AWS Certified Solutions Architect Associate Practice Exams

Practice Test 1: AWS Certified Solutions Architect Associate
Open

Practice Test 2: AWS Certified Solutions Architect…

Set a certification due date

AWS Certified Solutions Architect – Associate

Course content

AI Assistant

Practice tests

Start

Start

Practice Test 2: AWS Certified Solutions Architect Associate

Start

Practice Test 3: AWS Certified Solutions Architect Associate

Start

Practice Test 4: AWS Certified Solutions Architect Associate

Start

Practice Test 5: AWS Certified Solutions Architect Associate

Start

Practice Test 6: AWS Certified Solutions Architect Associate

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

2025 AWS Certified Solutions Architect Associate Practice Tests [SAA-C03] + Exam Simulator + Explanations + Cheat Sheets

Rating: 4.5 out of 54.5
12,930 ratings

117,520

Students

390 questions

Total

Last updated May 2025

English

What you'll learn

ASSESS YOUR EXAM READINESS: Pass the AWS Certified Solutions Architect Associate exam the first time with a great score

EXAM SIMULATION: All Practice Tests are timed and scored (passing score is 72%) mimicking the real exam environment

DETAILED EXPLANATIONS: Every question includes a detailed explanation that describes why each answer is correct or incorrect

REFERENCE LINKS: To help you understand AWS concepts, all answers link to sections of our online Training Notes (Cheat Sheets) with exam-specific information

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized to ensure you're learning and not memorizing

ALWAYS UP TO DATE: Covering the latest SAA-C03 exam blueprint, our question bank is constantly updated based on student feedback from the real exam

MASTER THE CLOUD: Learn how to answer challenging scenario-based questions

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

ACTIVE Q&A FORUM: Our discussion board provides a platform for students to ask questions, share their recent exam experiences, and offer feedback on exam topics

RESPONSIVE SUPPORT: Our team of AWS experts respond to all of your questions, concerns or feedback

BEST VALUE FOR MONEY: Our practice exams offer the best value for your money with lifetime access - including all future updates at no extra cost

Show moreShow less

Description

Are you preparing for the AWS Certified Solutions Architect Associate exam and want to ensure you're fully ready to pass your AWS certification exam on your first attempt? Look no further than these high-quality AWS Solutions Architect Associate practice exams to assess your exam-readiness!

These 6 AWS practice tests accurately reflect the difficulty of the Amazon Web Services exam questions and are the most realistic AWS exam experience available on Udemy, as demonstrated by the fantastic reviews from thousands of happy students. With our comprehensive AWS certification training course, you'll be well-equipped to pass your AWS Solutions Architect exam with flying colors.

If you're looking for easy-to-pass questions, our Amazon AWS practice tests may not be for you. Our students love these high-quality practice tests because they simulate the actual certification exam and help them get a better understanding of AWS concepts.

Don't just take our word for it – check out our reviews, which confirm that our AWS practice questions closely match the exam pattern and difficulty. These practice tests will prepare you thoroughly for the real exam giving you the confidence you need to take and pass the test!

This SAA-C03 practice test course includes:

390 exam-style questions with detailed answers and explanations to reinforce your understanding of the core concepts

Test report that highlights the areas you need to focus on

Regular updates to reflect the latest exam content

Realistic exam simulation to help you build confidence in your ability to pass your exam

Free bonus material to help you succeed in your exam

TOP REASONS WHY THESE PRACTICE EXAMS ARE THE KEY TO ACING YOUR AWS EXAM

100% ALIGNED WITH SAA-C03 EXAM: All practice tests are 100% scenario-based reflecting the current AWS exam question/answer format (1 answer from 4 options, or 2 or more answers from 5 or more options)

SIMULATE THE REAL CERTIFICATION EXAM: Practice tests are timed (130 min to answer 65 questions) and scored (passing score is 72%) accurately mirroring the real exam environment. This allows you to become familiar with the AWS exam format

DEEP DIVE REFERENCE LINKS: Our practice tests offer more than just answers – they link to relevant sections of our online "Training Notes," providing you with a comprehensive collection of exam-specific information for the SAA-C03 exam

DETAILED EXPLANATIONS FOR ALL ANSWERS: Once you complete our practice tests, you'll have the opportunity to review and check your answers. Each question includes a detailed explanation that describes why each answer is either correct or incorrect, supporting your understanding of AWS Services which is key to passing the exam

REGULAR UPDATES: We are constantly improving and updating our questions based on exam feedback from thousands of our students. As a result, most of our students achieve exceptional results, with an average exam score of over 85%

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized, making it more challenging to ensure you're learning and not memorizing

TEST REPORT: Upon completion of the practice test, you'll receive a comprehensive report that provides insight into your progress and highlights the AWS knowledge areas you need to focus on the most in your studies

ADDITIONAL LEARNING RESOURCES: To help you succeed in your exam, we've included free learning material (optional, requires name/email) that complements the course content

RESPONSIVE SUPPORT: All of your questions, concerns, and feedback will be comprehensively addressed by our team of AWS experts

ACTIVE Q&A DISCUSSION BOARD: Participate in AWS-related discussions on our Q&A discussion board, where our students share their exam experiences and offer valuable feedback on the topics covered

BEST VALUE FOR MONEY: When investing in these tests you get lifetime access to all 6 sets of practice questions

MOBILE ACCESS: Study on the go and access all practice questions from your mobile phone - anywhere, anytime

MONEY-BACK GUARANTEE: 30-day money-back guarantee - no questions asked

WHAT DO OTHER STUDENTS SAY?

Our practice tests are widely regarded as the best, providing you with the preparation you need to confidently pass your AWS Certified Solutions Architect Associate exam with a great score. But don't just take our word for it – check out the excellent course reviews from our happy students, who achieved an average passing score of over 850!

"Well Crafted Questionnaire material, which will help you to gain the confidence on taking the exam. I greatly recommend anyone to take this practice text before appearing for the exam."

"Just passed the exam with a surprisingly good score and found that these practice exams were very helpful. I tried some other courses too but these questions were most similar to the AWS exam and the free training notes on the website were invaluable."

"I've never worked in architecture before and had very little experience in AWS. However, I was able to pass the CSAA exam with 92%, and I have to say that most of the credit goes to these practice exams. If you only buy one practice course, make it this one. I can't recommend it enough."

HOW TO BEST PREPARE FOR YOUR AWS CERTIFICATION EXAM

KEY TRAINING ADVICE: While the actual AWS exam has a passing score of 72%, we recommend that you retake our AWS practice exams until you consistently score 80% or higher. It's important to put in the effort and study the online training notes in detail. Once you achieve the recommended score in our practice tests, you'll be well-prepared to sit the AWS exam and achieve a remarkable score.

COVERING AWS FUNDAMENTALS: Through our AWS practice exams and online training notes, we cover the fundamentals of AWS Architecture and how to create performant, cost-optimized, and fault-tolerant applications. We also deep dive into individual services including Amazon S3, Amazon CloudFront, Amazon Storage Gateway, Amazon EC2, Amazon ECS, AWS IAM, AWS Lambda, Amazon RDS, Route 53, DynamoDB, RedShift, ElastiCache, Amazon Aurora, VPC, SQS, SNS, SWF, ElasticTranscoder, Amazon Kinesis, API Gateway, Direct Connect, Snowball, CloudWatch, CloudTrail and many more.

UNDERSTANDING AWS ARCHITECTURE: The AWS Certified Solutions Architect Associate exam consists entirely of scenario-based questions that assess your knowledge and experience with Amazon Web Services. Knowing the correct use of a particular AWS service and understanding the cost, operational, security, and performance implications of different design choices are essential for success. Our AWS practice exams are specifically designed to help beginners master these concepts and answer these questions accurately.

GET FAMILIAR WITH AWS EXAM FORMAT: Our AWS Certified Solutions Architect Associate practice exams help you get familiar with the test question format and structure, giving you an edge in the actual AWS exam. While many practice tests in the market do not match the exam pattern format, you can trust that our practice tests will thoroughly prepare you for the real AWS exam.

DEEPEN YOUR KNOWLEDGE: It's important to note that while our AWS practice exams match the style and pattern of the actual exam, they are not brain dumps. Simply memorizing answers will not prepare you for the real AWS certification exam. Instead, we recommend using our AWS Solutions Architect practice exams to deepen your understanding which will give you the best chance of passing your exam no matter what questions you encounter on exam day.

COMPETITIVE ADVANTAGE: These days, most IT roles require AWS training and certification, as Amazon Web Services has become the leading provider of cloud computing services. Our AWS practice tests and supporting training resources are designed to give you a competitive edge and help you pass your AWS Certified Solutions Architect certification exam with confidence.

YOUR INSTRUCTOR

Hi, I'm Neal Davis, and I'm delighted to be your instructor for this course. As the founder of Digital Cloud Training, I'm deeply committed to providing top-quality AWS certification training resources. I created these practice tests to help you excel in your AWS exam and achieve your professional goals. With over 20 years of hands-on experience in the Cloud space, I'm excited to share my expertise with you on Udemy.

OUR SUCCESS IN NUMBERS

Over 750,000 students enrolled in our AWS courses on Udemy

4.7-star instructor rating from over 150,000 reviews

Our students pass the AWS exam with an average score of over 85%

Watch the intro video to find out why students choose Digital Cloud Training to fast-track their exam success!

MONEY-BACK GUARANTEE

We are totally confident in the value of our practice exams which come with a 30-day unconditional money-back guarantee. To fast-track your AWS exam success - get lifetime access now - risk-free!

Who this course is for:

Students preparing for the AWS Certified Solutions Architect - Associate exam [SAA-C03]

Candidates for the AWS Certified Solutions Architect - Associate exam who are keen to ace their exam the first time

Students who have completed the AWS Certified Solutions Architect Associate video course from Neal Davis and are looking for some final test preparation

Students who wish to evaluate their AWS exam readiness by testing their skills through an exam simulation

Anyone who wants to learn AWS through high-quality questions and answers, in-depth explanations, and helpful reference links

IT professionals who want to enter any AWS technical job interview with confidence

Anyone who is keen to take their career and salary to the next level with an AWS Certification

Show moreShow less

Instructors

Neal Davis | AWS Certified Solutions Architect & Developer

AWS Solutions Architect & AWS Certified Instructor

Hi, my name's Neal. I am the founder of Digital Cloud Training, a highly experienced AWS Cloud Solutions Architect and a successful IT instructor. I've been working in IT for over 20 years in a variety of roles ranging from support to architecture. Over the last 15 years, I have mainly worked as a Solutions Architect in the systems integration space designing solutions for enterprise organizations.

My experience in IT has included working with virtualization and cloud computing since it's inception. In my most recent consulting role I worked as an Enterprise Architect designing Hybrid IT and Digital Transformation solutions.

I have always enjoyed earning IT certifications and they have helped me immensely with moving upwards throughout my career. These days, my passion is to help others to achieve their career goals through in-depth AWS certification training resources.

That's why I started digitalcloud.training - to provide certification training resources for Amazon Web Services (AWS) certifications that represent a higher quality standard than is otherwise available in the market.

Connect with me on Facebook, LinkedIn, Youtube or Twitter.

Show moreShow less

Digital Cloud Training | AWS Certified Cloud Practitioner AWS Certified Solutions Architect, AWS Developer Associate

Highest Quality AWS Certification Exam Preparation Resources

Digital Cloud Training provides AWS Certification exam preparation resources including instructor-led Video Courses, guided Hands-on Labs, in-depth Training Notes, Exam-Cram lessons for quick revision, Quizzes to test your knowledge and exam-difficulty Practice Exams to assess your exam readiness.

We strive to provide the highest quality AWS Training Resources that ensure our students are best prepared to pass their AWS exams first time, every time!

With Digital Cloud Training, you get access to highly experienced staff who support you on your AWS Certification journey and help you elevate your career through achieving highly valuable certifications.

Show moreShow less

Featured review

Vijay Srinivas V.

6 courses

4 reviews

Rating: 5.0 out of 5 4 years ago

Good to take the practice tests, I had taken Neals tests which instills much confidence and he covers all the topics with detail explanation and especially for the Load Balancing/VPC related with very clear picture explanation which makes people understand the practical scenarios very much. Sincere Thanks! Vijay

Show moreShow less

Was this review helpful?

See all reviews (12,930)

Requirements

Before assessing your exam readiness, we highly recommend completing the AWS Certified Solutions Architect - Associate video course by Neal Davis. These instructor-led video lectures from Digital Cloud Training build the solid knowledge foundation preparing students for the final step of their AWS certification journey

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Practice Test 1: AWS Certified Solutions Architect Associate

AWS Certified Solutions Architect Associate - Results

Back to result overview
Attempt 2

All domains

All domains

AWS Application Integration

AWS Database

AWS Storage

AWS Networking & Content Delivery

AWS Compute

AWS Security, Identity, & Compliance

AWS Management & Governance

AWS Analytics

AWS Migration & Transfer

65 all

0 correct

0 incorrect

65 skipped

0 marked

Collapse all questions

Question 1Skipped

An eCommerce application consists of three tiers. The web tier includes EC2 instances behind an Application Load balancer, the middle tier uses EC2 instances and an Amazon SQS queue to process orders, and the database tier consists of an Auto Scaling DynamoDB table. During busy periods customers have complained about delays in the processing of orders. A Solutions Architect has been tasked with reducing processing times.

Which action will be MOST effective in accomplishing this requirement?

Correct answer

Use Amazon EC2 Auto Scaling to scale out the middle tier instances based on the SQS queue depth.

Use Amazon DynamoDB Accelerator (DAX) in front of the DynamoDB backend tier.

Replace the Amazon SQS queue with Amazon Kinesis Data Firehose.

Add an Amazon CloudFront distribution with a custom origin to cache the responses for the web tier.

Overall explanation

The most likely cause of the processing delays is insufficient instances in the middle tier where the order processing takes place. The most effective solution to reduce processing times in this case is to scale based on the backlog per instance (number of messages in the SQS queue) as this reflects the amount of work that needs to be done.

CORRECT: "Use Amazon EC2 Auto Scaling to scale out the middle tier instances based on the SQS queue depth" is the correct answer.

INCORRECT: "Replace the Amazon SQS queue with Amazon Kinesis Data Firehose" is incorrect. The issue is not the efficiency of queuing messages but the processing of the messages. In this case scaling the EC2 instances to reflect the workload is a better solution.

INCORRECT: "Use Amazon DynamoDB Accelerator (DAX) in front of the DynamoDB backend tier" is incorrect. The DynamoDB table is configured with Auto Scaling so this is not likely to be the bottleneck in order processing.

INCORRECT: "Add an Amazon CloudFront distribution with a custom origin to cache the responses for the web tier" is incorrect. This will cache media files to speed up web response times but not order processing times as they take place in the middle tier.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-using-sqs-queue.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Application Integration

Question 2Skipped

A web application allows users to upload photos and add graphical elements to them. The application offers two tiers of service: free and paid. Photos uploaded by paid users should be processed before those submitted using the free tier. The photos are uploaded to an Amazon S3 bucket which uses an event notification to send the job information to Amazon SQS.

How should a Solutions Architect configure the Amazon SQS deployment to meet these requirements?

Use one SQS standard queue. Use batching for the paid photos and short polling for the free photos.

Use one SQS FIFO queue. Assign a higher priority to the paid photos so they are processed first.

Correct answer

Use a separate SQS Standard queue for each tier. Configure Amazon EC2 instances to prioritize polling for the paid queue over the free queue.

Use a separate SQS FIFO queue for each tier. Set the free queue to use short polling and the paid queue to use long polling.

Overall explanation

AWS recommend using separate queues when you need to provide prioritization of work. The logic can then be implemented at the application layer to prioritize the queue for the paid photos over the queue for the free photos.

CORRECT: "Use a separate SQS Standard queue for each tier. Configure Amazon EC2 instances to prioritize polling for the paid queue over the free queue" is the correct answer.

INCORRECT: "Use one SQS FIFO queue. Assign a higher priority to the paid photos so they are processed first" is incorrect. FIFO queues preserve the order of messages but they do not prioritize messages within the queue. The orders would need to be placed into the queue in a priority order and there’s no way of doing this as the messages are sent automatically through event notifications as they are received by Amazon S3.

INCORRECT: "Use one SQS standard queue. Use batching for the paid photos and short polling for the free photos" is incorrect. Batching adds efficiency but it has nothing to do with ordering or priority.

INCORRECT: "Use a separate SQS FIFO queue for each tier. Set the free queue to use short polling and the paid queue to use long polling" is incorrect. Short polling and long polling are used to control the amount of time the consumer process waits before closing the API call and trying again. Polling should be configured for efficiency of API calls and processing of messages but does not help with message prioritization.

References:

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-how-it-works.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 3Skipped

A healthcare company is migrating its on-premises Oracle database to an Amazon RDS for Oracle database. The database must meet compliance requirements to retain backups for 120 days. Additionally, the company must have the ability to restore the database to any point in time within the past 10 days. The solution must minimize operational overhead and ensure compliance with these requirements.

Which solution will meet these requirements with the LEAST operational overhead?

Correct answer

Configure Amazon RDS automated backups. Set the retention period to 35 days and enable point-in-time recovery for the past 10 days. Use AWS Backup to retain additional backups for 120 days.

Use AWS Backup to create a backup plan for Amazon RDS with a 120-day retention period. Enable point-in-time recovery by combining AWS Backup and RDS automated backups.

Set up Amazon S3 Lifecycle policies to retain database exports for 120 days. Use AWS Database Migration Service (AWS DMS) to export the database to Amazon S3 every 24 hours.

Create an Amazon RDS manual snapshot every week. Use an AWS Lambda function to delete snapshots that are older than 120 days.

Overall explanation

Configure Amazon RDS automated backups. Set the retention period to 35 days and enable point-in-time recovery for the past 10 days. Use AWS Backup to retain additional backups for 120 days: This is correct because RDS automated backups support up to 35 days of retention and point-in-time recovery. AWS Backup can extend the retention period to 120 days without additional complexity.
Create an Amazon RDS manual snapshot every week. Use an AWS Lambda function to delete snapshots that are older than 120 days: This is incorrect because manual snapshot management introduces operational overhead and is not as scalable or reliable as RDS automated backups combined with AWS Backup.
Use AWS Backup to create a backup plan for Amazon RDS with a 120-day retention period. Enable point-in-time recovery by combining AWS Backup and RDS automated backups: This is incorrect because while AWS Backup can retain backups for 120 days, it cannot directly handle point-in-time recovery, which requires native RDS automated backups.
Set up Amazon S3 Lifecycle policies to retain database exports for 120 days. Use AWS Database Migration Service (AWS DMS) to export the database to Amazon S3 every 24 hours: This is incorrect because exporting the database to S3 introduces unnecessary operational complexity and does not support point-in-time recovery.

References:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html
https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

Domain

AWS Database

Question 4Skipped

A company runs a dynamic website that is hosted on an on-premises server in the United States. The company is expanding to Europe and is investigating how they can optimize the performance of the website for European users. The website’s backed must remain in the United States. The company requires a solution that can be implemented within a few days.

What should a Solutions Architect recommend?

Launch an Amazon EC2 instance in an AWS Region in the United States and migrate the website to it.

Use Amazon CloudFront with Lambda@Edge to direct traffic to an on-premises origin.

Migrate the website to Amazon S3. Use cross-Region replication between Regions and a latency-based Route 53 policy.

Correct answer

Use Amazon CloudFront with a custom origin pointing to the on-premises servers.

Overall explanation

A custom origin can point to an on-premises server and CloudFront is able to cache content for dynamic websites. CloudFront can provide performance optimizations for custom origins even if they are running on on-premises servers. These include persistent TCP connections to the origin, SSL enhancements such as Session tickets and OCSP stapling.

Additionally, connections are routed from the nearest Edge Location to the user across the AWS global network. If the on-premises server is connected via a Direct Connect (DX) link this can further improve performance.

CORRECT: "Use Amazon CloudFront with a custom origin pointing to the on-premises servers" is the correct answer.

INCORRECT: "Use Amazon CloudFront with Lambda@Edge to direct traffic to an on-premises origin" is incorrect. Lambda@Edge is not used to direct traffic to on-premises origins.

INCORRECT: "Launch an Amazon EC2 instance in an AWS Region in the United States and migrate the website to it" is incorrect. This would not necessarily improve performance for European users.

INCORRECT: "Migrate the website to Amazon S3. Use cross-Region replication between Regions and a latency-based Route 53 policy" is incorrect. You cannot host dynamic websites on Amazon S3 (static only).

References:

https://aws.amazon.com/cloudfront/dynamic-content/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Storage

Question 5Skipped

A financial services company has a web application with an application tier running in the U.S and Europe. The database tier consists of a MySQL database running on Amazon EC2 in us-west-1. Users are directed to the closest application tier using Route 53 latency-based routing. The users in Europe have reported poor performance when running queries.

Which changes should a Solutions Architect make to the database tier to improve performance?

Migrate the database to Amazon RedShift. Use AWS DMS to synchronize data. Configure applications to use the RedShift data warehouse for queries.

Migrate the database to Amazon RDS for MySQL. Configure Multi-AZ in one of the European Regions.

Correct answer

Migrate the database to an Amazon Aurora global database in MySQL compatibility mode. Configure the application tier in Europe to use the local reader endpoint.

Create an Amazon RDS Read Replica in one of the European regions. Configure the application tier in Europe to use the read replica for queries.

Overall explanation

Amazon Aurora Global Database is designed for globally distributed applications, allowing a single Amazon Aurora database to span multiple AWS regions. It replicates your data with no impact on database performance, enables fast local reads with low latency in each region, and provides disaster recovery from region-wide outages.

A global database can be configured in the European region and then the application tier in Europe will need to be configured to use the local database for reads/queries. The diagram below depicts an Aurora Global Database deployment.

CORRECT: "Migrate the database to an Amazon Aurora global database in MySQL compatibility mode. Configure the application tier in Europe to use the local reader endpoint" is the correct answer.

INCORRECT: "Migrate the database to Amazon RDS for MySQL. Configure Multi-AZ in one of the European Regions" is incorrect. You cannot configure a multi-AZ DB instance to run in another Region, it must be in the same Region but in a different Availability Zone.

INCORRECT: "Migrate the database to Amazon RedShift. Use AWS DMS to synchronize data. Configure applications to use the RedShift data warehouse for queries" is incorrect. RedShift is a data warehouse and used for running analytics queries on data that is exported from transactional database systems. It should not be used to reduce latency for users of a database, and is not a live copy of the data.

INCORRECT: "Create an Amazon RDS Read Replica in one of the European regions. Configure the application tier in Europe to use the read replica for queries" is incorrect. You cannot create an RDS Read Replica of a database that is running on Amazon EC2. You can only create read replicas of databases running on Amazon RDS.

References:

https://aws.amazon.com/rds/aurora/global-database/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2/

Domain

AWS Database

Question 6Skipped

An Amazon S3 bucket in the us-east-1 Region hosts the static website content of a company. The content is made available through an Amazon CloudFront origin pointing to that bucket. A second copy of the bucket is created in the ap-southeast-1 Region using cross-region replication. The chief solutions architect wants a solution that provides greater availability for the website.

Which combination of actions should a solutions architect take to increase availability? (Select TWO.)

Correct selection

Add an origin for ap-southeast-1 to CloudFront.

Correct selection

Using us-east-1 bucket as the primary bucket and ap-southeast-1 bucket as the secondary bucket, create a CloudFront origin group.

Point Amazon Route 53 to the replica bucket by creating a record.

Set up failover routing in Amazon Route 53.

Create an origin for CloudFront for both buckets.

Overall explanation

You can set up CloudFront with origin failover for scenarios that require high availability. To get started, you create an origin group with two origins: a primary and a secondary. If the primary origin is unavailable or returns specific HTTP response status codes that indicate a failure, CloudFront automatically switches to the secondary origin.

CORRECT: "Add an origin for ap-southeast-1 to CloudFront” is the correct answer (as explained above.)

CORRECT: "Using us-east-1 bucket as the primary bucket and ap-southeast-1 bucket as the secondary bucket, create a CloudFront origin group” is also a correct answer (as explained above.)

INCORRECT: "Create an origin for CloudFront for both buckets” is incorrect. This would not increase the availability of the solution on its own.

INCORRECT: "Set up failover routing in Amazon Route 53” is incorrect as we are trying to enable failover in CloudFront and using Route 53 is for routing domain names.

INCORRECT: "Create a record in Amazon Route 53 pointing to the replica bucket" is incorrect as we are trying to enable failover in CloudFront and using Route 53 is for routing domain names.

References:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/high_availability_origin_failover.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Networking & Content Delivery

Question 7Skipped

A company is deploying a fleet of Amazon EC2 instances running Linux across multiple Availability Zones within an AWS Region. The application requires a data storage solution that can be accessed by all of the EC2 instances simultaneously. The solution must be highly scalable and easy to implement. The storage must be mounted using the NFS protocol.

Which solution meets these requirements?

Create an Amazon EBS volume and use EBS Multi-Attach to mount the volume to all EC2 instances across each Availability Zone.

Create an Amazon S3 bucket and create an S3 gateway endpoint to allow access to the file system using the NFS protocol.

Correct answer

Create an Amazon EFS file system with mount targets in each Availability Zone. Configure the application instances to mount the file system.

Create an Amazon RDS database and store the data in a BLOB format. Point the application instances to the RDS endpoint.

Overall explanation

Amazon EFS provides scalable file storage for use with Amazon EC2. You can use an EFS file system as a common data source for workloads and applications running on multiple instances. The EC2 instances can run in multiple AZs within a Region and the NFS protocol is used to mount the file system.

With EFS you can create mount targets in each AZ for lower latency. The application instances in each AZ will mount the file system using the local mount target.

CORRECT: "Create an Amazon EFS file system with mount targets in each Availability Zone. Configure the application instances to mount the file system" is the correct answer.

INCORRECT: "Create an Amazon S3 bucket and create an S3 gateway endpoint to allow access to the file system using the NFS protocol" is incorrect. You cannot use NFS with S3 or with gateway endpoints.

INCORRECT: "Create an Amazon EBS volume and use EBS Multi-Attach to mount the volume to all EC2 instances across each Availability Zone" is incorrect. You cannot use Amazon EBS Multi-Attach across multiple AZs.

INCORRECT: "Create an Amazon RDS database and store the data in a BLOB format. Point the application instances to the RDS endpoint" is incorrect. This is not a suitable storage solution for a file system that is mounted over NFS.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AmazonEFS.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-efs/

Domain

AWS Storage

Question 8Skipped

A media processing company is migrating its on-premises application to the AWS Cloud. The application processes high volumes of videos and generates large output files during the workflow.

The company requires a scalable solution to handle an increasing number of video processing jobs. The solution should minimize manual intervention, simplify job orchestration, and eliminate the need to manage infrastructure. Operational overhead must be kept to a minimum.

Which solution will fulfill these requirements with the LEAST operational overhead?

Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate to process the videos. Use Amazon Simple Queue Service (Amazon SQS) for workflow orchestration and store the processed files in Amazon S3.

Use AWS Lambda and Amazon EC2 On-Demand Instances for video processing. Store the processed files in Amazon FSx for Lustre.

Use a fleet of Amazon EC2 Spot Instances to process the videos. Use AWS Step Functions for workflow management and store the processed files in Amazon Elastic File System (Amazon EFS).

Correct answer

Use AWS Batch to run video processing jobs. Use AWS Step Functions to manage the workflow. Store the processed files in Amazon S3.

Overall explanation

Use AWS Batch to run video processing jobs. Use AWS Step Functions to manage the workflow. Store the processed files in Amazon S3: This is correct because AWS Batch automatically manages the underlying infrastructure, scales based on workload and simplifies batch job management. Combining this with AWS Step Functions enables efficient orchestration of workflows. Storing the processed files in Amazon S3 provides durability and scalability, which is ideal for managing large files. This solution minimizes operational overhead by leveraging fully managed services.

Use Amazon Elastic Container Service (Amazon ECS) with AWS Fargate to process the videos. Use Amazon Simple Queue Service (Amazon SQS) for workflow orchestration and store the processed files in Amazon S3: This is incorrect because, while Fargate reduces infrastructure management, integrating SQS for workflow orchestration adds complexity compared to using AWS Step Functions. AWS Batch provides more specialized functionality for processing batch workloads.

Use AWS Lambda and Amazon EC2 On-Demand Instances for video processing. Store the processed files in Amazon FSx for Lustre: This is incorrect because combining Lambda with EC2 adds complexity to infrastructure management and does not fully eliminate operational overhead. Additionally, FSx for Lustre is more suitable for high-performance computing scenarios rather than general-purpose storage of processed files.

Use a fleet of Amazon EC2 Spot Instances to process the videos. Use AWS Step Functions for workflow management and store the processed files in Amazon Elastic File System (Amazon EFS): This is incorrect because Spot Instances are not ideal for workflows that must minimize interruptions, as they can be terminated unexpectedly. AWS Batch is a more suitable solution for managing job processing workloads with minimal operational overhead.

References:

https://docs.aws.amazon.com/batch/latest/userguide/what-is-batch.html

https://docs.aws.amazon.com/step-functions/latest/dg/welcome.html

Domain

AWS Compute

Question 9Skipped

An application is being created that will use Amazon EC2 instances to generate and store data. Another set of EC2 instances will then analyze and modify the data. Storage requirements will be significant and will continue to grow over time. The application architects require a storage solution.

Which actions would meet these needs?

Store the data in an Amazon EBS volume. Mount the EBS volume on the application instances

Correct answer

Store the data in an Amazon EFS filesystem. Mount the file system on the application instances

Store the data in Amazon S3 Glacier. Update the vault policy to allow access to the application instances

Store the data in AWS Storage Gateway. Setup AWS Direct Connect between the Gateway appliance and the EC2 instances

Overall explanation

Amazon Elastic File System (Amazon EFS) provides a simple, scalable, fully managed elastic NFS file system for use with AWS Cloud services and on-premises resources. It is built to scale on-demand to petabytes without disrupting applications, growing and shrinking automatically as you add and remove files, eliminating the need to provision and manage capacity to accommodate growth.

Amazon EFS supports the Network File System version 4 (NFSv4.1 and NFSv4.0) protocol. Multiple Amazon EC2 instances can access an Amazon EFS file system at the same time, providing a common data source for workloads and applications running on more than one instance or server.

For this scenario, EFS is a great choice as it will provide a scalable file system that can be mounted by multiple EC2 instances and accessed simultaneously.

CORRECT: "Store the data in an Amazon EFS filesystem. Mount the file system on the application instances" is the correct answer.

INCORRECT: "Store the data in an Amazon EBS volume. Mount the EBS volume on the application instances" is incorrect. Though there is a new feature that allows (EBS multi-attach) that allows attaching multiple Nitro instances to a volume, this is not on the exam yet, and has some specific constraints.

INCORRECT: "Store the data in Amazon S3 Glacier. Update the vault policy to allow access to the application instances" is incorrect as S3 Glacier is not a suitable storage location for live access to data, it is used for archival.

INCORRECT: "Store the data in AWS Storage Gateway. Setup AWS Direct Connect between the Gateway appliance and the EC2 instances" is incorrect. There is no reason to store the data on-premises in a Storage Gateway, using EFS is a much better solution.

References:

https://docs.aws.amazon.com/efs/latest/ug/whatisefs.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-efs/

Domain

AWS Database

Question 10Skipped

A startup is prototyping a movie streaming platform on AWS. The platform consists of an Application Load Balancer, an Auto Scaling group of Amazon EC2 instances to host the frontend, and an Amazon RDS for PostgreSQL DB instance running in a Single-AZ configuration.

Users report slow response times when browsing the catalog of available movies. The movie catalog is a set of tables in the database that is updated infrequently. A solutions architect finds that the database's CPU utilization spikes significantly during catalog queries.

What should the solutions architect recommend to improve the performance of the platform during catalog searches?

Migrate the movie catalog to Amazon DynamoDB and use the DynamoDB Accelerator (DAX) service to cache queries for the catalog.

Enable read replicas for the RDS instance. Configure the frontend application to distribute catalog queries across the read replicas.

Use Amazon Aurora Serverless for the movie catalog database. Configure Aurora’s built-in caching to handle frequent queries efficiently.

Correct answer

Implement an Amazon ElastiCache for Redis cluster to cache catalog queries. Configure the application to use lazy loading to populate the cache.

Overall explanation

Implement an Amazon ElastiCache for Redis cluster to cache catalog queries. Configure the application to use lazy loading to populate the cache: This is correct because ElastiCache provides a highly performant in-memory caching layer that can significantly reduce database load and response times for infrequently updated data like a product or movie catalog. Lazy loading ensures the cache is populated only when a query misses, reducing unnecessary overhead.

Migrate the movie catalog to Amazon DynamoDB and use the DynamoDB Accelerator (DAX) service to cache queries for the catalog: This is incorrect because migrating to DynamoDB introduces unnecessary complexity and operational overhead, especially for a relational workload that involves the movie catalog. DAX is designed for NoSQL databases and is not the best fit for this use case.

Enable read replicas for the RDS instance. Configure the frontend application to distribute catalog queries across the read replicas: This is incorrect because while read replicas can improve performance for read-heavy workloads, they do not reduce query latency as effectively as an in-memory caching solution like ElastiCache.

Use Amazon Aurora Serverless for the movie catalog database. Configure Aurora’s built-in caching to handle frequent queries efficiently: This is incorrect because switching to Aurora Serverless would involve significant changes to the database architecture. While Aurora provides caching, ElastiCache is specifically optimized for high-performance caching use cases.

References:
https://aws.amazon.com/elasticache/
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-elasticache/

Domain

AWS Database

Question 11Skipped

A financial services company runs a trading application on a Kubernetes cluster hosted in its on-premises data center. Due to a recent surge in trading activity, the on-premises infrastructure can no longer support the increased load. The company plans to migrate the trading application to the AWS Cloud using an Amazon Elastic Kubernetes Service (Amazon EKS) cluster.

The company wants to minimize the operational overhead by avoiding management of the underlying compute infrastructure for the new AWS architecture.

Which solution will meet these requirements with the LEAST operational overhead?

Use Amazon EC2 Spot Instances with managed node groups to provide cost-effective compute capacity for the EKS cluster. Deploy the application using the Spot nodes.

Use managed node groups to provide the compute capacity for the EKS cluster. Deploy the application to the cluster using the managed nodes.

Correct answer

Use AWS Fargate to provide the compute capacity for the EKS cluster. Create a Fargate profile and deploy the application using the profile.

Use self-managed EC2 instances to provide the compute capacity for the EKS cluster. Deploy the application to the cluster using these instances.

Overall explanation

Use AWS Fargate to provide the compute capacity for the EKS cluster. Create a Fargate profile and deploy the application using the profile: This is correct because AWS Fargate eliminates the need to provision or manage EC2 instances, allowing the company to run pods without managing the underlying infrastructure. This greatly reduces operational overhead and meets the company’s requirements.
Use self-managed EC2 instances to provide the compute capacity for the EKS cluster. Deploy the application to the cluster using these instances: This is incorrect because self-managed EC2 instances require manual provisioning, patching, and scaling, which increases operational overhead compared to serverless options like Fargate.
Use managed node groups to provide the compute capacity for the EKS cluster. Deploy the application to the cluster using the managed nodes: This is incorrect because while managed node groups reduce some operational effort compared to self-managed nodes, they still require some level of instance management, such as scaling and patching, unlike Fargate.
Use Amazon EC2 Spot Instances with managed node groups to provide cost-effective compute capacity for the EKS cluster. Deploy the application using the Spot nodes: This is incorrect because Spot Instances, while cost-effective, introduce potential interruptions and require management of instance scaling, which adds operational complexity.

References:
https://docs.aws.amazon.com/eks/latest/userguide/fargate.html
https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

Domain

AWS Compute

Question 12Skipped

A developer created an application that uses Amazon EC2 and an Amazon RDS MySQL database instance. The developer stored the database user name and password in a configuration file on the root EBS volume of the EC2 application instance. A Solutions Architect has been asked to design a more secure solution.

What should the Solutions Architect do to achieve this requirement?

Attach an additional volume to the EC2 instance with encryption enabled. Move the configuration file to the encrypted volume.

Move the configuration file to an Amazon S3 bucket. Create an IAM role with permission to the bucket and attach it to the EC2 instance.

Correct answer

Create an IAM role with permission to access the database. Attach this IAM role to the EC2 instance.

Install an Amazon-trusted root certificate on the application instance and use SSL/TLS encrypted connections to the database.

Overall explanation

The key problem here is having plain text credentials stored in a file. Even if you encrypt the volume there is still as security risk as the credentials are loaded by the application and passed to RDS.

The best way to secure this solution is to get rid of the credentials completely by using an IAM role instead. The IAM role can be assigned permissions to the database instance and can be attached to the EC2 instance. The instance will then obtain temporary security credentials from AWS STS which is much more secure.

CORRECT: "Create an IAM role with permission to access the database. Attach this IAM role to the EC2 instance" is the correct answer.

