QUESTION 101
A company operates multiple VPCs in a single AWS account. Account users need temporary access to Amazon S3 buckets. The S3 buckets are private and have no public endpoints. The solution must use the principle of least privilege for access to each environment and avoid distributing permanent access keys. Which solution will meet these requirements?

A. Create a gateway VPC endpoint for Amazon S3 in each VPC. Attach an endpoint policy that allows only environment-scoped IAM roles to access the S3 buckets.
B. Configure the S3 buckets to use server-side encryption with Amazon S3 managed keys (SSE-S3). Create S3 bucket policies that allow access only from the VPC CIDR blocks.
C. Define separate Amazon S3 access points for each environment. Allow users to assume a role associated with the access points. Use the default Amazon S3 endpoints.
D. Route Amazon S3 traffic through a NAT gateway. Configure S3 bucket policies that allow traffic from only the NAT gateway’s public IP addresses.

Correct Answer: C

QUESTION 102
A financial company is migrating its banking applications to a set of AWS accounts managed by AWS Organizations. The applications will store sensitive customer data on Amazon Elastic Block Store (Amazon EBS) olumes. The company will take regular snapshots for backup purposes. The company wants to implement controls across all AWS accounts to prevent sharing EBS snapshots publicly. Which solution will meet these requirements with the LEAST operational overhead?

A. Enable AWS Config rules for each organizational unit (OU) in Organizations to monitor EBS snapshot permissions.
B. Enable block public access for EBS snapshots at the organization level.
C. Create an IAM policy in the root account of the organization that prevents users from modifying snapshot permissions.
D. Use AWS CloudTrail to track snapshot permission changes.

Correct Answer: A

QUESTION 103
A company is running a multi-tier web application on AWS. The application runs its database tier on Amazon Aurora MySQL. The application and database tiers are in the us-east-1 Region. A database administrator who monitors the Aurora DB cluster finds that an intermittent increase in read traffic is creating high CPU utilization on the read replica. The result is increased read latency for the application. The memory and disk utilization of the DB instance are stable throughout the event of increased latency. What should a solutions architect do to improve the read scalability?

A. Reboot the DB cluster.
B. Create a cross-Region read replica.
C. Configure Aurora Auto Scaling for the read replica.
D. Increase the provisioned read IOPS for the DB instance.
Correct Answer: C

QUESTION 104
A company manages millions of documents in hundreds of Amazon S3 buckets in multiple AWS Regions. The company must determine whether any of the S3 buckets contain personally identifiable information (PII). Which solution will meet this requirement with the LEAST operational overhead?

A. Use Amazon Detective to detect PII in the S3 buckets.
B. Use AWS Trusted Advisor to generate PII notifications.
C. Use Amazon Macie to detect PII in the S3 buckets.
D. Use AWS Lambda functions to review each file in the S3 buckets to identify PII.

Correct Answer: C

QUESTION 105
A company runs a backend service on Amazon EC2 instances that run Amazon Linux. The backend service depends on JSON documents that contain sensitive information, such as API keys stored locally on the file system of each instance. A solutions architect needs to design a solution that stores this information securely. The solution must provide role-based and fine-grained access to individual API keys. The company’s compliance policy requires that all sensitive information is available in more than one AWS Region. Which solution will meet these requirements?

A. Mount the EC2 instance to an Amazon Elastic File System (Amazon EFS) file system distributed across two or more Availability Zones. Enable encryption of data at rest and data in transit.
B. Transfer the documents to an Amazon DocumentDB database. Modify the backend service to read the secrets from the DocumentDB database.
C. Create individual secrets that contain each API key in AWS Secrets Manager. Modify the backend service to read the secrets from Secrets Manager. Replicate the secrets to another Region.
D. Copy the documents to an Amazon S3 bucket that has client-side encryption enabled. Modify the backend service to read the secrets from the S3 bucket. Enable S3 Cross-Region Replication (CRR) on the S3 bucket.

