A company wants to migrate virtual Microsoft workloads from an on-premises data center to AWS. The company has successfully tested a few sample workloads on AWS. The company also has created an AWS Site-to-Site VPN connection to a VPC. A solutions architect needs to generate a total cost of ownership (TCO) report for the migration of all the workloads from the data center.
Simple Network Management Protocol (SNMP) has been enabled on each VM in the data center. The company cannot add more VMs in the data center and cannot install additional software on the VMs. The discovery data must be automatically imported into AWS Migration Hub.
Which solution will meet these requirements?
A. Use the AWS Application Migration Service agentless service and the AWS Migration Hub Strategy Recommendations to generate the TCO report.
B. Launch a Windows Amazon EC2 instance. Install the Migration Evaluator agentless collector on the EC2 instance. Configure Migration Evaluator to generate the TCO report.
C. Launch a Windows Amazon EC2 instance. Install the Migration Evaluator agentless collector on the EC2 instance. Configure Migration Hub to generate the TCO report.
D. Use the AWS Migration Readiness Assessment tool inside the VPC. Configure Migration Evaluator to generate the TCO report.
Show Answer
Correct Answer: B
Explanation: Migration Evaluator is the AWS service used to produce TCO/business case reports. Because the company cannot install agents on the on-premises VMs but has SNMP enabled, the Migration Evaluator agentless collector is the appropriate choice. The collector can be deployed on a Windows EC2 instance that has connectivity to the on-premises environment over the Site-to-Site VPN, discover the VMware/Microsoft environment agentlessly via SNMP/vCenter, and automatically import discovery data into AWS Migration Hub. Migration Hub itself does not generate TCO reports; it centralizes migration tracking and imported discovery data. Application Migration Service and Migration Readiness Assessment do not satisfy the TCO-report requirement.
Question 65
A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company hosts some applications in a VPC in the company's shared services account.
The company has attached a transit gateway to the VPC in the shared services account.
The company is developing a new capability and has created a development environment that requires access to the applications that are in the shared services account. The company intends to delete and recreate resources frequently in the development account. The company also wants to give a development team the ability to recreate the team's connection to the shared services account as required.
Which solution will meet these requirements?
A. Create a transit gateway in the development account. Create a transit gateway peering request to the shared services account. Configure the shared services transit gateway to automatically accept peering connections.
B. Turn on automatic acceptance for the transit gateway in the shared services account. Use AWS Resource Access Manager (AWS RAM) to share the transit gateway resource in the shared services account with the development account. Accept the resource in the development account. Create a transit gateway attachment in the development account.
C. Turn on automatic acceptance for the transit gateway in the shared services account. Create a VPC endpoint. Use the endpoint policy to grant permissions on the VPC endpoint for the development account. Configure the endpoint service to automatically accept connection requests. Provide the endpoint details to the development team.
D. Create an Amazon EventBridge rule to invoke an AWS Lambda function that accepts the transit gateway attachment when the development account makes an attachment request. Use AWS Network Manager to share the transit gateway in the shared services account with the development account. Accept the transit gateway in the development account.
Show Answer
Correct Answer: B
Explanation: Sharing the existing transit gateway from the shared services account by using AWS Resource Access Manager (AWS RAM), with transit gateway auto-accept enabled, allows the development account to create and recreate its own VPC attachment as needed without manual approval each time. This matches the requirement for frequent recreation and delegated control. Creating a second transit gateway and peering it is unnecessary complexity, VPC endpoints do not solve general VPC-to-VPC connectivity through a transit gateway, and the EventBridge/Lambda approach is unnecessary because transit gateway auto-accept and RAM already provide the required functionality.
Question 66
A company uses AWS Organizations to manage its AWS accounts. A solutions architect must design a solution in which only administrator roles are allowed to use IAM actions. However, the solutions architect does not have access to all the AWS accounts throughout the company.
Which solution meets these requirements with the LEAST operational overhead?
A. Create an SCP that applies to all the AWS accounts to allow IAM actions only for administrator roles. Apply the SCP to the root OU.
B. Configure AWS CloudTrail to invoke an AWS Lambda function for each event that is related to IAM actions. Configure the function to deny the action if the user who invoked the action is not an administrator.
C. Create an SCP that applies to all the AWS accounts to deny IAM actions for all users except for those with administrator roles. Apply the SCP to the root OU.
D. Set an IAM permissions boundary that allows IAM actions. Attach the permissions boundary to every administrator role across all the AWS accounts.