INCORRECT: "Move the configuration file to an Amazon S3 bucket. Create an IAM role with permission to the bucket and attach it to the EC2 instance" is incorrect. This just relocates the file; the contents are still unsecured and must be loaded by the application and passed to RDS. This is an insecure process.

INCORRECT: "Attach an additional volume to the EC2 instance with encryption enabled. Move the configuration file to the encrypted volume" is incorrect. This will only encrypt the file at rest, it still must be read, and the contents passed to RDS which is insecure.

INCORRECT: "Install an Amazon-trusted root certificate on the application instance and use SSL/TLS encrypted connections to the database" is incorrect. The file is still unsecured on the EBS volume so encrypting the credentials in an encrypted channel between the EC2 instance and RDS does not solve all security issues.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Security, Identity, & Compliance

Question 13Skipped

A new application is to be published in multiple regions around the world. The Architect needs to ensure only 2 IP addresses need to be whitelisted. The solution should intelligently route traffic for lowest latency and provide fast regional failover.

How can this be achieved?

Launch EC2 instances into multiple regions behind an NLB with a static IP address

Correct answer

Launch EC2 instances into multiple regions behind an NLB and use AWS Global Accelerator

Launch EC2 instances into multiple regions behind an ALB and use Amazon CloudFront with a pair of static IP addresses

Launch EC2 instances into multiple regions behind an ALB and use a Route 53 failover routing policy

Overall explanation

AWS Global Accelerator uses the vast, congestion-free AWS global network to route TCP and UDP traffic to a healthy application endpoint in the closest AWS Region to the user.

This means it will intelligently route traffic to the closest point of presence (reducing latency). Seamless failover is ensured as AWS Global Accelerator uses anycast IP address which means the IP does not change when failing over between regions so there are no issues with client caches having incorrect entries that need to expire.

This is the only solution that provides deterministic failover.

CORRECT: "Launch EC2 instances into multiple regions behind an NLB and use AWS Global Accelerator" is the correct answer.

INCORRECT: "Launch EC2 instances into multiple regions behind an NLB with a static IP address" is incorrect. An NLB with a static IP is a workable solution as you could configure a primary and secondary address in applications. However, this solution does not intelligently route traffic for lowest latency.

INCORRECT: "Launch EC2 instances into multiple regions behind an ALB and use a Route 53 failover routing policy" is incorrect. A Route 53 failover routing policy uses a primary and standby configuration. Therefore, it sends all traffic to the primary until it fails a health check at which time it sends traffic to the secondary. This solution does not intelligently route traffic for lowest latency.

INCORRECT: "Launch EC2 instances into multiple regions behind an ALB and use Amazon CloudFront with a pair of static IP addresses" is incorrect. Amazon CloudFront cannot be configured with “a pair of static IP addresses”.

References:

https://aws.amazon.com/global-accelerator/

https://aws.amazon.com/global-accelerator/faqs/

https://docs.aws.amazon.com/global-accelerator/latest/dg/what-is-global-accelerator.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-global-accelerator/

Domain

AWS Networking & Content Delivery

Question 14Skipped

A video production company is planning to move some of its workloads to the AWS Cloud. The company will require around 5 TB of storage for video processing with the maximum possible I/O performance. They also require over 400 TB of extremely durable storage for storing video files and 800 TB of storage for long-term archival.

Which combinations of services should a Solutions Architect use to meet these requirements?

Amazon EBS for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage.

Amazon EC2 instance store for maximum performance, Amazon EFS for durable data storage, and Amazon S3 for archival storage.

Correct answer

Amazon EC2 instance store for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage.

Amazon EBS for maximum performance, Amazon EFS for durable data storage, and Amazon S3 Glacier for archival storage.

Overall explanation

The best I/O performance can be achieved by using instance store volumes for the video processing. This is safe to use for use cases where the data can be recreated from the source files so this is a good use case.

For storing data durably Amazon S3 is a good fit as it provides 99.999999999% of durability. For archival the video files can then be moved to Amazon S3 Glacier which is a low cost storage option that is ideal for long-term archival.

CORRECT: "Amazon EC2 instance store for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage" is the correct answer.

INCORRECT: "Amazon EBS for maximum performance, Amazon S3 for durable data storage, and Amazon S3 Glacier for archival storage" is incorrect. EBS is not going to provide as much I/O performance as an instance store volume so is not the best choice for this use case.

INCORRECT: "Amazon EC2 instance store for maximum performance, Amazon EFS for durable data storage, and Amazon S3 for archival storage" is incorrect. EFS does not provide as much durability as Amazon S3 and will not be as cost-effective.

INCORRECT: "Amazon EBS for maximum performance, Amazon EFS for durable data storage, and Amazon S3 Glacier for archival storage" is incorrect. EBS and EFS are not the best choices here as described above.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html

https://aws.amazon.com/s3/storage-classes/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 15Skipped

A scientific research institute stores experimental datasets in AWS. Some datasets are accessed daily for analysis, while others remain unused for weeks or months. The datasets are large and must be highly durable, but the institute wants to reduce costs without compromising availability for frequently accessed data.

The institute needs a cost-effective storage solution that adapts to these varying access patterns and ensures the highest durability.

Which storage solution meets these requirements?

Use Amazon FSx for Lustre integrated with Amazon S3 to offload unused datasets and retrieve them as needed for analysis.

Use Amazon S3 Glacier Instant Retrieval for all datasets to achieve high durability with low-cost storage for infrequent access.

Use Amazon EFS with lifecycle policies to move infrequently accessed files to lower-cost storage tiers.

Correct answer

Use Amazon S3 Intelligent-Tiering to automatically adjust storage costs based on the frequency of data access while maintaining high durability.

Overall explanation

Use Amazon S3 Intelligent-Tiering to automatically adjust storage costs based on the frequency of data access while maintaining high durability: This is correct because S3 Intelligent-Tiering dynamically transitions objects between storage tiers, optimizing costs for infrequent access while retaining the high durability and availability required for datasets.

Use Amazon EFS with lifecycle policies to move infrequently accessed files to lower-cost storage tiers: This is incorrect because Amazon EFS is optimized for file-based workloads and does not provide the same cost optimization or scalability for object storage as S3 Intelligent-Tiering.

Use Amazon S3 Glacier Instant Retrieval for all datasets to achieve high durability with low-cost storage for infrequent access: This is incorrect because S3 Glacier Instant Retrieval is optimized for archival storage, not for datasets that are frequently accessed. The latency and cost of retrieval make it unsuitable for daily analysis.

Use Amazon FSx for Lustre integrated with Amazon S3 to offload unused datasets and retrieve them as needed for analysis: This is incorrect because FSx for Lustre is designed for high-performance computing and workloads requiring fast processing speeds. It introduces unnecessary complexity and cost for general storage needs.

References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html
https://aws.amazon.com/s3/storage-classes/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 16Skipped

A company uses an Amazon RDS for MySQL instance for its operational database. To handle the increased read-only traffic during a recent peak period, the company added a read replica. During the peak period, the CPU usage on the read replica reached 60%, and the primary instance also had 60% CPU usage. After the peak period ended, the read replica's CPU usage decreased to 25%, while the primary instance consistently remains at 60%. The company wants to optimize costs while ensuring enough capacity for future growth.

Which solution will meet these requirements?

Delete the read replica and upgrade the primary instance to a larger instance size.

Upgrade the read replica to a larger instance size and downgrade the primary instance to a smaller instance size.

Delete the read replica and keep the primary instance unchanged.

Correct answer

Resize the read replica to a smaller instance size and keep the primary instance unchanged.

Overall explanation

Resize the read replica to a smaller instance size and keep the primary instance unchanged: This is correct because the read replica’s CPU usage is now consistently low at 25%, meaning a smaller instance size can accommodate the current workload. Keeping the primary instance unchanged ensures consistent performance for write-heavy workloads.

Delete the read replica and keep the primary instance unchanged: This is incorrect because the read replica may still be needed for future peak periods or reporting and removing it could impact performance if the workload increases again.

Upgrade the read replica to a larger instance size and downgrade the primary instance to a smaller instance size: This is incorrect because the primary instance already has consistent 60% CPU usage. Downgrading it could result in performance bottlenecks.

Delete the read replica and upgrade the primary instance to a larger instance size: This is incorrect because increasing the primary instance size will unnecessarily increase costs, especially since the read replica can handle reporting traffic at a lower cost.

References:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html
https://aws.amazon.com/rds/features/resize/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

Domain

AWS Database

Question 17Skipped

A company is launching a new internal platform for managing multiple independent projects. Each project will require its own dedicated AWS account for isolation. The company needs a solution that automates account creation, applies mandatory security guardrails, and centrally manages shared networking resources such as VPNs and subnets for the accounts. The solution must minimize manual effort and ensure compliance with security standards.

Which solution will meet these requirements with the LEAST operational overhead?

Use AWS Organizations to create accounts for each project. Deploy a shared VPC in a centralized account. Configure AWS Firewall Manager to enforce security controls. Manually configure routing for project account traffic through the shared VPC.

Use AWS Control Tower to set up accounts with pre-configured VPCs in each project account. Connect these VPCs to a central networking account through a transit gateway. Enforce security controls with AWS Config.

Correct answer

Use AWS Control Tower to automate account provisioning. Create a dedicated networking account with a centralized VPC. Use AWS Resource Access Manager (AWS RAM) to share subnets with project accounts. Enforce security guardrails by using AWS Control Tower guardrails.

Use AWS Organizations to create project accounts manually. Deploy a VPC in a centralized networking account. Use AWS RAM to share subnets. Manually configure security policies in each account.

Overall explanation

Use AWS Control Tower to automate account provisioning. Create a dedicated networking account with a centralized VPC. Use AWS Resource Access Manager (AWS RAM) to share subnets with project accounts. Enforce security guardrails by using AWS Control Tower guardrails: This is correct because AWS Control Tower simplifies account setup with built-in security guardrails. It minimizes operational overhead by automating VPC sharing and guardrail enforcement through AWS RAM.
Use AWS Organizations to create project accounts manually. Deploy a VPC in a centralized networking account. Use AWS RAM to share subnets. Manually configure security policies in each account: This is incorrect because manual account setup and security configuration increase operational overhead.
Use AWS Control Tower to set up accounts with pre-configured VPCs in each project account. Connect these VPCs to a central networking account through a transit gateway. Enforce security controls with AWS Config: This is incorrect because configuring a transit gateway and enforcing controls through AWS Config introduces more complexity than required for this use case.
Use AWS Organizations to create accounts for each project. Deploy a shared VPC in a centralized account. Configure AWS Firewall Manager to enforce security controls. Manually configure routing for project account traffic through the shared VPC: This is incorrect because it requires more manual effort to configure routing and lacks automation in account creation and security enforcement.

References:

https://docs.aws.amazon.com/controltower/latest/userguide/

https://docs.aws.amazon.com/ram/latest/userguide/

Domain

AWS Management & Governance

Question 18Skipped

A solutions architect is creating a system that will run analytics on financial data for several hours a night, 5 days a week. The analysis is expected to run for the same duration and cannot be interrupted once it is started. The system will be required for a minimum of 1 year.

What should the solutions architect configure to ensure the EC2 instances are available when they are needed?

Correct answer

On-Demand Capacity Reservations

Regional Reserved Instances

Savings Plans

On-Demand Instances

Overall explanation

On-Demand Capacity Reservations enable you to reserve compute capacity for your Amazon EC2 instances in a specific Availability Zone for any duration. This gives you the ability to create and manage Capacity Reservations independently from the billing discounts offered by Savings Plans or Regional Reserved Instances.

By creating Capacity Reservations, you ensure that you always have access to EC2 capacity when you need it, for as long as you need it. You can create Capacity Reservations at any time, without entering a one-year or three-year term commitment, and the capacity is available immediately.

The table below shows the difference between capacity reservations and other options:

CORRECT: "On-Demand Capacity Reservations" is the correct answer.

INCORRECT: "Regional Reserved Instances" is incorrect. This type of reservation does not reserve capacity.

INCORRECT: "On-Demand Instances" is incorrect. This does not provide any kind of capacity reservation.

INCORRECT: "Savings Plans" is incorrect. This pricing option does not provide a capacity reservation.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-scheduled-instances.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2/

Domain

AWS Compute

Question 19Skipped

A company operates a multi-tier application with its backend services deployed on Amazon EC2 instances in a VPC. The backend services must communicate securely with APIs of a third-party SaaS provider that is also hosted on AWS. The company wants to ensure that this communication occurs privately and minimizes exposure to the public internet.

Which solution will meet these requirements?

Use an AWS VPN connection to establish a secure tunnel between the VPC and the third-party SaaS provider's infrastructure.

Set up an AWS Direct Connect connection between the VPC and the third-party SaaS provider to establish private communication.

Deploy a NAT gateway in the VPC to enable secure outbound communication with the third-party SaaS provider.

Correct answer

Configure AWS PrivateLink to create a private connection between the VPC and the third-party SaaS provider's APIs.

Overall explanation

Configure AWS PrivateLink to create a private connection between the VPC and the third-party SaaS provider's APIs: This is correct because AWS PrivateLink enables private connectivity between VPCs and supported AWS or third-party services, ensuring that traffic does not traverse the public internet.

Set up an AWS Direct Connect connection between the VPC and the third-party SaaS provider to establish private communication: This is incorrect because AWS Direct Connect is used for establishing private connections between on-premises environments and AWS, not for connecting to third-party SaaS providers within AWS.

Deploy a NAT gateway in the VPC to enable secure outbound communication with the third-party SaaS provider: This is incorrect because a NAT gateway facilitates outbound internet access for resources in private subnets but does not ensure private communication with third-party services.

Use an AWS VPN connection to establish a secure tunnel between the VPC and the third-party SaaS provider's infrastructure: This is incorrect because VPN connections are typically used for secure communication between on-premises environments and AWS, not for private connectivity to SaaS providers hosted on AWS.

References:
https://docs.aws.amazon.com/privatelink/latest/userguide/what-is-privatelink.html
https://aws.amazon.com/privatelink/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 20Skipped

A company provides a REST-based interface to an application that allows a partner company to send data in near-real time. The application then processes the data that is received and stores it for later analysis. The application runs on Amazon EC2 instances.

The partner company has received many 503 Service Unavailable Errors when sending data to the application and the compute capacity reaches its limits and is unable to process requests when spikes in data volume occur.

Which design should a Solutions Architect implement to improve scalability?

Use Amazon SQS to ingest the data. Configure the EC2 instances to process messages from the SQS queue.

Correct answer

Use Amazon Kinesis Data Streams to ingest the data. Process the data using AWS Lambda functions.

Use Amazon API Gateway in front of the existing application. Create a usage plan with a quota limit for the partner company.

Use Amazon SNS to ingest the data and trigger AWS Lambda functions to process the data in near-real time.

Overall explanation

Amazon Kinesis enables you to ingest, buffer, and process streaming data in real-time. Kinesis can handle any amount of streaming data and process data from hundreds of thousands of sources with very low latencies. This is an ideal solution for data ingestion.

To ensure the compute layer can scale to process increasing workloads, the EC2 instances should be replaced by AWS Lambda functions. Lambda can scale seamlessly by running multiple executions in parallel.

CORRECT: "Use Amazon Kinesis Data Streams to ingest the data. Process the data using AWS Lambda functions" is the correct answer.

INCORRECT: "Use Amazon API Gateway in front of the existing application. Create a usage plan with a quota limit for the partner company" is incorrect. A usage plan will limit the amount of data that is received and cause more errors to be received by the partner company.

INCORRECT: "Use Amazon SQS to ingest the data. Configure the EC2 instances to process messages from the SQS queue" is incorrect. Amazon Kinesis Data Streams should be used for near-real time or real-time use cases instead of Amazon SQS.

INCORRECT: "Use Amazon SNS to ingest the data and trigger AWS Lambda functions to process the data in near-real time" is incorrect. SNS is not a near-real time solution for data ingestion. SNS is used for sending notifications.

References:

https://aws.amazon.com/kinesis/

https://docs.aws.amazon.com/lambda/latest/dg/invocation-scaling.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-lambda/

https://digitalcloud.training/amazon-kinesis/

Domain

AWS Analytics

Question 21Skipped

A research organization wants to set up an Amazon EMR cluster for multiple departments to run their big data analytics jobs. The organization needs to ensure that each department’s workloads can access only the specific AWS services required for their analysis. Additionally, the organization wants to block access to Instance Metadata Service Version 2 (IMDSv2) on the EMR cluster's underlying EC2 instances.

Which solution will meet these requirements?

Assign unique EC2 IAM instance profiles to each team’s workloads. Configure the instance profiles with the specific permissions needed for each department.

Correct answer

Use EMR runtime roles to enforce granular permissions for each department's workloads. Configure the EMR cluster to use these roles when submitting jobs.

Create an EMR security configuration that disables access to the Instance Metadata Service. Use this security configuration with application-specific IAM roles to submit the workloads.

Configure VPC interface endpoints for each AWS service that the departments require. Route traffic from the big data workloads through these VPC endpoints.

Overall explanation

Use EMR runtime roles to enforce granular permissions for each department's workloads. Configure the EMR cluster to use these roles when submitting jobs: This is correct because EMR runtime roles allow fine-grained access control for individual workloads without exposing permissions at the instance level. Runtime roles are scoped specifically to applications, reducing the risk of unnecessary access.

Configure VPC interface endpoints for each AWS service that the departments require. Route traffic from the big data workloads through these VPC endpoints: This is incorrect because while VPC interface endpoints can restrict network access, they do not enforce permissions at the application level or prevent access to IMDSv2.

Assign unique EC2 IAM instance profiles to each team’s workloads. Configure the instance profiles with the specific permissions needed for each department: This is incorrect because instance profiles provide permissions at the instance level rather than the workload level. This does not ensure workload isolation or restrict access to IMDSv2.

Create an EMR security configuration that disables access to the Instance Metadata Service. Use this security configuration with application-specific IAM roles to submit the workloads: This is incorrect because EMR security configurations do not directly provide granular access control for individual workloads. While security configurations can restrict metadata access, they cannot enforce permissions per workload.

References:
https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-iam-roles.html
https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-security-configuration.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-emr/

Domain

AWS Analytics

Question 22Skipped

A Solutions Architect has deployed an application on several Amazon EC2 instances across three private subnets. The application must be made accessible to internet-based clients with the least amount of administrative effort.

How can the Solutions Architect make the application available on the internet?

Create an Application Load Balancer and associate three private subnets from the same Availability Zones as the private instances. Add the private instances to the ALB.

Create a NAT gateway in a public subnet. Add a route to the NAT gateway to the route tables of the three private subnets.