Correct Answer: C

QUESTION 106
A company hosts a serverless application on AWS. The application uses AWS Lambda functions to call third-party APIs. The incoming traffic to the application is high and has an unpredictable pattern with idle times up to one hour. The company notices latency in the application after the application has been inactive for a long time. The company needs to reduce the application latency that occurs after application inactivity. Which solution meets these requirements?

A. Increase the Lambda function timeout to 15 minutes. Use Amazon EventBridge rules to run the Lambda functions every 15 minutes.
B. Monitor the Amazon CloudWatch metrics for the Lambda functions. Configure reserved concurrency for each Lambda function when needed.
C. Configure each Lambda function to use Lambda SnapStart.
D. Configure an Amazon ElastiCache Serverless Memcached cache to store the API call results. Modify the Lambda functions to query the cache before calling the APIs.

Correct Answer: C

QUESTION 107
A company must save all the email messages that its employees send to customers for a period of 12 months. The messages are stored in a binary format and vary in size from 1 KB to 20 KB. The company has selected Amazon S3 as the storage service for the messages. Which combination of steps will meet these requirements MOST cost-effectively? (Select TWO.)

A. Create an S3 bucket policy that denies the s3:DeleteObject action.
B. Create an S3 Lifecycle configuration that deletes the messages after 12 months.
C. Upload the messages to Amazon S3. Use S3 Object Lock in governance mode.
D. Upload the messages to Amazon S3. Use S3 Object Lock in compliance mode.
E. Use S3 Inventory. Create an AWS Batch job that periodically scans the inventory and deletes the messages after 12 months.

Correct Answer: BC

QUESTION 108
A company has four Amazon EC2 instances that run the same stateless Python application. The company needs to make the Python application highly available. The company also needs to give the Python application the ability to recover to EC2 instances that run the same application in another AWS Region. Which combination of steps should a solutions architect take to meet these requirements? (Select TWO.)

A. Provide content delivery through Amazon CloudFront.
B. Use a Network Load Balancer to provide failover across Regions.
C. Use Amazon Route 53 DNS failover to provide failover across Regions.
D. Use an Application Load Balancer to provide failover across Availability Zones.
E. Use Amazon Route 53 DNS failover to provide failover across Availability Zones.

Correct Answer: CD

QUESTION 109
A media streaming company needs to deploy its video processing application across multiple Availability Zones for high availability. The application consists of containerized microservices that process video files. The microservices must automatically recover from failures. Which solution meets these requirements with the LEAST operational overhead?

A. Deploy the containers to Amazon Elastic Container Service (Amazon ECS) with the EC2 launch type.
B. Deploy the containers to Amazon Elastic Kubernetes Service (Amazon EKS) with self-managed nodes.
C. Deploy the containers to Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type.
D. Deploy the containers to Amazon EC2 instances.

Correct Answer: C

QUESTION 110
A company wants to use AWS Direct Connect to connect the company’s on-premises networks to the AWS Cloud. The company runs several VPCs in a single AWS Region. The company plans to expand its VPC fleet to include hundreds of VPCs. A solutions architect needs to simplify and scale the company’s network infrastructure to accommodate future VPCs. Which service or resource will meet these requirements?

A. VPC endpoints
B. AWS Transit Gateway
C. Amazon Route 53
D. AWS Secrets Manager

Correct Answer: B

QUESTION 111
A company is running a two-tier web-based application in an on-premises data center. The application layer consists of a single server running a stateful application. The application connects to a PostgreSQL database running on a separate server. The application’s user base is expected to grow significantly, so the company is migrating the application and database to AWS. The solution will use Amazon Aurora PostgreSQL, Amazon EC2 Auto Scaling, and Elastic Load Balancing. Which solution will provide a consistent user experience that will allow the application and database tiers to scale?

