QUESTION 21
A company needs to move 30 TB of image files from its on-premises environment to AWS. The company’s internet connection is limited to 100 Mbps and is unreliable. The company must use an Amazon SageMaker model to run object detection on the images and analyze the findings. The entire process of data migration and analysis must be completed within 30 days. Which solution will meet these requirements?

A. Order an AWS Snowball Edge Compute Optimized device. Install AWS loT Greengrass V2 on the device. Use the device to run the SageMaker model and to perform object detection locally. Return the device to AWS to transfer the images to Amazon S3.
B. Order an AWS Snowball Edge Storage Optimized device. Use the device with AWS DataSync to transfer the images to Amazon S3. Create an AWS Lambda function to call the SageMaker model endpoint. Create an Amazon EventBridge rule to invoke the Lambda function when objects are uploaded to Amazon S3.
C. Order an AWS Snowcone device. Use the device to transfer the images to Amazon S3. Create an AWS Lambda function to call the SageMaker model endpoint. Create an Amazon EventBridge rule to invoke the Lambda function when objects are uploaded to Amazon S3.
D. Use AWS Transfer Family to set up an SFTP endpoint to copy the images to Amazon S3. Create a managed workflow in Transfer Family. Add a custom step a that invokes an AWS Lambda function to call the SageMaker model endpoint.

Correct Answer: A

QUESTION 22
A company is migrating its on-premises file transfer solution to AWS Transfer Family. The on-premises host includes an SFTP server to receive files, an application that performs a transformation of the files, and a messaging server. The transformations run every 5 minutes. When a transformation is complete, the application sends a message to a queue on the messaging server. The company needs to simplify the solution and reduce the management of the components. What should the company do to meet these requirements with the LEAST operational overhead?

A. Configure Transfer Family to use Amazon Elastic File System (Amazon EFS) storage. Use a cron job on Amazon EFS to perform the transformations. Configure the cron job to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when a file has been transformed.
B. Configure Transfer Family to use Amazon S3 storage. Use Amazon EMR to perform the transformations. Configure Amazon EMR to send a message to an Amazon Simple Notification Service (Amazon SNS) topic when a file has been transformed.
C. Configure Transfer Family to use Amazon S3 storage. Use AWS Glue to perform the transformations after S3 event notifications. Configure AWS Glue to send a message to an Amazon Simple Queue Service (Amazon SQS) queue when a file has been transformed.
D. Configure Transfer Family to use Amazon Elastic File System (Amazon EFS) storage. Create an AWS Glue time-based job to run every 5 minutes to initiate an a AWS Glue transformation. Configure AWS Glue to send a message to an Amazon Simple Queue Service (Amazon SQS) queue when a file has been transformed.

Correct Answer: C

QUESTION 23
A company has an application that runs on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The application is in an AWS account that has AWS CloudTrail enabled. The company restricts access to the application by adding the IP addresses of end users to a security group that is associated with the ALB. The company is developing an AWS Lambda function to determine if the allowed IP addresses have accessed the application recently. f an allowed IP address has not accessed the application in the last 90 days, the Lambda function will remove the IP address from the security group. The company needs to implement the functionality for the Lambda function to check the IP addresses. Which combination of steps will provide this functionality MOST cost-effectively? (Select TWO.)

A. For the VPC that contains the ALB, configure VPC flow logs to be sent to a log group in Amazon CloudWatch Logs.
B. Enable access logging on the ALB. Create an Amazon Athena table to query the ALB access logs.
C. Program the Lambda function to check when each allowed IP address from the security group last appeared in the VPC flow logs.
D. Program the Lambda function to check when each allowed IP address from the security group last appeared in the ALB access logs.
E. Program the Lambda function to check when each allowed IP address from the security group last appeared in the CloudTrail logs.

Correct Answer: BD

QUESTION 24
A company is running an application in the AWS Cloud. The application runs in a single AWS Region and stores all data in an Amazon Aurora MySQL DB cluster. The company runs hundreds of Amazon Elastic Container Service (Amazon ECS) containers on AWS Fargate. An Application Load Balancer distributes the traffic. The application is set up by using infrastructure as code (IaC) and the AWS Cloud Development Kit (AWS CDK). The application must fail over to a second Region with an RTO and RPO of 15 minutes. Which solution will meet these requirements?

