QUESTION 181
A company is using Amazon SageMaker AI Notebook Instances and SageMaker AIs to train machine learning (ML) models. The SageMaker AI Notebook Instances are deployed in a VPC that does not have access to or from the internet. Datasets for ML model training are stored in an Amazon S3 bucket. Interface VPC endpoints provide access to Amazon S3 and the SageMaker APIs. Occasionally, data scientists require access to a private Git repository to update application packages that they use as part of their workflow. The company must provide access to the Git repository while ensuring that the SageMaker Al Notebook Instances remain isolated from the internet. Which solution meets these requirements with the LEAST operational overhead?

A. Add the Git repository as a resource for SageMaker by referencing the remote URL. Configure AWS Secrets Manager to use Git credentials to access the repository.
B. Add the Git repository as a resource for SageMaker by referencing the remote URL. Add the username to the URL that is required to access the repository.
C. Create a NAT gateway in the VPC. Configure VPC routes to allow access to the internet. Configure network ACL rules that allow the SageMaker Al Notebook Instances access to only the Git repository URL.
D. Create a NAT gateway in the VPC. Configure VPC routes to allow access to the internet with a network ACL that allows access to only the Git repository URL.
Correct Answer: B

QUESTION 182
A company uses an organization in AWS Organizations with all features enabled to manage AWS accounts. For each new project, the company creates a new linked account. After the creation of a new account, the root user signs in to the new account and creates a service request to increase the service quota for Amazon EC2 instances. The company needs to automate this process. Which solution will meet these requirements with the LEAST operational overhead?

A. Create an Amazon EventBridge rule to detect the creation of a new account. Send the event to an Amazon SNS topic that invokes an AWS Lambda function. Configure the Lambda function to request a quota increase.
B. Create a Service Quotas request template in the organization’s management account. Configure the request template to request a quota increase. Associate the request template with the organization.
C. Create an AWS Config rule in the organization’s management account to check the quota. Create an AWS Lambda function. Configure the Lambda function to request a quota increase.
D. Create an automatic quota remediation action for AWS Trusted Advisor in the organization’s management account. Create an AWS Step Functions workflow for the remediation action. Configure the Step Functions step to request a quota increase.

Correct Answer: B

QUESTION 183
To comply with regulations, a company needs a solution to ensure that critical Amazon S3 objects always remain accessible and independently verifiable. The company must also validate object checksums. The company encrypts the objects by using server-side encryption with customer-provided keys (SSE-C). The solution must provide automated, near real-time synchronization of objects across multiple geographic locations. The company has already created a second S3 bucket in a second AWS Region. Which solutions will meet these requirements? (Select TWO.)

A. Configure Amazon S3 Cross-Region Replication (CRR) on the source S3 bucket with replication integrity checks.
B. Create an AWS Storage Gateway S3 File Gateway to synchronize S3 buckets across Regions to provide independent access in each Region.
C. Use AWS DataSync to transfer the contents of the original S3 bucket to the bucket in the second Region.
D. Create an AWS Lambda function to replicate objects across both Regions and to perform integrity checks. Configure an S3 event notification to invoke the Lambda function.
E. Use AWS Snowball Edge devices to periodically transfer data from the original S3 bucket to the bucket in the second Region.

Correct Answer: CD

QUESTION 184
A company hosts an ecommerce platform that consists of applications that run in the us-east-1 Region. The applications are deployed on Amazon ECS inside a VPC. The applications use images that the company stores in an Amazon ECR repository. The company stores the ecommerce product catalog data in an Amazon Neptune DB cluster. The company’s operations team updates the DB cluster often. The operations team is located in the United States. A solutions architect must design a similar solution in the eu-west-1 Region to serve European customers. The solutions architect must provide low latency and must implement read-only data replication for the DB cluster from us-east-1 to eu-west-1. The solution must use the same container images across both Regions. Which combination of steps will meet these requirements with the LEAST operational overhead? (Select TWO.)

