QUESTION 81
A healthcare company is designing a system to store and manage logs in the AWS Cloud. The system ingests and stores logs that are in JSON format. The logs contain sensitive patient information. The company must identify any sensitive data. The company must be able to search the log data by using SQL queries. Which solution will meet these requirements?
A. Store the logs in an Amazon S3 bucket. Configure Amazon Macie to discover sensitive data. Use Amazon Athena to query the logs.
B. Store the logs in an Amazon Elastic Block Store (Amazon EBS) volume. Create an application that uses Amazon SageMaker AI to detect sensitive data. Use Amazon RDS to query the logs.
C. Store the logs in Amazon DynamoDB. Use AWS Key Management Service (AWS KMS) to discover sensitive data. Use Amazon Redshift Spectrum to query the logs.
D. Store the logs in an Amazon S3 bucket. Use Amazon Inspector to discover sensitive data. Use Amazon Athena to query the logs.
Correct Answer: A
QUESTION 82
An application is experiencing performance issues based on increased demand. This increased demand is on read-only historical records pulled from an Amazon RDS-hosted database with custom views and queries. A solutions architect must improve performance without changing the database structure. Which approach will improve performance and MINIMIZE management overhead?
A. Deploy Amazon DynamoDB, move all the data, and point to DynamoDB.
B. Deploy Amazon ElastiCache (Redis OSS) and cache the data for the application.
C. Deploy Memcached on Amazon EC2 and cache the data for the application.
D. Deploy Amazon DynamoDB Accelerator (DAX) on Amazon RDS to improve cache performance.
Correct Answer: B
QUESTION 83
A company is hosting its website on Amazon S3 and is using Amazon CloudFront to cache content. The company has an upcoming product launch. An employee accidentally published marketing content to the website before the official release of the product. The company needs to remove the marketing content from the website as quickly as possible. Which solution will meet these requirements?
A. Deploy the updated version of the website to another S3 bucket. Update the origin for CloudFront.
B. Delete the marketing content in the existing S3 bucket. Invalidate the file path in CloudFront.
C. Create a new CloudFront cache policy with a low TTL. Associate the new policy with the existing CloudFront distribution.
D. Delete the marketing content in the existing S3 bucket. Update the S3 bucket policy to block requests to the file path.
Correct Answer: B
QUESTION 84
A company uses AWS CloudFormation to deploy IAM resources within accounts that AWS Control Tower governs. The security team wants to prevent the deployment of IAM roles that include inline policies with the following statements:
“Effect”: “Allow”,
“Action”: “*”,
“Resource”: “*”
Which solution will meet this requirement?
A. Use AWS Control Tower proactive controls to block CloudFormation stacks that match these inline policy statements.
B. Use AWS Control Tower detective controls to detect and delete IAM inline policies that contain these statements upon deployment.
C. Use AWS Config to create a rule that detects these statements in any inline IAM policies. Configure the rule to automatically remove these statements by using the AWS-DeleteIAMInlinePolicy remediation.
D. Use AWS Config to create a rule that detects these statements in inline IAM policies and sends a notification to the security team.
Correct Answer: A
QUESTION 85
A media company needs to migrate its Windows-based video editing environment to AWS. The company’s current environment processes 4K video files that require sustained throughput of 2 GB per second across multiple concurrent users. The company’s storage needs increase by 1 TB each week. The company needs a shared file system that supports SMB protocol and can scale automatically based on storage demands. Which solution will meet these requirements?
A. Deploy an Amazon FSx for Windows File Server Multi-AZ file system with SSD storage.
B. Deploy an Amazon Elastic File System (Amazon EFS) file system in Max I/0 mode. Provision mount targets in multiple Availability Zones.
C. Deploy an Amazon FSx for Lustre file system with a Persistent 2 deployment type. Provision the file system with 2 TB of storage.
D. Deploy Amazon S3 File Gateway by using multiple cached gateway instances. Configure S3 Transfer Acceleration.
Correct Answer: A
QUESTION 86
A company manages an application that stores data on an Amazon RDS for PostgreSQL Multi-AZ DB instance. High traffic on the application is causing increased latency for many read queries. A solutions architect must improve the performance of the application. Which solution will meet this requirement?
