QUESTION 61
A company uses an AWS Transfer for SFTP public sever endpoint and Amazon S3 storage to host large datasets for its customers. The company provides customers SSH private keys to authenticate and download their datasets. The Transfer for SFTP server is configured with structured logging that is saved to an S3 bucket. The company wants to charge customers based on their monthly data download usage. Which solution will meet these requirements?

A. Configure VPC Flow Logs to write to a new S3 bucket. Run monthly queries on the flow logs to identify customer usage and calculate cost. Add the charges to the customers’ monthly bills.
B. Each month use AWS Cost Explorer to examine the costs for Transfer for SFTP and obtain a breakdown by customer. Add the charges to the customers’ monthly bills.
C. Enable requester pays on the S3 bucket that hosts the software. Allocate the charges to each customer based on the customer’s requests.
D. Run Amazon Athena queries on the logging S3 bucket monthly to identify customer usage and calculate costs. Add the charges to the customers’ monthly bills.

Correct Answer: D

QUESTION 62
A company runs an ecommerce website on Amazon Elastic Container Service (Amazon ECS) behind an Application Load Balancer (ALB). The container images are stored in Amazon Elastic Container Registry (Amazon ECR). The website stores data in an Amazon Aurora MySQL DB cluster. The ALB uses an HTTPS listener with a public SSL certificate that is saved in AWS Certificate Manager (ACM). The website domain is registered with Amazon Route 53. The company wants to duplicate this setup in a second AWS Region in an active-active configuration. The website can tolerate minor latency for data replication between Regions. The company has already deployed an ECS cluster with an ALB in the secondary Region. The ECS cluster is registered for geolocation routing with Route 53. Which combination of steps will meet these requirements with the LEAST operational overhead? (Select THREE.)

A. Request a new ACM certificate for the company website in the secondary Region. Configure the ALB in the secondary Region with an HTTPS listener. Set the new ACM certificate as the default certificate.
B. Share the ACM certificate with the secondary Region by using AWS Resource Access Manager (AWS RAM). Configure the ALB in the secondary Region with an HTTPS listener. Set the shared ACM certificate as the default certificate.
C. Create a VPC endpoint for Amazon ECR in the secondary Region. Configure Amazon EC2 instances to download container images from the primary Region.
D. Enable Cross-Region Replication for ECR repositories to the secondary Region. Re-push the existing images to ECR repositories with a new tag.
E. Configure an Aurora global database in the primary Region. Enable write forwarding to the secondary Region.
F. Use an Aurora DB cluster that has multiple writer instances in the primary Region. Create a secondary Aurora DB instance in the secondary Region. Enable cross-Region writes between the DB clusters.

Correct Answer: BDE

QUESTION 63
A company is transitioning some of its applications to AWS. The company has already set up a central AWS network account in an AWS Region and established an AWS Direct Connect connection. The company expects to have hundreds of AWS workload accounts and VPCs soon. The corporate network must be able to access resources on AWS seamlessly and communicate with all the workload VPCs. The company also wants to route traffic from its workloads to the internet through the company’s on-premises data center. Which combination of steps will meet these requirements? (Select THREE.)

A. In the central network account, set up a Direct Connect gateway. Create a virtual private gateway for each workload account. Create an association proposal between the Direct Connect gateway and each workload account’s virtual private gateway.
B. In the central network account, provision a Direct Connect gateway and a transit gateway. Establish connectivity between the Direct Connect gateway and the transit gateway by associating the transit gateway with the Direct Connect gateway through a transit VIF.
C. In the central network account, create an internet gateway. Configure route table rules to direct internet traffic through the internet gateway.
D. Share the transit gateway with the workload accounts. Attach VPCs to the transit gateway.
E. Establish VPC peering connections between all the workload VPCs and the central network account. Configure route tables in the workload VPCs to route internet traffic to the central network account.
F. Provision private subnets exclusively. Configure route tables on the subnets and gateway to route traffic destined for non AWS resources to the on-premises data center.

Correct Answer: BDE

QUESTION 64
A company operates a fleet of Amazon EC2 instances in a VPC that has access to the internet. The company’s security policy requires that the EC2 instances can access only website domains from an approved list. Which solution will meet these requirements?

