QUESTION 121
A company has deployed resources in the us-east-1 Region. The company also uses thousands of AWS Outposts servers that are deployed at remote locations around the world. The Outposts servers regularly download new software versions from the resources in us-east-1 that consist of hundreds of files. The company wants to improve the latency of the software download process. Which solution will meet these requirements?
A. Create an Amazon S3 bucket in us-east-1. Configure the S3 bucket for static website hosting. Use a bucket policy and ACLs to provide read access to the Outposts servers.
B. Create an Amazon S3 bucket in us-east-1 and a second S3 bucket in the us-west-2 Region. Configure replication between the S3 buckets. Set up an Amazon CloudFront distribution with origin failover between the S3 buckets. Download the software by using signed URLs.
C. Create an Amazon S3 bucket in us-east-1. Configure S3 Transfer Acceleration. Configure the Outposts servers to download the software by using the S3 Transfer Acceleration endpoint.
D. Create an Amazon S3 bucket in us-east-1. Set up an Amazon CloudFront distribution that uses all edge locations with caching enabled. Configure the S3 bucket as the origin. Download the software by using signed URLS.
Correct Answer: D
QUESTION 122
A company has stored a file in an Amazon S3 bucket. The file contains IP address allow lists and IP address deny lists. The company needs to be able to access the file by using an HTTP endpoint. The company’s firewalls, which are not deployed on AWS, need to be able to read the file. The company wants to restrict access to the file to only the firewall IP addresses. The company has configured the Amazon S3 Block Public Access feature for this AWS account. Which solution meets these requirements?
A. Configure the S3 bucket as a static website. Create a bucket policy that restricts website access to only the firewall IP addresses. Add the static website’s URL to the firewall settings.
B. Create a bucket policy that explicitly allows access from only the firewall IP addresses. Add the file’s URL to the firewall settings.
C. Create an Amazon CloudFront distribution. Add the S3 bucket as the origin. Create an origin access control (OAC) that allows access from only the firewall IP addresses. Add the file URL to the firewall settings.
D. Create an AWS Lambda function that has access to the file. Configure the Lambda function to confirm if the IP address in the request is from one of the firewalls and return the lists. Add the Lambda function URL to the firewall settings.
Correct Answer: B
QUESTION 123
A company is using a loosely coupled serverless architecture on AWS. The architecture consists of multiple web applications and APIs distributed across multiple teams. The company uses AWS Control Tower to provision AWS accounts. The company’s development teams use AWS CloudFormation. The company wants to improve trace monitoring and gain insight into how individual services in application stacks are performing. Which solution will meet these requirements?
A. Enable AWS CloudTrail across all accounts by using AWS Control Tower.
B. Enable AWS X-Ray across all accounts by using AWS Control Tower.
C. Enable Amazon CloudWatch in the CloudFormation templates.
D. Enable AWS X-Ray in the CloudFormation templates.
Correct Answer: D
QUESTION 124
A company runs a latency-sensitive gaming service in the AWS Cloud. The gaming service runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). An Amazon DynamoDB table stores the gaming data. All the infrastructure is in a single AWS Region. The main user base is in that same Region. A solutions architect needs to update the architecture to support a global expansion of the gaming service. The gaming service must operate with the least possible latency. Which solution will meet these requirements?
A. Create an Amazon CloudFront distribution in front of the ALB.
B. Deploy an Amazon API Gateway regional API endpoint. Integrate the API endpoint with the ALB.
C. Create an accelerator in AWS Global Accelerator. Add a listener. Configure the endpoint to point to the ALB.
D. Deploy the ALB and the fleet of EC2 instances to another Region. Use Amazon Route 53 with geolocation routing.
Correct Answer: C
QUESTION 125
A company is preparing to migrate its on-premises application to AWS. The application consists of application servers and a Microsoft SQL Server database. The company cannot migrate the database to a different engine because SQL Server features are used in the application’s NET code. The company wants to maximize availability an minimize operational overhead. What should a solutions architect do to meet these requirements?