Show Answer
Correct Answer: C
Explanation: Service Control Policies (SCPs) are best used to set organization-wide guardrails. An SCP that explicitly denies IAM actions to everyone except designated administrator roles, applied at the root OU, centrally enforces the restriction across all accounts without requiring access to each account. SCPs cannot grant permissions, only limit them, so an 'allow only administrators' SCP is ineffective if FullAWSAccess or other SCPs remain. CloudTrail+Lambda is reactive rather than preventive, and permissions boundaries require per-role deployment across accounts.
Question 67
A company has many services running in its on-premises data center. The data center is connected to AWS using AWS Direct Connect (DX) and an IPSec VPN. The service data is sensitive and connectivity cannot traverse the internet. The company wants to expand into a new market segment and begin offering its services to other companies that are using AWS.
Which solution will meet these requirements?
A. Create a VPC Endpoint Service that accepts TCP traffic, host it behind a Network Load Balancer, and make the service available over DX.
B. Create a VPC Endpoint Service that accepts HTTP or HTTPS traffic, host it behind an Application Load Balancer, and make the service available over DX.
C. Attach an internet gateway to the VPC, and ensure that network access control and security group rules allow the relevant inbound and outbound traffic.
D. Attach a NAT gateway to the VPC, and ensure that network access control and security group rules allow the relevant inbound and outbound traffic.
Show Answer
Correct Answer: A
Explanation: AWS PrivateLink is the appropriate solution to privately expose services to AWS customers without traversing the public internet. A VPC Endpoint Service is backed by a Network Load Balancer (NLB), not directly by an Application Load Balancer (ALB). Internet gateways and NAT gateways require internet connectivity and do not meet the requirement that traffic must not traverse the internet.
Question 69
A company needs to migrate its website from an on-premises data center to AWS. The website consists of a load balancer, a content management system (CMS) that runs on a Linux operating system, and a MySQL database.
The CMS requires persistent NFS-compatible storage for a file system. The new solution on AWS must be able to scale from 2 Amazon EC2 instances to 30 EC2 instances in response to unpredictable traffic increases. The new solution also must require no changes to the website and must prevent data loss.
Which solution will meet these requirements?
A. Create an Amazon Elastic File System (Amazon EFS) file system. Deploy the CMS to AWS Elastic Beanstalk with an Application Load Balancer and an Auto Scaling group. Use .ebextensions to mount the EFS file system to the EC2 instances. Create an Amazon Aurora MySQL database that is separate from the Elastic Beanstalk environment.
B. Create an Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume. Deploy the CMS to AWS Elastic Beanstalk with a Network Load Balancer and an Auto Scaling group. Use .ebextensions to mount the EBS volume to the EC2 instances. Create an Amazon RDS for MySQL database in the Elastic Beanstalk environment.
C. Create an Amazon Elastic File System (Amazon EFS) file system. Create a launch template and an Auto Scaling group to launch EC2 instances to support the CMS. Create a Network Load Balancer to distribute traffic. Create an Amazon Aurora MySQL database. Use an EC2 Auto Scaling scale-in lifecycle hook to mount the EFS file system to the EC2 instances.
D. Create an Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume. Create a launch template and an Auto Scaling group to launch EC2 instances to support the CMS. Create an Application Load Balancer to distribute traffic. Create an Amazon ElastiCache for Redis cluster to support the MySQL database. Use EC2 user data to attach the EBS volume to the EC2 instances.
Show Answer
Correct Answer: A
Explanation: The CMS requires shared persistent NFS-compatible storage, which Amazon EFS provides. EBS Multi-Attach is not an NFS file system and has attachment and Availability Zone limitations, making B and D unsuitable. Elastic Beanstalk can deploy the application with an Application Load Balancer and Auto Scaling, and .ebextensions can mount EFS automatically on instance launch without changing the application. Using Amazon Aurora MySQL satisfies the managed MySQL database requirement. Option C incorrectly proposes mounting EFS during a scale-in lifecycle hook, which runs when instances are terminating rather than launching.
Question 70
A company is running a web-crawling process on a list of target URLs to obtain training documents for machine learning training algorithms. A fleet of Amazon EC2 t2.micro instances pulls the target URLs from an Amazon Simple Queue Service (Amazon SQS) queue. The instances then write the result of the crawling algorithm as a .csv file to an Amazon Elastic File System (Amazon EFS) volume. The EFS volume is mounted on all instances of the fleet.