A. Create an Amazon Route 53 Resolver DNS Firewall domain list with allowed domains. Configure a DNS Firewall rule group for the domain list. Associate the rule group with the VPC.
B. Create an Amazon Route 53 traffic policy for the company’s domain. Configure a Route 53 outbound endpoint and a Route 53 inbound endpoint. Associate the inbound endpoint with the VPC. Associate the approved list with the outbound endpoint.
C. Create an Amazon Route 53 traffic flow policy to match the allowed domains. Create a Route 53 Resolver. Configure the traffic flow policy to forward requests that match the Route 53 Resolver. Associate the traffic flow policy with the VPC.
D. Create an Amazon Route 53 outbound endpoint that is associated with the VPC. Configure a Route 53 traffic flow policy to forward requests for allowed domains to the outbound endpoint. Associate the traffic flow policy with the VPC.

Correct Answer: A

QUESTION 65
A company wants to modernize a monolithic application in the company’s data center and deploy the application on AWS. The monolithic application consists of an event broker in a central account and multiple microservices in individual AWS accounts. The event broker and the microservices are deployed on Amazon Elastic Container Service (Amazon ECS) clusters that use the Fargate launch type. Multiple microservices need access to the same events from the event broker. The company wants to distribute events from the central event broker to each microservice across accounts. Which solution will meet these requirements?

A. Create an Amazon Simple Notification Service (Amazon SNS) topic in the central account. Add a topic policy to allow other accounts to subscribe to the topic. Create an Amazon Simple Queue Service (Amazon SQS) queue in each individual AWS account. Subscribe the SQS queue to the SNS topic. Configure the microservices to read events from their own SQS queue.
B. Create a new Amazon EventBridge event bus in the central account with the required permissions. Add EventBridge rules filtered by service for each microservice. Invoke the rules to route events to other accounts.
C. Create a data stream in Amazon Kinesis Data Streams in the central account. Create an IAM policy to grant the necessary permissions to access the data stream. Set each of the microservices as an event source on the Kinesis stream. Configure the stream to invoke each microservice.
D. Create a new Amazon Simple Queue Service (Amazon SQS) queue as the event broker in the central account. Grant the required permissions. Configure each of the microservices to read messages from the central SQS queue.

Correct Answer: A

QUESTION 66
A company hosts an ecommerce platform that consists of applications in the us-east-1 Region. The applications are deployed on Amazon Elastic Container Service (Amazon ECS) inside a VPC. The applications use images that are stored in an Amazon Elastic Container Registry (Amazon ECR) repository. The ecommerce product catalog data is stored in an Amazon Neptune DB cluster and is often updated by the company’s operations team. The operations team is located in the United States. A solutions architect must design a similar solution in the eu-west-1 Region to serve European customers. The solutions architect must implement low latency, read-only data replication for the Neptune DB cluster from us-east-1 to eu-west-1. The solution must use the same container images across both Regions. Which combination of steps will meet these requirements with the LEAST operational overhead? (Select TWO.)

A. Convert the Neptune DB cluster in us-east-1 into a global database. Add a secondary DB cluster in eu-west-1.
B. Create VPC peering across both Regions. Create an AWS Database Migration Service (AWS DMS) task in us-east-1. Set the source as the Neptune DB cluster in us-east-1. Set the target as the Neptune DB cluster in eu-west-1.
C. Create VPC peering across both Regions. Enable the Neptune Streams feature in the DB cluster in us-east-1. In eu-west-1, create a custom AWS Lambda function that consumes Neptune streams from us-east-1 and replicates the streams in eu-west-1.
D. Update the resource policy of the ECR repository in us-east-1 with the following statements: “Action”: (“ecr:* “] and “Principal”: ( “AWS”: “arn:aws:iam::<account-id> root”). Create an ECR interface VPC endpoint in eu-west-1.
E. Enable Cross-Region Replication in Amazon ECR in us-east-1. Set the destination as eu-west-1. Re-push the existing images to repositories with a new tag in us-east-1.

Correct Answer: AE

QUESTION 67
A medical company is running a REST API on a set of Amazon EC2 instances. The EC2 instances run in an Auto Scaling group behind an Application Load Balancer (ALB). The ALB runs in three public subnets, and the EC2 instances run in three private subnets. The company has deployed an Amazon CloudFront distribution that has the ALB as the only origin. Which solution should a solutions architect recommend to enhance the origin security?