A. Convert the Aurora cluster to a global database. Add the second Region as an additional Region to the global database. Deploy a second ALB, a second ECS cluster, and Fargate containers to the second Region during a failover by using the AWS CDK.
B. Create an Aurora cluster in the second Region. Set the Aurora cluster as the read replica for the primary cluster. Create a second ALB and a second ECS cluster in the second Region. Deploy scaled down versions of the Fargate containers in the new ECS cluster. Scale up the containers during a failover.
C. Create a second ALB and a second ECS cluster in the second Region. Deploy scaled down versions of the Fargate containers in the new ECS cluster. Use AWS Backup to create a snapshot of the database every 15 minutes. Copy the snapshot to the second Region. Scale up the containers during a failover.
D. Enable automatic backup on the Aurora cluster. Copy the backup to the second Region. Deploy a second ALB, a second ECS cluster, and Fargate containers to the second Region during a failover by using the AWS CDK.

Correct Answer: A

QUESTION 25
A company has an IoT data lake that is stored in Amazon S3. Data scientists in a separate AWS account need to analyze the data on Amazon EC2 instances in a VPC Company policy requires that only authorized networks access the IoT data. The EC2 instances already have an IAM role that allows access to Amazon S3. An S3 access point exists on the data lake S3 bucket. The company needs to provide secure access to the S3 data lake for the EC2 instances while complying with the policy that requires access from only authorized networks. Which combination of steps will meet these requirements? (Select TWO.)

A. Create a gateway VPC endpoint for Amazon S3 in the data scientists’ VPC.
B. Update the S3 access point settings to block public access.
C. Update the EC2 instance role. Add a policy with a condition that denies the s3:GetObject action when the value for the s3: DataAccessPointArn condition key is a valid access point ARN.
D. Update the VPC route table to route S3 traffic to the S3 access point.
E. Add an S3 bucket policy with a condition that allows the s3:GetObiect action when the value for the s3: DataAccess PointArn condition key is a valid access point ARN.

Correct Answer: AE

QUESTION 26
A company has multiple AWS accounts and manages these accounts with AWS Organizations. A developer was given IAM user credentials to access AWS resources. The developer should have read-only access to all Amazon S3 buckets in the account. However, when the developer tries to access the S3 buckets from the console, they receive an access denied error message with no buckets listed. A solutions architect reviews the permissions and finds that the developer’s IAM user is listed as having read-only access to all S3 buckets in the account. Which additional steps should the solutions architect take to troubleshoot the issue? (Select TWO.)

A. Check the bucket policies for all S3 buckets.
B. Check the ACLs for all S3 buckets.
C. Check the SCPs set at the organizational units (OUs).
D. Check for the permissions boundaries set for the IAM user.
E. Check if an appropriate IAM role is attached to the IAM user.

Correct Answer: CD

QUESTION 27
A company has an on-premises Microsoft SQL Server database that writes a nightly 200 GB export to a local drive. The company wants to move the backups to more robust cloud storage on Amazon S3. The company has set up a 10 Gbps AWS Direct Connect connection between the on-premises data center and AWS. Which solution meets these requirements MOST cost-effectively?

A. Create a new S3 bucket. Deploy an AWS Storage Gateway file gateway within the VPC that is connected to the Direct Connect connection. Create a new SMB file share. Write nightly database exports to the new SMB file share.
B. Create an Amazon FS for Windows File Server Single-AZ file system within the VPC that is connected to the Direct Connect connection. Create a new SMB file share. Write nightly database exports to an SMB file share on the Amazon FSx file system. Enable nightly backups.
C. Create an Amazon FSx for Windows File Server Multi-AZ file system within the VPC that is connected to the Direct Connect connection. Create a new SMB file share. Write nightly database exports to an SMB file share on the Amazon FSx file system. Enable nightly backups.
D. Create a new S3 bucket. Deploy an AWS Storage Gateway volume gateway within the VPC that is connected to the Direct Connect connection. Create a new SMB file share. Write nightly database exports to the new SMB file share on the volume gateway, and automate copies of this data to an S3 bucket.