A separate system adds the URLs to the SQS queue at infrequent rates. The instances crawl each URL in 10 seconds or less.
Metrics indicate that some instances are idle when no URLs are in the SQS queue. A solutions architect needs to redesign the architecture to optimize costs.
Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)
A. Use m5.8xlarge instances instead of t2.micro instances for the web-crawling process. Reduce the number of instances in the fleet by 50%.
B. Convert the web-crawling process into an AWS Lambda function. Configure the Lambda function to pull URLs from the SQS queue.
C. Modify the web-crawling process to store results in Amazon Neptune.
D. Modify the web-crawling process to store results in an Amazon Aurora Serverless MySQL instance.
E. Modify the web-crawling process to store results in Amazon S3.
Show Answer
Correct Answer: B, E
Explanation: AWS Lambda is a better fit for infrequent, short-lived (<=10 second) queue-driven workloads because it scales on demand and charges only for execution time, eliminating idle EC2 costs. Amazon S3 is a much more cost-effective storage service than Amazon EFS for storing generated CSV output objects. Neptune and Aurora Serverless are databases, which are not appropriate replacements for flat CSV file storage, and using larger EC2 instances would not address idle compute costs.
Question 71
A company is using GitHub Actions to run a CI/CD pipeline that accesses resources on AWS. The company has an IAM user that uses a secret key in the pipeline to authenticate to AWS. An existing IAM role with an attached policy grants the required permissions to deploy resources.
The company’s security team implements a new requirement that pipelines can no longer use long-lived secret keys. A solutions architect must replace the secret key with a short-lived solution.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an IAM SAML 2.0 identity provider (IdP) in AWS Identity and Access Management (IAM). Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRole API call. Attach the existing IAM policy to the new IAM role. Update GitHub to use SAML authentication for the pipeline.
B. Create an IAM OpenID Connect (OIDC) identity provider (IdP) in AWS Identity and Access Management (IAM). Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRoleWithWebIdentity API call from the GitHub OIDC IdP. Update GitHub to assume the role for the pipeline.
C. Create an Amazon Cognito identity pool. Configure the authentication provider to use GitHub. Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRoleWithWebIdentity API call from the GitHub authentication provider. Configure the pipeline to use Cognito as its authentication provider.
D. Create a trust anchor to AWS Private Certificate Authority. Generate a client certificate to use with AWS IAM Roles Anywhere. Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRole API call. Attach the existing IAM policy to the new IAM role. Configure the pipeline to use the credential helper tool and to reference the client certificate public key to assume the new IAM role.
Show Answer
Correct Answer: B
Explanation: GitHub Actions natively supports OpenID Connect (OIDC) federation with AWS IAM. Configuring an IAM OIDC identity provider and an IAM role that trusts GitHub's OIDC provider allows the workflow to call STS AssumeRoleWithWebIdentity and receive short-lived credentials without storing long-lived AWS access keys. This is the AWS-recommended approach and has the least operational overhead. SAML is not the standard integration for GitHub Actions, Cognito is unnecessary for this server-to-server CI/CD use case, and IAM Roles Anywhere is intended for X.509 certificate-based workloads and adds unnecessary complexity.
Question 72
A company wants to record key performance indicators (KPIs) from its application as part of a strategy to convert to a user-based licensing schema. The application is a multi-tier application with a web-based UI. The company saves all log files to Amazon CloudWatch by using the CloudWatch agent. All logins to the application are saved in a log file.
As part of the new license schema, the company needs to find out how many unique users each client has on a daily basis, weekly basis, and monthly basis.
Which solution will provide this information with the LEAST change to the application?
A. Configure an Amazon CloudWatch Logs metric filter that saves each successful login as a metric. Configure the user name and client name as dimensions for the metric.
B. Change the application logic to make each successful login generate a call to the AWS SDK to increment a custom metric that records user name and client name dimensions in CloudWatch.
C. Configure the CloudWatch agent to extract successful login metrics from the logs. Additionally, configure the CloudWatch agent to save the successful login metrics as a custom metric that uses the user name and client name as dimensions for the metric.
D. Configure an AWS Lambda function to consume an Amazon CloudWatch Logs stream of the application logs. Additionally, configure the Lambda function to increment a custom metric in CloudWatch that uses the user name and client name as dimensions for the metric.