A. Enable Aurora Auto Scaling for Aurora Replicas. Use a Network Load Balancer with the least outstanding requests routing algorithm and sticky sessions enabled.
B. Enable Aurora Auto Scaling for Aurora writers. Use an Application Load Balancer with the round robin routing algorithm and sticky sessions enabled.
C. Enable Aurora Auto Scaling for Aurora Replicas. Use an Application Load Balancer with the round robin routing algorithm and sticky sessions enabled.
D. Enable Aurora Auto Scaling for Aurora writers. Use a Network Load Balancer with the least outstanding requests routing algorithm and sticky sessions enabled.

Correct Answer: C

QUESTION 112
An ecommerce company is redesigning a web application to run on the AWS Cloud. The application needs to store static website content and must use a Microsoft SQL Server database to store customer data. The company needs to deploy the application in a resilient way across multiple Availability Zones. Which solution will meet these requirements?

A. Use an Amazon S3 bucket to store static content. Deploy an Amazon RDS Custom for SQL Server DB instance for the database.
B. Use an Amazon S3 bucket to store static content. Create an Amazon RDS for SQL Server Multi-AZ deployment for the database.
C. Create an Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume to store static content. Deploy an Amazon RDS for SQL Server DB instance for the database.
D. Create an Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume to store static content. Deploy SQL Server on two Amazon EC2 instances in separate Availability Zones.

Correct Answer: B

QUESTION 113
A company has decoupled its application by using an Amazon Simple Queue Service (Amazon SQS) queue. The company has noticed increased costs, even when no orders are being processed. The company wants to reduce costs by optimizing the queue usage and configuration. Which solution meets these requirements?

A. Consume messages by using short polling.
B. Programmatically decrease the polling interval based on queue depth.
C. Increase the message visibility timeout on the SQS queue.
D. Consume messages by using long polling

Correct Answer: D

QUESTION 114
A company is migrating a Linux-based web server group to AWS. The web servers must access shared files by using the NFS protocol. The company must not make any changes to the web server application. Which solution will meet these requirements?

A. Create an Amazon S3 bucket to store the shared files in S3 Standard. Grant the S3 bucket access to the web servers.
B. Configure an Amazon CloudFront distribution. Set an Amazon S3 bucket as the origin. Store the shared files in the S3 bucket.
C. Create an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system on the web servers.
D. Create an Amazon FSx for Windows File Server file system. Configure SMB protocol access for the web servers.

Correct Answer: C

QUESTION 115
A company runs database workloads on AWS that are the backend for the company’s customer portals. The company runs a Multi-AZ database cluster on Amazon RDS for PostgreSQL. The company needs to implement a 30-day backup retention policy. The company currently has both automated RDS backups and manual RDS backups. The
company wants to maintain both types of existing RDS backups that are less than 30 days old. Which solution will meet these requirements MOST cost-effectively?

A. Configure the RDS backup retention policy to 30 days for automated backups by using AWS Backup. Manually delete manual backups that are older than 30 days.
B. Disable RDS automated backups. Delete automated backups and manual backups that are older than 30 days. Configure the RDS backup retention policy to 30 days for automated backups.
C. Configure the RDS backup retention policy to 30 days for automated backups. Manually delete manual backups that are older than 30 days.
D. Disable RDS automated backups. Delete automated backups and manual backups that are older than 30 days automatically by using AWS CloudFormation. Configure the RDS backup retention policy to 30 days for automated backups.

Correct Answer: C

QUESTION 116
A company hosts a public web application on AWS. The website has a three-tier architecture. The frontend web tier is comprised of Amazon EC2 instances in an Auto Scaling group. The application tier is a second Auto Scaling group. The database tier is an Amazon RDS database. The company has configured the Auto Scaling groups to handle the application’s normal level of demand. During an unexpected spike in demand, the company notices a long delay in the startup time when the frontend and application layers scale out. The company needs to improve the scaling performance of the application without negatively affecting the user experience. Which solution will meet these requirements MOST cost-effectively?