Correct Answer: A

QUESTION 28
A company runs its application on Amazon EC2 instances and AWS Lambda functions. The EC2 instances experience a continuous and stable load. The Lambda functions experience a varied and unpredictable load. The application includes a caching layer that uses an Amazon MemoryDB cluster. A solutions architect must recommend a solution to minimize the company’s overall monthly costs. Which solution will meet these requirements?

A. Purchase an EC2 Instance Savings Plan to cover the EC2 instances. Purchase a Compute Savings Plan for Lambda to cover the minimum expected consumption of the Lambda functions. Purchase reserved nodes to cover the MemoryDB cache nodes.
B. Purchase a Compute Savings Plan to cover the EC2 instances. Purchase Lambda reserved concurrency to cover the expected Lambda usage. Purchase reserved nodes to cover the MemoryDB cache nodes.
C. Purchase a Compute Savings Plan to cover the entire expected cost of the EC2 instances, Lambda functions, and MemoryDB cache nodes.
D. Purchase a Compute Savings Plan to cover the EC2 instances and the MemoryDB cache nodes. Purchase Lambda reserved concurrency to cover the expected Lambda usage.

Correct Answer: A

QUESTION 29
A company is running an email application across multiple AWS Regions. The company uses Ohio (us-east-2) as the primary Region and Northern Virginia (us-east-1) as the Disaster Recovery (DR) Region. The data is continuously replicated from the primary Region to the DR Region by a single instance on the public subnet in both Regions. The replication messages between the Regions have a significant backlog during certain times of the day. The backlog clears on its own after a short time, but it affects the application’s RPO. Which of the following solutions should help remediate this performance problem? (Select TWO.)

A. Increase the size of the instances.
B. Have the instance in the primary Region write the data to an Amazon SQS queue in the primary Region instead, and have the instance in the DR Region poll from this queue.
C. Use multiple instances on the primary and DR Regions to send and receive the replication data.
D. Change the DR Region to Oregon (us-west-2) instead of the current DR Region.
E. Attach an additional elastic network interface to each of the instances in both Regions and set up load balancing between the network interfaces.

Correct Answer: BC

QUESTION 30
A company hosts an application on AWS by using an Amazon EC2 instance in a private subnet behind an Application Load Balancer (ALB). The EC2 security group has no outbound rules. The subnet network ACLs are configured to allow only inbound traffic from the ALB. The company wants to implement a new feature. The application must access an Amazon S3 bucket by using the private subnet. The company has implemented an S3 gateway endpoint in the private subnet route table. Which combination of steps will meet these requirements with the LEAST operational overhead? (Select THREE.)

A. Modify the security group that is attached to the EC2 instance to allow outbound traffic to IP addresses that are included in the AWS managed S3 prefix list.
B. Modify the security group that is attached to the EC2 instance to allow outbound traffic to the S3 IP address range from the AWS managed S3 prefix list.
C. Update the private subnet network ACLs to allow inbound traffic and outbound traffic by using the AWS managed S3 prefix list ID source and destination value.
D. Update the network ACLs for the private subnet to allow inbound traffic and outbound traffic to and from Amazon S3. Use the IP address range of Amazon S3 from the AWS managed S3 prefix list as the source and destination values in the network ACL rules.
E. Create an AWS Lambda function to update network ACL rules with the AWS published S3 IP address range. Subscribe the Lambda function to the Amazon Simple Notification Service (Amazon SNS) AmazonipSpaceChanged topic so that the function updates the network ACL rules when the S3 IP address range changes.
F. Create an AWS Lambda function to update the EC2 instance security group rules with the AWS published S3 IP address range. Subscribe the Lambda function to the Amazon Simple Notification Service (Amazon SNS) AmazonlpSpaceChanged topic so that the function updates the rules when the S3 IP address range changes.

Correct Answer: ACD

QUESTION 31
A company is running an application in the AWS Cloud. The company has several third-party services that integrate with the application through a RESTful API. The API is a serverless implementation with an Amazon API Gateway regional API endpoint that integrates with several different AWS Lambda functions. The application’s data is nonrelational and is stored in an Amazon DynamoDB table. The application and the API are running in the eu-west-1 Region. The company needs the API to also be available in the us-east-1 Region. All data must be available in both Regions. A solutions architect already has deployed all the Lambda functions in us-east-1. Which additional steps should the solutions architect take to meet these requirements? (Select TWO.)

