A solutions architect must provide a secure way for a team of cloud engineers to use the AWS CLI to upload objects into an Amazon S3 bucket. Each cloud engineer has an IAM user, IAM access keys, and a virtual multi-factor authentication (MFA) device. The IAM users for the cloud engineers are in a group that is named S3-access. The cloud engineers must use MFA to perform any actions in Amazon S3.
Which solution will meet these requirements?
A. Attach a policy to the S3 bucket to prompt the IAM user for an MFA code when the IAM user performs actions on the S3 bucket. Use IAM access keys with the AWS CLI to call Amazon S3.
B. Update the trust policy for the S3-access group to require principals to use MFA when principals assume the group. Use IAM access keys with the AWS CLI to call Amazon S3.
C. Attach a policy to the S3-access group to deny all S3 actions unless MFA is present. Use IAM access keys with the AWS CLI to call Amazon S3.
D. Attach a policy to the S3-access group to deny all S3 actions unless MFA is present. Request temporary credentials from AWS Security Token Service (AWS STS). Attach the temporary credentials in a profile that Amazon S3 will reference when the user performs actions in Amazon S3.
Show Answer
Correct Answer: D
Explanation: IAM policy conditions can require MFA using the aws:MultiFactorAuthPresent context key, but that context is only present when using temporary credentials obtained through AWS STS after authenticating with MFA (for example, GetSessionToken). Long-term IAM access keys used directly with the AWS CLI do not include MFA context, so simply attaching a deny-unless-MFA policy while continuing to use long-term access keys will deny access. IAM groups do not have trust policies, and S3 bucket policies cannot prompt for MFA. Therefore, the correct approach is to enforce MFA in policy and use STS temporary credentials with the AWS CLI.
Question 77
A company needs to modernize an application and migrate the application to AWS. The application stores user profile data as text in a single table in an on-premises MySQL database.
After the modernization, users will use the application to upload video files that are up to 4 GB in size. Other users must be able to download the video files from the application. The company needs a video storage solution that provides rapid scaling. The solution must not affect application performance.
Which solution will meet these requirements?
A. Migrate the database to Amazon Aurora PostgreSQL by using AWS Database Migration Service (AWS DMS). Store the videos as base64-encoded strings in a TEXT column in the database.
B. Migrate the database to Amazon DynamoDB by using AWS Database Migration Service (AWS DMS) with the AWS Schema Conversion Tool (AWS SCT). Store the videos as objects in Amazon S3. Store the S3 key in the corresponding DynamoDB item.
C. Migrate the database to Amazon Keyspaces (for Apache Cassandra) by using AWS Database Migration Service (AWS DMS) with the AWS Schema Conversion Tool (AWS SCT). Store the videos as objects in Amazon S3. Store the S3 object identifier in the corresponding Amazon Keyspaces entry.
D. Migrate the database to Amazon DynamoDB by using AWS Database Migration Service (AWS DMS) with the AWS Schema Conversion Tool (AWS SCT). Store the videos as base64-encoded strings in the corresponding DynamoDB item.
Show Answer
Correct Answer: B
Explanation: Large binary files such as 4 GB videos should be stored in Amazon S3, which provides virtually unlimited, rapidly scalable object storage without burdening the database. The database should store only metadata and the S3 object key. For modernizing a simple user-profile table from MySQL, DynamoDB is an appropriate managed NoSQL target when using AWS SCT and AWS DMS for schema conversion and migration. Storing large videos as base64 in a database (Aurora or DynamoDB) is inefficient and harms performance. Amazon Keyspaces is not the appropriate choice for this access pattern.
Question 78
A company needs to migrate 60 on-premises legacy applications to AWS. The applications are based on the NET Framework and run on Windows.
The company needs a solution that minimizes migration time and requires no application code changes. The company also does not want to manage the infrastructure.
Which solution will meet these requirements?
A. Refactor the applications and containerize them by using AWS Toolkit for NET Refactoring. Use Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type to host the containerized applications.
B. Use the Windows Web Application Migration Assistant to migrate the applications to AWS Elastic Beanstalk. Use Elastic Beanstalk to deploy and manage the applications.
C. Use the Windows Web Application Migration Assistant to migrate the applications to Amazon EC2 instances. Use the EC2 instances to deploy and manage the applications.