Create an Amazon Machine Image (AMI) of the instances in the private subnet and launch new instances from the AMI in public subnets. Create an Application Load Balancer and add the public instances to the ALB.

Correct answer

Create an Application Load Balancer and associate three public subnets from the same Availability Zones as the private instances. Add the private instances to the ALB.

Overall explanation

To make the application instances accessible on the internet the Solutions Architect needs to place them behind an internet-facing Elastic Load Balancer. The way you add instances in private subnets to a public facing ELB is to add public subnets in the same AZs as the private subnets to the ELB. You can then add the instances and to the ELB and they will become targets for load balancing.

An example of this architecture is shown below:

CORRECT: "Create an Application Load Balancer and associate three public subnets from the same Availability Zones as the private instances. Add the private instances to the ALB" is the correct answer.

INCORRECT: "Create an Application Load Balancer and associate three private subnets from the same Availability Zones as the private instances. Add the private instances to the ALB" is incorrect. Public subnets in the same AZs as the private subnets must be added to make this configuration work.

INCORRECT: "Create an Amazon Machine Image (AMI) of the instances in the private subnet and launch new instances from the AMI in public subnets. Create an Application Load Balancer and add the public instances to the ALB" is incorrect. There is no need to use an AMI to create new instances in a public subnet. You can add instances in private subnets to a public-facing ELB.

INCORRECT: "Create a NAT gateway in a public subnet. Add a route to the NAT gateway to the route tables of the three private subnets" is incorrect. A NAT gateway is used for outbound traffic not inbound traffic and cannot make the application available to internet-based clients.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/public-load-balancer-private-ec2/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Compute

Question 23Skipped

A company is working with a strategic partner that has an application that must be able to send messages to one of the company’s Amazon SQS queues. The partner company has its own AWS account.

How can a Solutions Architect provide least privilege access to the partner?

Create a user account and grant the sqs:SendMessage permission for Amazon SQS. Share the credentials with the partner company.

Correct answer

Update the permission policy on the SQS queue to grant the sqs:SendMessage permission to the partner’s AWS account.

Update the permission policy on the SQS queue to grant all permissions to the partner’s AWS account.

Create a cross-account role with access to all SQS queues and use the partner's AWS account in the trust document for the role.

Overall explanation

Amazon SQS supports resource-based policies. The best way to grant the permissions using the principle of least privilege is to use a resource-based policy attached to the SQS queue that grants the partner company’s AWS account the sqs:SendMessage privilege.

The following policy is an example of how this could be configured:

CORRECT: "Update the permission policy on the SQS queue to grant the sqs:SendMessage permission to the partner’s AWS account" is the correct answer.

INCORRECT: "Create a user account that and grant the sqs:SendMessage permission for Amazon SQS. Share the credentials with the partner company" is incorrect. This would provide the permissions for all SQS queues, not just the queue the partner company should be able to access.

INCORRECT: "Create a cross-account role with access to all SQS queues and use the partner's AWS account in the trust document for the role" is incorrect. This would provide access to all SQS queues and the partner company should only be able to access one SQS queue.

INCORRECT: "Update the permission policy on the SQS queue to grant all permissions to the partner’s AWS account" is incorrect. This provides too many permissions; the partner company only needs to send messages to the queue.

References:

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-basic-examples-of-sqs-policies.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 24Skipped

A global logistics company hosts its shipment tracking system in the eu-west-1 Region. The system runs on Amazon EC2 instances, and customers access the shipment tracking API to retrieve real-time updates about their packages. Customers from Asia and South America report slower API response times compared to customers in Europe.

The company wants to improve API response times for international customers in a cost-effective manner.

Which solution will meet these requirements MOST cost-effectively?

Establish an AWS Direct Connect connection with a public virtual interface (VIF) from each international customer's data center to the eu-west-1 Region. Route API requests over the Direct Connect connection to the shipment tracking system.

Correct answer

Use AWS Global Accelerator to route traffic through the closest AWS edge location to customers. Configure endpoint groups for the shipment tracking API to distribute traffic globally and reduce response times.

Deploy EC2 instances hosting the API in Asia and South America. Use an Application Load Balancer to distribute traffic across all Regions based on the geolocation of customer requests.

Deploy Amazon CloudFront in front of the API. Configure the API response to be cached and use the CachingOptimized managed policy to improve efficiency and reduce latency for frequently requested data.

Overall explanation

Use AWS Global Accelerator to route traffic through the closest AWS edge location to customers. Configure endpoint groups for the shipment tracking API to distribute traffic globally and reduce response times: This is correct because Global Accelerator uses AWS’s global network to reduce latency by routing traffic through the nearest edge location to the customer. It ensures cost-effective performance improvement for customers in Asia and South America without requiring infrastructure duplication in multiple Regions.

Establish an AWS Direct Connect connection with a public virtual interface (VIF) from each international customer's data center to the eu-west-1 Region. Route API requests over the Direct Connect connection to the shipment tracking system: This is incorrect because Direct Connect requires significant investment in physical infrastructure and is more suitable for consistent, high-bandwidth traffic rather than improving API latency for multiple international customers.

Deploy Amazon CloudFront in front of the API. Configure the API response to be cached and use the CachingOptimized managed policy to improve efficiency and reduce latency for frequently requested data: This is incorrect because CloudFront is ideal for caching static or frequently accessed content. For real-time APIs where caching is not effective, CloudFront would not address latency issues for international users.

Deploy EC2 instances hosting the API in Asia and South America. Use an Application Load Balancer to distribute traffic across all Regions based on the geolocation of customer requests: This is incorrect because deploying additional EC2 instances in multiple Regions increases operational costs and complexity. Global Accelerator is a more cost-effective solution that avoids duplicating infrastructure.

References:
https://docs.aws.amazon.com/global-accelerator/latest/dg/introduction.html
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-global-accelerator/

Domain

AWS Networking & Content Delivery

Question 25Skipped

A retail company with many stores and warehouses is implementing IoT sensors to gather monitoring data from devices in each location. The data will be sent to AWS in real time. A solutions architect must provide a solution for ensuring events are received in order for each device and ensure that data is saved for future processing.

Which solution would be MOST efficient?

Use an Amazon SQS standard queue for real-time events with one queue for each device. Trigger an AWS Lambda function from the SQS queue to save data to Amazon S3

Use Amazon Kinesis Data Streams for real-time events with a shard for each device. Use Amazon Kinesis Data Firehose to save data to Amazon EBS

Use an Amazon SQS FIFO queue for real-time events with one queue for each device. Trigger an AWS Lambda function for the SQS queue to save data to Amazon EFS

Correct answer

Use Amazon Kinesis Data Streams for real-time events with a partition key for each device. Use Amazon Kinesis Data Firehose to save data to Amazon S3

Overall explanation

Amazon Kinesis Data Streams collect and process data in real time. A Kinesis data stream is a set of shards. Each shard has a sequence of data records. Each data record has a sequence number that is assigned by Kinesis Data Streams. A shard is a uniquely identified sequence of data records in a stream.

A partition key is used to group data by shard within a stream. Kinesis Data Streams segregates the data records belonging to a stream into multiple shards. It uses the partition key that is associated with each data record to determine which shard a given data record belongs to.

For this scenario, the solutions architect can use a partition key for each device. This will ensure the records for that device are grouped by shard and the shard will ensure ordering. Amazon S3 is a valid destination for saving the data records.

CORRECT: "Use Amazon Kinesis Data Streams for real-time events with a partition key for each device. Use Amazon Kinesis Data Firehose to save data to Amazon S3" is the correct answer.

INCORRECT: "Use Amazon Kinesis Data Streams for real-time events with a shard for each device. Use Amazon Kinesis Data Firehose to save data to Amazon EBS" is incorrect as you cannot save data to EBS from Kinesis.

INCORRECT: "Use an Amazon SQS FIFO queue for real-time events with one queue for each device. Trigger an AWS Lambda function for the SQS queue to save data to Amazon EFS" is incorrect as SQS is not the most efficient service for streaming, real time data.

INCORRECT: "Use an Amazon SQS standard queue for real-time events with one queue for each device. Trigger an AWS Lambda function from the SQS queue to save data to Amazon S3" is incorrect as SQS is not the most efficient service for streaming, real time data.

References:

https://docs.aws.amazon.com/streams/latest/dev/key-concepts.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-kinesis/

Domain

AWS Analytics

Question 26Skipped

A company runs an application on an Amazon EC2 instance the requires 250 GB of storage space. The application is not used often and has small spikes in usage on weekday mornings and afternoons. The disk I/O can vary with peaks hitting a maximum of 3,000 IOPS. A Solutions Architect must recommend the most cost-effective storage solution that delivers the performance required.

Which configuration should the Solutions Architect recommend?

Which solution should the solutions architect recommend?

Amazon EBS Throughput Optimized HDD (st1)

Amazon EBS Cold HDD (sc1)

Amazon EBS Provisioned IOPS SSD (i01)

Correct answer

Amazon EBS General Purpose SSD (gp2)

Overall explanation

General Purpose SSD (gp2) volumes offer cost-effective storage that is ideal for a broad range of workloads. These volumes deliver single-digit millisecond latencies and the ability to burst to 3,000 IOPS for extended periods of time.

Between a minimum of 100 IOPS (at 33.33 GiB and below) and a maximum of 16,000 IOPS (at 5,334 GiB and above), baseline performance scales linearly at 3 IOPS per GiB of volume size. AWS designs gp2 volumes to deliver their provisioned performance 99% of the time. A gp2 volume can range in size from 1 GiB to 16 TiB.

In this configuration the volume will provide a baseline performance of 750 IOPS but will always be able to burst to the required 3,000 IOPS during periods of increased traffic.

CORRECT: "Amazon EBS General Purpose SSD (gp2)" is the correct answer.

INCORRECT: "Amazon EBS Provisioned IOPS SSD (i01)" is incorrect. The i01 volume type will be more expensive and is not necessary for the performance levels required.

INCORRECT: "Amazon EBS Cold HDD (sc1)" is incorrect. The sc1 volume type is not going to deliver the performance requirements as it cannot burst to 3,000 IOPS.

INCORRECT: "Amazon EBS Throughput Optimized HDD (st1)" is incorrect. The st1 volume type is not going to deliver the performance requirements as it cannot burst to 3,000 IOPS.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ebs/

Domain

AWS Compute

Question 27Skipped

A company is investigating methods to reduce the expenses associated with on-premises backup infrastructure. The Solutions Architect wants to reduce costs by eliminating the use of physical backup tapes. It is a requirement that existing backup applications and workflows should continue to function.

What should the Solutions Architect recommend?

Correct answer

Connect the backup applications to an AWS Storage Gateway using an iSCSI-virtual tape library (VTL).

Create an Amazon EFS file system and connect the backup applications using the iSCSI protocol.

Create an Amazon EFS file system and connect the backup applications using the NFS protocol.

Connect the backup applications to an AWS Storage Gateway using the iSCSI protocol.

Overall explanation

The AWS Storage Gateway Tape Gateway enables you to replace using physical tapes on premises with virtual tapes in AWS without changing existing backup workflows. Tape Gateway emulates physical tape libraries, removes the cost and complexity of managing physical tape infrastructure, and provides more durability than physical tapes.

CORRECT: "Connect the backup applications to an AWS Storage Gateway using an iSCSI-virtual tape library (VTL)" is the correct answer.

INCORRECT: "Create an Amazon EFS file system and connect the backup applications using the NFS protocol" is incorrect. The NFS protocol is used by AWS Storage Gateway File Gateways but these do not provide virtual tape functionality that is suitable for replacing the existing backup infrastructure.

INCORRECT: "Create an Amazon EFS file system and connect the backup applications using the iSCSI protocol" is incorrect. The NFS protocol is used by AWS Storage Gateway File Gateways but these do not provide virtual tape functionality that is suitable for replacing the existing backup infrastructure.

INCORRECT: "Connect the backup applications to an AWS Storage Gateway using the NFS protocol" is incorrect. The iSCSI protocol is used by AWS Storage Gateway Volume Gateways but these do not provide virtual tape functionality that is suitable for replacing the existing backup infrastructure.

References:

https://aws.amazon.com/storagegateway/vtl/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-storage-gateway/

Domain

AWS Storage

Question 28Skipped

A company has two accounts for perform testing and each account has a single VPC: VPC-TEST1 and VPC-TEST2. The operations team require a method of securely copying files between Amazon EC2 instances in these VPCs. The connectivity should not have any single points of failure or bandwidth constraints.

Which solution should a Solutions Architect recommend?

Attach a virtual private gateway to VPC-TEST1 and VPC-TEST2 and enable routing.

Attach a Direct Connect gateway to VPC-TEST1 and VPC-TEST2 and enable routing.

Correct answer

Create a VPC peering connection between VPC-TEST1 and VPC-TEST2.

Create a VPC gateway endpoint for each EC2 instance and update route tables.

Overall explanation

A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses. Instances in either VPC can communicate with each other as if they are within the same network.

You can create a VPC peering connection between your own VPCs, or with a VPC in another AWS account. The VPCs can be in different regions (also known as an inter-region VPC peering connection).

CORRECT: "Create a VPC peering connection between VPC-TEST1 and VPC-TEST2" is the correct answer.

INCORRECT: "Create a VPC gateway endpoint for each EC2 instance and update route tables" is incorrect. You cannot create VPC gateway endpoints for Amazon EC2 instances. These are used with DynamoDB and S3 only.

INCORRECT: "Attach a virtual private gateway to VPC-TEST1 and VPC-TEST2 and enable routing" is incorrect. You cannot create an AWS Managed VPN connection between two VPCs.

INCORRECT: "Attach a Direct Connect gateway to VPC-TEST1 and VPC-TEST2 and enable routing" is incorrect. Direct Connect gateway is used to connect a Direct Connect connection to multiple VPCs, it is not useful in this scenario as there is no Direct Connect connection.

References:

https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 29Skipped

A surveying team is using a fleet of drones to collect images of construction sites. The surveying team's laptops lack the inbuilt storage and compute capacity to transfer the images and process the data. While the team has Amazon EC2 instances for processing and Amazon S3 buckets for storage, network connectivity is intermittent and unreliable. The images need to be processed to evaluate the progress of each construction site.

What should a solutions architect recommend?

Cache the images locally on a hardware appliance pre-installed with AWS Storage Gateway to process the images when connectivity is restored.

Correct answer

Process and store the images using AWS Snowball Edge devices.

Configure Amazon Kinesis Data Firehose to create multiple delivery streams aimed separately at the S3 buckets for storage and the EC2 instances for processing the images.

During intermittent connectivity to EC2 instances, upload images to Amazon SQS.

Overall explanation

AWS physical Snowball Edge device will provide much more inbuilt compute and storage compared to the current team’s laptops. This negates the need to rely on a stable connection to process any images and solves the team's problems easily and efficiently.

CORRECT: "Process and store the images using AWS Snowball Edge devices” is the correct answer (as explained above.)

INCORRECT: "During intermittent connectivity to EC2 instances, upload images to Amazon SQS” is incorrect as you would still need a reliable internet connection to upload any images to Amazon SQS.

INCORRECT: "Configure Amazon Kinesis Data Firehose to create multiple delivery streams aimed separately at the S3 buckets for storage and the EC2 instances for processing the images" is incorrect as you would still need a reliable internet connection to upload any images to the Amazon Kinesis Service.

INCORRECT: "Cache the images locally on a hardware appliance pre-installed with AWS Storage Gateway to process the images when connectivity is restored” is incorrect as you would still need reliable internet connection to upload any images to the Amazon Storage Gateway service.

References:

https://docs.aws.amazon.com/snowball/latest/developer-guide/whatisedge.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-migration-services/

Domain

AWS Migration & Transfer

Question 30Skipped

A company runs an application in an on-premises data center that collects environmental data from production machinery. The data consists of JSON files stored on network attached storage (NAS) and around 5 TB of data is collected each day. The company must upload this data to Amazon S3 where it can be processed by an analytics application. The data must be transferred securely.

Which solution offers the MOST reliable and time-efficient data transfer?

AWS Database Migration Service over the Internet.

Amazon S3 Transfer Acceleration over the Internet.

Multiple AWS Snowcone devices.

Correct answer

AWS DataSync over AWS Direct Connect.

Overall explanation

The most reliable and time-efficient solution that keeps the data secure is to use AWS DataSync and synchronize the data from the NAS device directly to Amazon S3. This should take place over an AWS Direct Connect connection to ensure reliability, speed, and security.

AWS DataSync can copy data between Network File System (NFS) shares, Server Message Block (SMB) shares, self-managed object storage, AWS Snowcone, Amazon Simple Storage Service (Amazon S3) buckets, Amazon Elastic File System (Amazon EFS) file systems, and Amazon FSx for Windows File Server file systems.

CORRECT: "AWS DataSync over AWS Direct Connect" is the correct answer.

INCORRECT: "AWS Database Migration Service over the Internet" is incorrect. DMS is for migrating databases, not files.

INCORRECT: "Amazon S3 Transfer Acceleration over the Internet" is incorrect. The Internet does not offer the reliability, speed or performance that this company requires.

INCORRECT: "Multiple AWS Snowcone devices" is incorrect. This is not a time-efficient approach as it can take time to ship these devices in both directions.

References:

https://aws.amazon.com/datasync/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-migration-services/

Domain

AWS Migration & Transfer

Question 31Skipped

A company is launching a new photo processing service that uses machine learning (ML) models to analyze and tag images. The service consists of independent microservices for different types of image processing tasks. Each ML model loads approximately 500 MB of data from Amazon S3 into memory at startup.
Users will submit images through a RESTful API, which can handle individual or batch requests. Traffic patterns are unpredictable, with peaks during marketing campaigns and minimal usage during off-hours. The company needs a scalable and cost-effective solution to manage this workload.

Which solution will meet these requirements?

Route the API requests to a Network Load Balancer (NLB). Deploy the ML models as Amazon Elastic Kubernetes Service (Amazon EKS) pods. Configure auto scaling based on CPU usage for EKS nodes.

Send the API requests to an Amazon EventBridge bus. Deploy the ML models as AWS Lambda functions that EventBridge invokes. Use auto scaling to increase memory and concurrency based on the size of the event payloads.

Route the API requests to an Application Load Balancer (ALB). Deploy the ML models as AWS Lambda functions. Use provisioned concurrency to ensure Lambda functions remain warm for high-performance batch processing.

Correct answer

Send the API requests to an Amazon Simple Queue Service (Amazon SQS) queue. Deploy the ML models as Amazon Elastic Container Service (Amazon ECS) services that read messages from the queue. Use auto scaling for ECS to adjust capacity based on queue length.