A. Convert the DB cluster in us-east-1 into a global database. Add a secondary DB cluster in eu-west-1.
B. Create VPC peering connections across both Regions. Create an AWS DMS task in us-east-1. Set the source as the DB cluster in us-east-1. Set the target as the DB cluster in eu-west-1.
C. Create VPC peering connections across both Regions. Enable the Neptune Streams feature for the DB cluster in us-east-1. In eu-west-1, create a custom AWS Lambda function that consumes Neptune streams from us-east-1 and replicates the streams to eu-west-1.
D. Update the resource policy of the ECR repository in us-east-1 with the following statements: “Action”: [“ecr:* ” and “Principal”: {“AWS”: “arn:aws iam:: <account-id>:root”> Create an ECR interface VPC endpoint in eu-west-1.
E. Enable Cross-Region Replication in Amazon ECR in us-east-1. Set the destination as eu-west-1. Re-push the existing images to the repositories with a new tag in us-east-1.

Correct Answer: AE

QUESTION 185
Example Corp recently acquired AnyCompany, which has been operating its AWS workloads in a single account. Example Corp needs to integrate the AnyCompany’s account into Example Corp’s existing organization in AWS Organizations. Example Corp must ensure that all Amazon EC2 instances that are used for development are part of a specific OU for development work. Example Corp needs to scan all EC2 instances every day for vulnerabilities and produce a report that includes findings. All EC2 instances must be patched and baselined on a regular schedule. Example Corp has already tagged all the EC2 instances that are used for development with a development environment tag. Which combination of steps will meet these requirements with LEAST operational overhead? (Select THREE.)

A. Invite AnyCompany’s account into the organization. Use SCPs to enforce tag requirements for all new instances. Create a new account under an OU for development work. Recreate EC2 instances that have the development environment tag into the account.
B. Invite AnyCompany’s account int the organization. Use IAM policies for each account to enforce tag usage. Use AWS Resource Groups to recreate EC2 instances that have the development environment tag into a new OU for development work.
C. Configure AWS Security Hub across the organization. Configure AWS Trusted Advisor to perform daily security checks on all EC2 instances in the organization.
D. Configure AWS Security Hub across the organization. Configure Amazon Inspector to perform daily security checks on all EC2 instances in the organization.
E. Configure AWS Systems Manager Patch Manager in each individual account. Define patch baselines and reports separately for each account.
F. Configure AWS Systems Manager Patch Manager across the organization by using a delegated administrator account. Create organization-wide patch baselines and configure compliance reporting.

Correct Answer: CDF

QUESTION 186
A company runs a test application on an Amazon EC2 instance. Testing clients across the United States send data to the application by using a REST API. As traffic increases, application response times increase. The company wants to migrate to a serverless architecture and stream data to clients through WebSockets. Which solution will meet these requirements?

A. Create a new Amazon API Gateway REST API. Implement the business logic in AWS Lambda functions. Set the Lambda functions as integrations to the new REST API. Create a new AWS Step Functions state machine and set the clients as targets. Use the state machine to send data back to the clients.
B. Create a new API Gateway HTTP API and an Amazon SQS queue. Configure the HTTP API to integrate with the SQS queue. Implement the business logic in an AWS Lambda function. Use the SQS queue to invoke the Lambda function. Configure the Lambda function to write data to an AWS AppSync Events channel. Ensure that the clients subscribe to the AWS AppSync Events channel.
C. Create a new AWS AppSync API and a new Amazon SQS queue. Integrate the SQS queue with the AWS AppSync API. Update the current business logic to consume from the SQS queue. Create a new Amazon EventBridge event bus and an EventBridge rule. Set the clients as targets for the rule. Use the EventBridge event bus to send data back to the clients.
D. Create a new Amazon CloudFront distribution. Implement the business logic in a CloudFront function. Set the CloudFront function as an origin of the CloudFront distribution. Enable AWS IoT Core. Configure the CloudFront function to write data to an MQTT topic. Ensure that the clients subscribe to the IoT Core MQTT topic through WebSockets.

Correct Answer: B

QUESTION 187
A company is planning a large event where a promotional offer will be introduced. The company’s website is hosted on AWS and backed by an Amazon RDS for PostgreSQL DB instance. The website explains the promotion and includes a sign-up page that collects user information and preferences. Management expects large and unpredictable volumes of traffic periodically, which will create many database writes. A solutions architect needs to build a solution that does not change the underlying data model and ensures that submissions are not dropped before they are committed to the database. Which solution will meet these requirements?