D. Refactor the applications and containerize them by using AWS Toolkit for NET Refactoring. Use Amazon Elastic Kubernetes Service (Amazon EKS) with the Fargate launch type to host the containerized applications.
Show Answer
Correct Answer: B
Explanation: The requirements are to minimize migration time, avoid application code changes, and avoid managing infrastructure. Options A and D require refactoring/containerization, which conflicts with the no code changes requirement. Option C uses EC2, which requires infrastructure management. Windows Web Application Migration Assistant is designed to migrate .NET Framework Windows web applications to AWS Elastic Beanstalk, and Elastic Beanstalk manages the underlying infrastructure, making B the best fit.
Question 79
A company is designing an AWS environment for a manufacturing application. The application has been successful with customers, and the application's user base has increased. The company has connected the AWS environment to the company's on-premises data center through a 1 Gbps AWS Direct Connect connection. The company has configured BGP for the connection.
The company must update the existing network connectivity solution to ensure that the solution is highly available, fault tolerant, and secure.
Which solution will meet these requirements MOST cost-effectively?
A. Add a dynamic private IP AWS Site-to-Site VPN as a secondary path to secure data in transit and provide resilience for the Direct Connect connection. Configure MACsec to encrypt traffic inside the Direct Connect connection.
B. Provision another Direct Connect connection between the company's on-premises data center and AWS to increase the transfer speed and provide resilience. Configure MACsec to encrypt traffic inside the Direct Connect connection.
C. Configure multiple private VIFs. Load balance data across the VIFs between the on-premises data center and AWS to provide resilience.
D. Add a static AWS Site-to-Site VPN as a secondary path to secure data in transit and to provide resilience for the Direct Connect connection.
Show Answer
Correct Answer: D
Explanation: The existing Direct Connect is 1 Gbps, which does not support MACsec. Therefore, options that require configuring MACsec are not applicable. Multiple VIFs do not provide physical redundancy, and adding a second Direct Connect is more expensive than necessary. A Site-to-Site VPN provides encrypted traffic and a resilient backup path to Direct Connect, making the static VPN option the only viable and most cost-effective choice from the options provided.
Question 80
A company that has multiple business units is using AWS Organizations with all features enabled. The company has implemented an account structure in which each business unit has its own AWS account. Administrators in each AWS account need to view detailed cost and utilization data for their account by using Amazon Athena.
Each business unit can have access to only its own cost and utilization data. The IAM policies that govern the ability to set up AWS Cost and Usage Reports are in place. A central Cost and Usage Report that contains all data for the organization is already available in an Amazon S3 bucket.
Which solution will meet these requirements with the LEAST operational complexity?
A. In the organization's management account, use AWS Resource Access Manager (AWS RAM) to share the Cost and Usage Report data with each member account.
B. In the organization's management account, configure an S3 event to invoke an AWS Lambda function each time a new file arrives in the S3 bucket that contains the central Cost and Usage Report. Configure the Lambda function to extract each member account’s data and to place the data in Amazon S3 under a separate prefix. Modify the S3 bucket policy to allow each member account to access its own prefix.
C. In each member account, access AWS Cost Explorer. Create a new report that contains relevant cost information for the account. Save the report in Cost Explorer. Provide instructions that the account administrators can use to access the saved report.
D. In each member account, create a new S3 bucket to store Cost and Usage Report data. Set up a Cost and Usage Report to deliver the data to the new S3 bucket.
Show Answer
Correct Answer: D
Explanation: Each member account can create its own Cost and Usage Report that delivers only that account's data to an S3 bucket it owns. Administrators can then query the report with Athena without seeing other business units' data. This uses native CUR functionality and avoids building and maintaining custom Lambda-based processing or sharing mechanisms. AWS RAM does not solve per-account filtering of CUR data, and Cost Explorer reports do not satisfy the Athena requirement.
Question 82
A company is deploying a new web-based application and needs a storage solution for the Linux application servers. The company wants to create a single location for updates to application data for all instances. The active dataset will be up to 100 GB in size. A solutions architect has determined that peak operations will occur for 3 hours daily and will require a total of 225 MiBps of read throughput.
The solutions architect must design a Multi-AZ solution that makes a copy of the data available in another AWS Region for disaster recovery (DR). The DR copy has an RPO of less than 1 hour.