A. Store a random string in AWS Secrets Manager. Create an AWS Lambda function for automatic secret rotation. Configure CloudFront to inject the random string as a custom HTTP header for the origin request. Create an AWS WAF web ACL rule with a string match rule for the custom header. Associate the web ACL with the ALB.
B. Create an AWS WAF web ACL rule with an IP match condition of the CloudFront service IP address ranges. Associate the web ACL with the ALB. Move the ALB into the three private subnets.
C. Store a random string in AWS Systems Manager Parameter Store. Configure Parameter Store automatic rotation for the string. Configure CloudFront to inject the random string as a custom HTTP header for the origin request. Inspect the value of the custom HTTP header, and block access in the ALB.
D. Configure AWS Shield Advanced. Create a security group policy to allow connections from CloudFront service IP address ranges. Add the policy to AWS Shield Advanced, and attach the policy to the ALB.

Correct Answer: B

QUESTION 68
A company is building an image storage application on AWS. Customers will upload large images. The application will resize the images, store the resized images in an Amazon S3 bucket, and then delete the images after 6 months. The application must be able to rerun failed resize jobs. Which solution will meet these requirements?

A. Use S3 Event Notifications to invoke AWS Step Functions to process the images. Run an AWS Lambda function that resizes the images in place and replaces the original images in the S3 bucket. Set up a lifecycle configuration rule on the S3 bucket to expire all stored images as needed.
B. Enable an Amazon EventBridge integration on the S3 bucket. Create an EventBridge rule to invoke an AWS Lambda function when a user uploads an image to the S3 bucket. Configure the Lambda function to resize the image and replace the original image in the S3 bucket. Set up a lifecycle configuration rule on the S3 bucket to expire all stored images as needed.
C. Use S3 Event Notifications to invoke an AWS Lambda function when a user stores an image. Use the Lambda function to resize the image in place and to store the original image in the S3 bucket. Set up a lifecycle configuration rule on the S3 bucket to expire all noncurrent versions of images as needed.
D. Use S3 Event Notifications to store a message in Amazon Simple Queue Service (Amazon SQS). Invoke an AWS Lambda function that resizes the image and stores the resized image in an S3 bucket that uses S3 Standard-Infrequent Access (S3 Standard-IA). Set up a lifecycle configuration rule on the S3 bucket to expire all noncurrent versions of images as needed.

Correct Answer: A

QUESTION 69
A company generates approximately 20 GB of data multiple times each day. The company uses AWS DataSync to copy all data from on-premises storage to Amazon S3 every 6 hours for further processing. The analytics team wants to modify the copy process to copy only data relevant to the analytics team and ignore the rest of the data. The team wants to copy data as soon as possible and receive a notification when the copy process is finished. Which combination of steps will meet these requirements MOST cost-effectively? (Select THREE.)

A. Modify the data generation process on premises to create a manifest file at the end of the copy process with the names of the objects to be copied to Amazon S3. Create a custom script to upload the manifest file to an S3 bucket.
B. Modify the data generation process on premises to create a manifest file at the end of the copy process with the names of the objects to be copied to Amazon S3. Create an AWS Lambda function to load the manifest file data into an Amazon DynamoDB table.
C. Create an AWS Lambda function that Amazon EventBridge invokes when the manifest file is loaded into Amazon DynamoDB. Configure the Lambda function to copy the data from on-premises storage to the S3 bucket that uses the manifest file.
D. Create an AWS Lambda function that an S3 Event Notification invokes when the manifest file is uploaded. Configure the Lambda function to invoke the DataSync task by calling the StartTaskExecution API action with a manifest.
E. Create an Amazon Simple Notification Service (Amazon SNS) topic. Create an Amazon EventBridge rule to send an email notification to the SNS topic when the DataSync task execution status changes to SUCCESS or to ERROR.
F. Create an Amazon Simple Notification Service (Amazon SNS) topic. Create an AWS Lambda function to send an email notification to the SNS topic when the DataSync task execution status changes to SUCCESS or to ERROR.

Correct Answer: ACE

QUESTION 70
A company has AWS accounts that are in an organization in AWS Organizations. The company wants to track Amazon EC2 usage as a metric. The company’s architecture team must receive a daily alert if the EC2 usage is more than 10% higher than the average EC2 usage from the past 30 days. Which solution will meet these requirements?