A. Immediately before the event, scale up the existing DB instance to meet the anticipated demand. Then scale down after the event.
B. Use Amazon SQS to decouple the application and database layers. Configure an AWS Lambda function to write items from the queue into the database.
C. Migrate to Amazon DynamoDB and manage throughput capacity with automatic scaling.
D. Use Amazon ElastiCache (Memcached) to increase write capacity to the DB instance.

Correct Answer: B

QUESTION 188
A company hosts a read-heavy web application on Amazon EKS and Amazon DynamoDB. The company uses Amazon Route 53 as its DNS solution. The application serves hundreds of users during peak usage periods. Most users are in the United States, but the application is experiencing growing usage in Europe and the Middle East. The company needs to reduce application latency for all global users. Which solution will meet this requirement?

A. Deploy the application to multiple AWS Regions. Create a global secondary index (GSI) in the primary Region. Increase provisioned throughput for DynamoDB read capacity units (RCUs). Update the application to use the GSI. Create a Route 53 failover record. Set with the us-east-1 Region as the primary Region. Set the eu-central-1 Region and the me-central-1 Region as secondary Regions. Configure Route 53 health checks and enable Evaluate Target Health.
B. Use a DynamoDB Accelerator (DAX) cluster with memory-optimized instances. Deploy the application to three Availability Zones. Update the application to use the DAX endpoints. Update the Route 53 record set to use the new deployment endpoints.
C. Increase the compute resources for the application. Create an Amazon CloudFront distribution and set the application endpoint as the origin. Create DynamoDB read replicas in the primary AWS Region. Update the application to use the DynamoDB replica endpoints.
D. Deploy the application to multiple AWS Regions. Convert the DynamoDB table to a global table with replicas in target Regions. Update the application to access the nearest DynamoDB replica. Create a Route 53 geolocation record set for the target Regions. Configure Route 53 health checks and enable Evaluate Target Health.

Correct Answer: D

QUESTION 189
A company runs an application on an Amazon EC2 instance in a private VPC. The application accesses data from an Amazon S3 bucket. Currently, the application has outbound internet access through existing NAT gateways. The company establishes an AWS Site-to-Site VPN connection from the company’s on-premises office to the VPC. The company wants both the application and the on-premises users to access the S3 bucket without traversing the public internet. The company also wants to remove the NAT gateways. Which solution will meet these requirements?

A. Create an S3 gateway endpoint with private DNS inside the VPC. Update the routing for the on-premises environment to route the traffic for the S3 bucket to the gateway endpoint that is inside the VPC. Update the on-premises DNS to use the private DNS names for the S3 bucket.
B. Create both an S3 gateway and an S3 interface endpoint with private DNS inside the VPC. Update the routing for each of the VPC’s subnets and the on-premises environment. Update the on-premises DNS to use the private DNS names for the S3 bucket.
C. Install Mountpoint for Amazon S3 on the EC2 instance. Mount the S3 bucket directly to the EC2 instance. Configure the application to use the new mountpoint to access the S3 bucket.
D. Install Storage Browser for S3 on the EC2 instance and add it to the application. Ensure that the users of the application use Storage Browser to access the S3 data.

Correct Answer: A

QUESTION 190
A company runs a website on Amazon ECS containers that use the AWS Fargate launch type. The company configures AWS Application Auto Scaling by using a target tracking scaling policy. The company sets the request count as the scaling metric. An Application Load Balancer (ALB) serves traffic to the ECS containers. The website serves images on request and resizes the images to a predefined size to match the viewers’ screens. After the website resizes an image, the website caches the image locally in a container and serves subsequent requests from the cache. During periods of high traffic, the company observed that images load slowly and with high latency. The company wants to minimize the latency to serve images. Which solution will meet this requirement with the LEAST operational overhead?

