AWS Certified Solutions Architect Associate Practice Exams

Practice Test 2: AWS Certified Solutions Architect Associate
Open

Practice Test 1: AWS Certified Solutions Architect…

Practice Test 3: AWS Certified Solutions Architect…

Set a certification due date

AWS Certified Solutions Architect – Associate

Course content

AI Assistant

Practice tests

Start

Practice Test 1: AWS Certified Solutions Architect Associate

Start

Start

Practice Test 3: AWS Certified Solutions Architect Associate

Start

Practice Test 4: AWS Certified Solutions Architect Associate

Start

Practice Test 5: AWS Certified Solutions Architect Associate

Start

Practice Test 6: AWS Certified Solutions Architect Associate

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

2025 AWS Certified Solutions Architect Associate Practice Tests [SAA-C03] + Exam Simulator + Explanations + Cheat Sheets

Rating: 4.5 out of 54.5
12,930 ratings

117,520

Students

390 questions

Total

Last updated May 2025

English

What you'll learn

ASSESS YOUR EXAM READINESS: Pass the AWS Certified Solutions Architect Associate exam the first time with a great score

EXAM SIMULATION: All Practice Tests are timed and scored (passing score is 72%) mimicking the real exam environment

DETAILED EXPLANATIONS: Every question includes a detailed explanation that describes why each answer is correct or incorrect

REFERENCE LINKS: To help you understand AWS concepts, all answers link to sections of our online Training Notes (Cheat Sheets) with exam-specific information

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized to ensure you're learning and not memorizing

ALWAYS UP TO DATE: Covering the latest SAA-C03 exam blueprint, our question bank is constantly updated based on student feedback from the real exam

MASTER THE CLOUD: Learn how to answer challenging scenario-based questions

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

ACTIVE Q&A FORUM: Our discussion board provides a platform for students to ask questions, share their recent exam experiences, and offer feedback on exam topics

RESPONSIVE SUPPORT: Our team of AWS experts respond to all of your questions, concerns or feedback

BEST VALUE FOR MONEY: Our practice exams offer the best value for your money with lifetime access - including all future updates at no extra cost

Show moreShow less

Description

Are you preparing for the AWS Certified Solutions Architect Associate exam and want to ensure you're fully ready to pass your AWS certification exam on your first attempt? Look no further than these high-quality AWS Solutions Architect Associate practice exams to assess your exam-readiness!

These 6 AWS practice tests accurately reflect the difficulty of the Amazon Web Services exam questions and are the most realistic AWS exam experience available on Udemy, as demonstrated by the fantastic reviews from thousands of happy students. With our comprehensive AWS certification training course, you'll be well-equipped to pass your AWS Solutions Architect exam with flying colors.

If you're looking for easy-to-pass questions, our Amazon AWS practice tests may not be for you. Our students love these high-quality practice tests because they simulate the actual certification exam and help them get a better understanding of AWS concepts.

Don't just take our word for it – check out our reviews, which confirm that our AWS practice questions closely match the exam pattern and difficulty. These practice tests will prepare you thoroughly for the real exam giving you the confidence you need to take and pass the test!

This SAA-C03 practice test course includes:

390 exam-style questions with detailed answers and explanations to reinforce your understanding of the core concepts

Test report that highlights the areas you need to focus on

Regular updates to reflect the latest exam content

Realistic exam simulation to help you build confidence in your ability to pass your exam

Free bonus material to help you succeed in your exam

TOP REASONS WHY THESE PRACTICE EXAMS ARE THE KEY TO ACING YOUR AWS EXAM

100% ALIGNED WITH SAA-C03 EXAM: All practice tests are 100% scenario-based reflecting the current AWS exam question/answer format (1 answer from 4 options, or 2 or more answers from 5 or more options)

SIMULATE THE REAL CERTIFICATION EXAM: Practice tests are timed (130 min to answer 65 questions) and scored (passing score is 72%) accurately mirroring the real exam environment. This allows you to become familiar with the AWS exam format

DEEP DIVE REFERENCE LINKS: Our practice tests offer more than just answers – they link to relevant sections of our online "Training Notes," providing you with a comprehensive collection of exam-specific information for the SAA-C03 exam

DETAILED EXPLANATIONS FOR ALL ANSWERS: Once you complete our practice tests, you'll have the opportunity to review and check your answers. Each question includes a detailed explanation that describes why each answer is either correct or incorrect, supporting your understanding of AWS Services which is key to passing the exam

REGULAR UPDATES: We are constantly improving and updating our questions based on exam feedback from thousands of our students. As a result, most of our students achieve exceptional results, with an average exam score of over 85%

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized, making it more challenging to ensure you're learning and not memorizing

TEST REPORT: Upon completion of the practice test, you'll receive a comprehensive report that provides insight into your progress and highlights the AWS knowledge areas you need to focus on the most in your studies

ADDITIONAL LEARNING RESOURCES: To help you succeed in your exam, we've included free learning material (optional, requires name/email) that complements the course content

RESPONSIVE SUPPORT: All of your questions, concerns, and feedback will be comprehensively addressed by our team of AWS experts

ACTIVE Q&A DISCUSSION BOARD: Participate in AWS-related discussions on our Q&A discussion board, where our students share their exam experiences and offer valuable feedback on the topics covered

BEST VALUE FOR MONEY: When investing in these tests you get lifetime access to all 6 sets of practice questions

MOBILE ACCESS: Study on the go and access all practice questions from your mobile phone - anywhere, anytime

MONEY-BACK GUARANTEE: 30-day money-back guarantee - no questions asked

WHAT DO OTHER STUDENTS SAY?

Our practice tests are widely regarded as the best, providing you with the preparation you need to confidently pass your AWS Certified Solutions Architect Associate exam with a great score. But don't just take our word for it – check out the excellent course reviews from our happy students, who achieved an average passing score of over 850!

"Well Crafted Questionnaire material, which will help you to gain the confidence on taking the exam. I greatly recommend anyone to take this practice text before appearing for the exam."

"Just passed the exam with a surprisingly good score and found that these practice exams were very helpful. I tried some other courses too but these questions were most similar to the AWS exam and the free training notes on the website were invaluable."

"I've never worked in architecture before and had very little experience in AWS. However, I was able to pass the CSAA exam with 92%, and I have to say that most of the credit goes to these practice exams. If you only buy one practice course, make it this one. I can't recommend it enough."

HOW TO BEST PREPARE FOR YOUR AWS CERTIFICATION EXAM

KEY TRAINING ADVICE: While the actual AWS exam has a passing score of 72%, we recommend that you retake our AWS practice exams until you consistently score 80% or higher. It's important to put in the effort and study the online training notes in detail. Once you achieve the recommended score in our practice tests, you'll be well-prepared to sit the AWS exam and achieve a remarkable score.

COVERING AWS FUNDAMENTALS: Through our AWS practice exams and online training notes, we cover the fundamentals of AWS Architecture and how to create performant, cost-optimized, and fault-tolerant applications. We also deep dive into individual services including Amazon S3, Amazon CloudFront, Amazon Storage Gateway, Amazon EC2, Amazon ECS, AWS IAM, AWS Lambda, Amazon RDS, Route 53, DynamoDB, RedShift, ElastiCache, Amazon Aurora, VPC, SQS, SNS, SWF, ElasticTranscoder, Amazon Kinesis, API Gateway, Direct Connect, Snowball, CloudWatch, CloudTrail and many more.

UNDERSTANDING AWS ARCHITECTURE: The AWS Certified Solutions Architect Associate exam consists entirely of scenario-based questions that assess your knowledge and experience with Amazon Web Services. Knowing the correct use of a particular AWS service and understanding the cost, operational, security, and performance implications of different design choices are essential for success. Our AWS practice exams are specifically designed to help beginners master these concepts and answer these questions accurately.

GET FAMILIAR WITH AWS EXAM FORMAT: Our AWS Certified Solutions Architect Associate practice exams help you get familiar with the test question format and structure, giving you an edge in the actual AWS exam. While many practice tests in the market do not match the exam pattern format, you can trust that our practice tests will thoroughly prepare you for the real AWS exam.

DEEPEN YOUR KNOWLEDGE: It's important to note that while our AWS practice exams match the style and pattern of the actual exam, they are not brain dumps. Simply memorizing answers will not prepare you for the real AWS certification exam. Instead, we recommend using our AWS Solutions Architect practice exams to deepen your understanding which will give you the best chance of passing your exam no matter what questions you encounter on exam day.

COMPETITIVE ADVANTAGE: These days, most IT roles require AWS training and certification, as Amazon Web Services has become the leading provider of cloud computing services. Our AWS practice tests and supporting training resources are designed to give you a competitive edge and help you pass your AWS Certified Solutions Architect certification exam with confidence.

YOUR INSTRUCTOR

Hi, I'm Neal Davis, and I'm delighted to be your instructor for this course. As the founder of Digital Cloud Training, I'm deeply committed to providing top-quality AWS certification training resources. I created these practice tests to help you excel in your AWS exam and achieve your professional goals. With over 20 years of hands-on experience in the Cloud space, I'm excited to share my expertise with you on Udemy.

OUR SUCCESS IN NUMBERS

Over 750,000 students enrolled in our AWS courses on Udemy

4.7-star instructor rating from over 150,000 reviews

Our students pass the AWS exam with an average score of over 85%

Watch the intro video to find out why students choose Digital Cloud Training to fast-track their exam success!

MONEY-BACK GUARANTEE

We are totally confident in the value of our practice exams which come with a 30-day unconditional money-back guarantee. To fast-track your AWS exam success - get lifetime access now - risk-free!