A. Set up a budget in AWS Budgets in the organization’s management account to track EC2 usage. Use a daily time period. Base the budget on the average EC2 usage for the past 30 days plus 10%. Configure an alert to notify the architecture team if the budget threshold is reached.
B. Configure AWS Cost Anomaly Detection in the organization’s management account. Configure a monitor type of AWS Service. Apply a filter of Amazon EC2. Configure an alert subscription to notify the architecture team if the usage is 10% more than the average usage for the past 30 days.
C. Enable AWS Trusted Advisor in the organization’s management account. Configure a cost optimization advisory alert to notify the architecture team if the EC2 usage is 10% more than the reported average usage for the past 30 days.
D. Configure Amazon Detective in the organization’s management account. Configure an EC2 usage anomaly alert to notify the architecture team if Detective identifies a usage anomaly of more than 10%.

Correct Answer: A

QUESTION 71
A company has AWS accounts in an organization in AWS Organizations that has all features enabled. Each company department has an OU and a separate cost center. The company needs to allocate AWS charges by each department. The company must ensure that all new Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS) volumes are created with a valid CostCenter tag from a predefined list of cost centers. The company must prevent the creation of new resources that do not comply with this tagging policy. Which solution will meet these requirements?

A. Configure the required-tags AWS Config managed rule in the organization’s management account. Customize AWS Config to include globally recorded resource types. Specify the AWSEC2::Instance and AWS:EC2::Volume resource type values. Define a parameter where the parameter value is restricted to a comma-separated list of cost centers.
B. Configure the required-tags AWS Config managed rule in each AWS account. Specify the AWS EC2 Instance and AWS EC2: Volume resource type values. Define a parameter where the parameter value is restricted to a comma-separated list of cost centers.
C. Enable trusted access for tag policies in the organization’s management account. Create a tag policy that has a comma-separated list of cost centers as the tag value. Configure the tag policy to enforce the ec2:instance and ec2:volume resource type values.
D. Implement an SCP at the root of the organization. Configure the SCP to deny the ec2:RunInstances and ec2:CreateVolume actions unless the aws:RequestTag/CostCenter condition key has a value from a list of allowed cost centers.

Correct Answer: D

QUESTION 72
A company wants to migrate virtual Microsoft workloads from an on-premises data center to AWS. The company has successfully tested a few sample workloads on AWS. The company also has created an AWS Site-to-Site VPN connection to a VPC. A solutions architect needs to generate a total cost of ownership (TCO) report for the migration of all the workloads from the data center. Simple Network Management Protocol (SNMP) has been enabled on each VM in the data center. The company cannot add more VMs in the data center and cannot install additional software on the VMs. The discovery data must be automatically imported into AWS Migration Hub. Which solution will meet these requirements?

A. Use the AWS Application Migration Service agentless service and the AWS Migration Hub Strategy Recommendations to generate the TCO report.
B. Launch a Windows Amazon EC2 instance. Install the Migration Evaluator agentless collector on the EC2 instance. Configure Migration Evaluator to generate the TCO report.
C. Launch a Windows Amazon EC2 instance. Install the Migration Evaluator agentless collector on the EC2 instance. Configure Migration Hub to generate the TCO report.
D. Use the AWS Migration Readiness Assessment tool inside the VPC. Configure Migration Evaluator to generate the TCO report.

Correct Answer: A

QUESTION 73
A company is building an image storage application on AWS. Customers will upload large images. The application will resize the images, store the resized images in an Amazon S3 bucket, and then delete the images after 6 months. The application must be able to rerun failed resize jobs. Which solution will meet these requirements?

A. Use S3 Event Notifications to invoke AWS Step Functions to process the images. Run an AWS Lambda function that resizes the images in place and replaces the original images in the S3 bucket. Set up a lifecycle configuration rule on the S3 bucket to expire all stored images as needed.
B. Enable an Amazon EventBridge integration on the S3 bucket. Create an EventBridge rule to invoke an AWS Lambda function when a user uploads an image to the S3 bucket. Configure the Lambda function to resize the image and replace the original image in the S3 bucket. Set up a lifecycle configuration rule on the S3 bucket to expire all stored images as needed.
C. Use S3 Event Notifications to invoke an AWS Lambda function when a user stores an image. Use the Lambda function to resize the image in place and to store the original image in the S3 bucket. Set up a lifecycle configuration rule on the S3 bucket to expire all noncurrent versions of images as needed.
D. Use S3 Event Notifications to store a message in Amazon Simple Queue Service (Amazon SQS). Invoke an AWS Lambda function that resizes the image and stores the resized image in an S3 bucket that uses S3 Standard-Infrequent Access (S3 Standard-IA). Set up a lifecycle configuration rule on the S3 bucket to expire all noncurrent versions of images as needed.