Overall explanation

Send the API requests to an Amazon Simple Queue Service (Amazon SQS) queue. Deploy the ML models as Amazon Elastic Container Service (Amazon ECS) services that read messages from the queue. Use auto scaling for ECS to adjust capacity based on queue length: This solution effectively decouples the API from the backend processing with SQS, ensuring scalability during peaks. ECS services handle the asynchronous nature of requests, and auto scaling adjusts resources based on queue traffic.

Route the API requests to a Network Load Balancer (NLB). Deploy the ML models as Amazon Elastic Kubernetes Service (Amazon EKS) pods. Configure auto scaling based on CPU usage for EKS nodes: While scalable, this setup is more operationally complex and does not inherently manage batch processing or asynchronous workloads as well as SQS.

Route the API requests to an Application Load Balancer (ALB). Deploy the ML models as AWS Lambda functions. Use provisioned concurrency to ensure Lambda functions remain warm for high-performance batch processing: AWS Lambda is not optimal for this use case due to its constraints on memory and runtime, particularly with large ML models and batch requests.

Send the API requests to an Amazon EventBridge bus. Deploy the ML models as AWS Lambda functions that EventBridge invokes. Use auto scaling to increase memory and concurrency based on the size of the event payloads: EventBridge is not suitable for handling high-frequency batch image processing tasks. AWS Lambda’s limitations also make it unsuitable for this scenario.

References:
https://docs.aws.amazon.com/ecs/latest/developerguide/what-is-ecs.html
https://docs.aws.amazon.com/sqs/latest/dg/welcome.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 32Skipped

A logistics company processes real-time sensor data from delivery vehicles to optimize routes and track vehicle health. The current architecture includes an Auto Scaling group of Amazon EC2 instances for ingesting and storing sensor data, and a separate Auto Scaling group for analyzing and generating route optimizations based on this data.

The company has observed performance issues during peak delivery hours when the rate of data ingestion is significantly higher than the analysis and processing rate. The company wants to ensure that both systems can scale independently, and no data is lost during scaling events.

Which solution will meet these requirements?

Replace the EC2-based Auto Scaling groups with AWS Lambda functions to process the incoming data and analysis tasks. Use Amazon DynamoDB to store the intermediate data and scale DynamoDB based on the traffic patterns.

Use two Amazon SQS queues: one for data ingestion and one for route analysis. Configure Amazon EventBridge rules to monitor queue length and scale each Auto Scaling group based on the backlog of messages in their respective queues.

Use Amazon Kinesis Data Streams to buffer the sensor data. Configure Amazon Kinesis Data Analytics to process the data and adjust the number of EC2 instances in the analysis Auto Scaling group based on the volume of data being processed.

Correct answer

Use two Amazon Simple Queue Service (Amazon SQS) queues: one for data ingestion and one for route analysis. Configure the EC2 instances to poll their respective queues and scale the Auto Scaling groups based on the ApproximateNumberOfMessages metric in each queue.

Overall explanation

Use two Amazon Simple Queue Service (Amazon SQS) queues: one for data ingestion and one for route analysis. Configure the EC2 instances to poll their respective queues and scale the Auto Scaling groups based on the ApproximateNumberOfMessages metric in each queue: This is correct because SQS decouples the ingestion and analysis processes, ensuring no data is lost during traffic spikes. Scaling the Auto Scaling groups based on the queue length allows for efficient scaling that matches the workload demand for each process.

Replace the EC2-based Auto Scaling groups with AWS Lambda functions to process the incoming data and analysis tasks. Use Amazon DynamoDB to store the intermediate data and scale DynamoDB based on the traffic patterns: This is incorrect because replacing EC2 instances with Lambda introduces architectural changes and operational overhead. Additionally, DynamoDB is not required when SQS provides an efficient decoupling mechanism.

Use Amazon Kinesis Data Streams to buffer the sensor data. Configure Amazon Kinesis Data Analytics to process the data and adjust the number of EC2 instances in the analysis Auto Scaling group based on the volume of data being processed: This is incorrect because Kinesis introduces additional complexity and costs and is not necessary for this use case. SQS already provides buffering and scaling capabilities tailored to this scenario.

Use two Amazon SQS queues: one for data ingestion and one for route analysis. Configure Amazon EventBridge rules to monitor queue length and scale each Auto Scaling group based on the backlog of messages in their respective queues: This is incorrect because EventBridge is not the optimal mechanism for scaling Auto Scaling groups. Scaling directly based on SQS metrics is simpler and more efficient for managing workloads in this scenario.

References:
https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-using-sqs-queue.html
Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 33Skipped

A company needs to connect its on-premises data center network to a new virtual private cloud (VPC). There is a symmetrical internet connection of 100 Mbps in the data center network. The data transfer rate for an on-premises application is multiple gigabytes per day. Processing will be done using an Amazon Kinesis Data Firehose stream.

What should a solutions architect recommend for maximum performance?

Get an AWS Snowball Edge Storage Optimized device. Data must be copied to the device after several days and shipped to AWS for expedited transfer to Kinesis Data Firehose. Repeat as necessary.

Establish an AWS Site-to-Site VPN connection between the on-premises network and the VPC. Set up BGP routing between the customer gateway and the virtual private gateway. Send data to Kinesis Data Firehose using a VPN connection.

Establish a peering connection between the on-premises network and the VPC. Configure routing for the on-premises network to use the VPC peering connection.

Correct answer

Kinesis Data Firehose can be connected to the VPC using AWS PrivateLink. Install a 1 Gbps AWS Direct Connect connection between the on-premises network and AWS. To send data from on-premises to Kinesis Data Firehose, use the PrivateLink endpoint.

Overall explanation

Explanation:

Using AWS PrivateLink to create an interface endpoint will allow your traffic to traverse the AWS Global Backbone to allow maximum performance and security. Also by using an AWS Direct Connect cable you can ensure you have a dedicated cable to provide maximum performance and low latency to and from AWS.

CORRECT: "Kinesis Data Firehose can be connected to the VPC using AWS PrivateLink. Install a 1 Gbps AWS Direct Connect connection between the on-premises network and AWS. To send data from on-premises to Kinesis Data Firehose, use the PrivateLink endpoint” is the correct answer (as explained above.)

INCORRECT: "Establish a peering connection between the on-premises network and the VPC. Configure routing for the on-premises network to use the VPC peering connection” is incorrect also because VPC peering connections can only exist between two VPCs within the AWS Cloud.

INCORRECT: "Get an AWS Snowball Edge Storage Optimized device. Data must be copied to the device after several days and shipped to AWS for expedited transfer to Kinesis Data Firehose. Repeat as necessary” is incorrect. AWS Snowball Edge is designed to be more of a one-time migration service which you physically receive from AWS, and then ship it into an AWS Region of your choice.

INCORRECT: "Establish an AWS Site-to-Site VPN connection between the on-premises network and the VPC. Set up BGP routing between the customer gateway and the virtual private gateway. Send data to Kinesis Data Firehose using a VPN connection” is incorrect. This is a functional solution; however a physical connection would provide a much more reliable and performant solution.

References:

https://aws.amazon.com/privatelink/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 34Skipped

A global manufacturing company uses AWS Outposts servers to manage IoT workloads in its factories across multiple continents. The company regularly updates factory IoT software, consisting of 50 files, from a central Amazon S3 bucket in the us-east-1 Region. Factories report significant delays when downloading and applying the updates, causing downtime. The company needs to minimize the latency for distributing software updates globally while reducing operational overhead.

Which solution will meet this requirement with the LEAST operational overhead?

Create an Amazon S3 bucket in the us-east-1 Region. Configure Amazon S3 Transfer Acceleration for the bucket. Use the S3 Transfer Acceleration endpoint for faster downloads.

Create an Amazon S3 bucket in the us-east-1 Region. Deploy AWS Outposts servers at the factories as S3 endpoints. Configure the servers to cache the updates locally.

Correct answer

Create an Amazon S3 bucket in the us-east-1 Region. Set up an Amazon CloudFront distribution with the S3 bucket as the origin. Use signed URLs to download the software updates.

Create Amazon S3 buckets in multiple Regions. Configure S3 Cross-Region Replication (CRR) between the buckets. Deploy updates from the nearest bucket to each factory location.

Overall explanation

Create an Amazon S3 bucket in the us-east-1 Region. Set up an Amazon CloudFront distribution with the S3 bucket as the origin. Use signed URLs to download the software updates: This is correct because CloudFront caches the software updates at edge locations around the world, significantly reducing latency. Signed URLs ensure secure access, and the solution requires minimal operational overhead. Create an Amazon S3 bucket in the us-east-1 Region. Configure Amazon S3 Transfer Acceleration for the bucket. Use the S3 Transfer Acceleration endpoint for faster downloads: This is incorrect because Transfer Acceleration optimizes file transfers only when data is uploaded or downloaded from a single bucket, which may not provide consistent latency improvements for global locations. Create an Amazon S3 bucket in the us-east-1 Region. Deploy AWS Outposts servers at the factories as S3 endpoints. Configure the servers to cache the updates locally: This is incorrect because configuring Outposts servers as S3 endpoints increases operational complexity and cost. CloudFront is a simpler and more efficient solution for this use case. Create Amazon S3 buckets in multiple Regions. Configure S3 Cross-Region Replication (CRR) between the buckets. Deploy updates from the nearest bucket to each factory location: This is incorrect because managing multiple buckets and configuring CRR requires additional effort and increases complexity compared to using a single bucket with CloudFront.

References:
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html
https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Storage

Question 35Skipped

A persistent database must be migrated from an on-premises server to an Amazon EC2 instances. The database requires 64,000 IOPS and, if possible, should be stored on a single Amazon EBS volume.

Which solution should a Solutions Architect recommend?

Create an Amazon EC2 instance with four Amazon EBS General Purpose SSD (gp2) volumes attached. Max out the IOPS on each volume and use a RAID 0 stripe set.

Use an instance from the I3 I/O optimized family and leverage instance store storage to achieve the IOPS requirement.

Create an Amazon EC2 instance with two Amazon EBS Provisioned IOPS SSD (i01) volumes attached. Provision 32,000 IOPS per volume and create a logical volume using the OS that aggregates the capacity.

Correct answer

Create a Nitro-based Amazon EC2 instance with an Amazon EBS Provisioned IOPS SSD (i01) volume attached. Provision 64,000 IOPS for the volume.

Overall explanation

Amazon EC2 Nitro-based systems are not required for this solution but do offer advantages in performance that will help to maximize the usage of the EBS volume. For the data storage volume an i01 volume can support up to 64,000 IOPS so a single volume with sufficient capacity (50 IOPS per GiB) can be deliver the requirements.

The current list of EBS volume types is in the table below:

CORRECT: "Create a Nitro-based Amazon EC2 instance with an Amazon EBS Provisioned IOPS SSD (i01) volume attached. Provision 64,000 IOPS for the volume" is the correct answer.

INCORRECT: "Use an instance from the I3 I/O optimized family and leverage instance store storage to achieve the IOPS requirement" is incorrect.

INCORRECT: "Create an Amazon EC2 instance with four Amazon EBS General Purpose SSD (gp2) volumes attached. Max out the IOPS on each volume and use a RAID 0 stripe set" is incorrect. This is not a good use case for gp2 volumes. It is much better to use io1 which also meets the requirement of having a single volume with 64,000 IOPS.

INCORRECT: "Create an Amazon EC2 instance with two Amazon EBS Provisioned IOPS SSD (i01) volumes attached. Provision 32,000 IOPS per volume and create a logical volume using the OS that aggregates the capacity" is incorrect. There is no need to create two volumes and aggregate capacity through the OS, the Solutions Architect can simply create a single volume with 64,000 IOPS.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volume-types.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2/

Domain

AWS Compute

Question 36Skipped

A genetics research firm processes DNA sequencing data for multiple clients. The raw data is stored in relational databases provided by each client. The company must extract the data, apply unique transformation algorithms for each client, and store the processed results in Amazon S3.

Due to the sensitivity of the data, the company must encrypt it both during processing and at rest in Amazon S3. Each client must have their own encryption keys to meet compliance requirements. The company also wants to minimize operational overhead while implementing this solution.

Which solution will meet these requirements with the LEAST operational effort?

Use AWS Glue to create a single ETL pipeline for all clients. Configure the pipeline to tag each client’s data and use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt data based on client-specific keys before storing it in Amazon S3.

Deploy a centralized Amazon EMR cluster to process data for all clients. Encrypt the data in transit using TLS certificates for each client and store the data in Amazon S3 using server-side encryption with Amazon S3 managed keys (SSE-S3).

Correct answer

Use AWS Glue to create individual ETL jobs for each client. Attach a security configuration that uses client-specific AWS KMS keys for server-side encryption (SSE-KMS) during processing and storage in S3.

Deploy an Amazon EMR cluster for each client with a client-specific Hadoop configuration. Use client-side encryption (CSE) to encrypt data with customer-managed root keys during transformations and upload the results to S3.

Overall explanation

Use AWS Glue to create individual ETL jobs for each client. Attach a security configuration that uses client-specific AWS KMS keys for server-side encryption (SSE-KMS) during processing and storage in S3: This is correct because AWS Glue simplifies ETL workflows and supports attaching security configurations to enforce client-specific encryption with KMS keys. This approach minimizes operational effort by automating the process while meeting encryption requirements.

Use AWS Glue to create a single ETL pipeline for all clients. Configure the pipeline to tag each client’s data and use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt data based on client-specific keys before storing it in Amazon S3: This is incorrect because a single ETL pipeline complicates the tagging and encryption logic, increasing the risk of errors. Separate ETL jobs for each client provide a cleaner and more scalable solution.

Deploy an Amazon EMR cluster for each client with a client-specific Hadoop configuration. Use client-side encryption (CSE) to encrypt data with customer-managed root keys during transformations and upload the results to S3: This is incorrect because deploying separate EMR clusters for each client significantly increases operational overhead and costs. AWS Glue is a more efficient solution for this workload.

Deploy a centralized Amazon EMR cluster to process data for all clients. Encrypt the data in transit using TLS certificates for each client and store the data in Amazon S3 using server-side encryption with Amazon S3 managed keys (SSE-S3): This is incorrect because TLS encrypts data only in transit, not during processing. Additionally, SSE-S3 does not meet the compliance requirement of using client-specific encryption keys.

References:

https://docs.aws.amazon.com/glue/latest/dg/encryption-security-configurations.html
https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-glue/

Domain

AWS Analytics

Question 37Skipped

A company has deployed a new website on Amazon EC2 instances behind an Application Load Balancer (ALB). Amazon Route 53 is used for the DNS service. The company has asked a Solutions Architect to create a backup website with support contact details that users will be directed to automatically if the primary website is down.

How should the Solutions Architect deploy this solution cost-effectively?

Deploy the backup website on EC2 and ALB in another Region and use Route 53 health checks for failover routing.

Correct answer

Configure a static website using Amazon S3 and create a Route 53 failover routing policy.

Create the backup website on EC2 and ALB in another Region and create an AWS Global Accelerator endpoint.

Configure a static website using Amazon S3 and create a Route 53 weighted routing policy.

Overall explanation

The most cost-effective solution is to create a static website using an Amazon S3 bucket and then use a failover routing policy in Amazon Route 53. With a failover routing policy users will be directed to the main website as long as it is responding to health checks successfully.

If the main website fails to respond to health checks (its down), Route 53 will begin to direct users to the backup website running on the Amazon S3 bucket. It’s important to set the TTL on the Route 53 records appropriately to ensure that users resolve the failover address within a short time.

CORRECT: "Configure a static website using Amazon S3 and create a Route 53 failover routing policy" is the correct answer.

INCORRECT: "Configure a static website using Amazon S3 and create a Route 53 weighted routing policy" is incorrect. Weighted routing is used when you want to send a percentage of traffic between multiple endpoints. In this case all traffic should go to the primary until if fails, then all should go to the backup.

INCORRECT: "Deploy the backup website on EC2 and ALB in another Region and use Route 53 health checks for failover routing" is incorrect. This is not a cost-effective solution for the backup website. It can be implemented using Route 53 failover routing which uses health checks but would be an expensive option.

INCORRECT: "Create the backup website on EC2 and ALB in another Region and create an AWS Global Accelerator endpoint" is incorrect. Global Accelerator is used for performance as it directs traffic to the nearest healthy endpoint. It is not useful for failover in this scenario and is also a very expensive solution.

References:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.html

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover-configuring.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

https://digitalcloud.training/amazon-route-53/

Domain

AWS Networking & Content Delivery

Question 38Skipped

A company runs an application on six web application servers in an Amazon EC2 Auto Scaling group in a single Availability Zone. The application is fronted by an Application Load Balancer (ALB). A Solutions Architect needs to modify the infrastructure to be highly available without making any modifications to the application.

Which architecture should the Solutions Architect choose to enable high availability?

Create an Auto Scaling group to launch three instances across each of two Regions.

Create a launch template that can be used to quickly create more instances in another Region.

Correct answer

Modify the Auto Scaling group to use two instances across each of three Availability Zones.

Create an Amazon CloudFront distribution with a custom origin across multiple Regions.

Overall explanation

The only thing that needs to be changed in this scenario to enable HA is to split the instances across multiple Availability Zones. The architecture already uses Auto Scaling and Elastic Load Balancing so there is plenty of resilience to failure. Once the instances are running across multiple AZs there will be AZ-level fault tolerance as well.

CORRECT: "Modify the Auto Scaling group to use two instances across each of three Availability Zones" is the correct answer.

INCORRECT: "Create an Amazon CloudFront distribution with a custom origin across multiple Regions" is incorrect. CloudFront is not used to create HA for your application, it is used to accelerate access to media content.

INCORRECT: "Create a launch template that can be used to quickly create more instances in another Region" is incorrect. Multi-AZ should be enabled rather than multi-Region.

INCORRECT: "Create an Auto Scaling group to launch three instances across each of two Regions" is incorrect. HA can be achieved within a Region by simply enabling more AZs in the ASG. An ASG cannot launch instances in multiple Regions.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-add-availability-zone.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 39Skipped

A company runs an application in a private subnet within a VPC. The application is integrated with Amazon Cognito using a user pool for user authentication. The company wants to enable users to securely upload and store their documents in an Amazon S3 bucket.

What combination of steps should the company take to securely integrate the application with Amazon S3? (Select TWO.)

Correct selection

Configure an Amazon Cognito identity pool to provide temporary credentials for Amazon S3 when users authenticate through the user pool.

Correct selection

Enable Amazon S3 VPC endpoints in the VPC to ensure private connectivity between the application and the S3 bucket.

Assign IAM roles directly to the S3 bucket to allow user-level access.

Add a bucket policy to deny requests that do not include valid Amazon Cognito credentials.