Which solution will meet these requirements?
A. Deploy a new Amazon Elastic File System (Amazon EFS) Multi-AZ file system. Configure the file system for 75 MiBps of provisioned throughput. Implement replication to a file system in the DR Region.
B. Deploy a new Amazon FSx for Lustre file system. Configure Bursting Throughput mode for the file system. Use AWS Backup to back up the file system to the DR Region.
C. Deploy a General Purpose SSD (gp3) Amazon Elastic Block Store (Amazon EBS) volume with 225 MiBps of throughput. Enable Multi-Attach for the EBS volume. Use AWS Elastic Disaster Recovery to replicate the EBS volume to the DR Region.
D. Deploy an Amazon FSx for OpenZFS file system in both the production Region and the DR Region. Create an AWS DataSync scheduled task to replicate the data from the production file system to the DR file system every 10 minutes.
Show Answer
Correct Answer: A
Explanation: Amazon EFS is a Multi-AZ shared file system for Linux instances and supports native cross-Region replication with an RPO typically well under 1 hour. Provisioned throughput of 75 MiBps is sufficient because EFS read throughput can reach up to 3x the provisioned write throughput, providing 225 MiBps of read throughput. The other options fail requirements: FSx for Lustre does not meet the stated DR/RPO approach, gp3 EBS does not support Multi-Attach, and AWS DataSync scheduled tasks cannot run every 10 minutes (minimum 1 hour).
Question 83
A company used AWS CloudFormation to create all new infrastructure in its AWS member accounts. The resources rarely change and are properly sized for the expected load. The monthly AWS bill is consistent.
Occasionally, a developer creates a new resource for testing and forgets to remove the resource when the test is complete. Most of these tests last a few days before the resources are no longer needed.
The company wants to automate the process of finding unused resources. A solutions architect needs to design a solution that determines whether the cost in the AWS bill is increasing. The solution must help identify resources that cause an increase in cost and must automatically notify the company's operations team.
Which solution will meet these requirements?
A. Turn on billing alerts. Use AWS Cost Explorer to determine the costs for the past month. Create an Amazon CloudWatch alarm for total estimated charges. Specify a cost threshold that is higher than the costs that Cost Explorer determined. Add a notification to alert the operations team if the alarm threshold is breached.
B. Turn on billing alerts. Use AWS Cost Explorer to determine the average monthly costs for the past 3 months. Create an Amazon CloudWatch alarm for total estimated charges. Specify a cost threshold that is higher than the costs that Cost Explorer determined. Add a notification to alert the operations team if the alarm threshold is breached.
C. Use AWS Cost Anomaly Detection to create a cost monitor that has a monitor type of Linked account. Create a subscription to send daily AWS cost summaries to the operations team. Specify a threshold for cost variance.
D. Use AWS Cost Anomaly Detection to create a cost monitor that has a monitor type of AWS services. Create a subscription to send daily AWS cost summaries to the operations team. Specify a threshold for cost variance.
Show Answer
Correct Answer: D
Explanation: AWS Cost Anomaly Detection is designed to automatically detect unexpected increases in spend and notify teams. An AWS services monitor provides service-level anomaly detection, making it easier to identify which service is driving the increased cost, which aligns better with the requirement to identify the cause of cost increases. CloudWatch billing alarms only alert on total charges and do not identify the source of the increase.
Question 84
A company uses AWS Organizations to manage its development environment. Each development team at the company has its own AWS account. Each account has a single VPC and CIDR blocks that do not overlap.
The company has an Amazon Aurora DB cluster in a shared services account. All the development teams need to work with live data from the DB cluster.
Which solution will provide the required connectivity to the DB cluster with the LEAST operational overhead?
A. Create an AWS Resource Access Manager (AWS RAM) resource share for the DB cluster. Share the DB cluster with all the development accounts.
B. Create a transit gateway in the shared services account. Create an AWS Resource Access Manager (AWS RAM) resource share for the transit gateway. Share the transit gateway with all the development accounts. Instruct the developers to accept the resource share. Configure networking.
C. Create an Application Load Balancer (ALB) that points to the IP address of the DB cluster. Create an AWS PrivateLink endpoint service that uses the ALB. Add permissions to allow each development account to connect to the endpoint service.