Correct Answer: D

QUESTION 74
A solutions architect is designing a solution to automatically provision new AWS accounts in an organization in AWS Organizations. The solutions architect has enabled AWS Control Tower for the organization. The solution must enable security controls and create resources such as billing alarms after creating new AWS accounts. The solution must be scalable. Which solution meets these requirements with the LEAST operational overhead?

A. Create a new AWS account in the organization. Deploy a blueprint to the new AWS account. Define a blueprint that creates resources such as billing alarms. Configure AWS Control Tower to apply the blueprint after creating the new AWS account.
B. Create a new AWS account in the organization. Establish trusted access to the account by using an AWS CloudFormation template. Enroll the new AWS account into AWS Control Tower. Deploy a blueprint to the new AWS account by using AWS Control Tower to provision resources.
C. Use Account Factory to initiate the creation of a new AWS account by using AWS Service Catalog. Configure a lifecycle event in AWS Control Tower that invokes an AWS Lambda function. Configure the Lambda function to deploy an AWS CloudFormation template by using the AWSControlTower Execution role.
D. Use Account Factory to initiate the creation of a new AWS account by using AWS Control Tower. Define a blueprint that creates resources such as billing alarms. Configure AWS Control Tower to apply the blueprint after creating the new AWS account.

Correct Answer: D

QUESTION 75
A company wants to use an Amazon S3 bucket for its data scientists to store documents. The company uses AWS IAM Identity Center to authenticate users. The company created an IAM Identity Center group for the data scientists. The company wants to grant the data scientists access to only their specific folders in the S3 bucket. The company also wants to know which documents each data scientist accessed. Which combination of steps will meet these requirements? (Select TWO.)

A. Create a custom IAM Identity Center permission set to grant the data scientists access to an S3 bucket prefix that matches their username tag. Use a policy to limit access to paths with the ${aws:PrincipalTag/username}/* condition.
B. Create an IAM Identity Center role for the data scientist group that has Amazon S3 read access and write access. Add an S3 bucket policy that allows access to the IAM Identity Center role.
C. Configure AWS CloudTrail to log S3 data events and deliver the logs to an S3 bucket. Use Amazon Athena to run queries on the CloudTrail logs in Amazon S3.
D. Configure AWS CloudTrail to log S3 management events to Amazon CloudWatch. Use the Amazon Athena CloudWatch connector to query the logs.
E. Enable S3 access logging to the EMR File System (EMRFS). Create an AWS Glue job to run queries on the access log data in EMRFS.

Correct Answer: AC

QUESTION 76
A company collects air quality data from sensors. The company plans to use the MQTT protocol to send the data to AWS IoT Core. The company will process the data and then will store the data in an Amazon Aurora database. During periods of low air quality, sensors will send data more frequently. The company must buffer the data during these periods to make sure that no data is lost before the data is processed and stored. Which solution will meet these requirements?

A. Create an Amazon Kinesis data stream. Create an AWS IT rule action and set the data stream as the target. Create an AWS Step Functions state machine that is invoked by the data stream. Use the state machine to process and store the data.
B. Create an Amazon Kinesis data stream. Create an AWS IoT rule action and set the data stream as the target. Create an application that runs on an Amazon ECS cluster with the AWS Fargate launch type. Configure the application to read data from the data stream, process the data, and store the data.
C. Create an Amazon SQS queue. Create an AWS IoT rule action and set the SQS queue as the target. Create an AWS Step Functions state machine that is invoked by the SQS queue. Use the state machine to process and store the data.
D. Create an Amazon SNS topic. Create an AWS IoT rule action and set the SNS topic as the target. Create an application that runs on an Amazon ECS cluster with the AWS Fargate launch type. Configure the application to read data from the SNS topic, process the data, and store the data.

Correct Answer: A

QUESTION 77
A company has deployed production workloads on Amazon EC2 On-Demand Instances and Amazon RDS for PostgreSQL DB instances in multiple environments. The company has the AWS Business Support plan. A solutions architect must optimize the cost of the workloads without negatively affecting the availability or compute capacity of the workloads. Which solution will meet these requirements?