A. Deploy a second API Gateway regional API endpoint in us-east-1. Create Lambda integration with the functions in us-east-1.
B. Enable DynamoDB Streams on the table in eu-west-1. Replicate all changes to a DynamoDB table in us-east-1.
C. Modify the DynamoDB table to be a global table in eu-west-1 and in us-east-1.
D. Change the API Gateway API endpoint in eu-west-1 to an edge-optimized endpoint. Create Lambda integration with the functions in both Regions.
E. Create a DynamoDB read replica in us-east-1.

Correct Answer: AC

QUESTION 32
A company hosts a software as a service (SaaS) solution on AWS. The solution has an Amazon API Gateway API that serves an HTTPS endpoint. The API uses AWS Lambda functions for compute. The Lambda functions store data in an Amazon Aurora Serverless v1 database. The company used the AWS Serverless Application Model (AWS SAM) to deploy the solution. The solution extends across multiple Availability Zones and has no disaster recovery (DR) plan. A solutions architect must design a DR strategy that can recover the solution in another AWS Region. The solution has an RTO of 5 minutes and an RPO of 1
minute. What should the solutions architect do to meet these requirements?

A. Create a read replica of the Aurora Serverless v1 database in the target Region. Use AWS SAM to create a runbook to deploy the solution to the target Region. Promote the read replica to primary in case of disaster.
B. Change the Aurora Serverless v1 database to a standard Aurora MySQL global database that extends across the source Region and the target Region. Use AWS SAM to create a runbook to deploy the solution to the target Region.
C. Create an Aurora Serverless v1 DB cluster that has multiple writer instances in the target Region. Launch the solution in the target Region. Configure the two Regional solutions to work in an active-passive configuration.
D. Change the Aurora Serverless v1 database to a standard Aurora MySQL global database that extends across the source Region and the target Region. Launch the solution in the target Region. Configure the two Regional solutions to work in an active-passive configuration.

Correct Answer: D

QUESTION 33
A company uses Amazon CloudFront to serve a static application from an Amazon S3 bucket origin. A custom domain maps to the CloudFront distribution. The application calls a Regional Amazon API Gateway endpoint in the ap-northeast-1 Region for backend APIs. The company has configured cross-origin resource sharing (CORS) so the application can access the APIs. Recent tests discovered that API calls are slower from outside ap-northeast-1, which causes slow page loads. What should the company do to improve application performance?

A. Enable CloudFront Origin Shield and S3 Transfer Acceleration for the S3 bucket.
B. Use an Amazon Route 53 latency-based routing policy for the API Gateway endpoint and the CloudFront distribution.
C. Register the API Gateway endpoint as an origin in CloudFront. Access the backend APIs by using the application’s DNS name.
D. Set up AWS Global Accelerator in the same account as the CloudFront distribution. Access the backend APIs by using Global Accelerator.

Correct Answer: D

QUESTION 34
A company operates an API service in the AWS Cloud. The service is based on an Amazon API Gateway REST API that is integrated with an AWS Lambda function. The Lambda function stores data in an Amazon DynamoDB table. The DynamoDB table is configured with on-demand capacity mode. An application accesses the API service sporadically during the day. Performance testing showed high variability in response time. The first response to identical requests took longer to process compared to subsequent responses. Which solution will ensure consistent performance?

A. Configure a Lambda function endpoint as the target for an Amazon Route 53 record set. Use Route 53 latency-based routing to distribute traffic.
B. Configure provisioned concurrency for the Lambda function. Use AWS Application Auto Scaling with a target tracking scaling policy to manage concurrency based on usage.
C. Create an Amazon CloudFront distribution that uses the API Gateway endpoint as an origin. Route API requests by using the CloudFront distribution.
D. Implement DynamoDB Accelerator (DAX). Use provisioned capacity mode and auto scaling for the DynamoDB table.

Correct Answer: B

QUESTION 35
A company is running several applications in the AWS Cloud. Each application is running in a separate AWS account in a VPC that the company’s networking team controls. The VPC consists of two public subnets and two private subnets. A NAT gateway is deployed in each public subnet for outbound internet traffic. The applications must run in the private subnets and cannot be reachable from the public internet. As the number of applications has increased, the company has become concerned about the complexity of the network infrastructure. Which combination of steps should a solutions architect take to centralize the network architecture? (Select THREE.)