A. Enable Amazon RDS Performance Insights. Configure storage capacity to scale automatically.
B. Configure the DB instance to use DynamoDB Accelerator (DAX).
C. Create a read replica of the DB instance. Serve read traffic from the read replica.
D. Use Amazon Data Firehose between the application and Amazon RDS to increase the concurrency of database requests.
Correct Answer: C
QUESTION 87
A company is building a solution to provide customers with an API that accesses financial data. The API backend needs to compute tax data for each request. The company anticipates greater demand to access the data during the last 3 months of each year. A solutions architect needs to design a scalable solution that can meet the regular demand and the peak demand at the end of each year. Which solution will meet these requirements?
A. Host the API on an Amazon EC2 instance that runs third-party software. Configure the EC2 instance to perform tax computations.
B. Deploy an Amazon API Gateway REST API. Create an AWS Lambda function to perform tax computations. Integrate the Lambda function with the REST API.
C. Create an Application Load Balancer (ALB) in front of two Amazon EC2 instances. Configure the EC2 instances to perform tax computations.
D. Deploy an Amazon API Gateway REST API. Configure an Amazon EC2 instance to perform tax computations. Integrate the EC2 instance with the REST API.
Correct Answer: B
QUESTION 88
A company uses Amazon Redshift for its data warehouse. The company wants to ensure high durability for its data in case of any component failure. What should a solutions architect recommend?
A. Enable concurrency scaling.
B. Enable cross-Region snapshots.
C. Increase the data retention period
D. Deploy Amazon Redshift in Multi-AZ.
Correct Answer: B
QUESTION 89
A company uses Amazon Route 53 as its DNS provider. The company hosts a website both on premises and in the AWS Cloud. The company’s on-premises data center is near the us-west-1 Region. The company hosts the website on AWS in the eu-central-1 Region. The company wants to optimize load times for the website as much as possible.
Which solution will meet these requirements?
A. Create a DNS record with a failover routing policy that routes all primary traffic to eu-central-1. Configure the routing policy to use the on-premises data center as the secondary location.
B. Create a DNS record with an IP-based routing policy. Configure specific IP ranges to return the value for the eu-central-1 website. Configure all other IP ranges to return the value for the on-premises website.
C. Create a DNS record with a latency-based routing policy. Associate the record for the on-premises data center with us-west-1.
D. Create a DNS record with a weighted routing policy. Split the traffic evenly between eu-central-1 and the on-premises data center.
Correct Answer: C
QUESTION 90
A company has an internet-facing application that runs on premises. The application contains mostly user-generated content. The data is stored in an on-premises network- attached storage system. The company wants to archive this data annually and has chosen to move the archival data to Amazon S3. The company needs a solution to migrate the archival data into an 53 bucket. Which solution will meet these requirements?
A. Use AWS Storage Gateway Volume Gateway. Cache the data, and then replicate the data from the on-premises environment to Amazon S3.
B. Use AWS DataSync. Create a configuration to replicate the data from the on-premises environment to Amazon S3.
C. Use AWS Transfer Family. Use an SFTP client to serially transfer the data from the on-premises environment to Amazon S3.
D. Use Amazon S3 Transfer Acceleration. Use a third-party backup utility to replicate the data from the on-premises environment to Amazon S3.
Correct Answer: B
QUESTION 91
A company’s solutions architect is building a static website to be deployed in Amazon S3 for a production environment. The website integrates with an Amazon Aurora PostgreSQL database by using an AWS Lambda function. The website that is deployed to production will use a Lambda alias that points to a specific version of the Lambda function. The company must rotate the database credentials every 2 weeks. Lambda functions that the company deployed previously must be able to use the most recent credentials. Which solution will meet these requirements?
A. Store the database credentials in AWS Secrets Manager. Turn on rotation. Write code in the Lambda function to retrieve the credentials from Secrets Manager.
B. Include the database credentials as part of the Lambda function code. Update the credentials periodically and deploy the new Lambda function.
