results of the jobs are not time sensitive, and the process can withstand interruptions.
Each job must process 15-20 GB of data when the data is stored in the S3 bucket. The company will store the output from the jobs in a different Amazon S3 bucket for further analysis.
Which solution will meet these requirements MOST cost-effectively?
A. Create a serverless data pipeline. Use AWS Step Functions for orchestration. Use AWS Lambda functions with provisioned capacity to process the data.
B. Create an AWS Batch compute environment that includes Amazon EC2 Spot Instances. Specify the SPOT_CAPACITY_OPTIMIZED allocation strategy.
C. Create an AWS Batch compute environment that includes Amazon EC2 On-Demand Instances and Spot Instances. Specify the SPOT_CAPACITY_OPTIMIZED allocation strategy for the Spot Instances.
D. Use Amazon Elastic Kubernetes Service (Amazon EKS) to run the processing jobs. Use managed node groups that contain a combination of Amazon EC2 On-Demand Instances and Spot Instances.
Show Answer
Correct Answer: B
Explanation: The workload consists of large, fault-tolerant, non–time-sensitive batch jobs that read data from Amazon S3 and can tolerate interruptions. AWS Batch is purpose-built for running large-scale batch processing and integrates natively with Amazon S3. Using Amazon EC2 Spot Instances provides the lowest compute cost, and the SPOT_CAPACITY_OPTIMIZED allocation strategy minimizes interruptions by selecting Spot capacity with the highest availability. Options using Lambda are unsuitable due to data size and execution limits, and EKS or mixed On-Demand/Spot environments are more complex and less cost-effective for this use case.
Question 75
A solutions architect must provide a secure way for a team of cloud engineers to use the AWS CLI to upload objects into an Amazon S3 bucket. Each cloud engineer has an IAM user, IAM access keys, and a virtual multi-factor authentication (MFA) device. The IAM users for the cloud engineers are in a group that is named S3-access. The cloud engineers must use MFA to perform any actions in Amazon S3.
Which solution will meet these requirements?
A. Attach a policy to the S3 bucket to prompt the IAM user for an MFA code when the IAM user performs actions on the S3 bucket. Use IAM access keys with the AWS CLI to call Amazon S3.
B. Update the trust policy for the S3-access group to require principals to use MFA when principals assume the group. Use IAM access keys with the AWS CLI to call Amazon S3.
C. Attach a policy to the S3-access group to deny all S3 actions unless MFA is present. Use IAM access keys with the AWS CLI to call Amazon S3.
D. Attach a policy to the S3-access group to deny all S3 actions unless MFA is present. Request temporary credentials from AWS Security Token Service (AWS STS). Attach the temporary credentials in a profile that Amazon S3 will reference when the user performs actions in Amazon S3.
Show Answer
Correct Answer: D
Explanation: To require MFA for AWS CLI access to Amazon S3, IAM users must use temporary credentials that are issued only after MFA authentication. Attaching a group policy that denies all S3 actions unless MFA is present enforces the requirement, and obtaining temporary credentials from AWS STS with MFA satisfies it. Using long-term IAM access keys alone cannot enforce MFA for API calls, and bucket policies or group trust policies cannot prompt for or enforce MFA for CLI actions. Therefore, using STS temporary credentials with an MFA-enforced group policy is the correct solution.
Question 77
A company needs to modernize an application and migrate the application to AWS. The application stores user profile data as text in a single table in an on-premises MySQL database.
After the modernization, users will use the application to upload video files that are up to 4 GB in size. Other users must be able to download the video files from the application. The company needs a video storage solution that provides rapid scaling. The solution must not affect application performance.
Which solution will meet these requirements?
A. Migrate the database to Amazon Aurora PostgreSQL by using AWS Database Migration Service (AWS DMS). Store the videos as base64-encoded strings in a TEXT column in the database.
B. Migrate the database to Amazon DynamoDB by using AWS Database Migration Service (AWS DMS) with the AWS Schema Conversion Tool (AWS SCT). Store the videos as objects in Amazon S3. Store the S3 key in the corresponding DynamoDB item.
C. Migrate the database to Amazon Keyspaces (for Apache Cassandra) by using AWS Database Migration Service (AWS DMS) with the AWS Schema Conversion Tool (AWS SCT). Store the videos as objects in Amazon S3. Store the S3 object identifier in the corresponding Amazon Keyspaces entry.
D. Migrate the database to Amazon DynamoDB by using AWS Database Migration Service (AWS DMS) with the AWS Schema Conversion Tool (AWS SCT). Store the videos as base64-encoded strings in the corresponding DynamoDB item.
Show Answer
Correct Answer: B
Explanation: Video files up to 4 GB require an object storage service that can scale rapidly and deliver high throughput without impacting application performance. Amazon S3 is designed for large objects, provides virtually unlimited scaling, and supports efficient upload and download. The database should store only metadata, such as the S3 object key. DynamoDB is well suited for scalable, low-latency access to user profile and metadata. Storing videos as base64-encoded data in a database (Aurora or DynamoDB) would severely impact performance and size limits, and Amazon Keyspaces is unnecessary for this use case.