A. Install SQL Server on Amazon EC2 in a Multi-AZ deployment.
B. Install SQL Server on Amazon EC2 in a spread placement group.
C. Migrate the data to Amazon RDS for SQL Server in a Multi-AZ deployment.
D. Migrate the data to Amazon RDS for SQL Server in a cross-Region Multi-AZ deployment.
Correct Answer: C
QUESTION 126
A solutions architect is designing a customer-facing application for a company. The application’s database will have a clearly defined access pattern throughout the year and will have a variable number of reads and writes that depend on the time of year. The company must retain audit records for the database for 7 days. The recovery point objective (RPO) must be less than 5 hours. Which solution meets these requirements?
A. Use Amazon DynamoDB with auto scaling. Use on-demand backups and Amazon DynamoDB Streams.
B. Use Amazon Redshift. Configure concurrency scaling. Activate audit logging. Perform database snapshots every 4 hours.
C. Use Amazon RDS with Provisioned IOPS. Activate the database auditing parameter. Perform database snapshots every 5 hours.
D. Use Amazon Aurora MySQL with auto scaling. Activate the database auditing parameter.
Correct Answer: D
QUESTION 127
A company has two AWS applications that are connected by using an Amazon Simple Queue Service (Amazon SQS) FIFO queue. The sending application creates requests as SQS messages that the receiving application needs to process on a first-come, first-served basis. Which solution will ensure the processing order?
A. Configure the receiving application to combine the sequence number with the message deduplication ID to process queued messages.
B. Configure the receiving application to process messages based on the message deduplication ID.
C. Configure the receiving application to read the message group ID to process queued messages.
D. Configure the receiving application to combine the message group ID and sequence number to process queued messages.
Correct Answer: C
QUESTION 128
A security team needs to enforce the rotation of all IAM users’ access keys every 90 days. If an access key is found to be older, the key must be made inactive and removed. A solutions architect must create a solution that will check for and remediate any keys older than 90 days. Which solution meets these requirements with the LEAST operational effort?
A. Create an AWS Config rule to check for the key age. Configure the AWS Config rule to run an AWS Batch job to remove the key.
B. Create an Amazon EventBridge rule to check for the key age. Configure the rule to run an AWS Batch job to remove the key.
C. Create an AWS Config rule to check for the key age. Define an Amazon EventBridge rule to schedule an AWS Lambda function to remove the key.
D. Create an Amazon EventBridge rule to check for the key age. Define an EventBridge rule to run an AWS Batch job to remove the key.
Correct Answer: C
QUESTION 129
A financial company has an Amazon API Gateway REST API that uses a Python-based AWS Lambda function to process financial transactions. The API needs to handle an unpredictable number of transactions. The Lambda function experiences cold starts that take more than 10 seconds. The cold starts have caused a poor user experience. The company needs to improve the startup performance while maintaining security. Which solution will meet these requirements?
A. Configure reserved concurrency for the Lambda function.
B. Increase the Lambda function’s timeout value to more than 10 seconds.
C. Activate Lambda SnapStart.
D. Use Lambda container images instead of .zip deployments.
Correct Answer: C
QUESTION 130
A company runs an application by using on-premises servers. The application stores user data in a NoSQL database. The company wants to migrate the application to a decoupled architecture in the AWS Cloud. The company wants to be able to scale the different application components automatically. Which solution meets these requirements?
A. Migrate the application to a group of Amazon EC2 instances behind an Application Load Balancer. Migrate the database to an Amazon RDS for PostgreSQL database with read replicas.
B. Migrate the application to an Auto Scaling group of Amazon EC2 instances behind an Application Load Balancer. Migrate the database to an Amazon DynamoDB table with on-demand capacity mode.
C. Migrate the application to an AWS Lambda function behind an Application Load Balancer. Migrate the database to an Amazon DynamoDB table with provisioned capacity mode.
D. Migrate the application to an AWS Lambda function behind an Amazon API Gateway REST API. Migrate the database to an Amazon Aurora PostgreSQL serverless database.
Correct Answer: B
QUESTION 131
A company has an Amazon RDS for MySQL database that runs in the AWS Cloud. The company needs to implement a disaster recovery (DR) plan. The company wants to regularly back up the database. The DR plan must also retain copies in the company’s on-premises DR data center that can be restored in the on-premises DR environment if needed. Which solution meets these requirements with the LEAST operational overhead?
A. Create individual RDS DB snapshots and export the snapshots to Amazon S3. Sync the snapshots to the on-premises DR data center by using the aws s3 sync command.