D. Create an AWS Site-to-Site VPN connection in the shared services account. Configure networking. Use AWS Marketplace VPN software in each development account to connect to the Site-to-Site VPN connection.
Show Answer
Correct Answer: B
Explanation: AWS RAM sharing for Aurora DB clusters supports sharing for cross-account cloning, not direct live connectivity to the running database. The requirement is for all development VPCs to connect to the shared Aurora cluster. A transit gateway shared through AWS RAM provides scalable, centralized VPC connectivity across multiple AWS accounts with non-overlapping CIDRs and the least ongoing operational overhead. Option C is invalid because AWS PrivateLink endpoint services require a Network Load Balancer, not an Application Load Balancer, and Aurora cannot be fronted this way. Option D adds unnecessary VPN complexity.
Question 85
A company has an on-premises data center and is using Kubernetes to develop a new solution on AWS. The company uses Amazon Elastic Kubernetes Service (Amazon EKS) clusters for its development and test environments.
The EKS control plane and data plane for production workloads must reside on premises. The company needs an AWS managed solution for Kubernetes management.
Which solution will meet these requirements with the LEAST operational overhead?
A. Install an AWS Outposts server in the on-premises data center. Deploy Amazon EKS by using a local cluster configuration on the Outposts server for the production workloads.
B. Install Amazon EKS Anywhere on the company's hardware in the on-premises data center. Deploy the production workloads on an EKS Anywhere cluster.
C. Install an AWS Outposts server in the on-premises data center. Deploy Amazon EKS by using an extended cluster configuration on the Outposts server for the production workloads.
D. Install an AWS Outposts server in the on-premises data center. Install Amazon EKS Anywhere on the Outposts server. Deploy the production workloads on an EKS Anywhere cluster.
Show Answer
Correct Answer: A
Explanation: Amazon EKS on AWS Outposts with a local cluster places both the Kubernetes control plane and worker nodes on the Outposts hardware in the on-premises data center while remaining an AWS-managed EKS offering. EKS Anywhere runs on customer-managed infrastructure and is self-managed, so it has higher operational overhead. An extended Outposts cluster keeps the control plane in the AWS Region, which does not satisfy the requirement that the control plane reside on premises.
Question 86
A public retail web application uses an Application Load Balancer (ALB) in front of Amazon EC2 instances running across multiple Availability Zones (AZs) in a Region backed by an Amazon RDS MySQL Multi-AZ deployment. Target group health checks are configured to use HTTP and pointed at the product catalog page. Auto Scaling is configured to maintain the web fleet size based on the ALB health check.
Recently, the application experienced an outage. Auto Scaling continuously replaced the instances during the outage. A subsequent investigation determined that the web server metrics were within the normal range, but the database tier was experiencing high load, resulting in severely elevated query response times.
Which of the following changes together would remediate these issues while improving monitoring capabilities for the availability and functionality of the entire application stack for future growth? (Choose two.)
A. Configure read replicas for Amazon RDS MySQL and use the single reader endpoint in the web application to reduce the load on the backend database tier.
B. Configure the target group health check to point at a simple HTML page instead of a product catalog page and the Amazon Route 53 health check against the product page to evaluate full application functionality. Configure Amazon CloudWatch alarms to notify administrators when the site fails.
C. Configure the target group health check to use a TCP check of the Amazon EC2 web server and the Amazon Route 53 health check against the product page to evaluate full application functionality. Configure Amazon CloudWatch alarms to notify administrators when the site fails.
D. Configure an Amazon CloudWatch alarm for Amazon RDS with an action to recover a high-load, impaired RDS instance in the database tier.
E. Configure an Amazon ElastiCache cluster and place it between the web application and RDS MySQL instances to reduce the load on the backend database tier.
Show Answer
Correct Answer: B, E
Explanation: Use lightweight ALB health checks that validate only web server availability to avoid replacing healthy instances when the database is slow, while using an external end-to-end health check and CloudWatch alarms to monitor full application functionality. Reduce database load for scalability by adding ElastiCache in front of RDS. Read replicas are less appropriate here because the option incorrectly refers to a single reader endpoint for RDS MySQL and not all load is necessarily read-only. TCP health checks are too shallow, and RDS recovery actions do not address high load.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.