Configure the application to generate Amazon S3 access tokens directly from the Cognito user pool.

Overall explanation

Configure an Amazon Cognito identity pool to provide temporary credentials for Amazon S3 when users authenticate through the user pool: This is correct because an Amazon Cognito identity pool is required to grant temporary AWS credentials for accessing S3 buckets. The user pool alone does not provide direct access to AWS resources, so the identity pool integrates with the user pool to securely grant users permissions to interact with S3.

Enable Amazon S3 VPC endpoints in the VPC to ensure private connectivity between the application and the S3 bucket: This is correct because the application runs in a private subnet and needs secure connectivity to Amazon S3. A VPC endpoint ensures traffic remains within the AWS network, improving security and reducing reliance on internet gateways or NAT gateways.

Add a bucket policy to deny requests that do not include valid Amazon Cognito credentials: This is incorrect because bucket policies can restrict access based on certain conditions, but integrating Amazon Cognito requires granting access through IAM roles tied to identity pools, not bucket policies.

Assign IAM roles directly to the S3 bucket to allow user-level access: This is incorrect because IAM roles are assigned to entities like users or identity pools, not to resources like S3 buckets. The proper method involves attaching policies to the identity pool role to grant temporary credentials.

Configure the application to generate Amazon S3 access tokens directly from the Cognito user pool: This is incorrect because user pools authenticate users but do not directly provide credentials for AWS services. An identity pool is required to bridge the authentication process with AWS resource access.

References:

https://docs.aws.amazon.com/cognito/latest/developerguide/identity-pools.html

https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cognito/

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Security, Identity, & Compliance

Question 40Skipped

A fintech company is modernizing its payments processing system to adopt a serverless microservices architecture. The company wants to decouple its services and implement an event-driven architecture to support a publish/subscribe (pub/sub) model. The system needs to notify multiple downstream services when payment events occur, ensuring scalability and low operational overhead.

Which solution will meet these requirements MOST cost-effectively?

Use Amazon Kinesis Data Firehose to deliver payment events to multiple S3 buckets. Configure downstream services to poll the buckets for event processing.

Correct answer

Configure an Amazon SNS topic to receive payment events from an AWS Lambda function. Set up multiple subscribers, such as Lambda functions, to process the events.

Use Amazon MQ as a message broker to enable publish/subscribe communication between the payment microservices and the downstream services.

Configure an Amazon EventBridge rule to capture payment events and route them to multiple AWS Lambda functions that handle downstream processing.

Overall explanation

Configure an Amazon SNS topic to receive payment events from an AWS Lambda function. Set up multiple subscribers, such as Lambda functions, to process the events: This is correct because SNS is a fully managed pub/sub messaging service that supports high-throughput, scalable delivery to multiple subscribers, which aligns with the company's requirements.

Configure an Amazon EventBridge rule to capture payment events and route them to multiple AWS Lambda functions that handle downstream processing: This is incorrect because EventBridge is more suited for complex event routing scenarios and not optimized for simple pub/sub use cases compared to SNS.

Use Amazon Kinesis Data Firehose to deliver payment events to multiple S3 buckets. Configure downstream services to poll the buckets for event processing: This is incorrect because Kinesis Data Firehose is designed for streaming data delivery, not for pub/sub messaging. It adds unnecessary overhead for the described use case.

Use Amazon MQ as a message broker to enable publish/subscribe communication between the payment microservices and the downstream services: This is incorrect because Amazon MQ is a managed message broker service that is typically used for legacy applications requiring protocols such as JMS or AMQP. It adds more operational complexity compared to SNS.

References:
https://docs.aws.amazon.com/sns/latest/dg/welcome.html
https://docs.aws.amazon.com/eventbridge/latest/userguide/what-is-amazon-eventbridge.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 41Skipped

The database tier of a web application is running on a Windows server on-premises. The database is a Microsoft SQL Server database. The application owner would like to migrate the database to an Amazon RDS instance.

How can the migration be executed with minimal administrative effort and downtime?

Correct answer

Use the AWS Database Migration Service (DMS) to directly migrate the database to RDS

Use the AWS Database Migration Service (DMS) to directly migrate the database to RDS. Use the Schema Conversion Tool (SCT) to enable conversion from Microsoft SQL Server to Amazon RDS

Use the AWS Server Migration Service (SMS) to migrate the server to Amazon EC2.Use AWS Database Migration Service (DMS) to migrate the database to RDS

Use AWS DataSync to migrate the data from the database to Amazon S3. Use AWS Database Migration Service (DMS) to migrate the database to RDS

Overall explanation

You can directly migrate Microsoft SQL Server from an on-premises server into Amazon RDS using the Microsoft SQL Server database engine. This can be achieved using the native Microsoft SQL Server tools, or using AWS DMS as depicted below:

CORRECT: "Use the AWS Database Migration Service (DMS) to directly migrate the database to RDS" is the correct answer.

INCORRECT: "Use the AWS Server Migration Service (SMS) to migrate the server to Amazon EC2. Use AWS Database Migration Service (DMS) to migrate the database to RDS" is incorrect. You do not need to use the AWS SMS service to migrate the server into EC2 first. You can directly migrate the database online with minimal downtime.

INCORRECT: "Use AWS DataSync to migrate the data from the database to Amazon S3. Use AWS Database Migration Service (DMS) to migrate the database to RDS" is incorrect. AWS DataSync is used for migrating data, not databases.

INCORRECT: "Use the AWS Database Migration Service (DMS) to directly migrate the database to RDS. Use the Schema Conversion Tool (SCT) to enable conversion from Microsoft SQL Server to Amazon RDS" is incorrect. You do not need to use the SCT as you are migrating into the same destination database engine (RDS is just the platform).

References:

https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/migrate-an-on-premises-microsoft-sql-server-database-to-amazon-rds-for-sql-server.html

https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Source.html

https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.html

https://aws.amazon.com/dms/schema-conversion-tool/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-migration-services/

Domain

AWS Migration & Transfer

Question 42Skipped

A financial services company stores transaction records in an Amazon S3 bucket. The company runs its analytics application on a cluster of on-premises servers. The application needs temporary, secure access to the S3 bucket to analyze the data files.

The company uses AWS IAM Identity Center to manage identities and ensure adherence to the principle of least privilege. The solution must avoid long-term credential storage and provide a secure method for the application to access the S3 bucket.

Which solution will meet these requirements?

Correct answer

Use IAM Roles Anywhere to issue temporary credentials to the application. Set up a trust relationship with IAM Identity Center and configure the application to assume the role using these credentials.

Deploy AWS Storage Gateway File Gateway to the on-premises environment. Configure the application to access the S3 bucket through the gateway by using NFS or SMB.

Use AWS Systems Manager to store an access key and secret key for an IAM user with access to the S3 bucket. Configure the application to retrieve the credentials from Systems Manager Parameter Store when needed.

Create an S3 bucket policy to allow access from the public IP address range of the company’s on-premises servers. Configure the application to access the S3 bucket directly.

Overall explanation

Use IAM Roles Anywhere to issue temporary credentials to the application. Set up a trust relationship with IAM Identity Center and configure the application to assume the role using these credentials: This is correct because IAM Roles Anywhere provides a secure and scalable method for on-premises workloads to obtain temporary AWS credentials. It avoids the use of long-term credentials and integrates with IAM Identity Center to ensure least privilege access to the S3 bucket.

Create an S3 bucket policy to allow access from the public IP address range of the company’s on-premises servers. Configure the application to access the S3 bucket directly: This is incorrect because opening access to a public IP address range is less secure and does not align with the principle of least privilege. It exposes the S3 bucket to potential security risks.

Deploy AWS Storage Gateway File Gateway to the on-premises environment. Configure the application to access the S3 bucket through the gateway by using NFS or SMB: This is incorrect because while File Gateway can provide access to S3, it is designed for file-based workloads and adds unnecessary complexity for this use case. IAM Roles Anywhere is a simpler and more secure option for temporary credentials.

Use AWS Systems Manager to store an access key and secret key for an IAM user with access to the S3 bucket. Configure the application to retrieve the credentials from Systems Manager Parameter Store when needed: This is incorrect because storing long-term credentials in Parameter Store introduces security risks. Temporary credentials from IAM Roles Anywhere are a more secure and compliant solution.

References:
https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html
https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Security, Identity, & Compliance

Question 43Skipped

Amazon EC2 instances in an Auto Scaling group. The application stores temporary training data on attached Amazon Elastic Block Store (Amazon EBS) volumes. The company seeks recommendations to optimize costs for the EC2 instances, the Auto Scaling group, and the EBS volumes with minimal manual intervention.

Which solution will meet these requirements with the MOST operational efficiency?

Use AWS Compute Optimizer for recommendations on EC2 instances and Auto Scaling groups. Use Amazon Data Lifecycle Manager to evaluate cost optimizations for the EBS volumes.

Set up Amazon CloudWatch billing alerts and manually analyze metrics to identify cost-saving opportunities for the EC2 instances, the Auto Scaling group, and the EBS volumes.

Use AWS Cost and Usage Reports to export data to Amazon Athena. Query the data to identify inefficiencies in the EC2 instances, the Auto Scaling group, and the EBS volumes.

Correct answer

Configure AWS Compute Optimizer to provide cost optimization recommendations for the EC2 instances, the Auto Scaling group, and the EBS volumes.

Overall explanation

Configure AWS Compute Optimizer to provide cost optimization recommendations for the EC2 instances, the Auto Scaling group, and the EBS volumes: This is correct because AWS Compute Optimizer offers actionable insights for cost optimization across EC2 instances, Auto Scaling groups, and EBS volumes with minimal operational overhead.

Set up Amazon CloudWatch billing alerts and manually analyze metrics to identify cost-saving opportunities for the EC2 instances, the Auto Scaling group, and the EBS volumes: This option requires significant manual intervention, which reduces operational efficiency.

Use AWS Cost and Usage Reports to export data to Amazon Athena. Query the data to identify inefficiencies in the EC2 instances, the Auto Scaling group, and the EBS volumes: While this approach provides insights, it requires significant manual effort to analyze the data.

Use AWS Compute Optimizer for recommendations on EC2 instances and Auto Scaling groups. Use Amazon Data Lifecycle Manager to evaluate cost optimizations for the EBS volumes: This requires separate configurations for different resources, increasing complexity compared to a single AWS Compute Optimizer setup.

References:
https://docs.aws.amazon.com/compute-optimizer/latest/ug/what-is.html
https://docs.aws.amazon.com/AmazonEBS/latest/dg/ebs-automatic-snapshot-policy.html

Domain

AWS Compute

Question 44Skipped

A genomics research organization is building an application to analyze large datasets. Raw genomic data is stored in an Amazon S3 bucket, processed by multiple Amazon EC2 instances, and the results are stored in a separate S3 bucket. The application frequently transfers large amounts of data between the EC2 instances during analysis. The organization wants to reduce overall data transfer costs while maintaining efficient data processing.

What should the solutions architect do to achieve this?

Correct answer

Deploy all the EC2 instances in the same Availability Zone to eliminate cross-AZ data transfer charges.

Use Amazon Elastic Fabric Adapter (EFA) to enable high-speed data transfer between EC2 instances, reducing transfer costs.

Use Amazon S3 Transfer Acceleration to optimize the transfer of data between the EC2 instances and the S3 buckets.

Configure an Auto Scaling group to launch the EC2 instances in multiple Regions to distribute the processing workload.

Overall explanation

Deploy all the EC2 instances in the same Availability Zone to eliminate cross-AZ data transfer charges: This is correct because data transfer between EC2 instances in the same AZ is free, while transferring data across AZs incurs additional charges. Keeping all instances in the same AZ minimizes data transfer costs while maintaining efficient processing.
Configure an Auto Scaling group to launch the EC2 instances in multiple Regions to distribute the processing workload: This is incorrect because distributing workloads across multiple Regions increases inter-region data transfer costs, which are higher than cross-AZ costs. This approach does not address the need to reduce data transfer costs.
Use Amazon Elastic Fabric Adapter (EFA) to enable high-speed data transfer between EC2 instances, reducing transfer costs: This is incorrect because EFAs optimize network performance for HPC (high-performance computing) workloads but do not reduce costs associated with cross-AZ or inter-AZ data transfer charges.
Use Amazon S3 Transfer Acceleration to optimize the transfer of data between the EC2 instances and the S3 buckets: This is incorrect because S3 Transfer Acceleration is designed to speed up data transfer over long distances to S3, such as from on-premises locations or remote clients. It does not reduce costs for transfers between EC2 instances.

References:
https://aws.amazon.com/ec2/pricing/on-demand/
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni-efa.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2/

Domain

AWS Networking & Content Delivery

Question 45Skipped

A company is migrating from an on-premises infrastructure to the AWS Cloud. One of the company's applications stores files on a Windows file server farm that uses Distributed File System Replication (DFSR) to keep data in sync. A solutions architect needs to replace the file server farm.

Which service should the solutions architect use?

Amazon S3

Correct answer

Amazon FSx

Amazon EFS

AWS Storage Gateway

Overall explanation

Amazon FSx for Windows File Server provides fully managed, highly reliable file storage that is accessible over the industry-standard Server Message Block (SMB) protocol.

Amazon FSx is built on Windows Server and provides a rich set of administrative features that include end-user file restore, user quotas, and Access Control Lists (ACLs).

Additionally, Amazon FSX for Windows File Server supports Distributed File System Replication (DFSR) in Single-AZ deployments as can be seen in the feature comparison table below.

CORRECT: "Amazon FSx" is the correct answer.

INCORRECT: "Amazon EFS" is incorrect as EFS only supports Linux systems.

INCORRECT: "Amazon S3" is incorrect as this is not a suitable replacement for a Microsoft filesystem.

INCORRECT: "AWS Storage Gateway" is incorrect as this service is primarily used for connecting on-premises storage to cloud storage. It consists of a software device installed on-premises and can be used with SMB shares but it actually stores the data on S3. It is also used for migration. However, in this case the company need to replace the file server farm and Amazon FSx is the best choice for this job.

References:

https://docs.aws.amazon.com/fsx/latest/WindowsGuide/high-availability-multiAZ.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-fsx/

Domain

AWS Storage

Question 46Skipped

A company runs an application that uses an Amazon RDS PostgreSQL database. The database is currently not encrypted. A Solutions Architect has been instructed that due to new compliance requirements all existing and new data in the database must be encrypted. The database experiences high volumes of changes and no data can be lost.

How can the Solutions Architect enable encryption for the database without incurring any data loss?

Correct answer

Create a snapshot of the existing RDS DB instance. Create an encrypted copy of the snapshot. Create a new RDS DB instance from the encrypted snapshot and update the application. Use AWS DMS to synchronize data between the source and destination RDS DBs.

Update the RDS DB to Multi-AZ mode and enable encryption for the standby replica. Perform a failover to the standby instance and then delete the unencrypted RDS DB instance.

Create a snapshot of the existing RDS DB instance. Create an encrypted copy of the snapshot. Create a new RDS DB instance from the encrypted snapshot. Configure the application to use the new DB endpoint.

Create an RDS read replica and specify an encryption key. Promote the encrypted read replica to primary. Update the application to point to the new RDS DB endpoint.

Overall explanation

You cannot change the encryption status of an existing RDS DB instance. Encryption must be specified when creating the RDS DB instance. The best way to encrypt an existing database is to take a snapshot, encrypt a copy of the snapshot and restore the snapshot to a new RDS DB instance. This results in an encrypted database that is a new instance. Applications must be updated to use the new RDS DB endpoint.

In this scenario as there is a high rate of change, the databases will be out of sync by the time the new copy is created and is functional. The best way to capture the changes between the source (unencrypted) and destination (encrypted) DB is to use AWS Database Migration Service (DMS) to synchronize the data.

The slide below depicts the process for encrypting an unencrypted RDS DB instance:

CORRECT: "Create a snapshot of the existing RDS DB instance. Create an encrypted copy of the snapshot. Create a new RDS DB instance from the encrypted snapshot and update the application. Use AWS DMS to synchronize data between the source and destination RDS DBs" is the correct answer.

INCORRECT: "Create a snapshot of the existing RDS DB instance. Create an encrypted copy of the snapshot. Create a new RDS DB instance from the encrypted snapshot. Configure the application to use the new DB endpoint" is incorrect. This answer creates an encrypted DB instance but does not synchronize the data.

INCORRECT: "Create an RDS read replica and specify an encryption key. Promote the encrypted read replica to primary. Update the application to point to the new RDS DB endpoint" is incorrect. You cannot create an encrypted read replica of an unencrypted RDS DB. The read replica will always have the same encryption status as the RDS DB it is created from.

INCORRECT: "Update the RDS DB to Multi-AZ mode and enable encryption for the standby replica. Perform a failover to the standby instance and then delete the unencrypted RDS DB instance" is incorrect. You also cannot have an encrypted Multi-AZ standby instance of an unencrypted RDS DB.

References:

https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/encrypt-an-existing-amazon-rds-for-postgresql-db-instance.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

Domain

AWS Database

Question 47Skipped

A company runs containerized applications for many application workloads in an on-premise data center. The company is planning to deploy containers to AWS and the chief architect has mandated that the same configuration and administrative tools must be used across all containerized environments. The company also wishes to remain cloud agnostic to safeguard against the impact of future changes in cloud strategy.

How can a Solutions Architect design a managed solution that will align with open-source software?

Launch the containers on a fleet of Amazon EC2 instances in a cluster placement group.

Correct answer

Launch the containers on Amazon Elastic Kubernetes Service (EKS) and EKS worker nodes.

Launch the containers on Amazon Elastic Container Service (ECS) with AWS Fargate instances.

Launch the containers on Amazon Elastic Container Service (ECS) with Amazon EC2 instance worker nodes.

Overall explanation

Amazon EKS is a managed service that can be used to run Kubernetes on AWS. Kubernetes is an open-source system for automating the deployment, scaling, and management of containerized applications. Applications running on Amazon EKS are fully compatible with applications running on any standard Kubernetes environment, whether running in on-premises data centers or public clouds. This means that you can easily migrate any standard Kubernetes application to Amazon EKS without any code modification.

This solution ensures that the same open-source software is used for automating the deployment, scaling, and management of containerized applications both on-premises and in the AWS Cloud.

CORRECT: "Launch the containers on Amazon Elastic Kubernetes Service (EKS) and EKS worker nodes" is the correct answer.