C. Use Lambda environment variables. Update the environment variables when new credentials are available.
D. Store the database credentials in AWS Systems Manager Parameter Store. Turn on rotation. Write code in the Lambda function to retrieve the credentials from Systems Manager Parameter Store.
Correct Answer: A
QUESTION 92
A solutions architect has an application container, an AWS Lambda function, and an Amazon Simple Queue Service (Amazon SQS) queue. The Lambda function uses the SQS queue as an event source. The Lambda function makes a call to a third-party machine learning (ML) API when the function is invoked. The response from the third-party API can take up to 60 seconds to return. The Lambda function’s timeout value is currently 65 seconds. The solutions architect has noticed that the Lambda function sometimes processes duplicate messages from the SQS queue. What should the solutions architect do to ensure that the Lambda function does not process duplicate messages?
A. Configure the Lambda function with a larger amount of memory.
B. Configure an increase in the Lambda function’s timeout value.
C. Configure the SQS queue’s delivery delay value to be greater than the maximum time it takes to call the third-party API.
D. Configure the SQS queue’s visibility timeout value to be greater than the maximum time it takes to call the third-party API.
Correct Answer: D
QUESTION 93
A company is storing data that will not be frequently accessed in the AWS Cloud. If the company needs to access the data, the data needs to be retrieved within 12 hours. The company wants a solution that is cost-effective for storage costs for each gigabyte. Which Amazon S3 storage class will meet these requirements?
A. S3 Standard
B. S3 Glacier Flexible Retrieval
C. S3 One Zone-Infrequent Access (S3 One Zone-IA)
D. S3 Standard-Infrequent Access (S3 Standard-IA)
Correct Answer: D
QUESTION 94
A company is building a data processing application that uses AWS Lambda functions. The application’s Lambda functions need to communicate with an Amazon RDS DB instance that is deployed within a VPC in the same AWS account. Which solution meets these requirements in the MOST secure way?
A. Configure the DB instance to allow public access. Update the DB instance security group to allow access from the Lambda public address space for the AWS Region.
B. Deploy the Lambda functions inside the VPC. Attach a network ACL to the Lambda subnet. Provide outbound rule access to the VPC CIDR range only. Update the DB instance security group to allow traffic from 0.0.0.0/0.
C. Deploy the Lambda functions inside the VPC. Attach a security group to the Lambda functions. Provide outbound rule access to the VPC CIDR range only. Update the DB instance security group to allow traffic from the Lambda security group.
D. Peer the Lambda default VPC with the VPC that hosts the DB instance to allow direct network access without the need for security groups.
Correct Answer: C
QUESTION 95
A company has a web application that users access from around the world. The company has web servers in multiple AWS Regions to support the traffic. A solutions architect must configure an Amazon Route 53 routing policy to send traffic to only the active web servers. Which configuration meets this requirement?
A. Create a simple routing policy that uses health checks for each Region.
B. Create a multivalue answer routing policy that uses health checks for each Region.
C. Create a geoproximity routing policy with a health check bias of 99 for each Region.
D. Create a weighted routing policy with a health check weight of 100 for each Region.
Correct Answer: B
QUESTION 96
A company is building a serverless application that processes large volumes of data from a mobile app. The application uses an AWS Lambda function to process the data and store the data in an Amazon DynamoDB table. The company needs to ensure that the application can recover from failures and continue processing data without losing any records. Which solution will meet these requirements?
A. Configure the Lambda function to use a dead-letter queue with an Amazon Simple Queue Service (Amazon SQS) queue. Configure Lambda to retry failed records from the dead-letter queue. Use a retry mechanism by implementing an exponential backoff algorithm.
B. Configure the Lambda function to read records from Amazon Data Firehose. Replay the Firehose records in case of any failures.
C. Use Amazon OpenSearch Service to store failed records. Configure AWS Lambda to retry failed records from OpenSearch Service. Use Amazon EventBridge to orchestrate the retry logic.
D. Use Amazon Simple Notification Service (Amazon SNS) to store the failed records. Configure Lambda to retry failed records from the SNS topic. Use Amazon API Gateway to orchestrate the retry calls.