Question 78
A company needs to migrate 60 on-premises legacy applications to AWS. The applications are based on the NET Framework and run on Windows.
The company needs a solution that minimizes migration time and requires no application code changes. The company also does not want to manage the infrastructure.
Which solution will meet these requirements?
A. Refactor the applications and containerize them by using AWS Toolkit for NET Refactoring. Use Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type to host the containerized applications.
B. Use the Windows Web Application Migration Assistant to migrate the applications to AWS Elastic Beanstalk. Use Elastic Beanstalk to deploy and manage the applications.
C. Use the Windows Web Application Migration Assistant to migrate the applications to Amazon EC2 instances. Use the EC2 instances to deploy and manage the applications.
D. Refactor the applications and containerize them by using AWS Toolkit for NET Refactoring. Use Amazon Elastic Kubernetes Service (Amazon EKS) with the Fargate launch type to host the containerized applications.
Show Answer
Correct Answer: B
Explanation: The requirements are minimal migration time, no application code changes, and no infrastructure management. Windows Web Application Migration Assistant is designed to lift and shift .NET Framework applications to AWS with minimal effort. AWS Elastic Beanstalk abstracts EC2, scaling, load balancing, and patching, so the company does not manage infrastructure. Options A and D require refactoring/containerization (code changes). Option C requires managing EC2 infrastructure.
Question 79
A company is designing an AWS environment for a manufacturing application. The application has been successful with customers, and the application's user base has increased. The company has connected the AWS environment to the company's on-premises data center through a 1 Gbps AWS Direct Connect connection. The company has configured BGP for the connection.
The company must update the existing network connectivity solution to ensure that the solution is highly available, fault tolerant, and secure.
Which solution will meet these requirements MOST cost-effectively?
A. Add a dynamic private IP AWS Site-to-Site VPN as a secondary path to secure data in transit and provide resilience for the Direct Connect connection. Configure MACsec to encrypt traffic inside the Direct Connect connection.
B. Provision another Direct Connect connection between the company's on-premises data center and AWS to increase the transfer speed and provide resilience. Configure MACsec to encrypt traffic inside the Direct Connect connection.
C. Configure multiple private VIFs. Load balance data across the VIFs between the on-premises data center and AWS to provide resilience.
D. Add a static AWS Site-to-Site VPN as a secondary path to secure data in transit and to provide resilience for the Direct Connect connection.
Show Answer
Correct Answer: D
Explanation: The most cost‑effective way to improve availability, fault tolerance, and security for an existing 1 Gbps Direct Connect is to add an AWS Site‑to‑Site VPN as a backup path. A VPN provides encrypted traffic and resilience if Direct Connect fails. MACsec is not supported on 1 Gbps Direct Connect links, which makes options that rely on MACsec invalid. Adding another Direct Connect connection would be significantly more expensive, and multiple VIFs on a single Direct Connect do not provide true redundancy. Therefore, adding a Site‑to‑Site VPN as a secondary path is the correct choice.
Question 80
A company that has multiple business units is using AWS Organizations with all features enabled. The company has implemented an account structure in which each business unit has its own AWS account. Administrators in each AWS account need to view detailed cost and utilization data for their account by using Amazon Athena.
Each business unit can have access to only its own cost and utilization data. The IAM policies that govern the ability to set up AWS Cost and Usage Reports are in place. A central Cost and Usage Report that contains all data for the organization is already available in an Amazon S3 bucket.
Which solution will meet these requirements with the LEAST operational complexity?
A. In the organization's management account, use AWS Resource Access Manager (AWS RAM) to share the Cost and Usage Report data with each member account.
B. In the organization's management account, configure an S3 event to invoke an AWS Lambda function each time a new file arrives in the S3 bucket that contains the central Cost and Usage Report. Configure the Lambda function to extract each member account’s data and to place the data in Amazon S3 under a separate prefix. Modify the S3 bucket policy to allow each member account to access its own prefix.
C. In each member account, access AWS Cost Explorer. Create a new report that contains relevant cost information for the account. Save the report in Cost Explorer. Provide instructions that the account administrators can use to access the saved report.
D. In each member account, create a new S3 bucket to store Cost and Usage Report data. Set up a Cost and Usage Report to deliver the data to the new S3 bucket.
Show Answer
Correct Answer: D
Explanation: The requirement is least operational complexity while ensuring strict data isolation and Athena access. Creating a Cost and Usage Report (CUR) in each member account is the simplest approach: it uses native AWS functionality, automatically scopes data to the owning account, integrates directly with Athena, and avoids custom code, cross-account S3 policies, or Lambda processing. Option B introduces unnecessary architectural and maintenance complexity. Options A and C do not meet the Athena and detailed CUR requirements.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.