INCORRECT: "Launch the containers on a fleet of Amazon EC2 instances in a cluster placement group" is incorrect

INCORRECT: "Launch the containers on Amazon Elastic Container Service (ECS) with AWS Fargate instances" is incorrect

INCORRECT: "Launch the containers on Amazon Elastic Container Service (ECS) with Amazon EC2 instance worker nodes" is incorrect

References:

https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

Domain

AWS Compute

Question 48Skipped

An AWS Organization has an OU with multiple member accounts in it. The company needs to restrict the ability to launch only specific Amazon EC2 instance types. How can this policy be applied across the accounts with the least effort?

Create an IAM policy to deny launching all but the specific instance types

Create an SCP with an allow rule that allows launching the specific instance types

Correct answer

Create an SCP with a deny rule that denies all but the specific instance types

Use AWS Resource Access Manager to control which launch types can be used

Overall explanation

To apply the restrictions across multiple member accounts you must use a Service Control Policy (SCP) in the AWS Organization. The way you would do this is to create a deny rule that applies to anything that does not equal the specific instance type you want to allow.

The following architecture could be used to achieve this goal:

CORRECT: "Create an SCP with a deny rule that denies all but the specific instance types" is the correct answer.

INCORRECT: "Create an SCP with an allow rule that allows launching the specific instance types" is incorrect as a deny rule is required.

INCORRECT: "Create an IAM policy to deny launching all but the specific instance types" is incorrect. With IAM you need to apply the policy within each account rather than centrally so this would require much more effort.

INCORRECT: "Use AWS Resource Access Manager to control which launch types can be used" is incorrect. AWS Resource Access Manager (RAM) is a service that enables you to easily and securely share AWS resources with any AWS account or within your AWS Organization. It is not used for restricting access or permissions.

References:

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_example-scps.html#example-ec2-instances

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-organizations/

Domain

AWS Management & Governance

Question 49Skipped

A company uses an Amazon RDS MySQL database instance to store customer order data. The security team have requested that SSL/TLS encryption in transit must be used for encrypting connections to the database from application servers. The data in the database is currently encrypted at rest using an AWS KMS key.

How can a Solutions Architect enable encryption in transit?

Add a self-signed certificate to the RDS DB instance. Use the certificates in all connections to the RDS DB instance.

Correct answer

Download the AWS-provided root certificates. Use the certificates when connecting to the RDS DB instance.

Enable encryption in transit using the RDS Management console and obtain a key using AWS KMS.

Take a snapshot of the RDS instance. Restore the snapshot to a new instance with encryption in transit enabled.

Overall explanation

Amazon RDS creates an SSL certificate and installs the certificate on the DB instance when Amazon RDS provisions the instance. These certificates are signed by a certificate authority. The SSL certificate includes the DB instance endpoint as the Common Name (CN) for the SSL certificate to guard against spoofing attacks.

You can download a root certificate from AWS that works for all Regions or you can download Region-specific intermediate certificates.

CORRECT: "Download the AWS-provided root certificates. Use the certificates when connecting to the RDS DB instance" is the correct answer.

INCORRECT: "Take a snapshot of the RDS instance. Restore the snapshot to a new instance with encryption in transit enabled" is incorrect. There is no need to do this as a certificate is created when the DB instances is launched.

INCORRECT: "Enable encryption in transit using the RDS Management console and obtain a key using AWS KMS" is incorrect. You cannot enable/disable encryption in transit using the RDS management console or use a KMS key.

INCORRECT: "Add a self-signed certificate to the RDS DB instance. Use the certificates in all connections to the RDS DB instance" is incorrect. You cannot use self-signed certificates with RDS.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

Domain

AWS Database

Question 50Skipped

A retail company operates a multi-tier application that includes a web server layer running on Amazon EC2 instances and a database layer hosted on Amazon RDS. The company is preparing for an annual sales event and anticipates a significant surge in traffic to its application. The operations team wants to monitor the performance of the EC2 instances and database, analyzing metrics with a granularity of 1 minute to ensure quick detection of bottlenecks during the event.

What should the solutions architect do to meet this requirement?

Use AWS Systems Manager to collect logs from the EC2 instances and Amazon RDS. Store the logs in Amazon S3 and use Amazon Athena to query performance data.

Configure an Amazon CloudWatch Events rule to trigger an AWS Lambda function that collects custom metrics from the EC2 instances and Amazon RDS. Use Amazon CloudWatch dashboards to display the metrics.

Configure Amazon CloudWatch Logs Insights to aggregate application logs for both the EC2 instances and Amazon RDS. Use Amazon QuickSight for detailed visualization.

Correct answer

Enable detailed monitoring on all EC2 instances and use Amazon CloudWatch metrics for analysis.

Overall explanation

Enable detailed monitoring on all EC2 instances and use Amazon CloudWatch metrics for analysis: This is the correct solution because detailed monitoring provides metrics at 1-minute intervals, which allows the operations team to quickly detect and analyze potential bottlenecks during the sales event. CloudWatch natively supports metrics for both EC2 and RDS.

Configure Amazon CloudWatch Logs Insights to aggregate application logs for both the EC2 instances and Amazon RDS. Use Amazon QuickSight for detailed visualization: This is incorrect because while Logs Insights is useful for log analysis, it does not directly provide 1-minute metric granularity required for real-time monitoring.

Configure an Amazon CloudWatch Events rule to trigger an AWS Lambda function that collects custom metrics from the EC2 instances and Amazon RDS. Use Amazon CloudWatch dashboards to display the metrics: This is incorrect because using CloudWatch detailed monitoring is a simpler and more efficient solution compared to creating custom metrics with Lambda.

Use AWS Systems Manager to collect logs from the EC2 instances and Amazon RDS. Store the logs in Amazon S3 and use Amazon Athena to query performance data: This is incorrect because this solution is not suitable for real-time monitoring and involves unnecessary operational overhead.

References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch.html
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudwatch/

Domain

AWS Management & Governance

Question 51Skipped

A logistics company is running a containerized application on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with Amazon EC2 instances as the worker nodes. The application includes a management dashboard that uses Amazon DynamoDB for real-time tracking data and a reporting service that stores large datasets in Amazon S3.

The company needs to ensure that the EKS Pods running the management dashboard can access only Amazon DynamoDB, and the EKS Pods running the reporting service can access only Amazon S3. The company uses AWS Identity and Access Management (IAM) for access control.

Which solution will meet these requirements?

Create separate IAM policies for Amazon S3 and DynamoDB access. Attach both policies to the IAM role associated with the EC2 instance profile. Use Kubernetes namespaces to restrict access for the respective Pods to Amazon S3 or DynamoDB.

Correct answer

Create separate IAM roles with policies for Amazon S3 and DynamoDB access. Use Kubernetes service accounts with IAM Role for Service Accounts (IRSA) to assign the AmazonS3FullAccess policy to the reporting service Pods and the AmazonDynamoDBFullAccess policy to the management dashboard Pods.

Create IAM roles with permissions for Amazon S3 and DynamoDB access. Attach the Amazon S3 role to the reporting service Pods and the DynamoDB role to the management dashboard Pods using a shared service account.

Configure role-based access control (RBAC) within Kubernetes to define which Pods can access Amazon S3 and DynamoDB. Use Kubernetes ConfigMaps to store the IAM credentials for each service.

Overall explanation

Create separate IAM roles with policies for Amazon S3 and DynamoDB access. Use Kubernetes service accounts with IAM Role for Service Accounts (IRSA) to assign the AmazonS3FullAccess policy to the reporting service Pods and the AmazonDynamoDBFullAccess policy to the management dashboard Pods: This is correct because IAM Role for Service Accounts (IRSA) allows the assignment of IAM roles directly to Kubernetes service accounts, which the Pods use to assume permissions. This solution enables fine-grained access control, ensuring that the Pods for the management dashboard can access only DynamoDB and the Pods for the reporting service can access only S3.

Create separate IAM policies for Amazon S3 and DynamoDB access. Attach both policies to the IAM role associated with the EC2 instance profile. Use Kubernetes namespaces to restrict access for the respective Pods to Amazon S3 or DynamoDB: This is incorrect because attaching both policies to the EC2 instance profile means all Pods running on the worker nodes would inherit access to both S3 and DynamoDB, violating the requirement for restricted access. Kubernetes namespaces alone do not enforce IAM permissions.

Create IAM roles with permissions for Amazon S3 and DynamoDB access. Attach the Amazon S3 role to the reporting service Pods and the DynamoDB role to the management dashboard Pods using a shared service account: This is incorrect because using a shared service account would not provide sufficient isolation between the Pods. IRSA is the correct mechanism to ensure separate access control for each service.

Configure role-based access control (RBAC) within Kubernetes to define which Pods can access Amazon S3 and DynamoDB. Use Kubernetes ConfigMaps to store the IAM credentials for each service: This is incorrect because storing IAM credentials in ConfigMaps is not a secure practice. Additionally, RBAC in Kubernetes is not designed to enforce access control for AWS services. IRSA is the proper solution for managing IAM permissions at the Pod level.

References:

https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html

https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Compute

Question 52Skipped

A company requires that all AWS IAM user accounts have specific complexity requirements and minimum password length.

How should a Solutions Architect accomplish this?

Correct answer

Set a password policy for the entire AWS account.

Create an IAM policy that enforces the requirements and apply it to all users.

Use an AWS Config rule to enforce the requirements when creating user accounts.

Set a password policy for each IAM user in the AWS account.

Overall explanation

The easiest way to enforce this requirement is to update the password policy that applies to the entire AWS account. When you create or change a password policy, most of the password policy settings are enforced the next time your users change their passwords. However, some of the settings are enforced immediately such as the password expiration period.

CORRECT: "Set a password policy for the entire AWS account" is the correct answer.

INCORRECT: "Set a password policy for each IAM user in the AWS account" is incorrect. There’s no need to set an individual password policy for each user, it will be easier to set the policy for everyone.

INCORRECT: "Create an IAM policy that enforces the requirements and apply it to all users" is incorrect. As there is no specific targeting required it is easier to update the account password policy.

INCORRECT: "Use an AWS Config rule to enforce the requirements when creating user accounts" is incorrect. You cannot use AWS Config to enforce the password requirements at the time of creating a user account.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Security, Identity, & Compliance

Question 53Skipped

A healthcare organization is designing a secure web application in the AWS Cloud for managing patient records. The application must securely retrieve and store multiple patient credentials, including access keys and passwords. The organization wants to use an AWS-managed service to handle these credentials. The solution must minimize operational overhead while ensuring security.

Which solution will meet these requirements with the LEAST operational overhead?

Store the patient credentials in an Amazon S3 bucket. Enable server-side encryption with AWS KMS keys (SSE-KMS). Use pre-signed URLs to retrieve the credentials securely.

Correct answer

Store the patient credentials in AWS Secrets Manager. Use the GetSecretValue API to securely retrieve the credentials in the application at runtime.

Store the patient credentials in AWS Systems Manager Parameter Store. Use the GetParametersByPath API to securely retrieve the credentials in the application at runtime.

Store the patient credentials in an Amazon RDS database table. Encrypt the credentials by using AWS Key Management Service (AWS KMS). Configure the application to query the RDS database to retrieve the credentials.

Overall explanation

Store the patient credentials in AWS Secrets Manager. Use the GetSecretValue API to securely retrieve the credentials in the application at runtime: This is correct because Secrets Manager is designed to securely store and retrieve credentials with minimal operational overhead. It also supports secret rotation and integrates with AWS services for secure runtime access.

Store the patient credentials in AWS Systems Manager Parameter Store. Use the GetParametersByPath API to securely retrieve the credentials in the application at runtime: This is incorrect because although Parameter Store can store credentials, it does not offer native secret rotation, which increases operational overhead.

Store the patient credentials in an Amazon RDS database table. Encrypt the credentials by using AWS Key Management Service (AWS KMS). Configure the application to query the RDS database to retrieve the credentials: This is incorrect because manually managing credentials in an RDS database introduces significant operational complexity and does not offer built-in secret rotation or retrieval mechanisms.

Store the patient credentials in an Amazon S3 bucket. Enable server-side encryption with AWS KMS keys (SSE-KMS). Use pre-signed URLs to retrieve the credentials securely: This is incorrect because S3 is not designed for storing credentials, and managing access via pre-signed URLs increases complexity while not offering features such as secret rotation.

References: https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-secrets-manager/

Domain

AWS Security, Identity, & Compliance

Question 54Skipped

A healthcare organization operates multiple applications on virtual machines (VMs) in its on-premises data center. Due to increasing demand for its services, the data center can no longer scale quickly enough to meet business needs. The organization has decided to migrate its non-critical workloads to AWS using a lift-and-shift strategy to expedite the process.

Which combination of steps will meet these requirements? (Select THREE.)

Install the AWS Systems Manager Agent on the VMs to streamline operational management during migration.

Use AWS App Runner to containerize the workloads before migrating them to AWS.

Use AWS Server Migration Service (AWS SMS) to automate the migration of VMs to Amazon EC2 instances.

Correct selection

Stop all operations on the VMs. Perform a cutover by launching the migrated instances in AWS.

Correct selection

Use AWS Application Migration Service to replicate the VMs to AWS. Install the AWS Replication Agent on each VM.

Correct selection

Complete the initial data replication from the VMs to AWS. Launch test instances to perform acceptance tests for the workloads.

Overall explanation

Use AWS Application Migration Service to replicate the VMs to AWS. Install the AWS Replication Agent on each VM: This is correct because AWS Application Migration Service enables lift-and-shift migrations by replicating VMs from the on-premises data center to AWS. Installing the Replication Agent is the first step to initiate data replication.

Complete the initial data replication from the VMs to AWS. Launch test instances to perform acceptance tests for the workloads: This is correct because testing the replicated workloads ensures the migrated VMs function as expected on AWS before the final cutover.

Stop all operations on the VMs. Perform a cutover by launching the migrated instances in AWS: This is correct because stopping operations ensures a clean cutover process, allowing the organization to launch the migrated instances in AWS with minimal disruption to business operations.

Use AWS Server Migration Service (AWS SMS) to automate the migration of VMs to Amazon EC2 instances: This is incorrect because AWS SMS has been deprecated in favor of AWS Application Migration Service, which provides a more streamlined and modern approach to lift-and-shift migrations.

Install the AWS Systems Manager Agent on the VMs to streamline operational management during migration: This is incorrect because while the Systems Manager Agent is useful for post-migration operations and management, it is not directly involved in the lift-and-shift migration process.

Use AWS App Runner to containerize the workloads before migrating them to AWS: This is incorrect because containerizing workloads introduces additional complexity and does not align with the lift-and-shift strategy described in the scenario.

References:

https://docs.aws.amazon.com/migrationhub/latest/ug/what-is-migrationhub.html
https://docs.aws.amazon.com/mgn/latest/ug/what-is-aws-mgn.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-migration-services/

Domain

AWS Migration & Transfer

Question 55Skipped

A company offers an online product brochure that is delivered from a static website running on Amazon S3. The company’s customers are mainly in the United States, Canada, and Mexico. The company is looking to cost-effectively reduce the latency for users in these regions.

What is the most cost-effective solution to these requirements?

Create an Amazon CloudFront distribution and set the price class to use all Edge Locations for best performance.

Create an Amazon CloudFront distribution and use Lambda@Edge to run the website's data processing closer to the users.

Create an Amazon CloudFront distribution that uses origins in U.S, Canada and Mexico.

Correct answer

Create an Amazon CloudFront distribution and set the price class to use only U.S, Canada and Mexico.

Overall explanation

With Amazon CloudFront you can set the price class to determine where in the world the content will be cached. One of the price classes is “U.S, Canada and Mexico” and this is where the company’s users are located. Choosing this price class will result in lower costs and better performance for the company’s users.

CORRECT: "Create an Amazon CloudFront distribution and set the price class to use only U.S, Canada and Mexico." is the correct answer.

INCORRECT: "Create an Amazon CloudFront distribution and set the price class to use all Edge Locations for best performance" is incorrect. This will be more expensive as it will cache content in Edge Locations all over the world.

INCORRECT: "Create an Amazon CloudFront distribution that uses origins in U.S, Canada and Mexico" is incorrect. The origin can be in one place, there’s no need to add origins in different Regions. The price class should be used to limit the caching of the content to reduce cost.

INCORRECT: "Create an Amazon CloudFront distribution and use Lambda@Edge to run the website's data processing closer to the users" is incorrect. Lambda@Edge will not assist in this situation as there is no data processing required, the content from the static website must simply be cached at an edge location.

References:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PriceClass.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Networking & Content Delivery

Question 56Skipped

There are two applications in a company: a sender application that sends messages containing payloads, and a processing application that receives messages containing payloads. The company wants to implement an AWS service to handle messages between these two different applications. The sender application sends on average 1,000 messages each hour and the messages depending on the type sometimes take up to 2 days to be processed. If the messages fail to process, they must be retained so that they do not impact the processing of any remaining messages.

Which solution meets these requirements and is the MOST operationally efficient?

Set up a Redis database on Amazon EC2. Configure the instance to be used by both applications. The messages should be stored, processed, and deleted, respectively.

Correct answer

Provide an Amazon Simple Queue Service (Amazon SQS) queue for the sender and processor applications. Set up a dead-letter queue to collect failed messages.

Subscribe the processing application to an Amazon Simple Notification Service (Amazon SNS) topic to receive notifications. Write to the SNS topic using the sender application.

Receive the messages from the sender application using an Amazon Kinesis data stream. Utilize the Kinesis Client Library (KCL) to integrate the processing application.

Overall explanation

Amazon Simple Queue Service (SQS) is a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications. SQS eliminates the complexity and overhead associated with managing and operating message-oriented middleware and empowers developers to focus on differentiating work.

CORRECT: "Provide an Amazon Simple Queue Service (Amazon SQS) queue for the sender and processor applications. Set up a dead-letter queue to collect failed messages” is the correct answer (as explained above.)

INCORRECT: "Set up a Redis database on Amazon EC2. Configure the instance to be used by both applications. The messages should be stored, processed, and deleted, respectively” is incorrect, as the most operationally efficient way is to use the managed service Amazon SQS.

INCORRECT: "Receive the messages from the sender application using an Amazon Kinesis data stream. Utilize the Kinesis Client Library (KCL) to integrate the processing application” is incorrect, as the most operationally efficient way is to use the managed service Amazon SQS

INCORRECT: "Subscribe the processing application to an Amazon Simple Notification Service (Amazon SNS) topic to receive notifications. Write to the SNS topic using the sender application” is incorrect as Amazon SNS is not a queuing service, but a pub-sub one to many notification service and cannot be used as a queue.

References:

https://aws.amazon.com/sqs/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 57Skipped

A company runs a critical data analysis job every Friday evening. The job processes large datasets and requires at least 2 hours to complete without interruptions. The job is stateful and needs reliable compute resources. The company wants to minimize operational overhead while ensuring the job runs as scheduled.