A. Create a new Amazon CloudFront distribution and an Amazon S3 bucket. Set the ALB as one origin for the distribution and the S3 bucket as a second origin. Configure a cache behavior that routes image requests to the S3 origin, and configure a default cache behavior for the ALB origin. Pre-scale all images and upload the images to the S3 bucket.
B. Create an Amazon ElastiCache (Memcached) cluster. Update the application to read and write the resized images to the ElastiCache (Memcached) cluster by using the image name and size as the key.
C. Create an Amazon Aurora cluster and an Amazon S3 bucket. Update the application to store resized images in the S3 bucket and to store a cache key in the Aurora cluster. Configure the application to load the cache key from the Aurora cluster and to serve images from the S3 bucket.
D. Create an Amazon API Gateway HTTP API and enable API request caching. Replace the ALB with the HTTP API and remove the local caching in the application code.

Correct Answer: A

QUESTION 191
A company is using Amazon SageMaker Al Notebook Instances and SageMaker APIs to train machine learning (ML) models. The SageMaker Al Notebook Instances are deployed in a VPC that does not have access to or from the internet. Datasets for ML model training are stored in an Amazon S3 bucket. Interface VPC endpoints provide access to Amazon S3 and the SageMaker APIs. Occasionally, data scientists require access to a private Git repository to update application packages that they use as part of their workflow. The company must provide access to the Git repository while ensuring that the SageMaker Al Notebook Instances remain isolated from the internet. Which solution meets these requirements with the LEAST operational overhead?

A. Add the Git repository as a resource for SageMaker by referencing the remote URL. Configure AWS Secrets Manager to use Git credentials to access the repository.
B. Add the Git repository as a resource for SageMaker by referencing the remote URL. Add the username to the URL that is required to access the repository.
C. Create a NAT gateway in the VPC. Configure VPC routes to allow access to the internet. Configure network ACL rules that allow the SageMaker AI Notebook Instances access to only the Git repository URL.
D. Create a NAT gateway in the VPC. Configure VPC routes to allow access to the internet with a network ACL that allows access to only the Git repository URL.

Correct Answer: A

QUESTION 192
A company hosts an ecommerce platform that consists of applications that run in the us-east-1 Region. The applications are deployed on Amazon ECS inside a VPC. The applications use images that the company stores in an Amazon ECR repository. The company stores the ecommerce product catalog data in an Amazon Neptune DB cluster. The company’s operations team updates the DB cluster often. The operations team is located in the United States. A solutions architect must design a similar solution in the eu-west-1 Region to serve European customers. The solutions architect must provide low latency and must implement read-only data replication for the DB cluster from us-east-1 to eu-west-1. The solution must use the same container images across both Regions. Which combination of steps will meet these requirements with the LEAST operational overhead? (Select TWO.)

A. Convert the DB cluster in us-east-1 into a global database. Add a secondary DB cluster in eu-west-1.
B. Create VPC peering connections across both Regions. Create an AWS DMS task in us-east-1. Set the source as the DB cluster in us-east-1. Set the target as the DB cluster in eu-west-1.
C. Create VPC peering connections across both Regions. Enable the Neptune Streams feature for the DB cluster in us-east-1. In eu-west-1, create a custom AWS Lambda function that consumes Neptune streams from us-east-1 and replicates the streams to eu-west-1.
D. Update the resource policy of the ECR repository in us-east-1 with the following statements: “Action”: [“ecr:* “] and “Principal”: { “AWS”: “arn:aws iam::<account-id>:root”}. Create an ECR interface VPC endpoint in eu-west-1.
E. Enable Cross-Region Replication in Amazon ECR in us-east-1. Set the destination as eu-west-1. Re-push the existing images to the repositories with a new tag in us-east-1.

Correct Answer: AE

QUESTION 193
A company runs payment gateways in multiple AWS Regions. The company also operates on-premises data centers where the company manages hardware security modules (HSMs) to tokenize sensitive payment data to comply with security regulations. To process payment transactions within the company’s performance SLA, the company requires an automated and centrally managed solution that can provide dedicated private connectivity between the on-premises HSMs and AWS payment services. Which solution will meet this requirement?

A. Use a centrally managed accelerator in AWS Global Accelerator to route traffic from each data center the nearest AWS Region.
B. Establish AWS Site-to-Site VPN connections between the data centers and AWS. Set up a centrally managed transit gateway and set appropriate routes.
C. Use AWS CloudHSM to tokenize the sensitive payment data. Deploy CloudHSM in the same private subnet as the payment services workload.
D. Set up AWS Cloud WAN with AWS Direct Connect attachments between on-premises data centers and AWS.