Who this course is for:

Students preparing for the AWS Certified Solutions Architect - Associate exam [SAA-C03]

Candidates for the AWS Certified Solutions Architect - Associate exam who are keen to ace their exam the first time

Students who have completed the AWS Certified Solutions Architect Associate video course from Neal Davis and are looking for some final test preparation

Students who wish to evaluate their AWS exam readiness by testing their skills through an exam simulation

Anyone who wants to learn AWS through high-quality questions and answers, in-depth explanations, and helpful reference links

IT professionals who want to enter any AWS technical job interview with confidence

Anyone who is keen to take their career and salary to the next level with an AWS Certification

Show moreShow less

Instructors

Neal Davis | AWS Certified Solutions Architect & Developer

AWS Solutions Architect & AWS Certified Instructor

Hi, my name's Neal. I am the founder of Digital Cloud Training, a highly experienced AWS Cloud Solutions Architect and a successful IT instructor. I've been working in IT for over 20 years in a variety of roles ranging from support to architecture. Over the last 15 years, I have mainly worked as a Solutions Architect in the systems integration space designing solutions for enterprise organizations.

My experience in IT has included working with virtualization and cloud computing since it's inception. In my most recent consulting role I worked as an Enterprise Architect designing Hybrid IT and Digital Transformation solutions.

I have always enjoyed earning IT certifications and they have helped me immensely with moving upwards throughout my career. These days, my passion is to help others to achieve their career goals through in-depth AWS certification training resources.

That's why I started digitalcloud.training - to provide certification training resources for Amazon Web Services (AWS) certifications that represent a higher quality standard than is otherwise available in the market.

Connect with me on Facebook, LinkedIn, Youtube or Twitter.

Show moreShow less

Digital Cloud Training | AWS Certified Cloud Practitioner AWS Certified Solutions Architect, AWS Developer Associate

Highest Quality AWS Certification Exam Preparation Resources

Digital Cloud Training provides AWS Certification exam preparation resources including instructor-led Video Courses, guided Hands-on Labs, in-depth Training Notes, Exam-Cram lessons for quick revision, Quizzes to test your knowledge and exam-difficulty Practice Exams to assess your exam readiness.

We strive to provide the highest quality AWS Training Resources that ensure our students are best prepared to pass their AWS exams first time, every time!

With Digital Cloud Training, you get access to highly experienced staff who support you on your AWS Certification journey and help you elevate your career through achieving highly valuable certifications.

Show moreShow less

Featured review

Vijay Srinivas V.

6 courses

4 reviews

Rating: 5.0 out of 5 4 years ago

Good to take the practice tests, I had taken Neals tests which instills much confidence and he covers all the topics with detail explanation and especially for the Load Balancing/VPC related with very clear picture explanation which makes people understand the practical scenarios very much. Sincere Thanks! Vijay

Show moreShow less

Was this review helpful?

See all reviews (12,930)

Requirements

Before assessing your exam readiness, we highly recommend completing the AWS Certified Solutions Architect - Associate video course by Neal Davis. These instructor-led video lectures from Digital Cloud Training build the solid knowledge foundation preparing students for the final step of their AWS certification journey

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Practice Test 2: AWS Certified Solutions Architect Associate

AWS Certified Solutions Architect Associate - Results

Back to result overview
Attempt 2

All domains

All domains

AWS Analytics

AWS Networking & Content Delivery

AWS Migration & Transfer

AWS Security, Identity, & Compliance

AWS Compute

AWS Storage

AWS Database

AWS Application Integration

65 all

0 correct

0 incorrect

65 skipped

0 marked

Collapse all questions

Question 1Skipped

A media company operates an on-premises analytics platform to collect streaming data from video playback devices. The platform provides near real-time insights into user engagement and content performance. The company wants to migrate the platform to AWS and use an AWS-native solution for data ingestion, storage, search, and visualization.

Which solution will meet these requirements?

Correct answer

Use Amazon Kinesis Data Streams to ingest the data streams and process the data with AWS Lambda. Store the data in Amazon OpenSearch Service for search and analysis. Use Amazon Managed Grafana to create visual dashboards.

Use Amazon EC2 instances to ingest and process the data streams into Amazon S3 buckets for storage. Use AWS Glue to catalog the data and Amazon Athena to perform searches. Use Amazon QuickSight to create visualizations.

Use Amazon EMR to process the data streams and store the data in Amazon DynamoDB. Use DynamoDB queries for searching and Amazon CloudWatch to create graphical dashboards.

Use Amazon MSK (Managed Streaming for Apache Kafka) to ingest the data streams. Store the data in Amazon Redshift for analysis. Use Redshift Spectrum for advanced querying and Amazon QuickSight to create visual dashboards.

Overall explanation

Use Amazon Kinesis Data Streams to ingest the data streams and process the data with AWS Lambda. Store the data in Amazon OpenSearch Service for search and analysis. Use Amazon Managed Grafana to create visual dashboards: This is correct because Kinesis Data Streams is designed for real-time data ingestion. OpenSearch Service supports full-text search and analytics, while Managed Grafana provides dynamic dashboards for visualization.

Use Amazon EC2 instances to ingest and process the data streams into Amazon S3 buckets for storage. Use AWS Glue to catalog the data and Amazon Athena to perform searches. Use Amazon QuickSight to create visualizations: This is incorrect because EC2-based ingestion increases operational overhead and does not leverage AWS-native streaming capabilities like Kinesis. Athena is not ideal for near real-time analytics.

Use Amazon EMR to process the data streams and store the data in Amazon DynamoDB. Use DynamoDB queries for searching and Amazon CloudWatch to create graphical dashboards: This is incorrect because EMR is primarily used for large-scale data processing, not real-time streaming. Additionally, DynamoDB is not a search engine and is not well-suited for the type of search and analysis required in this use case.

Use Amazon MSK (Managed Streaming for Apache Kafka) to ingest the data streams. Store the data in Amazon Redshift for analysis. Use Redshift Spectrum for advanced querying and Amazon QuickSight to create visual dashboards: This is incorrect because while MSK is a suitable option for data ingestion, Redshift is designed for batch analytics, not real-time streaming analytics.

References:
https://docs.aws.amazon.com/kinesis/index.html
https://docs.aws.amazon.com/opensearch-service/latest/developerguide/what-is.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-kinesis/

Domain

AWS Analytics

Question 2Skipped

A company hosts a website on Amazon EC2 instances behind an Application Load Balancer (ALB). The website serves static content. Website traffic is increasing. The company wants to minimize the website hosting costs.

Which solution will meet these requirements?

Move the website to AWS Amplify. Configure an ALB to resolve to the Amplify website.

Correct answer

Move the website to an Amazon S3 bucket. Configure an Amazon CloudFront distribution for the S3 bucket.

Move the website to AWS Amplify. Configure EC2 instances to cache the website.

Move the website to an Amazon S3 bucket. Configure an Amazon ElastiCache cluster for the S3 bucket.

Overall explanation

Move the website to an Amazon S3 bucket. Configure an Amazon CloudFront distribution for the S3 bucket: This is correct because Amazon S3 is cost-effective for serving static content. Adding CloudFront ensures global content delivery with reduced latency and caching, which minimizes hosting costs.
Move the website to an Amazon S3 bucket. Configure an Amazon ElastiCache cluster for the S3 bucket: This is incorrect because ElastiCache is designed for in-memory data storage and retrieval, not for optimizing S3 access for static content.
Move the website to AWS Amplify. Configure an ALB to resolve to the Amplify website: This is incorrect because Amplify is already a fully managed service that does not require an ALB for static websites.
Move the website to AWS Amplify. Configure EC2 instances to cache the website: This is incorrect because using EC2 instances for caching introduces unnecessary complexity and cost for a static website.

References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Networking & Content Delivery

Question 3Skipped

A retail company is migrating its supply chain application to Amazon Elastic Kubernetes Service (Amazon EKS). The company requires pods in the EKS cluster to use custom subnets in its existing VPC. Additionally, the pods must securely communicate with other resources within the VPC, while adhering to compliance requirements.

Which solution will meet these requirements?

Correct answer

Use the Amazon VPC CNI plugin for Kubernetes. Configure the custom subnets in the VPC and associate the subnets with the EKS cluster to allow pods to use them.

Define Kubernetes network policies that enforce pod placement on specific nodes residing in the custom subnets within the VPC.

Set up AWS Transit Gateway to manage the routing between custom subnets and the EKS pods for secure communication within the VPC.

Configure an AWS Site-to-Site VPN between the custom subnets and the EKS cluster to enable secure communication for the pods.

Overall explanation

Use the Amazon VPC CNI plugin for Kubernetes. Configure the custom subnets in the VPC and associate the subnets with the EKS cluster to allow pods to use them: This is correct because the Amazon VPC CNI plugin allows EKS pods to receive IP addresses from the specified custom subnets within the VPC. This ensures that the pods can securely communicate with other resources in the VPC.

Set up AWS Transit Gateway to manage the routing between custom subnets and the EKS pods for secure communication within the VPC: This is incorrect because AWS Transit Gateway is primarily used for connecting multiple VPCs or on-premises networks. It is not needed for pod-level subnet configuration within a single VPC.

Configure an AWS Site-to-Site VPN between the custom subnets and the EKS cluster to enable secure communication for the pods: This is incorrect because the VPC and EKS cluster are already within the same AWS environment, and a VPN is unnecessary for communication within the same VPC.

Define Kubernetes network policies that enforce pod placement on specific nodes residing in the custom subnets within the VPC: This is incorrect because Kubernetes network policies are used to control traffic flow between pods, not to configure subnet usage for pods.

References:
https://docs.aws.amazon.com/eks/latest/userguide/pod-networking.html
https://aws.amazon.com/blogs/containers/introducing-eks-vpc-cni-custom-network-configuration/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 4Skipped

A solutions architect is required to move 750 TB of data from a branch office's network-attached file system to Amazon S3 Glacier. The branch office’s internet connection is poor, and the solution must not saturate the connection. Normal business traffic loads must not be affected by the migration.

What is the MOST cost-effective solution?

Correct answer

Order 10 AWS Snowball appliances and select an Amazon S3 bucket as the destination. Create a lifecycle policy to transition the S3 objects to Amazon S3 Glacier.

Copy the files directly from the network-attached file system to Amazon S3. Build a lifecycle policy to move the S3 objects across storage classes into Amazon S3 Glacier.