A. Create new egress-only internet gateways in each application account.
B. Create a new VPC in a new networking account. Deploy new NAT gateways into the new VPC.
C. Delete the existing NAT gateways. Update the route tables to send traffic to the egress-only internet gateways.
D. Create a transit gateway in the new networking account. Share the transit gateway by using AWS Resource Access Manager (AWS RAM). Attach each application VPC to the transit gateway.
E. Create a VPC peering connection in the application VPC. Connect the application VPC to the egress-only internet gateways.
F. Delete the existing NAT gateways. Update the route tables to send traffic to the transit gateway.

Correct Answer: BDF

QUESTION 36
A company needs to migrate its website from an on-premises data center to AWS. The website consists of a load balancer, a content management system (CMS) that runs on a Linux operating system, and a MySQL database. The CMS requires persistent NFS-compatible storage for a file system. The new solution on AWS must be able to scale from 2 Amazon EC2 instances to 30 EC2 instances in response to unpredictable traffic increases. The new solution also must require no changes to the website and must prevent data loss. Which solution will meet these requirements?

A. Create an Amazon Elastic File System (Amazon EFS) file system. Deploy the CMS to AWS Elastic Beanstalk with an Application Load Balancer and an Auto Scaling group. Use ebextensions to mount the EFS file system to the EC2 instances. Create an Amazon Aurora MySQL database that is separate from the Elastic Beanstalk environment.
B. Create an Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume. Deploy the CMS to AWS Elastic Beanstalk with a Network Load Balancer and an Auto Scaling group. Use ebextensions to mount the EBS volume to the EC2 instances. Create an Amazon RDS for MySQL database in the Elastic Beanstalk environment.
C. Create an Amazon Elastic File System (Amazon EFS) file system. Create a launch template and an Auto Scaling group to launch EC2 instances to support the CMS. Create a Network Load Balancer to distribute traffic. Create an Amazon Aurora MySQL database. Use an EC2 Auto Scaling scale-in lifecycle hook to mount the EFS file system to the EC2 instances.
D. Create an Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume. Create a launch template and an Auto Scaling group to launch EC2 instances to support the CMS. Create an Application Load Balancer to distribute traffic. Create an Amazon ElastiCache (Redis OSS) cluster to support the MySQL database. Use EC2 user data to attach the EBS volume to the EC2 instances.

Correct Answer: A

QUESTION 37
A company that uses AWS Organizations is creating several new AWS accounts. The company is setting up controls to properly allocate AWS costs to business units The company must implement a solution to ensure that all resources include a tag that has a key of costcenter and a value from a predefined list of business units. The solution must send a notification each time a resource tag does not meet these criteria. The solution must not prevent the creation of resources. Which solution will meet these requirements with the LEAST operational overhead?

A. Create an IAM policy for all actions that create AWS resources. Add a condition to the policy that aws: RequestTag/costcenter must exist and must contain a valid business unit value. Create an Amazon EventBridge rule that monitors IAM service events and Amazon EC2 service events for noncompliant tag policies. Configure the rule to send notifications through Amazon Simple Notification Service (Amazon SNS).
B. Create an IAM policy for all actions that create AWS resources. Add a condition to the policy that aws: ResourceTag/costcenter must exist and must contain a valid business unit value. Create an Amazon EventBridge rule that monitors IAM service events and Amazon EC2 service events for noncompliant tag policies. Configure the rule to send notifications through Amazon Simple Notification Service (Amazon SNS).
C. Create an organization tag policy that ensures that all resources have the costcenter tag with a valid business unit value. Do not select the option to prevent operations when tags are noncompliant. Create an Amazon EventBridge rule that monitors all events for noncompliant tag policies. Configure the rule to send notifications through Amazon Simple Notification Service (Amazon SNS).
D. Create an organization tag policy that ensures that all resources have the costcenter tag with a valid business unit value. Select the option to prevent operations when tags are noncompliant. Create an Amazon EventBridge rule that monitors all events for noncompliant tag policies. Configure the rule to send notifications through Amazon Simple Notification Service (Amazon SNS).