B. Configure AWS Backup to run and manage RDS backups. Copy the backups to a vault in the on-premises DR data center.
C. Use the mysqldump utility to export the database, store the dump in Amazon S3, and sync the dump to the on-premises DR data center every day.
D. Create individual RDS DB snapshots and export the snapshots to Amazon S3. Use AWS DataSync to transfer the snapshots to the on-premises DR data center.
Correct Answer: B
QUESTION 132
An ecommerce company is building an order processing system. Each order involves multiple steps. The steps must run in sequence, handle retries, and log the outcome. The company needs a managed solution to coordinate the order processing. Which solution will meet these requirements?
A. Configure Amazon EventBridge with rules that invoke AWS Lambda functions for each step.
B. Configure an AWS Step Functions Standard Workflow to coordinate AWS Lambda functions for each step.
C. Configure Amazon MQ to invoke AWS Lambda functions for state transitions between steps.
D. Configure Amazon Simple Queue Service (Amazon SQS) with FIFO queues that invoke AWS Lambda functions for each step.
Correct Answer: B
QUESTION 133
A company is designing a secure solution to grant access to its Amazon RDS for PostgreSQL database. Applications that run on Amazon EC2 instances must be able to securely authenticate to the database without storing long-term credentials. Which solution will meet these requirements?
A. Enable RDS IAM authentication and configure AWS Secrets Manager to store database credentials. Configure applications to retrieve credentials at runtime.
B. Configure a custom IAM policy for the database that allows access from the EC2 instances’ IP addresses. Configure applications to use a static password to authenticate to the database.
C. Set up an IAM user for each application. Store the access key ID and secret access key in the EC2 instances’ environment variables. Grant the IAM users permission to the database.
D. Use IAM roles to assign permissions to the EC2 instances. Configure the applications to obtain a token from the RDS database to authenticate by using IAM authentication.
Correct Answer: D
QUESTION 134
A company is building a web application. The company needs a load balancing solution that supports HTTPS header-based routing. The company’s security team also requires a rules-based method of blocking specific incoming requests to decrease the effects of malicious activity. Which solution will meet these requirements?
A. Create an Application Load Balancer (ALB). Configure an HTTPS listener with mutual TLS enabled.
B. Create an Application Load Balancer (ALB). Integrate the ALB with AWS WAF. Configure the security team’s required rules.
C. Create an Application Load Balancer (ALB). Integrate the ALB with AWS Config. Apply custom rules to all ALB resources.
D. Create a Network Load Balancer (NLB). Configure AWS Network Firewall with the security team’s required rules.
Correct Answer: B
QUESTION 135
A company has an on-premises volume backup solution that has reached its end of life. The company wants to use AWS as part of a new backup solution and wants to maintain local access to all the data while it is backed up on AWS. The company wants to ensure that the data backed up on AWS is automatically and securely transferred. Which solution meets these requirements?
A. Use AWS Snowball to migrate data out of the on-premises solution to Amazon S3. Configure on-premises systems to mount the Snowball S3 endpoint to provide local access to the data.
B. Use AWS Snowball Edge to migrate data out of the on-premises solution to Amazon S3. Use the Snowball Edge file interface to provide on-premises systems with local access to the data.
C. Use AWS Storage Gateway and configure a cached volume gateway. Run the Storage Gateway software appliance on premises and configure a percentage of data to cache locally. Mount the gateway storage volumes to provide local access to the data.
D. Use AWS Storage Gateway and configure a stored volume gateway. Run the Storage Gateway software appliance on premises and map the gateway storage volumes to on-premises storage. Mount the gateway storage volumes to provide local access to the data.
Correct Answer: D
QUESTION 136
A company hosts a website on Amazon EC2 instances that run Amazon Linux. The instances are behind an Application Load Balancer (ALB) and are part of an Auto Scaling group. Each instance uses Amazon Elastic Block Store (Amazon EBS) volumes to store product manuals. New instances often have outdated data. The new instances occasionally take up to 30 minutes to receive updates from an external source. The company must ensure that all instances have up-to-date product manuals. The company needs a solution that can adapt quickly to increased demand. The solution must not require modifications for the application code. Which solution will meet these requirements?