Order 10 AWS Snowball appliances and point these appliances to an S3 Glacier vault and put in place a bucket policy which will only allow access via a VPC endpoint.

Create a site-to-site VPN connection directly to an Amazon S3 bucket, Enforce the connection with an VPC Endpoint.

Overall explanation

The AWS Snow Family consists of several physical devices which can be used for edge computing, and to migrate large amounts of data into Amazon S3.

The process for using AWS Snowball is as follows:

The solutions architect will need 10 Snowball devices to fulfill the capacity required in this instance as each Snowball contains up to 80TB of usable storage.

CORRECT: "Order 10 AWS Snowball appliances and select an Amazon S3 bucket as the destination. Create a lifecycle policy to transition the S3 objects to Amazon S3 Glacier” is the correct answer (as explained above.)

INCORRECT: "Create a site-to-site VPN connection directly to an Amazon S3 bucket, Enforce the connection with an VPC Endpoint" is incorrect, as although this would achieve the solution, it would be using the branch’s internet connection and would saturate it - preventing normal business activities from taking place.

INCORRECT: "Order 10 AWS Snowball appliances and point these appliances to an S3 Glacier vault and put in place a bucket policy which will only allow access via a VPC endpoint" is incorrect as S3 Glacier is not a viable destination for Snowball, and you need to place it into S3 Standard first then transition the data in Glacier after the fact.

INCORRECT: "Copy the files directly from the network-attached file system to Amazon S3. Build a lifecycle policy to move the S3 objects across storage classes into Amazon S3 Glacier" is incorrect. It is not possible to mount third-party NAS appliance to an S3 bucket. You could use a service like AWS DataSync to move data from the network attached file system into S3, however this would still be traveling over the branch’s internet line.

References:

https://aws.amazon.com/snowball/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-migration-services/

Domain

AWS Migration & Transfer

Question 5Skipped

A company runs workloads in the AWS Cloud and wants to consolidate and analyze security-related information to enhance workload protection. The company needs a solution that simplifies the collection and centralization of security data across multiple AWS accounts and Regions with minimal development effort.

Which solution will meet these requirements with the LEAST development effort?

Create a custom Lambda function to fetch security data in JSON format and store it in Amazon S3 for further analysis.

Use AWS Glue crawlers to extract and catalog security data into an AWS Lake Formation-managed data lake.

Correct answer

Configure Amazon Security Lake to automatically collect, normalize, and store security data in Amazon S3 for analysis.

Deploy an Amazon RDS cluster and use AWS Database Migration Service (AWS DMS) to load security data from multiple sources.

Overall explanation

Configure Amazon Security Lake to automatically collect, normalize, and store security data in Amazon S3 for analysis: This is the best solution because Amazon Security Lake is purpose-built for centralizing security data. It minimizes development effort by automatically collecting and formatting data into the Open Cybersecurity Schema Framework (OCSF) for analysis.

Use AWS Glue crawlers to extract and catalog security data into an AWS Lake Formation-managed data lake: While this approach helps create a centralized data lake, it requires more development effort to set up the data ingestion pipelines and manage the schema.

Deploy an Amazon RDS cluster and use AWS Database Migration Service (AWS DMS) to load security data from multiple sources: This is incorrect because DMS is not designed for collecting and normalizing security data. Setting up RDS for this use case introduces unnecessary complexity.

Create a custom Lambda function to fetch security data in JSON format and store it in Amazon S3 for further analysis: While possible, this solution requires custom development and ongoing maintenance, making it less efficient than using a managed service like Amazon Security Lake.

References:
https://aws.amazon.com/security-lake
https://docs.aws.amazon.com/security-lake/latest/userguide/what-is-security-lake.html

Domain

AWS Security, Identity, & Compliance

Question 6Skipped

An Amazon EC2 instance runs in a VPC network, and the network must be secured by a solutions architect. The EC2 instances contain highly sensitive data and have been launched in private subnets. Company policy restricts EC2 instances that run in the VPC from accessing the internet. The instances need to access the software repositories using a third-party URL to download and install software product updates. All other internet traffic must be blocked, with no exceptions.

Which solution meets these requirements?

Place an Application Load Balancer in front of your EC2 instances. Direct all outbound traffic to the ALB. For outbound access to the internet, use a URL-based rule listener in the ALB's target group.

Create an AWS WAF web ACL. Filter traffic requests based on source and destination IP address ranges with custom rules.

Correct answer

Configure the route table for the private subnet so that it routes the outbound traffic to an AWS Network Firewall firewall then configure domain list rule groups.

Establish strict inbound rules for your security groups. Specify the URLs of the authorized software repositories on the internet in your outbound rule.

Overall explanation

The AWS Network Firewall is a managed service that makes it easy to deploy essential network protections for all your Amazon Virtual Private Clouds, and you can then use domain list rules to block HTTP or HTTPS traffic to domains identified as low-reputation, or that are known or suspected to be associated with malware or botnets.

CORRECT: "Configure the route table for the private subnet so that it routes the outbound traffic to an AWS Network Firewall firewall then configure domain list rule groups" is the correct answer (as explained above.)

INCORRECT: "Create an AWS WAF web ACL. Filter traffic requests based on source and destination IP address ranges with custom rules" is incorrect. AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits and bots that may affect availability, compromise security, or consume excessive resources. It is designed to protect your applications from malicious traffic, not your VPC.

INCORRECT: "Establish strict inbound rules for your security groups. Specify the URLs of the authorized software repositories on the internet in your outbound rule" is incorrect. You cannot specify URLs in security group rules so this would not work.

INCORRECT: "Place an Application Load Balancer in front of your EC2 instances. Direct all outbound traffic to the ALB. For outbound access to the internet, use a URL-based rule listener in the ALB's target group" is incorrect. The ALB would not work as this sits within the VPC and is unable to control traffic entering and leaving the VPC itself.

References:

https://aws.amazon.com/network-firewall/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 7Skipped

A web application is deployed in multiple regions behind an ELB Application Load Balancer. You need deterministic routing to the closest region and automatic failover. Traffic should traverse the AWS global network for consistent performance.

How can this be achieved?

Correct answer

Configure AWS Global Accelerator and configure the ALBs as targets

Create a Route 53 Alias record for each ALB and configure a latency-based routing policy

Place an EC2 Proxy in front of the ALB and configure automatic failover

Use a CloudFront distribution with multiple custom origins in each region and configure for high availability

Overall explanation

AWS Global Accelerator is a service that improves the availability and performance of applications with local or global users. You can configure the ALB as a target and Global Accelerator will automatically route users to the closest point of presence.

Failover is automatic and does not rely on any client side cache changes as the IP addresses for Global Accelerator are static anycast addresses. Global Accelerator also uses the AWS global network which ensures consistent performance.

CORRECT: "Configure AWS Global Accelerator and configure the ALBs as targets" is the correct answer.

INCORRECT: "Place an EC2 Proxy in front of the ALB and configure automatic failover" is incorrect. Placing an EC2 proxy in front of the ALB does not meet the requirements. This solution does not ensure deterministic routing the closest region and failover is happening within a region which does not protect against regional failure. Also, this introduces a potential bottleneck and lack of redundancy.

INCORRECT: "Create a Route 53 Alias record for each ALB and configure a latency-based routing policy" is incorrect. A Route 53 Alias record for each ALB with latency-based routing does provide routing based on latency and failover. However, the traffic will not traverse the AWS global network.

INCORRECT: "Use a CloudFront distribution with multiple custom origins in each region and configure for high availability" is incorrect. You can use CloudFront with multiple custom origins and configure for HA. However, the traffic will not traverse the AWS global network.

References:

https://aws.amazon.com/global-accelerator/

https://aws.amazon.com/global-accelerator/faqs/

https://docs.aws.amazon.com/global-accelerator/latest/dg/what-is-global-accelerator.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-global-accelerator/

Domain

AWS Networking & Content Delivery

Question 8Skipped

A multi-tier application runs with eight front-end web servers in an Amazon EC2 Auto Scaling group in a single Availability Zone behind an Application Load Balancer. A solutions architect needs to modify the infrastructure to be highly available without modifying the application.

Which architecture should the solutions architect choose that provides high availability?

Create an Auto Scaling template that can be used to quickly create more instances in another Region

Create an Auto Scaling group that uses four instances across each of two subnets

Create an Auto Scaling group that uses four instances across each of two Regions

Correct answer

Modify the Auto Scaling group to use four instances across each of two Availability Zones

Overall explanation

High availability can be enabled for this architecture quite simply by modifying the existing Auto Scaling group to use multiple availability zones. The ASG will automatically balance the load so you don’t actually need to specify the instances per AZ.

The architecture for the web tier will look like the one below:

CORRECT: "Modify the Auto Scaling group to use four instances across each of two Availability Zones" is the correct answer.

INCORRECT: "Create an Auto Scaling group that uses four instances across each of two Regions" is incorrect as EC2 Auto Scaling does not support multiple regions.

INCORRECT: "Create an Auto Scaling template that can be used to quickly create more instances in another Region" is incorrect as EC2 Auto Scaling does not support multiple regions.

INCORRECT: "Create an Auto Scaling group that uses four instances across each of two subnets" is incorrect as the subnets could be in the same AZ.

References:

https://aws.amazon.com/ec2/autoscaling/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 9Skipped

A website runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The website’s DNS records are hosted in Amazon Route 53 with the domain name pointing to the ALB. A solution is required for displaying a static error page if the website becomes unavailable.

Which configuration should a solutions architect use to meet these requirements with the LEAST operational overhead?

Create a Route 53 weighted routing policy. Create a static website using an Amazon S3 bucket that hosts a static error page. Configure the record for the S3 static website with a weighting of zero. When an issue occurs increase the weighting

Set up a Route 53 active-active configuration with the ALB and an Amazon EC2 instance hosting a static error page as endpoints. Route 53 will only send requests to the instance if the health checks fail for the ALB

Create a Route 53 active-passive failover configuration. Create a static website using an Amazon S3 bucket that hosts a static error page. Configure the static website as the passive record for failover

Correct answer

Create a Route 53 alias record for an Amazon CloudFront distribution and specify the ALB as the origin. Create custom error pages for the distribution

Overall explanation

Using Amazon CloudFront as the front-end provides the option to specify a custom message instead of the default message. To specify the specific file that you want to return and the errors for which the file should be returned, you update your CloudFront distribution to specify those values.