Which solution will meet these requirements?

Configure the job to run in an AWS Lambda function with reserved concurrency. Use Amazon EventBridge to invoke the function on a schedule.

Use an Amazon EMR cluster with Spot Instances to process the job. Use Amazon EMR Step Functions to schedule the job execution.

Correct answer

Configure the job as a containerized task and run it on AWS Fargate using Amazon ECS. Schedule the task using Amazon EventBridge Scheduler.

Deploy the job on a dedicated Amazon EC2 On-Demand instance. Use a cron job to schedule the analysis.

Overall explanation

Configure the job as a containerized task and run it on AWS Fargate using Amazon ECS. Schedule the task using Amazon EventBridge Scheduler: This is the best option because AWS Fargate provides a serverless compute engine for containers, ensuring no interruptions. EventBridge Scheduler offers an easy way to schedule tasks without requiring manual intervention.

Configure the job to run in an AWS Lambda function with reserved concurrency. Use Amazon EventBridge to invoke the function on a schedule: This is incorrect because Lambda functions are not suited for stateful, long-running jobs. Lambda has a maximum execution duration of 15 minutes.

Deploy the job on a dedicated Amazon EC2 On-Demand instance. Use a cron job to schedule the analysis: While this solution avoids interruptions, it requires managing and maintaining the EC2 instance, which increases operational overhead.

Use an Amazon EMR cluster with Spot Instances to process the job. Use Amazon EMR Step Functions to schedule the job execution: Spot Instances are not suitable for stateful jobs because they can be interrupted. This approach also introduces additional complexity with EMR setup and management.

References:
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/scheduling_tasks.html
https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-run-lambda-schedule.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

Domain

AWS Compute

Question 58Skipped

A company runs an application in a factory that has a small rack of physical compute resources. The application stores data on a network attached storage (NAS) device using the NFS protocol. The company requires a daily offsite backup of the application data.

Which solution can a Solutions Architect recommend to meet this requirement?

Use an AWS Storage Gateway volume gateway with cached volumes on premises to replicate the data to Amazon S3.

Use an AWS Storage Gateway volume gateway with stored volumes on premises to replicate the data to Amazon S3.

Create an IPSec VPN to AWS and configure the application to mount the Amazon EFS file system. Run a copy job to backup the data to EFS.

Correct answer

Use an AWS Storage Gateway file gateway hardware appliance on premises to replicate the data to Amazon S3.

Overall explanation

The AWS Storage Gateway Hardware Appliance is a physical, standalone, validated server configuration for on-premises deployments. It comes pre-loaded with Storage Gateway software, and provides all the required CPU, memory, network, and SSD cache resources for creating and configuring File Gateway, Volume Gateway, or Tape Gateway.

A file gateway is the correct type of appliance to use for this use case as it is suitable for mounting via the NFS and SMB protocols.

CORRECT: "Use an AWS Storage Gateway file gateway hardware appliance on premises to replicate the data to Amazon S3" is the correct answer.

INCORRECT: "Use an AWS Storage Gateway volume gateway with stored volumes on premises to replicate the data to Amazon S3" is incorrect. Volume gateways are used for block-based storage and this solution requires NFS (file-based storage).

INCORRECT: "Use an AWS Storage Gateway volume gateway with cached volumes on premises to replicate the data to Amazon S3" is incorrect. Volume gateways are used for block-based storage and this solution requires NFS (file-based storage).

INCORRECT: "Create an IPSec VPN to AWS and configure the application to mount the Amazon EFS file system. Run a copy job to backup the data to EFS" is incorrect. It would be better to use a Storage Gateway which will automatically take care of synchronizing a copy of the data to AWS.

References:

https://aws.amazon.com/storagegateway/hardware-appliance/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-storage-gateway/

Domain

AWS Storage

Question 59Skipped

A financial institution is designing the architecture for a new data processing platform on AWS. The institution uses organizational units (OUs) in AWS Organizations to manage its accounts. To comply with regulatory requirements, all Amazon EC2 instances must include a compliance-level tag with values of compliant or noncompliant. IAM users must not be allowed to create EC2 instances without this tag or modify the tag after creation.

Which combination of steps will meet these requirements? (Select TWO.)

Correct selection

In AWS Organizations, create a service control policy (SCP) to deny the creation of EC2 instances if the compliance-level tag is not specified. Attach the SCP to the appropriate OU.

Create an IAM policy that denies the deletion of tags on EC2 instances. Assign this policy to all IAM users who manage EC2 resources in the organization's accounts.

Use AWS Config to check for compliance-level tags on EC2 instances. Configure AWS Config to remediate noncompliant resources by automatically adding the required tags to EC2 instances.

Use AWS Lambda with an EventBridge rule to trigger a function whenever a new EC2 instance is created. Configure the function to terminate any instance that does not include the compliance-level tag with the correct values.

Correct selection

In AWS Organizations, create a tag policy to enforce the use of the compliance-level tag with the required values. Attach the tag policy to the appropriate OU to ensure EC2 instances adhere to the tagging requirements.

Overall explanation

In AWS Organizations, create a service control policy (SCP) to deny the creation of EC2 instances if the compliance-level tag is not specified. Attach the SCP to the appropriate OU: This is correct because SCPs are used to enforce policies across accounts in an organization. By denying the creation of EC2 instances without the required tag, this SCP ensures that all instances are tagged at creation.

In AWS Organizations, create a tag policy to enforce the use of the compliance-level tag with the required values. Attach the tag policy to the appropriate OU to ensure EC2 instances adhere to the tagging requirements: This is correct because tag policies enforce tagging standards for AWS resources. By attaching the tag policy to the OU, you ensure that all EC2 instances follow the defined tagging requirements.

Use AWS Config to check for compliance-level tags on EC2 instances. Configure AWS Config to remediate noncompliant resources by automatically adding the required tags to EC2 instances: This is incorrect because AWS Config cannot prevent resource creation or modification. It can detect noncompliance but requires additional tools like Lambda for remediation, which introduces operational overhead.

Create an IAM policy that denies the deletion of tags on EC2 instances. Assign this policy to all IAM users who manage EC2 resources in the organization's accounts: This is incorrect because IAM policies apply only at the user or role level and cannot enforce organization-wide restrictions. SCPs and tag policies are better suited for this requirement.

Use AWS Lambda with an EventBridge rule to trigger a function whenever a new EC2 instance is created. Configure the function to terminate any instance that does not include the compliance-level tag with the correct values: This is incorrect because using Lambda for real-time remediation introduces operational complexity. SCPs and tag policies are more efficient and simpler to manage.

References:
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies.html
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_tag-policies.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-organizations/

Domain

AWS Management & Governance

Question 60Skipped

A company has developed a non-production application that is composed of multiple microservices for each of the company's business units. A single development team maintains all the microservices. The current architecture uses a static web frontend and a Java-based backend that contains the application logic. The architecture also uses a MySQL database that the company hosts on an Amazon EC2 instance. The company needs to ensure that the application is secure, scalable, and globally available while minimizing operational overhead.

Which solution will meet these requirements?

Correct answer

Use Amazon CloudFront and Amazon S3 to host the static web frontend. Refactor the backend to use AWS Lambda functions that are invoked by Amazon API Gateway. Migrate the database to Amazon Aurora Serverless for auto-scaling.

Use AWS Amplify to host the static web frontend. Refactor the backend microservices to Amazon Elastic Kubernetes Service (Amazon EKS) with auto-scaling. Migrate the database to Amazon RDS for MySQL with a read replica for high availability.

Use Amazon CloudFront and AWS Amplify to host the static web frontend. Refactor the backend to AWS Lambda functions triggered by an EventBridge bus. Migrate the database to an Amazon EC2 Reserved Instance with backups configured on Amazon S3.

Use Amazon CloudFront and Amazon S3 to host the static web frontend. Refactor the backend microservices to run on Amazon ECS on AWS Fargate. Migrate the database to Amazon DynamoDB for auto-scaling and cost optimization.

Overall explanation

Use Amazon CloudFront and Amazon S3 to host the static web frontend. Refactor the backend to use AWS Lambda functions that are invoked by Amazon API Gateway. Migrate the database to Amazon Aurora Serverless for auto-scaling:

This is correct because S3 and CloudFront provide secure, globally available hosting for the static frontend. AWS Lambda and API Gateway eliminate server management, and Aurora Serverless offers a cost-effective, auto-scaling database solution.

Use AWS Amplify to host the static web frontend. Refactor the backend microservices to Amazon Elastic Kubernetes Service (Amazon EKS) with auto-scaling. Migrate the database to Amazon RDS for MySQL with a read replica for high availability:

This is incorrect because using Amazon EKS adds operational complexity. Amplify is better suited for modern full-stack applications, not static web hosting.

Use Amazon CloudFront and Amazon S3 to host the static web frontend. Refactor the backend microservices to run on Amazon ECS on AWS Fargate. Migrate the database to Amazon DynamoDB for auto-scaling and cost optimization:

This is incorrect because moving a relational database to DynamoDB requires a complete redesign, which increases migration complexity and effort.

Use Amazon CloudFront and AWS Amplify to host the static web frontend. Refactor the backend to AWS Lambda functions triggered by an EventBridge bus. Migrate the database to an Amazon EC2 Reserved Instance with backups configured on Amazon S3:

This is incorrect because EventBridge adds unnecessary complexity to trigger Lambda functions. Hosting a database on an EC2 Reserved Instance increases operational overhead compared to managed database services.

References:

https://aws.amazon.com/s3/

https://aws.amazon.com/rds/aurora/serverless/

Domain

AWS Networking & Content Delivery

Question 61Skipped

An Amazon VPC contains several Amazon EC2 instances. The instances need to make API calls to Amazon DynamoDB. A solutions architect needs to ensure that the API calls do not traverse the internet.

How can this be accomplished? (Select TWO.)

Create a VPC peering connection between the VPC and DynamoDB

Create a new DynamoDB table that uses the endpoint

Correct selection

Create a route table entry for the endpoint

Correct selection

Create a gateway endpoint for DynamoDB

Create an ENI for the endpoint in each of the subnets of the VPC

Overall explanation

Amazon DynamoDB and Amazon S3 support gateway endpoints, not interface endpoints. With a gateway endpoint you create the endpoint in the VPC, attach a policy allowing access to the service, and then specify the route table to create a route table entry in.

CORRECT: "Create a route table entry for the endpoint" is a correct answer.

CORRECT: "Create a gateway endpoint for DynamoDB" is also a correct answer.

INCORRECT: "Create a new DynamoDB table that uses the endpoint" is incorrect as it is not necessary to create a new DynamoDB table.

INCORRECT: "Create an ENI for the endpoint in each of the subnets of the VPC" is incorrect as an ENI is used by an interface endpoint, not a gateway endpoint.

INCORRECT: "Create a VPC peering connection between the VPC and DynamoDB" is incorrect as you cannot create a VPC peering connection between a VPC and a public AWS service as public services are outside of VPCs.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/vpce-gateway.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 62Skipped

A Microsoft Windows file server farm uses Distributed File System Replication (DFSR) to synchronize data in an on-premises environment. The infrastructure is being migrated to the AWS Cloud.

Which service should the solutions architect use to replace the file server farm?

Amazon EBS

Amazon EFS

Correct answer

Amazon FSx

AWS Storage Gateway

Overall explanation

Amazon FSx for Windows file server supports DFS namespaces and DFS replication. This is the best solution for replacing the on-premises infrastructure. Note the limitations for deployment:

CORRECT: "Amazon FSx" is the correct answer.

INCORRECT: "Amazon EFS" is incorrect. You cannot replace a Windows file server farm with EFS as it uses a completely different protocol.

INCORRECT: "Amazon EBS" is incorrect. Amazon EBS provides block-based volumes that are attached to EC2 instances. It cannot be used for replacing a shared Windows file server farm using DFSR.

INCORRECT: "AWS Storage Gateway" is incorrect. This service is used for providing cloud storage solutions for on-premises servers. In this case the infrastructure is being migrated into the AWS Cloud.

References:

https://docs.aws.amazon.com/fsx/latest/WindowsGuide/high-availability-multiAZ.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-fsx/

Domain

AWS Storage

Question 63Skipped

An eCommerce company runs an application on Amazon EC2 instances in public and private subnets. The web application runs in a public subnet and the database runs in a private subnet. Both the public and private subnets are in a single Availability Zone.

Which combination of steps should a solutions architect take to provide high availability for this architecture? (Select TWO.)

Create an EC2 Auto Scaling group in the public subnet and use an Application Load Balancer.

Create new public and private subnets in the same AZ but in a different Amazon VPC.

Create new public and private subnets in a different AZ. Create a database using Amazon EC2 in one AZ.

Correct selection

Create an EC2 Auto Scaling group and Application Load Balancer that spans across multiple AZs.

Correct selection

Create new public and private subnets in a different AZ. Migrate the database to an Amazon RDS multi-AZ deployment.

Overall explanation

High availability can be achieved by using multiple Availability Zones within the same VPC. An EC2 Auto Scaling group can then be used to launch web application instances in multiple public subnets across multiple AZs and an ALB can be used to distribute incoming load.

The database solution can be made highly available by migrating from EC2 to Amazon RDS and using a Multi-AZ deployment model. This will provide the ability to failover to another AZ in the event of a failure of the primary database or the AZ in which it runs.

CORRECT: "Create an EC2 Auto Scaling group and Application Load Balancer that spans across multiple AZs" is a correct answer.

CORRECT: "Create new public and private subnets in a different AZ. Migrate the database to an Amazon RDS multi-AZ deployment" is also a correct answer.

INCORRECT: "Create new public and private subnets in the same AZ but in a different Amazon VPC" is incorrect. You cannot use multiple VPCs for this solution as it would be difficult to manage and direct traffic (you can’t load balance across VPCs).

INCORRECT: "Create an EC2 Auto Scaling group in the public subnet and use an Application Load Balancer" is incorrect. This does not achieve HA as you need multiple public subnets across multiple AZs.

INCORRECT: "Create new public and private subnets in a different AZ. Create a database using Amazon EC2 in one AZ" is incorrect. The database solution is not HA in this answer option.

References:

https://aws.amazon.com/ec2/autoscaling/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

https://digitalcloud.training/amazon-rds/

Domain

AWS Database

Question 64Skipped

A financial services company operates multiple internal services across various AWS accounts. The company uses AWS Organizations to manage these accounts and needs a centralized security appliance in a networking account to inspect all inter-service communication between AWS accounts. The solution must ensure secure and efficient routing of traffic through the security appliance.

Which solution will meet these requirements?

Deploy interface VPC endpoints in the networking account for each service in the service accounts. Configure the security appliance to inspect traffic sent through the endpoints.

Deploy a Network Load Balancer (NLB) in the networking account to route traffic to the security appliance. Configure the service accounts to send traffic to the NLB by using a VPC peering connection.

Deploy an Application Load Balancer (ALB) in the networking account to route traffic to the security appliance. Configure the service accounts to send traffic to the ALB by using a private link.

Correct answer

Deploy a Gateway Load Balancer (GWLB) in the networking account to route traffic to the security appliance. Configure the service accounts to send traffic to the GWLB by using a Gateway Load Balancer endpoint in each service account.

Overall explanation

Deploy a Gateway Load Balancer (GWLB) in the networking account to route traffic to the security appliance. Configure the service accounts to send traffic to the GWLB by using a Gateway Load Balancer endpoint in each service account: This is correct because GWLB is specifically designed to simplify the deployment of security appliances. Using GWLB endpoints in service accounts ensures efficient routing and centralized inspection of traffic.

Deploy a Network Load Balancer (NLB) in the networking account to route traffic to the security appliance. Configure the service accounts to send traffic to the NLB by using a VPC peering connection: This is incorrect because NLB is not optimized for traffic inspection. Additionally, VPC peering lacks centralized management and scalability for large organizations.

Deploy an Application Load Balancer (ALB) in the networking account to route traffic to the security appliance. Configure the service accounts to send traffic to the ALB by using a private link: This is incorrect because ALB is primarily used for HTTP/HTTPS-based applications and is not suitable for routing traffic for inspection appliances.

Deploy interface VPC endpoints in the networking account for each service in the service accounts. Configure the security appliance to inspect traffic sent through the endpoints: This is incorrect because interface VPC endpoints do not inherently support routing all traffic through a centralized appliance and lack the capability for deep packet inspection.

References:
https://docs.aws.amazon.com/elasticloadbalancing/latest/gateway/introduction.html
https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-gateway-load-balancer/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Compute

Question 65Skipped

An insurance company has a web application that serves users in the United Kingdom and Australia. The application includes a database tier using a MySQL database hosted in eu-west-2. The web tier runs from eu-west-2 and ap-southeast-2. Amazon Route 53 geoproximity routing is used to direct users to the closest web tier. It has been noted that Australian users receive slow response times to queries.

Which changes should be made to the database tier to improve performance?

Deploy MySQL instances in each Region. Deploy an Application Load Balancer in front of MySQL to reduce the load on the primary instance

Migrate the database to Amazon DynamoDB. Use DynamoDB global tables to enable replication to additional Regions

Correct answer

Migrate the database to an Amazon Aurora global database in MySQL compatibility mode. Configure read replicas in ap-southeast-2

Migrate the database to Amazon RDS for MySQL. Configure Multi-AZ in the Australian Region

Overall explanation

The issue here is latency with read queries being directed from Australia to UK which is great physical distance. A solution is required for improving read performance in Australia.

An Aurora global database consists of one primary AWS Region where your data is mastered, and up to five read-only, secondary AWS Regions. Aurora replicates data to the secondary AWS Regions with typical latency of under a second. You issue write operations directly to the primary DB instance in the primary AWS Region.

This solution will provide better performance for users in the Australia Region for queries. Writes must still take place in the UK Region but read performance will be greatly improved.

CORRECT: "Migrate the database to an Amazon Aurora global database in MySQL compatibility mode. Configure read replicas in ap-southeast-2" is the correct answer.

INCORRECT: "Migrate the database to Amazon RDS for MySQL. Configure Multi-AZ in the Australian Region" is incorrect. The database is located in UK. If the database is migrated to Australia then the reverse problem will occur. Multi-AZ does not assist with improving query performance across Regions.

INCORRECT: "Migrate the database to Amazon DynamoDB. Use DynamoDB global tables to enable replication to additional Regions" is incorrect as a relational database running on MySQL is unlikely to be compatible with DynamoDB.

INCORRECT: "Deploy MySQL instances in each Region. Deploy an Application Load Balancer in front of MySQL to reduce the load on the primary instance" is incorrect as you can only put ALBs in front of the web tier, not the DB tier.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Expanded view

Beta

0 / 10used queries