A. Store the product manuals on instance store volumes that are attached to each EC2 instance.
B. Store the product manuals in an Amazon S3 bucket. Configure the EC2 instances to download updates from the S3 bucket.
C. Store the product manuals in an Amazon Elastic File System (Amazon EFS) volume. Mount the EFS volume on the EC2 instances
D. Store the product manuals in an Amazon S3 bucket. Use the S3 Standard-Infrequent Access (S3 Standard-IA) storage class. Configure the EC2 instances to download updates from the S3 bucket.
Correct Answer: C
QUESTION 137
A company uses a general-purpose instance class Amazon RDS for MySQL DB instance. The company has configured the DB instance in a Multi-AZ configuration across two Availability Zones as part of the company’s production application. The company’s finance team needs to run SQL queries against the DB instance to generate reports. Customers have reported significant performance issues with the application during report generation. A solutions architect needs to minimize the effect of the reporting job on the DB instance. Which solution will meet these requirements?
A. Create a proxy in Amazon RDS Proxy. Update the reporting job to query the proxy endpoint.
B. Update the RDS DB instance configuration to use three Availability Zones.
C. Add an RDS read replica. Update the reporting job to query the replica endpoint.
D. Change the RDS configuration from a general-purpose instance class to a memory-optimized instance class.
Correct Answer: C
QUESTION 138
A company receives service requests by using an Amazon API Gateway REST API. The company needs a scalable and fault-tolerant solution to process the requests. Each request must be enhanced with data from several third-party APIs and then stored in an Amazon DynamoDB table. Processing the third-party API data can take between 1 and 30 seconds. The solution must support observability and provide robust error handling. The solution must also scale to accommodate highly variable workloads, including traffic surges of thousands of requests each second. Which solution will meet these requirements?
A. Use Amazon CloudFront Functions to transform the incoming requests. Enable AWS X-Ray tracing to trace flows through Amazon CloudFront.
B. Use an AWS Step Functions Standard Workflow and AWS Lambda functions to transform the requests. Use Amazon CloudWatch Logs Insights to observe the Step Functions workflow executions.
C. Use an AWS Lambda function to transform the requests. Use Amazon CloudWatch Logs Insights to observe the Lambda function.
D. Use an AWS Step Functions Express Workflow and AWS Lambda functions to transform the requests. Enable AWS X-Ray tracing for all Lambda functions in the workflow.
Correct Answer: D
QUESTION 139
A company is planning to migrate its business-critical applications from an on-premises data center to AWS. The company has an on-premises installation of a Microsoft SQL Server Always On cluster. The company wants to migrate to an AWS managed database service. A solutions architect must design a heterogeneous database migration on AWS. Which solution will meet these requirements?
A. Migrate the SQL Server databases to Amazon RDS for MySQL by using backup and restore utilities.
B. Use an AWS Snowball Edge Storage Optimized device to transfer data to Amazon S3. Set up Amazon RDS for MySQL. Use S3 integration with SQL Server features, such as BULK INSERT.
C. Use AWS Schema Conversion Tool (AWS SCT) to translate the database schema to Amazon RDS for MySQL. Then use AWS Database Migration Service (AWS DMS) to migrate the data from on-premises databases to Amazon RDS.
D. Use AWS DataSync to migrate data over the network between on-premises storage and Amazon S3. Set up Amazon RDS for MySQL. Use S3 integration with SQL Server features, such as BULK INSERT.
Correct Answer: C
QUESTION 140
A protected from comms exploits a scalable web application that runs on Amazon EC2. The application users must stay on the same server after login. The application must be protected from common exploits. Which solution will meet these requirements?
A. Create an Application Load Balancer (ALB) with a target group. Attach the target group to an Auto Scaling group. Enable duration-based stickiness on the target group. Associate the ALB with an AWS Network Firewall firewall.
B. Create a Network Load Balancer (NLB) with a target group. Attach the target group to an Auto Scaling group. Associate the NLB with an AWS WAF web ACL.
C. Create an Application Load Balancer (ALB) with a target group. Attach the target group to an Auto Scaling group. Enable application-based stickiness on the target group. Associate the ALB with an AWS WAF web ACL.
D. Create a Network Load Balancer (NLB) with a target group. Attach the target group to an Auto Scaling group. Enable target group stickiness on the NLB. Associate the NLB with an AWS Network Firewall firewall.
Correct Answer: C