For example, the following is a customized error message:

The CloudFront distribution can use the ALB as the origin, which will cause the website content to be cached on the CloudFront edge caches.

This solution represents the most operationally efficient choice as no action is required in the event of an issue, other than troubleshooting the root cause.

CORRECT: "Create a Route 53 alias record for an Amazon CloudFront distribution and specify the ALB as the origin. Create custom error pages for the distribution" is the correct answer.

INCORRECT: "Create a Route 53 active-passive failover configuration. Create a static website using an Amazon S3 bucket that hosts a static error page. Configure the static website as the passive record for failover" is incorrect. This option does not represent the lowest operational overhead as manual intervention would be required to cause a fail-back to the main website.

INCORRECT: "Create a Route 53 weighted routing policy. Create a static website using an Amazon S3 bucket that hosts a static error page. Configure the record for the S3 static website with a weighting of zero. When an issue occurs increase the weighting" is incorrect. This option requires manual intervention and there would be a delay from the issue arising before an administrative action could make the changes.

INCORRECT: "Set up a Route 53 active-active configuration with the ALB and an Amazon EC2 instance hosting a static error page as endpoints. Route 53 will only send requests to the instance if the health checks fail for the ALB" is incorrect. With an active-active configuration traffic would be split between the website and the error page.

References:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/custom-error-pages.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Networking & Content Delivery

Question 10Skipped

A web application that allows users to upload and share documents is running on a single Amazon EC2 instance with an Amazon EBS volume. To increase availability the architecture has been updated to use an Auto Scaling group of several instances across Availability Zones behind an Application Load Balancer. After the change users can only see a subset of the documents.

What is the BEST method for a solutions architect to modify the solution so users can see all documents?

Use Sticky Sessions with the ALB to ensure users are directed to the same EC2 instance in a session

Configure the Application Load Balancer to send the request to all servers. Return each document from the correct server

Run a script to synchronize the data between Amazon EBS volumes

Correct answer

Copy the data from all EBS volumes to Amazon EFS. Modify the application to save new documents to Amazon EFS

Overall explanation

The problem that is being described is that the users are uploading the documents to an individual EC2 instance with a local EBS volume. Therefore, as EBS volumes cannot be shared across AZs, the data is stored separately and the ALB will be distributing incoming connections to different instances / data sets.

The simple resolution is to implement a shared storage layer for the documents so that they can be stored in one place and seen by any user who connects no matter which instance they connect to.

CORRECT: "Copy the data from all EBS volumes to Amazon EFS. Modify the application to save new documents to Amazon EFS" is the correct answer.

INCORRECT: "Run a script to synchronize the data between Amazon EBS volumes" is incorrect. This is a complex and messy approach. A better solution is to use a shared storage layer.

INCORRECT: "Use Sticky Sessions with the ALB to ensure users are directed to the same EC2 instance in a session" is incorrect as this will just “stick” a user to the same instance. They won’t see documents uploaded to other instances / EBS volumes.

INCORRECT: "Configure the Application Load Balancer to send the request to all servers. Return each document from the correct server" is incorrect as there is no mechanism here for selecting a specific document. The requirement also requests that all documents are visible.

References:

https://docs.aws.amazon.com/efs/latest/ug/how-it-works.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-efs/

Domain

AWS Storage

Question 11Skipped

To accelerate experimentation and agility, a company allows developers to apply existing IAM policies to existing IAM roles. Nevertheless, the security operations team is concerned that the developers could attach the existing administrator policy, circumventing any other security policies.

How should a solutions architect address this issue?

Assign all IAM duties to the security operations team and prevent developers from attaching policies.

Disable IAM activity across all organizational accounts using service control policies.

Correct answer

Set a permissions boundary on the developer IAM role that denies attaching administrator access.

Send an alert every time a developer creates a new policy using an Amazon SNS topic.

Overall explanation

Setting a permissions boundary is the easiest and safest way to ensure that any IAM users cannot assume any elevated permissions. A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. An entity's permissions boundary allows it to perform only the actions that are allowed by both its identity-based policies and its permissions boundaries.

CORRECT: "Set a permissions boundary on the developer IAM role that denies attaching administrator access" is the correct answer (as explained above.)

INCORRECT: "Send an alert every time a developer creates a new policy using an Amazon SNS topic” is incorrect. This does not explicitly prevent any developers from attaching the policy, only sending a notification.

INCORRECT: "Disable IAM activity across all organizational accounts using service control policies" is incorrect. If all IAM activity was disabled across all accounts within the Organizational unit, each IAM user would not be able to do anything within the account.

INCORRECT: "Assign all IAM duties to the security operations team and prevent developers from attaching policies" is incorrect. The easiest way to do this is to use a permissions boundary, to make sure the permissions are being administered appropriately.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Security, Identity, & Compliance

Question 12Skipped

A small Python application is used by a company to process JSON documents and output the results to a SQL database which currently lives on-premises. The application is run thousands of times every day, and the company wants to move the application to the AWS Cloud. To maximize scalability and minimize operational overhead, the company needs a highly available solution.

Which solution will meet these requirements?

The JSON documents should be queued as messages in the Amazon Simple Queue Service (Amazon SQS). Using the Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type, deploy the Python code as a container. The container can be used to process SQS messages. Using Amazon RDS, store the results.

Create an Amazon Elastic Block Store (Amazon EBS) volume for the JSON documents. Attach the volume to multiple Amazon EC2 instances using the EBS Multi-Attach feature. Process the documents with Python code on the EC2 instances and then extract the results to an Amazon RDS DB instance.

Build an S3 bucket to place the JSON documents in. Run the Python code on multiple Amazon EC2 instances to process the documents. Store the results in a database using the Amazon Aurora Database engine.

Correct answer

Put the JSON documents in an Amazon S3 bucket. As documents arrive in the S3 bucket, create an AWS Lambda function that runs Python code to process them. Use Amazon Aurora DB clusters to store the results.

Overall explanation

Firstly, S3 is a highly available and durable place to store these JSON documents that will be written once and read many times (WORM). As this application runs thousands of times per day, AWS Lambda would be ideal to use as it will scale whenever the application needs to be ran, and Python is a runtime environment that is natively supported by AWS Lambda, whenever the events arrive in the S3 bucket, and this could be easily achieved using S3 event notifications. Finally Amazon Aurora is a highly available and durable AWS managed database. Amazon Aurora automatically maintains six copies of your data across three Availability Zones (AZs) to adhere to your redundancy requirements.

CORRECT: "Put the JSON documents in an Amazon S3 bucket. As documents arrive in the S3 bucket, create an AWS Lambda function that runs Python code to process them. Use Amazon Aurora DB clusters to store the results" is the correct answer (as explained above.)

INCORRECT: "Build an S3 bucket to place the JSON documents in. Run the Python code on multiple Amazon EC2 instances to process the documents. Store the results in a database using the Amazon Aurora Database engine” is incorrect.

Multiple EC2 instances could work, however if you wanted to use EC2 to process the JSON documents you would need to either leave the EC2 instances running all the time (not cost effective) or have them spin up and spin down thousands of times per day (this would be slow and not ideal).

INCORRECT: "Create an Amazon Elastic Block Store (Amazon EBS) volume for the JSON documents. Attach the volume to multiple Amazon EC2 instances using the EBS Multi-Attach feature. Process the documents with Python code on the EC2 instances and then extract the results to an Amazon RDS DB instance" is incorrect.

EBS is not optimized for write once read many use-cases, and if you wanted to use EC2 to process the JSON documents you would need to either leave the EC2 instances running all the time (not cost effective) or have them spin up and spin down thousands of times per day (this would be slow and not ideal).

INCORRECT: "The JSON documents should be queued as messages in the Amazon Simple Queue Service (Amazon SQS). Using the Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type, deploy the Python code as a container. The container can be used to process SQS messages. Using Amazon RDS, store the results” is incorrect.

A queue within Amazon SQS is not designed to be used for write once read many solutions, and it is designed to be used to decouple separate layers of your architecture. Secondly, ECS for EC2 is not ideal as you would need to either leave the EC2 instances running all the time (not cost effective) or have them spin up and spin down thousands of times per day (this would be slow and not ideal) if you wanted to use ECS for EC2.

References:

https://docs.aws.amazon.com/lambda/latest/dg/services-rds.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Database

Question 13Skipped

A data analytics company is testing a Python-based application that processes customer data on an Amazon EC2 Linux instance. A single 1 TB Amazon Elastic Block Store (Amazon EBS) General Purpose SSD (gp3) volume is currently attached to the EC2 instance for data storage.

The company plans to deploy the application across multiple EC2 instances in an Auto Scaling group. All instances must access the same data that is currently stored on the EBS volume. The company needs a highly available and cost-effective solution that minimizes changes to the application code.

Which solution will meet these requirements?

Configure an Amazon FSx for Lustre file system. Integrate the file system with Amazon S3 and mount it on each EC2 instance for shared access.

Provision Amazon S3 and use the S3 REST API to allow all EC2 instances to upload and download data from the S3 bucket.

Correct answer

Use Amazon Elastic File System (Amazon EFS) and configure it in General Purpose performance mode. Mount the EFS file system on all EC2 instances.

Create an EC2 instance to act as an NFS server. Attach the EBS volume to this instance and share the volume with other EC2 instances in the Auto Scaling group.

Overall explanation

Use Amazon Elastic File System (Amazon EFS) and configure it in General Purpose performance mode. Mount the EFS file system on all EC2 instances: This is correct because Amazon EFS is a highly available, scalable, and resilient shared storage solution. It allows multiple EC2 instances to access the same data concurrently without requiring changes to the application code. General Purpose performance mode ensures low latency for shared access workloads.