Correct Answer: D

QUESTION 194
A company runs a test application on an Amazon EC2 instance. Testing clients across the United States send data to the application by using a REST API. As traffic increases, application response times increase. The company wants to migrate to a serverless architecture and stream data to clients through WebSockets. Which solution will meet these requirements?

A. Create a new Amazon API Gateway REST API. Implement the business logic in AWS Lambda functions. Set the Lambda functions as integrations to the new REST API. Create a new AWS Step Functions state machine and set the clients as targets. Use the state machine to send data back to the clients.
B. Create a new API Gateway HTTP API and an Amazon SQS queue. Configure the HTTP API to integrate with the SQS queue. Implement the business logic in an AWS Lambda function. Use the SQS queue to invoke the Lambda function. Configure the Lambda function to write data to an AWS AppSync Events channel. Ensure that the clients subscribe to the AWS AppSync Events channel.
C. Create a new AWS AppSync API and a new Amazon SQS queue. Integrate the SQS queue with the AWS AppSync API. Update the current business logic to consume from the SQS queue. Create a new Amazon EventBridge event bus and an EventBridge rule. Set the clients as targets for the rule. Use the EventBridge event bus to send data back to the clients.
D. Create a new Amazon CloudFront distribution. Implement the business logic in a CloudFront function. Set the CloudFront function as an origin of the CloudFront distribution. Enable AWS IoT Core. Configure the CloudFront function to write data to an MQTT topic. Ensure that the clients subscribe to the IoT Core MQTT topic through WebSockets.

Correct Answer: B

QUESTION 195
A company needs to improve the security of its web application on AWS. The application runs on a fleet of Amazon EC2 instances behind a public Application Load Balancer (ALB). The instances are in an Auto Scaling group. The ALB is registered as a custom origin in an Amazon CloudFront distribution. The company wants customers to access the website by using a fully qualified domain name (FQDN) that is associated with the CloudFront distribution. A security audit shows that the ALB can be accessed directly and that some requests bypass the CloudFront distribution. The company needs a solution that will prevent direct access to the ALB. The solution also must ensure that all requests pass through the CloudFront distribution. Which solution will meet these requirements?

A. Modify the security group that is attached to the ALB to allow incoming traffic from only the CloudFront distribution’s origin.
B. Configure the CloudFront distribution to use an AWS WAF web ACL to block requests that bypass the CloudFront distribution.
C. Add a security header to the CloudFront distribution. Implement header validation and enforcement at the ALB.
D. Configure an origin access control (OAC) for the CloudFront distribution. Update the ALB to allow only requests that come from the OAC.

Correct Answer: D

QUESTION 196
A company hosts a blog post application on AWS using Amazon API Gateway, Amazon DynamoDB, and AWS Lambda. The application currently does not use API keys to authorize requests. The API model is as follows:
GET /posts/{postld}: to get post details
GET /users/{userld}: to get user details
GET /comments/{commentld}: to get comments details

The company has noticed users are actively discussing topics in the comments section, and the company wants to increase user engagement by making the comments appear in real time. Which design should be used to reduce comment latency and improve user experience?

A. Use edge-optimized API with Amazon CloudFront to cache API responses.
B. Modify the blog application code to request GET/comments/{commentld) every 10 seconds.
C. Use AWS AppSync and leverage WebSockets to deliver comments.
D. Change the concurrency limit of the Lambda functions to lower the API response time

Correct Answer: C

QUESTION 197
A company runs an ecommerce website that sells sporting goods. The company deployed the website by using an Application Load Balancer (ALB), Amazon ECS on Amazon EC2 instances that are in an Auto Scaling group, and an Amazon RDS for MySQL database. Both the EC2 instances and the RDS for MySQL database run across multiple Availability Zones. During sales events, users report experiencing high latency when they search for items. The company observes that CPU utilization for the EC2 instances is 70%. CPU utilization for the RDS for MySQL database is 95%. The company determines that item searches and order creations are the cause of the high database CPU utilization. The company needs to implement a temporary solution to reduce the latency of searches during sales events before the application can be refactored. Which solution will meet this requirement with the LEAST development effort?