Correct Answer: C

QUESTION 38
A company is moving a business-critical, multi-tier application to AWS. The architecture consists of a desktop client application and server infrastructure. The server infrastructure resides in an on-premises data center that frequently fails to maintain the application uptime SLA of 99.95%. A solutions architect must re-architect the application to ensure that it can meet or exceed the SLA. The application contains a PostgreSQL database running on a single virtual machine. The business logic and presentation layers are load balanced between multiple virtual machines. Remote users complain about slow load times while using this latency-sensitive application. Which of the following will meet the availability requirements with little change to the application while improving user experience and minimizing costs?

A. Migrate the database to a PostgreSQL database in Amazon EC2. Host the application and presentation layers in automatically scaled Amazon ECS containers behind an Application Load Balancer. Allocate an Amazon WorkSpaces WorkSpace for each end user to improve the user experience.
B. Migrate the database to an Amazon RDS Aurora PostgreSQL configuration. Host the application and presentation layers in an Auto Scaling configuration on Amazon EC2 instances behind an Application Load Balancer. Use Amazon AppStream 2.0 to improve the user experience.
C. Migrate the database to an Amazon RDS PostgreSQL Multi-AZ configuration. Host the application and presentation layers in automatically scaled AWS Fargate containers behind a Network Load Balancer. Use Amazon ElastiCache to improve the user experience.
D. Migrate the database to an Amazon Redshift cluster with at least two nodes. Combine and host the application and presentation layers in automatically scaled Amazon ECS containers behind an Application Load Balancer. Use Amazon CloudFront to improve the user experience.

Correct Answer: B

QUESTION 39
A company uses an Amazon Redshift cluster to ingest data from various sources. The data is shared with other internal applications for analysis and reporting. The cluster has eight ra3.4xlarge nodes. Data ingestion runs daily from midnight to 8 AM and takes 3 hours. The cluster has 85% average CPU utilization during ingestion. The cluster uses on-demand node pricing and is paused outside of the 8-hour daily ingestion window. Snapshots are enabled on the cluster. The company wants to optimize this workload to reduce costs. Which solution will meet these requirements?

A. Create a new Redshift cluster with eight ra3.4xlarge nodes in concurrency scaling mode by using the most recent snapshot from the existing cluster. Modify the internal applications to retrieve data from the new Redshift cluster. Shut down the existing Redshift cluster. Purchase eight 1-year All Upfront Redshift reserved nodes.
B. Create a new Redshift cluster with six ra3. 16xlarge nodes by using the most recent snapshot from the existing cluster. Enable auto scaling. Modify the internal applications to retrieve data from the new Redshift cluster. Shut down the existing Redshift cluster.
C. Create a new Redshift Serverless endpoint with 64 Redshift Processing Units (RPUs) by using the most recent snapshot from the existing Redshift cluster. Update the internal applications to retrieve data from the new Redshift Serverless endpoint. Delete the existing Redshift cluster.
D. Configure Redshift Spectrum on the existing Redshift cluster. Set up IAM permissions to allow Redshift Spectrum to access Amazon S3. Unload data from the existing cluster to an S3 bucket. Update the internal applications to query the S3 data.

Correct Answer: C

QUESTION 40
A company builds Docker container images and publishes the images to Amazon Elastic Container Registry (Amazon ECR). Basic vulnerability scanning is performed on the images when the images are pushed to Amazon ECR. Some images that were pushed to Amazon ECR more than 12 months ago might have vulnerabilities. The company needs a solution that will continuously scan all current and new images in Amazon ECR to check for known vulnerabilities. Which solution will meet these requirements?

A. Create a new ECR repository. Enable ECR basic scanning on the new repository. Pull all images from the existing ECR repository and push the images to the new ECR repository.
B. Disable ECR basic scanning. Initiate manual scanning for all images older than 30 days based on the image push timestamp.
C. Disable ECR basic scanning. Pull images older than 12 months and push those images back to the ECR repository. Enable ECR enhanced scanning.
D. Enable enhanced scanning on the ECR repository. Pull images that have a SCAN ELIGIBILITY EXPIRED scan status and push those images back to the ECR repository.

Correct Answer: D