Configure an Amazon FSx for Lustre file system. Integrate the file system with Amazon S3 and mount it on each EC2 instance for shared access: This is incorrect because FSx for Lustre is designed for high-performance computing and temporary storage for large-scale workloads. It does not provide the same level of availability and resilience for long-term storage as Amazon EFS.

Create an EC2 instance to act as an NFS server. Attach the EBS volume to this instance and share the volume with other EC2 instances in the Auto Scaling group: This is incorrect because using a single EC2 instance as an NFS server introduces a single point of failure, which reduces availability. EFS provides a more resilient and scalable solution.

Provision Amazon S3 and use the S3 REST API to allow all EC2 instances to upload and download data from the S3 bucket: This is incorrect because Amazon S3 is an object storage service, not a file system. It requires significant changes to the application to handle S3 API calls, which increases operational complexity.

References:
https://aws.amazon.com/efs/
https://docs.aws.amazon.com/fsx/latest/LustreGuide/what-is.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-efs/

Domain

AWS Storage

Question 14Skipped

A global retail company needs to provide its remote IT operations team with secure access to AWS resources across multiple AWS accounts. The company uses an on-premises Microsoft Active Directory for centralized user authentication and authorization. The AWS accounts are managed through AWS Organizations and support various internal teams and projects.

The company wants to integrate its existing Active Directory with AWS to centralize identity management, reduce operational overhead, and ensure secure, role-based access to resources across all accounts.

Which solution will meet these requirements with the LEAST operational overhead?

Create individual IAM users for each team member. Assign permissions manually to each IAM user in every AWS account. Use AWS Config to enforce compliance with access policies across accounts.

Deploy AWS Managed Microsoft Active Directory using AWS Directory Service. Establish a one-way trust relationship with the on-premises Active Directory. Use IAM roles mapped to Active Directory groups to provide resource access in each AWS account.

Correct answer

Use AWS Identity Center (AWS IAM Identity Center) integrated with AD Connector to link the on-premises Active Directory. Configure permission sets in IAM Identity Center to assign account-level and resource-level permissions based on Active Directory groups.

Deploy an OpenID Connect (OIDC)-compatible identity provider and integrate it with the on-premises Active Directory. Use the identity provider to generate tokens for users and configure IAM roles to allow access to AWS resources.

Overall explanation

Use AWS Identity Center (AWS IAM Identity Center) integrated with AD Connector to link the on-premises Active Directory. Configure permission sets in IAM Identity Center to assign account-level and resource-level permissions based on Active Directory groups: This is correct because AD Connector allows seamless integration with the on-premises Active Directory without duplicating or synchronizing identities. When combined with IAM Identity Center, permissions can be centrally managed using permission sets mapped to AD groups, minimizing operational effort and ensuring consistent access control across multiple AWS accounts.

Deploy AWS Managed Microsoft Active Directory using AWS Directory Service. Establish a one-way trust relationship with the on-premises Active Directory. Use IAM roles mapped to Active Directory groups to provide resource access in each AWS account: This is incorrect because setting up AWS Managed Microsoft AD introduces additional overhead compared to using AD Connector. It requires managing a separate AWS-hosted directory and maintaining trust relationships with the on-premises directory.

Create individual IAM users for each team member. Assign permissions manually to each IAM user in every AWS account. Use AWS Config to enforce compliance with access policies across accounts: This is incorrect because creating and managing individual IAM users for a globally distributed team across multiple AWS accounts is operationally intensive and prone to errors. Additionally, AWS Config does not reduce the complexity of manually assigning permissions.

Deploy an OpenID Connect (OIDC)-compatible identity provider and integrate it with the on-premises Active Directory. Use the identity provider to generate tokens for users and configure IAM roles to allow access to AWS resources: This is incorrect because setting up an OIDC-compatible identity provider adds unnecessary complexity for a workforce identity management use case. It is more suited for customer-facing applications than for internal employee access to AWS resources.

References:
https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_ad_connector.html
https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html
Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Security, Identity, & Compliance

Question 15Skipped

A website runs on a Microsoft Windows server in an on-premises data center. The web server is being migrated to Amazon EC2 Windows instances in multiple Availability Zones on AWS. The web server currently uses data stored in an on-premises network-attached storage (NAS) device.

Which replacement to the NAS file share is MOST resilient and durable?

Migrate the file share to AWS Storage Gateway

Migrate the file share to Amazon EBS

Migrate the file share to Amazon Elastic File System (Amazon EFS)

Correct answer

Migrate the file share to Amazon FSx for Windows File Server

Overall explanation

Amazon FSx for Windows File Server provides fully managed, highly reliable file storage that is accessible over the industry-standard Server Message Block (SMB) protocol. It is built on Windows Server, delivering a wide range of administrative features such as user quotas, end-user file restore, and Microsoft Active Directory (AD) integration. It offers single-AZ and multi-AZ deployment options, fully managed backups, and encryption of data at rest and in transit.

This is the only solution presented that provides resilient storage for Windows instances.

CORRECT: "Migrate the file share to Amazon FSx for Windows File Server" is the correct answer.

INCORRECT: "Migrate the file share to Amazon Elastic File System (Amazon EFS)" is incorrect as you cannot use Windows instances with Amazon EFS.

INCORRECT: "Migrate the file share to Amazon EBS" is incorrect as this is not a shared storage solution for multi-AZ deployments.

INCORRECT: "Migrate the file share to AWS Storage Gateway" is incorrect as with Storage Gateway replicated files end up on Amazon S3. The replacement storage solution should be a file share, not an object-based storage system.

References:

https://aws.amazon.com/fsx/windows/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 16Skipped

A social media platform uses Amazon DynamoDB to store user profiles, friend connections, and post interactions. The platform is rapidly expanding to new countries and needs to ensure a seamless user experience with high availability and low latency for its global user base.

The platform must handle unpredictable workloads and regional outages while maintaining a cost-effective architecture.

Which solution will meet these requirements MOST cost-effectively?

Use DynamoDB Accelerator (DAX) to reduce read latency for frequently accessed items. Deploy DynamoDB tables in a single Region and use manual Cross-Region Replication to replicate data to other Regions for fault tolerance.

Deploy DynamoDB tables in a single AWS Region using provisioned capacity mode. Use DynamoDB Streams to replicate data asynchronously to a secondary Region for failover.

Use Amazon S3 to store user data and replicate the data across multiple Regions using S3 Cross-Region Replication. Use AWS Lambda to perform real-time data updates for the application.

Correct answer

Use DynamoDB global tables to replicate data automatically across multiple Regions. Deploy the tables in on-demand capacity mode to handle workload variability.

Overall explanation

Use DynamoDB global tables to replicate data automatically across multiple Regions. Deploy the tables in on-demand capacity mode to handle workload variability: This is correct because DynamoDB global tables provide automatic multi-Region replication, ensuring low latency and high availability for a global user base. On-demand capacity mode is a cost-effective choice for workloads with unpredictable demand, as it adjusts capacity based on usage.

Deploy DynamoDB tables in a single AWS Region using provisioned capacity mode. Use DynamoDB Streams to replicate data asynchronously to a secondary Region for failover: This is incorrect because using DynamoDB Streams for cross-Region replication requires a custom implementation, which increases operational overhead. Additionally, a single primary Region does not ensure low latency for a global user base.

Use Amazon S3 to store user data and replicate the data across multiple Regions using S3 Cross-Region Replication. Use AWS Lambda to perform real-time data updates for the application: This is incorrect because S3 is not designed for transactional, low latency use cases like a social media platform. DynamoDB is the better choice for structured, real-time data access.

Use DynamoDB Accelerator (DAX) to reduce read latency for frequently accessed items. Deploy DynamoDB tables in a single Region and use manual Cross-Region Replication to replicate data to other Regions for fault tolerance: This is incorrect because DAX reduces read latency but does not provide global availability or automatic replication. Manual Cross-Region Replication adds operational complexity and is less reliable than global tables.

References:
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GlobalTables.html
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.ReadWriteCapacityMode.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-dynamodb/

Domain

AWS Database

Question 17Skipped

A social media analytics company runs a data processing application on a single Amazon EC2 On-Demand Instance. The application is stateless and processes user behavior data in near real-time. Recently, the application has started showing performance degradation during peak times, including 5xx errors due to high traffic volumes. The company wants to implement a solution to make the application scale automatically to handle traffic spikes in a cost-effective way.

Which solution will meet these requirements MOST cost-effectively?

Create an Amazon Machine Image (AMI) of the application. Use the AMI to deploy two EC2 On-Demand Instances. Attach an Application Load Balancer to distribute traffic between the two instances.

Use AWS Lambda and Amazon SQS to redesign the application into a serverless architecture. Deploy Lambda functions to process incoming requests and store results in Amazon DynamoDB.

Correct answer

Create an Auto Scaling group using an Amazon Machine Image (AMI) of the application. Use a launch template that configures the Auto Scaling group to scale out and in based on CPU utilization. Attach an Application Load Balancer to the Auto Scaling group to distribute traffic.

Increase the size of the existing EC2 instance to a larger instance type using Amazon EC2 Auto Scaling scheduled actions to handle peak hours. Use Amazon Route 53 to distribute traffic between the upgraded instance and a secondary instance in another Region.

Overall explanation

Create an Auto Scaling group using an Amazon Machine Image (AMI) of the application. Use a launch template that configures the Auto Scaling group to scale out and in based on CPU utilization. Attach an Application Load Balancer to the Auto Scaling group to distribute traffic: This is correct because Auto Scaling ensures the application can scale automatically to meet demand, while the Application Load Balancer distributes traffic across instances, improving fault tolerance. This setup is both cost-effective and aligned with the application's stateless architecture.

Create an Amazon Machine Image (AMI) of the application. Use the AMI to deploy two EC2 On-Demand Instances. Attach an Application Load Balancer to distribute traffic between the two instances: This is incorrect because simply adding a second EC2 instance does not allow for dynamic scaling. This approach could lead to underutilization during off-peak times and increased costs.