Correct Answer: A
QUESTION 97
A company has resources across multiple AWS Regions and accounts. A newly hired solutions architect discovers a previous employee did not provide details about the resources inventory. The solutions architect needs to build and map the relationship details of the various workloads. across all accounts. which solution will meet these requirements in the MOST operationally efficient way?
A. Use AWS Systems Manager Inventory to generate a map view from the detailed view report.
B. Use AWS Step Functions to collect workload details. Build architecture diagrams of the workloads manually.
C. Use Workload Discovery on AWS to generate architecture diagrams of the workloads.
D. Use AWS X-Ray to view the workload details. Build architecture diagrams with relationships.
Correct Answer: C
QUESTION 98
A company has a single AWS account. The company runs workloads on Amazon EC2 instances in multiple VPCs in one AWS Region. The company also runs workloads in an on-premises data center that connects to the company’s AWS account by using AWS Direct Connect. The company needs all EC2 instances in the VPCs to resolve DNS queries for the internal.example.com domain to the authoritative DNS server that is located in the on- premises data center. The solution must use private communication between the VPCs and the on-premises network. All route tables, network ACLs, and security groups are configured correctly between AWS and the on-premises data center. Which combination of actions will meet these requirements? (Select THREE.)
A. Create an Amazon Route 53 inbound endpoint in all the workload VPCs.
B. Create an Amazon Route 53 outbound endpoint in one of the workload VPCs.
C. Create an Amazon Route 53 Resolver rule with the Forward type configured to forward queries for internal.example.com to the on-premises DNS server.
D. Create an Amazon Route 53 Resolver rule with the System type configured to forward queries for internal.example.com to the on-premises DNS server.
E. Associate the Amazon Route 53 Resolver rule with all the workload VPCs.
F. Associate the Amazon Route 53 Resolver rule with the workload VPC with the new Route 53 endpoint.
Correct Answer: BCE
QUESTION 99
A solutions architect has AWS Lambda functions that need to access a company’s internal data science libraries and reference data. Separate teams manage the libraries and the data. The teams must be able to update and upload new data independently. The Lambda functions are connected to the company’s central VPC. Which solution will provide the Lambda functions with access to the libraries and data?
A. Attach an Amazon EBS volume to the Lambda functions by using EBS Multi-Attach in the central VPC. Update the Lambda function execution roles to give the functions access to the EBS volume. Update the Lambda function code to reference the files in the EBS volume.
B. Compress the libraries and reference data in a Lambda /tmp folder. Update the Lambda function code to reference the files in the /tmp folder.
C. Set up an Amazon EFS file system with mount targets in the central VPC. Configure the Lambda functions to mount the EFS file system. Update the Lambda function execution roles to give the functions access to the EFS file system.
D. Set up an Amazon FSx for Windows File Server file system with mount targets in the central VPC. Configure the Lambda functions to mount the Amazon FSx file system. Update the Lambda function execution roles to give the functions access to the Amazon FSx file system.
Correct Answer: C
QUESTION 100
A company’s ecommerce platform experiences unpredictable surges in traffic related to periodic sale events. The platform’s web tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. EC2 worker instances in an Auto Scaling group process orders. The company needs a solution that accepts orders immediately, processes the orders asynchronously, and never loses orders if a worker instance experiences an application problem. Which solution will meet these requirements with the LEAST operational overhead?
A. Create an AWS Lambda function. Configure the web tier EC2 instances to invoke the Lambda function synchronously for each order. Configure the Lambda function to write the processed results directly to an Amazon DynamoDB table.
B. Configure the web tier EC2 instances to publish order details to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe a shared worker email address to the topic for processing.
C. Configure the web tier EC2 instances to place order messages into an Amazon Simple Queue Service (Amazon SQS) standard queue. Configure the Auto Scaling group of worker EC2 instances to poll the queue and write the results to an Amazon DynamoDB table.
D. Configure the web tier EC2 instances to insert orders into an Amazon RDS for MySQL table. Configure an AWS Lambda function to query unprocessed rows once each minute and update the row status.
Correct Answer: C