Show Answer
Correct Answer: A
Explanation: CloudWatch Logs metric filters can extract fields from existing application logs and publish custom CloudWatch metrics with dimensions, avoiding application code changes. Since the application already writes login events to CloudWatch Logs, configuring a metric filter is the least invasive option. Options B requires code changes, C misstates the CloudWatch agent's capabilities, and D adds unnecessary Lambda processing for a requirement focused on minimizing application changes.
Question 73
A company has an application that analyzes and stores image data on premises. The application receives millions of new image files every day. Files are an average of 1 MB in size. The files are analyzed in batches of 1 GB. When the application analyzes a batch, the application zips the images together. The application then archives the images as a single file in an on-premises NFS server for long-term storage.
The company has a Microsoft Hyper-V environment on premises and has compute capacity available. The company does not have storage capacity and wants to archive the images on AWS. The company needs the ability to retrieve archived data within 1 week of a request.
The company has a 10 Gbps AWS Direct Connect connection between its on-premises data center and AWS. The company needs to set bandwidth limits and schedule archived images to be copied to AWS during non-business hours.
Which solution will meet these requirements MOST cost-effectively?
A. Deploy an AWS DataSync agent on a new GPU-based Amazon EC2 instance. Configure the DataSync agent to copy the batch of files from the NFS on-premises server to Amazon S3 Glacier Instant Retrieval. After the successful copy, delete the data from the on-premises storage.
B. Deploy an AWS DataSync agent as a Hyper-V VM on premises. Configure the DataSync agent to copy the batch of files from the NFS on-premises server to Amazon S3 Glacier Deep Archive. After the successful copy, delete the data from the on-premises storage.
C. Deploy an AWS DataSync agent on a new general purpose Amazon EC2 instance. Configure the DataSync agent to copy the batch of files from the NFS on-premises server to Amazon S3 Standard. After the successful copy, delete the data from the on-premises storage. Create an S3 Lifecycle rule to transition objects from S3 Standard to S3 Glacier Deep Archive after 1 day.
D. Deploy an AWS Storage Gateway Tape Gateway on premises in the Hyper-V environment. Connect the Tape Gateway to AWS. Use automatic tape creation. Specify an Amazon S3 Glacier Deep Archive pool. Eject the tape after the batch of images is copied.
Show Answer
Correct Answer: B
Explanation: The most cost-effective solution is to deploy AWS DataSync as a Hyper-V VM on premises and copy data directly from the on-premises NFS server to Amazon S3 Glacier Deep Archive. DataSync supports scheduling and bandwidth throttling, works with NFS, and can run as a Hyper-V virtual appliance. Glacier Deep Archive is the lowest-cost archival storage class and meets the requirement to retrieve data within 1 week (retrieval is typically within hours, well under a week). Using EC2 for the agent is unnecessary because the source is on premises, storing first in S3 Standard adds avoidable storage cost, and Tape Gateway is intended for virtual tape backup workflows rather than file archive migration.
Question 74
A company needs to run large batch-processing jobs on data that is stored in an Amazon S3 bucket. The jobs perform simulations. The results of the jobs are not time sensitive, and the process can withstand interruptions.
Each job must process 15-20 GB of data when the data is stored in the S3 bucket. The company will store the output from the jobs in a different Amazon S3 bucket for further analysis.
Which solution will meet these requirements MOST cost-effectively?
A. Create a serverless data pipeline. Use AWS Step Functions for orchestration. Use AWS Lambda functions with provisioned capacity to process the data.
B. Create an AWS Batch compute environment that includes Amazon EC2 Spot Instances. Specify the SPOT_CAPACITY_OPTIMIZED allocation strategy.
C. Create an AWS Batch compute environment that includes Amazon EC2 On-Demand Instances and Spot Instances. Specify the SPOT_CAPACITY_OPTIMIZED allocation strategy for the Spot Instances.
D. Use Amazon Elastic Kubernetes Service (Amazon EKS) to run the processing jobs. Use managed node groups that contain a combination of Amazon EC2 On-Demand Instances and Spot Instances.
Show Answer
Correct Answer: B
Explanation: AWS Batch is purpose-built for large batch-processing workloads. Because the jobs are interruption-tolerant and not time sensitive, using EC2 Spot Instances provides the lowest cost. The SPOT_CAPACITY_OPTIMIZED allocation strategy helps reduce interruptions by selecting Spot capacity pools with optimal availability. Lambda is unsuitable for 15–20 GB batch simulations due to execution and resource limits, and EKS adds unnecessary operational overhead. Mixing On-Demand with Spot increases cost without a stated requirement for guaranteed capacity.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.