Use AWS Lambda and Amazon SQS to redesign the application into a serverless architecture. Deploy Lambda functions to process incoming requests and store results in Amazon DynamoDB: This is incorrect because redesigning the application as a serverless architecture adds significant development effort and may not be the most cost-effective solution compared to using Auto Scaling with existing EC2-based architecture.

Increase the size of the existing EC2 instance to a larger instance type using Amazon EC2 Auto Scaling scheduled actions to handle peak hours. Use Amazon Route 53 to distribute traffic between the upgraded instance and a secondary instance in another Region: This is incorrect because increasing the instance size does not enable dynamic scaling. Route 53 does not natively provide traffic distribution between instances based on load metrics, and this solution introduces unnecessary complexity with no clear scalability benefits.

References:
https://docs.aws.amazon.com/autoscaling/ec2/userguide/what-is-amazon-ec2-auto-scaling.html
https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 18Skipped

A solutions architect is designing a two-tier web application. The application consists of a public-facing web tier hosted on Amazon EC2 in public subnets. The database tier consists of Microsoft SQL Server running on Amazon EC2 in a private subnet. Security is a high priority for the company.

How should security groups be configured in this situation? (Select TWO.)

Configure the security group for the web tier to allow outbound traffic on port 443 from 0.0.0.0/0

Configure the security group for the database tier to allow inbound traffic on ports 443 and 1433 from the security group for the web tier

Correct selection

Configure the security group for the database tier to allow inbound traffic on port 1433 from the security group for the web tier

Configure the security group for the database tier to allow outbound traffic on ports 443 and 1433 to the security group for the web tier

Correct selection

Configure the security group for the web tier to allow inbound traffic on port 443 from 0.0.0.0/0 and to allow outbound traffic on port 1433 to the RDS

Overall explanation

In this scenario an inbound rule is required to allow traffic from any internet client to the web front end on SSL/TLS port 443. The source should therefore be set to 0.0.0.0/0 to allow any inbound traffic.

To secure the connection from the web frontend to the database tier, an outbound rule should be created from the public EC2 security group with a destination of the private EC2 security group. The port should be set to 1433 for MySQL. The private EC2 security group will also need to allow inbound traffic on 1433 from the public EC2 security group.

This configuration can be seen in the diagram:

CORRECT: "Configure the security group for the web tier to allow inbound traffic on port 443 from 0.0.0.0/0 and to allow outbound traffic on port 1433 to the RDS" is a correct answer.

CORRECT: "Configure the security group for the database tier to allow inbound traffic on port 1433 from the security group for the web tier" is also a correct answer.

INCORRECT: "Configure the security group for the web tier to allow outbound traffic on port 443 from 0.0.0.0/0" is incorrect as this is configured backwards.

INCORRECT: "Configure the security group for the database tier to allow outbound traffic on ports 443 and 1433 to the security group for the web tier" is incorrect as the MySQL database instance does not need to send outbound traffic on either of these ports.

INCORRECT: "Configure the security group for the database tier to allow inbound traffic on ports 443 and 1433 from the security group for the web tier" is incorrect as the database tier does not need to allow inbound traffic on port 443.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Security, Identity, & Compliance

Question 19Skipped

A company hosts a serverless application on AWS. The application consists of Amazon API Gateway, AWS Lambda, and Amazon RDS for PostgreSQL. During times of peak traffic and when traffic spikes are experienced, the company notices an increase in application errors caused by database connection timeouts. The company is looking for a solution that will reduce the number of application failures with the least amount of code changes.

What should a solutions architect do to meet these requirements?

Correct answer

Enable an RDS Proxy instance on your RDS Database.

Change the database to an Amazon DynamoDB database with on-demand scaling.

Reduce the concurrency rate for your Lambda Function.

Change the class of the instance of your database to allow more connections.

Overall explanation

Amazon RDS Proxy is a fully managed, highly available database proxy for Amazon Relational Database Service (RDS) that makes applications more scalable, more resilient to database failures, and more secure. Amazon RDS Proxy allows applications to pool and share connections established with the database, improving database efficiency and application scalability.

Amazon RDS Proxy can be enabled for most applications with no code changes so this solution requires the least amount of code changes.

CORRECT: "Enable an RDS Proxy instance on your RDS Database" is the correct answer (as explained above.)

INCORRECT: "Reduce the concurrency rate for your Lambda Function" is incorrect. Concurrency is the number of requests that your function is serving at any given time. The errors are caused by an increase in connection timeouts, so editing the concurrency of your Lambda function would not solve the problem.

INCORRECT: "Change the class of the instance of your database to allow more connections" is incorrect. Resizing the instance might help, but there will be some inevitable downtime with a PostgreSQL database on RDS. RDS Proxy is specifically designed for this reason and would incur no downtime.

INCORRECT: "Change the database to an Amazon DynamoDB database with on-demand scaling" is incorrect as this would require significant application changes to accommodate the NoSQL database structure.

References:

https://aws.amazon.com/rds/proxy/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-database/

Domain

AWS Database

Question 20Skipped

A medical research institution generates large volumes of patient imaging data daily. These images are initially stored on on-premises block storage systems connected to medical devices. Due to limited local storage capacity, the institution needs to offload data to the cloud. The data must remain accessible to on-premises analysis applications with low latency for frequently accessed images. The institution requires a storage solution that integrates with its existing setup and minimizes operational management.

Which solution will meet these requirements with the MOST operational efficiency?

Correct answer

Use AWS Storage Gateway Volume Gateway in cached mode. Configure cached volumes as iSCSI targets to store the primary dataset in AWS and cache frequently accessed imaging data locally.

Use AWS Storage Gateway Tape Gateway to store virtual tapes in Amazon S3 Glacier Instant Retrieval. Retrieve data from the tape gateway as needed for analysis.

Use AWS Snowball Edge to transfer imaging data to Amazon S3. Set up periodic data migrations to AWS to manage storage demands. Retrieve data on demand from S3 using Amazon S3 Transfer Acceleration.

Use Amazon S3 File Gateway to offload patient images to Amazon S3. Mount the file gateway to the on-premises analysis servers using NFS or SMB for direct access to the images.

Overall explanation

Use AWS Storage Gateway Volume Gateway in cached mode. Configure cached volumes as iSCSI targets to store the primary dataset in AWS and cache frequently accessed imaging data locally: This is correct because the cached mode stores the main dataset in AWS while caching frequently accessed data locally, ensuring low-latency access to imaging data for on-premises applications. It also addresses the storage limitations of the institution’s local environment.

Use Amazon S3 File Gateway to offload patient images to Amazon S3. Mount the file gateway to the on-premises analysis servers using NFS or SMB for direct access to the images: This is incorrect because S3 File Gateway is designed for file-based workloads rather than block storage. Medical imaging applications often require block-level access, making Volume Gateway a more appropriate choice.

Use AWS Snowball Edge to transfer imaging data to Amazon S3. Set up periodic data migrations to AWS to manage storage demands. Retrieve data on demand from S3 using Amazon S3 Transfer Acceleration: This is incorrect because Snowball Edge is a data transfer solution, not a continuously available storage gateway. This approach does not meet the requirement for frequent, low-latency access to imaging data.

Use AWS Storage Gateway Tape Gateway to store virtual tapes in Amazon S3 Glacier Instant Retrieval. Retrieve data from the tape gateway as needed for analysis: This is incorrect because Tape Gateway is designed for backup and archival purposes rather than frequently accessed data. Retrieving imaging data from virtual tapes introduces latency and does not meet the institution's low-latency requirements.

References:
https://docs.aws.amazon.com/storagegateway/latest/userguide/volume-gateway.html
https://docs.aws.amazon.com/storagegateway/latest/userguide/StorageGatewayConcepts.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-storage-gateway/

Domain

AWS Storage

Question 21Skipped

A research organization wants to move its data analytics application to a serverless solution. The organization stores scientific data in an Amazon S3 bucket and needs the solution to support SQL queries on both existing and new data. The data must be encrypted at rest and replicated to a different AWS Region to ensure durability and compliance.

Which solution will meet these requirements with the LEAST operational overhead?

Correct answer

Create a new S3 bucket that uses server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon Athena to query the data.

Create a new S3 bucket that uses server-side encryption with Amazon S3 managed keys (SSE-S3). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon Redshift Spectrum to query the data.

Configure Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3). Use Amazon Athena to query the data.

Configure S3 Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use AWS Glue for ETL and Amazon Redshift to query the data.

Overall explanation

Create a new S3 bucket that uses server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon Athena to query the data: This is correct because SSE-KMS provides encryption at rest with multi-Region replication, and Athena offers a serverless SQL querying solution with minimal operational overhead.

Create a new S3 bucket that uses server-side encryption with Amazon S3 managed keys (SSE-S3). Configure Cross-Region Replication (CRR). Load the data into the new S3 bucket. Use Amazon Redshift Spectrum to query the data: This is incorrect because Redshift Spectrum is not a fully serverless solution and requires managing the Redshift cluster, increasing operational overhead.

Configure Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with Amazon S3 managed keys (SSE-S3). Use Amazon Athena to query the data: This is incorrect because SSE-S3 does not provide the same level of security as SSE-KMS, which is required for compliance in many scenarios.

Configure S3 Cross-Region Replication (CRR) on the existing S3 bucket. Use server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use AWS Glue for ETL and Amazon Redshift to query the data: This is incorrect because AWS Glue and Redshift require additional management and are not as cost-efficient as Athena for simple SQL querying tasks.

References:
https://docs.aws.amazon.com/athena/latest/ug/what-is.html
https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Security, Identity, & Compliance

Question 22Skipped

An application running on Amazon ECS processes data and then writes objects to an Amazon S3 bucket. The application requires permissions to make the S3 API calls.

How can a Solutions Architect ensure the application has the required permissions?

Correct answer

Create an IAM role that has read/write permissions to the bucket and update the task definition to specify the role as the taskRoleArn.