A. Use Amazon CloudFront to cache HTTP query responses. Create one AWS Systems Manager Automation runbook to increase the instance size of the RDS database. Create a second runbook to return the instance size to its previous value. Schedule the first runbook to run one day before sales events. Schedule the second runbook to run the data after sales events.
B. Use Amazon CloudFront to cache HTTP query responses. Schedule the EC2 Auto Scaling group to increase the number of EC2 instances one day before sales events. Schedule the Auto Scaling group to decrease the number of instances to its previous value one day after sales events.
C. Use Amazon ElastiCache to cache database query responses. Refactor the website to use ElastiCache. Schedule the EC2 Auto Scaling group to increase the number of EC2 instances one day before sales events. Schedule the Auto Scaling group to decrease the number of instances to its previous value one day after sales events.
D. Migrate the RDS for MySQL database to Amazon DynamoDB. Use Amazon ElastiCache to cache database query responses. Refactor the website to use DynamoDB and ElastiCache.

Correct Answer: B

QUESTION 198
A solutions architect wants to cost-optimize and appropriately size Amazon EC2 instances in a single AWS account. The solutions architect wants to ensure that the instances are optimized based on CPU, memory, and network metrics. Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

A. Purchase AWS Business Support or AWS Enterprise Support for the account.
B. Turn on AWS Trusted Advisor and review any “Low Utilization Amazon EC2 Instances” recommendations.
C. Install the Amazon CloudWatch agent and configure memory metric collection on the EC2 instances.
D. Configure AWS Compute Optimizer in the AWS account to receive findings and optimization recommendations.
E. Create an EC2 Instance Savings Plan for the AWS Regions, instance families, and operating systems of interest.

Correct Answer: CD

QUESTION 199
A company needs a highly available database solution for an application. The solution must be able to fail over to a secondary AWS Region with an RPO of 5 minutes and an RTO of 20 minutes. The database is approximately 10 TB in size. Which solution will meet these requirements?

A. Deploy an Amazon Aurora DB cluster and take snapshots of the cluster every 5 minutes. When each snapshot is complete, copy the snapshot to a secondary Region.
B. Deploy an Amazon RDS Multi-AZ DB cluster with a cross-Region read replica in a secondary Region. Use an Amazon CloudWatch alarm to invoke an AWS Lambda function that promotes the read replica to become the primary in the event of a failure.
C. Deploy an Amazon Aurora DB cluster in the primary Region. Configure Amazon EventBridge to target Amazon RDS to create a second cluster in the event of a failure. Use AWS DMS to keep the secondary Region in sync with the primary Region.
D. Deploy an Amazon RDS Multi-AZ DB cluster in the primary Region with a cross-Region read replica in a secondary Region. Configure automated backups and enable automated failover to promote the read replica to become the primary in the secondary Region.

Correct Answer: D

QUESTION 200
A company runs a latency-sensitive application that consumes messages from an Amazon Managed Streaming for Apache Kafka (Amazon MSK) cluster. The MSK cluster runs across three Availability Zones. The current MSK cluster uses Standard brokers with two standard large instances in each Availability Zone. The company wants to minimize latency between Apache Kafka clients that are deployed in the same Availability Zones as the brokers. The company wants to increase available bandwidth and to increase the scaling speed of the cluster. Clients currently use default settings. Some downtime is acceptable while the company implements a solution. Which solution will meet these requirements?

A. Configure a predictive scaling policy and set the MSK cluster as the target. Set the target value to 80 and set the scheduling buffer size to 0. Configure a placement group for the Kafka clients and associate the MSK hosts with the placement group.
B. Configure Cruise Control on the MSK cluster and enable bandwidth control bandwidth and rebalancing. Deploy an Amazon MSK Connect proxy layer that uses latency-based routing. Reconfigure the Kafka clients to use the proxy endpoint.
C. Replace the Standard brokers with Express brokers that use express large instances. Set the client. rack property for the Kafka clients to az_id.
D. Resize the brokers to standard xlarge instances. Create MSK PrivateLink endpoints in each Availability Zone. Reconfigure each Kafka client to use the endpoint that is in the same Availability Zone as the client.

Correct Answer: D