A. Use AWS Cost and Usage Reports to analyze the most expensive instances and usage patterns. Use AWS Lambda to terminate underutilized instances. Purchase Compute Savings Plans for instances for highly utilized workloads.
B. Use AWS Budgets to track spending for each environment. Configure AWS Trusted Advisor cost optimization checks to rightsize instances. Create billing alerts in Amazon CloudWatch. Terminate underutilized instances. Purchase Reserved Instances for highly utilized workloads.
C. Opt in to AWS Compute Optimizer. Use Compute Optimizer and AWS Trusted Advisor to identify underutilized instances. Implement recommendations from Compute Optimizer, modify instance types, rightsize instances, and apply Auto Scaling groups. Purchase a Compute Savings Plan.
D. Use AWS Cost Explorer recommendations to rightsize underutilized instances. Create billing alerts in Amazon CloudWatch. Replace the EC2 On-Demand Instances with Spot Instances for underutilized instances. Stop any instances that are not in use.

Correct Answer: C

QUESTION 78
A company uses an organization in AWS Organizations that has multiple AWS accounts. The accounts host multiple resources that are tagged with a CostCenter tag key. The tag value is the name of the team. The company wants to accurately identify the cost of the resources so that the company can charge each team accordingly. Which solution meets these requirements?

A. Activate the CostCenter user-defined tag in the organization’s management account. Configure monthly AWS Cost and Usage Reports to save to an Amazon S3 bucket in the management account. Use the tag breakdown in the report to obtain the total cost for the resources that have the CostCenter tag.
B. Activate the CostCenter user-defined tag in every member account. Configure monthly AWS Cost and Usage Reports to save to an Amazon S3 bucket in the management account. Create an AWS Lambda function that runs monthly to retrieve the reports and calculate the total cost for the resources that have the CostCenter tag.
C. Activate the CostCenter user-defined tag in every member account. Schedule a monthly AWS Cost and Usage Report from the management account. Use the tag breakdown in the report to calculate the total cost for the resources that have the CostCenter tag.
D. Customize a report in the AWS Trusted Advisor organization view. Configure the report to generate monthly billing summaries for resources that have the CostCenter tag under the AWS accounts.

Correct Answer: C

QUESTION 79
A company is planning to migrate its on-premises data analysis application to AWS. The application is hosted across a fleet of servers and requires consistent system time. The company has established an AWS Direct Connect connection from its on-premises data center to AWS. The company has a high-precision stratum-0 atomic clock network appliance that acts as an NTP source for all on-premises servers. After the migration to AWS is complete, the clock on all Amazon EC2 instances that host the application must be synchronized with the on-premises atomic clock network appliance. Which solution will meet these requirements with the LEAST administrative overhead?

A. Configure a DHCP options set with the on-premises NTP server address. Assign the options set to the VPC. Ensure that NTP traffic is allowed between AWS and the on-premises networks.
B. Create a custom AMI to use the Amazon Time Sync Service at 169.254.169.123. Use this AMI for the application. Use AWS Config to audit the NTP configuration.
C. Deploy a third-party time server from the AWS Marketplace. Configure the time server to synchronize with the on-premises atomic clock network appliance. Ensure that NTP traffic is allowed inbound in the network ACLs for the VPC that contains the third-party server.
D. Create an IPsec VPN tunnel from the on-premises atomic clock network appliance to the VPC to encrypt the traffic over the Direct Connect connection. Configure the VPC route tables to direct NTP traffic over the tunnel.

Correct Answer: C

QUESTION 80
A solutions architect has created a single VPC on AWS. The VPC has one internet gateway and one NAT gateway. The VPC extends across three Availability Zones. Each Availability Zone includes one public subnet and one private subnet. The three private subnets contain Amazon EC2 instances that must be able to connect to the internet. Which solution will increase the network resiliency of this architecture?

A. Add two NAT gateways so that each Availability Zone has a NAT gateway. Configure a route table for each private subnet to send traffic to the NAT gateway in the subnet’s Availability Zone.
B. Add two NAT gateways so that each Availability Zone has a NAT gateway. Configure a route table for each public subnet to send traffic to the NAT gateway in the subnet’s Availability Zone.
C. Add two internet gateways so that each Availability Zone has an internet gateway. Configure a route table for each private subnet to send traffic to the internet gateway in the subnet’s Availability Zone.
D. Add two internet gateways so that each Availability Zone has an internet gateway. Configure a route table for each public subnet to send traffic to the internet gateway in the subnet’s Availability Zone.

Correct Answer: A