Update the S3 policy in IAM to allow read/write access from Amazon ECS, and then relaunch the container.

Attach an IAM policy with read/write permissions to the bucket to an IAM group and add the container instances to the group.

Create a set of Access Keys with read/write permissions to the bucket and update the task credential ID.

Overall explanation

With IAM roles for Amazon ECS tasks, you can specify an IAM role that can be used by the containers in a task. Applications must sign their AWS API requests with AWS credentials, and this feature provides a strategy for managing credentials for your applications to use, similar to the way that Amazon EC2 instance profiles provide credentials to EC2 instances.

You define the IAM role to use in your task definitions, or you can use a taskRoleArn override when running a task manually with the RunTask API operation.

Note that there are instances roles and task roles that you can assign in ECS when using the EC2 launch type. The task role is better when you need to assign permissions for just that specific task:

CORRECT: "Create an IAM role that has read/write permissions to the bucket and update the task definition to specify the role as the taskRoleArn" is the correct answer.

INCORRECT: "Update the S3 policy in IAM to allow read/write access from Amazon ECS, and then relaunch the container" is incorrect. Policies must be assigned to tasks using IAM Roles and this is not mentioned here.

INCORRECT: "Create a set of Access Keys with read/write permissions to the bucket and update the task credential ID" is incorrect. You cannot update the task credential ID with access keys and roles should be used instead.

INCORRECT: "Attach an IAM policy with read/write permissions to the bucket to an IAM group and add the container instances to the group" is incorrect. You cannot add container instances to an IAM group.

References:

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

Domain

AWS Security, Identity, & Compliance

Question 23Skipped

A highly sensitive application runs on Amazon EC2 instances using EBS volumes. The application stores data temporarily on Amazon EBS volumes during processing before saving results to an Amazon RDS database. The company’s security team mandate that the sensitive data must be encrypted at rest.

Which solution should a Solutions Srchitect recommend to meet this requirement?

Correct answer

Configure encryption for the Amazon EBS volumes and Amazon RDS database with AWS KMS keys.

Configure SSL/TLS encryption using AWS KMS customer master keys (CMKs) to encrypt database volumes.

Use AWS Certificate Manager to generate certificates that can be used to encrypt the connections between the EC2 instances and RDS.

Use Amazon Data Lifecycle Manager to encrypt all data as it is stored to the EBS volumes and RDS database.

Overall explanation

As the data is stored both in the EBS volumes (temporarily) and the RDS database, both the EBS and RDS volumes must be encrypted at rest. This can be achieved by enabling encryption at creation time of the volume and AWS KMS keys can be used to encrypt the data. This solution meets all requirements.

CORRECT: "Configure encryption for the Amazon EBS volumes and Amazon RDS database with AWS KMS keys" is the correct answer.

INCORRECT: "Use AWS Certificate Manager to generate certificates that can be used to encrypt the connections between the EC2 instances and RDS" is incorrect. This would encrypt the data in-transit but not at-rest.

INCORRECT: "Use Amazon Data Lifecycle Manager to encrypt all data as it is stored to the EBS volumes and RDS database" is incorrect. DLM is used for automating the process of taking and managing snapshots for EBS volumes.

INCORRECT: "Configure SSL/TLS encryption using AWS KMS customer master keys (CMKs) to encrypt database volumes" is incorrect. You cannot configure SSL/TLS encryption using KMS CMKs or use SSL/TLS to encrypt data at rest.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ebs/

https://digitalcloud.training/amazon-rds/

Domain

AWS Security, Identity, & Compliance

Question 24Skipped

A stock trading startup company has a custom web application to sell trading data to its users online. The company uses Amazon DynamoDB to store its data and wants to build a new service that sends an alert to the managers of four internal teams every time a new trading event is recorded. The company does not want this new service to affect the performance of the current application.

What should a solutions architect do to meet these requirements with the LEAST amount of operational overhead?

Correct answer

On the table, enable Amazon DynamoDB Streams. Subscriptions can be made to a single Amazon Simple Notification Service (Amazon SNS) topic using triggers.

Write new event data to the table using DynamoDB transactions. The transactions should be configured to notify internal teams.

Create a custom attribute for each record to flag new items. A cron job can be written to scan the table every minute for new items and notify an Amazon Simple Queue Service (Amazon SQS) queue.

Use the current application to publish a message to four Amazon Simple Notification Service (Amazon SNS) topics. Each team should subscribe to one topic.

Overall explanation

DynamoDB Streams captures a time-ordered sequence of item-level modifications in any DynamoDB table and stores this information in a log for up to 24 hours. Applications can access this log and view the data items as they appeared before and after they were modified, in near-real time. This is the native way to handle this within DynamoDB, therefore will incur the least amount of operational overhead.

CORRECT: "On the table, enable Amazon DynamoDB Streams. Subscriptions can be made to a single Amazon Simple Notification Service (Amazon SNS) topic using triggers” is the correct answer (as explained above.)

INCORRECT: "Write new event data to the table using DynamoDB transactions. The transactions should be configured to notify internal teams” is incorrect. With Amazon DynamoDB transactions, you can group multiple actions together and submit them as a single all-or-nothing TransactWriteItems or TransactGetItems operation. The following sections describe API operations, capacity management, best practices, and other details about using transactional operations in DynamoDB. This is not suitable for this use case.

INCORRECT: "Use the current application to publish a message to four Amazon Simple Notification Service (Amazon SNS) topics. Each team should subscribe to one topic” is incorrect. Using four separate SNS topics will take a significant amount of overhead, and this functionality can be managed natively within DynamoDB using DynamoDB streams.

INCORRECT: "Create a custom attribute for each record to flag new items. A cron job can be written to scan the table every minute for new items and notify an Amazon Simple Queue Service (Amazon SQS) queue” is incorrect. Writing a CRON job also takes significant overhead compared to using DynamoDB streams.

References:

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Streams.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-dynamodb/

Domain

AWS Database

Question 25Skipped

A High Performance Computing (HPC) application will be migrated to AWS. The application requires low network latency and high throughput between nodes and will be deployed in a single AZ.

How should the application be deployed for best inter-node performance?

Correct answer

In a cluster placement group

In a spread placement group

Behind a Network Load Balancer (NLB)

In a partition placement group

Overall explanation

A cluster placement group provides low latency and high throughput for instances deployed in a single AZ. It is the best way to provide the performance required for this application.

CORRECT: "In a cluster placement group" is the correct answer.

INCORRECT: "In a partition placement group" is incorrect. A partition placement group is used for grouping instances into logical segments. It provides control and visibility into instance placement but is not the best option for performance.

INCORRECT: "In a spread placement group" is incorrect. A spread placement group is used to spread instances across underlying hardware. It is not the best option for performance.

INCORRECT: "Behind a Network Load Balancer (NLB)" is incorrect. A network load balancer is used for distributing incoming connections, this does assist with inter-node performance.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2/

Domain

AWS Compute

Question 26Skipped

A solutions architect is finalizing the architecture for a distributed database that will run across multiple Amazon EC2 instances. Data will be replicated across all instances so the loss of an instance will not cause loss of data. The database requires block storage with low latency and throughput that supports up to several million transactions per second per server.

Which storage solution should the solutions architect use?

Correct answer

Amazon EC2 instance store

Amazon EFS

Amazon S3

Amazon EBS

Overall explanation

An instance store provides temporary block-level storage for your instance. This storage is located on disks that are physically attached to the host computer. Instance store is ideal for temporary storage of information that changes frequently, such as buffers, caches, scratch data, and other temporary content, or for data that is replicated across a fleet of instances, such as a load-balanced pool of web servers.

Some instance types use NVMe or SATA-based solid state drives (SSD) to deliver high random I/O performance. This is a good option when you need storage with very low latency, but you don't need the data to persist when the instance terminates or you can take advantage of fault-tolerant architectures.

In this scenario the data is replicated and fault tolerant so the best option to provide the level of performance required is to use instance store volumes.

CORRECT: "Amazon EC2 instance store" is the correct answer.

INCORRECT: "Amazon EBS " is incorrect. The Elastic Block Store (EBS) is a block storage device but as the data is distributed and fault tolerant a better option for performance would be to use instance stores.

INCORRECT: "Amazon EFS " is incorrect as EFS is not a block device, it is a filesystem that is accessed using the NFS protocol.

INCORRECT: "Amazon S3" is incorrect as S3 is an object-based storage system, not a block-based storage system.

References:

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/InstanceStorage.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ebs/

Domain

AWS Compute

Question 27Skipped

A fitness company collects user feedback from mobile app surveys about its workout plans and features. Users submit thousands of survey responses daily, and the company wants to automate feedback analysis to track user sentiment and improve its offerings. The analyzed feedback data must be stored for at least 12 months to identify trends over time.

The company requires a highly scalable solution that minimizes operational complexity.

Which solution will meet these requirements in the MOST scalable way?

Deploy an on-premises server that receives survey responses via a REST API. Process the data locally, use a custom machine learning model for sentiment analysis, and upload results to Amazon S3. Use Amazon S3 lifecycle policies to delete the data after 12 months.

Write survey responses directly to an Amazon Redshift database. Configure Amazon Redshift ML to perform sentiment analysis on the feedback data in real time. Use Amazon S3 to archive the processed results and configure lifecycle policies to delete S3 objects after 12 months.

Correct answer

Collect survey responses via an Amazon API Gateway endpoint integrated with Amazon Kinesis Data Firehose. Configure Firehose to stream the data to an Amazon S3 bucket. Use S3 Event Notifications to invoke an AWS Lambda function that calls Amazon Comprehend for sentiment analysis and writes results to an Amazon DynamoDB table with TTL configured to delete records after 12 months.

Send survey responses to an Amazon EventBridge rule, which routes the data to an AWS Step Functions workflow. Use Step Functions to trigger AWS Lambda for data processing and sentiment analysis with Amazon Comprehend. Store the results in an Amazon DynamoDB table and use DynamoDB's TTL feature to expire data after 12 months.