A. Decrease the minimum number of EC2 instances for both Auto Scaling groups. Increase the desired number of instances to meet the peak demand requirement.
B. Configure the maximum number of instances for both Auto Scaling groups to be the number required to meet the peak demand. Create a warm pool.
C. Increase the maximum number of EC2 instances for both Auto Scaling groups to meet the normal demand requirement. Create a warm pool.
D. Reconfigure both Auto Scaling groups to use a scheduled scaling policy. Increase the size of the EC2 instance types and the RDS instance types.

Correct Answer: B

QUESTION 117
An ecommerce company runs a multi-tier application on AWS. The frontend and backend tiers both run on Amazon EC2 instances. The database tier runs on an Amazon RDS for MySQL DB instance. The backend tier communicates with the RDS DB instance. The application makes frequent calls to return identical datasets from the database. The frequent calls on the database cause performance slowdowns. A solutions architect must improve the performance of the application backend. Which solution will meet this requirement?

A. Configure an Amazon Simple Notification Service (Amazon SNS) topic between the EC2 instances and the RDS DB instance.
B. Configure an Amazon ElastiCache (Redis OSS) cache. Configure the backend EC2 instances to read from the cache.
C. Configure an Amazon DynamoDB Accelerator (DAX) cluster. Configure the backend EC2 instances to read from the cluster.
D. Configure Amazon Data Firehose to stream the calls to the database.

Correct Answer: A

QUESTION 118
A company is planning to migrate to AWS. The network layout will include more than 1,000 VPCs in a single AWS Region. The resources in the VPCs need to communicate with each other. What should a solutions architect recommend to meet these requirements?

A. Create VPN tunnels from all the VPCs to each other. Enable route propagation.
B. Create an AWS Direct Connect gateway, and attach a public virtual interface (VIF) to each VPC. Enable route propagation.
C. Peer all the VPCs together by creating and accepting peering requests. Update route tables with the new routes.
D. Create a transit gateway, and place attachments in subnets of all the VPCs. Configure a transit gateway route table with the new routes.

Correct Answer: B

QUESTION 119
A company runs a high performance computing (HPC) workload on premises. The workload has a file system that contains 200 TB of data. The company needs to migrate the data to Amazon FSx for Lustre to support the HPC cluster. The HPC cluster will also migrate to AWS. The company has 10 Mbps internet capacity to accomplish the data migration. Which solution will migrate all the data within 30 days?

A. Use AWS Database Migration Service (AWS DMS) to transfer the data from on premises to an Amazon S3 bucket. Link an FSx for Lustre file system to the S3 bucket.
B. Deploy the AWS DataSync agent on premises. Use DataSync to transfer data from on premises to an FSx for Lustre file system.
C. Use AWS Storage Gateway Volume Gateway to transfer data from on premises to an FSx for Lustre file system.
D. Use an AWS Snowball Edge storage-optimized device to transfer data from on premises to an Amazon S3 bucket. Link an FSx for Lustre file system to the S3 bucket.

Correct Answer: D

QUESTION 120
A research laboratory needs to process a multi-terabyte dataset multiple times each day. The laboratory requires sub-millisecond latency while processing the data. Hundreds of Amazon EC2 Linux instances will process the data from the source and store the data in a different location. Which solution will meet these requirements?

A. Create an Amazon FSx for NetApp ONTAP file system. Set each volume’s tiering policy to All. Import the raw data into the file system. Mount the file system on the EC2 instances.
B. Create an Amazon S3 bucket to store the raw data. Create an Amazon FSx for Lustre file system that uses persistent SSD storage. Configure the FSx for Lustre file system to import data from and export data to Amazon S3. Mount the file system on the EC2 instances.
C. Create an Amazon S3 bucket to store the raw data. Create an Amazon FSx for Lustre file system that uses persistent HDD storage. Configure the FSx for Lustre file system to import data from and export data to Amazon S3. Access the file system by using a Gateway Load Balancer.
D. Create an Amazon FSx for Windows File Server Multi-AZ file system with HDD storage. Enable shadow copies. Mount the file system on the EC2 instances by using SMB protocol.

Correct Answer: B