Overall explanation

Collect survey responses via an Amazon API Gateway endpoint integrated with Amazon Kinesis Data Firehose. Configure Firehose to stream the data to an Amazon S3 bucket. Use S3 Event Notifications to invoke an AWS Lambda function that calls Amazon Comprehend for sentiment analysis and writes results to an Amazon DynamoDB table with TTL configured to delete records after 12 months:

This is correct because this architecture is highly scalable and cost-effective. Kinesis Data Firehose automatically scales to handle large volumes of data, and S3 provides reliable storage for raw survey responses. Using Lambda for sentiment analysis with Amazon Comprehend reduces operational complexity, and DynamoDB with TTL ensures data is stored efficiently for 12 months.

Send survey responses to an Amazon EventBridge rule, which routes the data to an AWS Step Functions workflow. Use Step Functions to trigger AWS Lambda for data processing and sentiment analysis with Amazon Comprehend. Store the results in an Amazon DynamoDB table, and use DynamoDB's TTL feature to expire data after 12 months:

This is incorrect because using EventBridge and Step Functions adds unnecessary complexity to the workflow. Kinesis Data Firehose with S3 provides a simpler and more efficient mechanism for streaming and storing data.

Write survey responses directly to an Amazon Redshift database. Configure Amazon Redshift ML to perform sentiment analysis on the feedback data in real time. Use Amazon S3 to archive the processed results, and configure lifecycle policies to delete S3 objects after 12 months:

This is incorrect because Amazon Redshift is better suited for analytical queries and is not optimized for real-time sentiment analysis. This solution introduces higher costs and complexity compared to using Amazon Comprehend and DynamoDB.

Deploy an on-premises server that receives survey responses via a REST API. Process the data locally, use a custom machine learning model for sentiment analysis, and upload results to Amazon S3. Use Amazon S3 lifecycle policies to delete the data after 12 months:

This is incorrect because deploying and managing on-premises servers increases operational overhead. AWS services like Lambda and Comprehend provide a more scalable and managed solution for this use case.

References:
https://docs.aws.amazon.com/streams/latest/dev/introduction.html
https://docs.aws.amazon.com/comprehend/latest/dg/what-is.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-kinesis/

Domain

AWS Networking & Content Delivery

Question 28Skipped

An application stores transactional data in an Amazon S3 bucket. The data is analyzed for the first week and then must remain immediately available and highly available for occasional analysis.

What is the MOST cost-effective storage solution that meets the requirements?

Configure a lifecycle policy to transition the objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days.

Correct answer

Configure a lifecycle policy to transition the objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days.

Configure a lifecycle policy to transition the objects to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) after 30 days.

Configure a lifecycle policy to transition the objects to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) after 7 days.

Overall explanation

The transition should be to Standard-IA rather than One Zone-IA. Though One Zone-IA would be cheaper, it also offers lower availability and the question states the objects “must remain immediately available”. Therefore the availability is a consideration.

Though there is no minimum duration when storing data in S3 Standard, you cannot transition to Standard IA within 30 days. This can be seen when trying to create a lifecycle rule:

Therefore, the best solution is to transition after 30 days.

CORRECT: "Configure a lifecycle policy to transition the objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days" is the correct answer.

INCORRECT: "Configure a lifecycle policy to transition the objects to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) after 30 days" is incorrect as explained above.

INCORRECT: "Configure a lifecycle policy to transition the objects to Amazon S3 Standard-Infrequent Access (S3 Standard-IA) after 7 days" is incorrect as explained above.

INCORRECT: "Configure a lifecycle policy to transition the objects to Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) after 7 days" is incorrect as explained above.

References:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-transition-general-considerations.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 29Skipped

A gaming company uses a web application to display scores. An Application Load Balancer is used to distribute load across Amazon EC2 instances which run the application. The application stores data in an Amazon RDS for MySQL database. Users are experiencing long delays and interruptions due to poor database read performance. It is important for the company to improve the user experience while minimizing changes to the application's architecture.

What should a solutions architect do to meet these requirements?

Correct answer

Use Amazon ElastiCache to cache the database layer.

Connect the database and the application layer using RDS Proxy.

Use an Amazon DynamoDB table instead of RDS.

Use AWS Lambda instead of Amazon EC2 for the compute layer.

Overall explanation

Amazon ElastiCache is a fully managed, in-memory caching service supporting flexible, real-time use cases. You can use ElastiCache for caching, which accelerates application and database performance, or as a primary data store for use cases that don't require durability like session stores, gaming leaderboards, streaming, and analytics. ElastiCache is compatible with Redis and Memcached.

As the issues in this instance are caused by poor read performance, a caching solution would offload reads from the primary database instance and allow the application to perform better.
CORRECT: "Use Amazon ElastiCache to cache the database layer” is the correct answer (as explained above.)

INCORRECT: "Connect the database and the application layer using RDS Proxy” is incorrect. RDS proxy allows applications to pool and share connections established with the database, improving database efficiency and application scalability. It does not however specifically improve read performance like a caching layer would.

INCORRECT: "Use AWS Lambda instead of Amazon EC2 for the compute layer" is incorrect. AWS Lambda would not be a suitable use case for hosting leaderboards, as the maximum timeout is 15 minutes, and the issue lies with the database layer, not the compute later.

INCORRECT: "Use an Amazon DynamoDB table instead of RDS" is incorrect. Migrating to DynamoDB would not help the load of reads on the database and changing the schema of the database would cause massive changes to the application’s architecture.

References:

https://aws.amazon.com/elasticache/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-elasticache/

Domain

AWS Database

Question 30Skipped

A company is architecting a shared storage solution for an AWS-hosted gaming application. The company needs the ability to use Lustre clients to access data. The solution must be fully managed.

Which solution meets these requirements?

Assign the AWS DataSync task to share the data as a mountable file system. Sync the file system with the application server.

Create an Amazon Elastic File System (Amazon EFS) file system and configure it to support Lustre. Attach the file system to the origin server. Connect the application server to the file system.

Create a file gateway with AWS Storage Gateway. Create a client-side file share using the required protocol. Share the file with the application server.

Correct answer

Create an Amazon FSx for Lustre file system. Connect the file system to the origin server. Ensure that the file system is connected to the application server.

Overall explanation

Amazon FSx for Lustre provides fully managed shared storage with the scalability and performance of the popular Lustre file system. It is fully managed and will allow the company to attach the file system to the origin server and connect the application server to the file system.

CORRECT: "Create an Amazon FSx for Lustre file system. Connect the file system to the origin server. Ensure that the file system is connected to the application server” is the correct answer (as explained above.)

INCORRECT: "Assign the AWS DataSync task to share the data as a mountable file system. Sync the file system with the application server” is incorrect. The solution requires a managed Lustre file system, so this would not work.

INCORRECT: "Create a file gateway with AWS Storage Gateway. Create a client-side file share using the required protocol. Share the file with the application server” is incorrect. The solution requires a managed Lustre file system, so this would not work.

INCORRECT: "Create an Amazon Elastic File System (Amazon EFS) file system and configure it to support Lustre. Attach the file system to the origin server. Connect the application server to the file system” is incorrect. The solution requires a managed Lustre file system, so this would not work.

References:

https://aws.amazon.com/fsx/lustre/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-fsx/

Domain

AWS Storage

Question 31Skipped

A company operates a self-managed Microsoft SQL Server database hosted on Amazon EC2 instances with Amazon Elastic Block Store (Amazon EBS) volumes. The company uses daily EBS snapshots for backup. Recently, an issue arose when a snapshot cleanup script unintentionally deleted all the snapshots. The solutions architect must design a solution to prevent accidental deletions while avoiding indefinite retention of EBS snapshots.

Which solution will meet these requirements with the LEAST development effort?

Change the IAM policy to deny deletion of EBS snapshots to all users.

Correct answer

Apply an EBS snapshot retention rule in Recycle Bin to retain snapshots for 7 days before permanent deletion.

Implement a cross-region copy for EBS snapshots daily and set a retention policy for the snapshots in the target region.

Use Amazon Data Lifecycle Manager to create EBS snapshots with automated retention rules.

Overall explanation

Apply an EBS snapshot retention rule in Recycle Bin to retain snapshots for 7 days before permanent deletion: This is correct because Recycle Bin provides a simple way to recover snapshots deleted by mistake. By configuring a retention rule, snapshots are stored securely for the defined duration, preventing accidental deletions without requiring custom development.

Change the IAM policy to deny deletion of EBS snapshots to all users: This is incorrect because it would prevent legitimate deletions of expired snapshots, which could lead to increased storage costs and operational inefficiencies.

Implement a cross-region copy for EBS snapshots daily and set a retention policy for the snapshots in the target region: This is incorrect because cross-region replication increases cost and complexity. It is unnecessary for this use case when the Recycle Bin can address the issue.

Use Amazon Data Lifecycle Manager to create EBS snapshots with automated retention rules: This is incorrect because Data Lifecycle Manager can manage retention but cannot prevent accidental deletions without Recycle Bin as a backup layer.

References:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-recycle-bin.html
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ebs/

Domain

AWS Storage

Question 32Skipped

A company has a file share on a Microsoft Windows Server in an on-premises data center. The server uses a local network attached storage (NAS) device to store several terabytes of files. The management team require a reduction in the data center footprint and to minimize storage costs by moving on-premises storage to AWS.

What should a Solutions Architect do to meet these requirements?

Configure an AWS Storage Gateway as a volume gateway.

Correct answer

Configure an AWS Storage Gateway file gateway.

Create an Amazon EFS volume and use an IPSec VPN.

Create an Amazon S3 bucket and an S3 gateway endpoint.

Overall explanation

An AWS Storage Gateway File Gateway provides your applications a file interface to seamlessly store files as objects in Amazon S3, and access them using industry standard file protocols. This removes the files from the on-premises NAS device and provides a method of directly mounting the file share for on-premises servers and clients.

CORRECT: "Configure an AWS Storage Gateway file gateway" is the correct answer.

INCORRECT: "Configure an AWS Storage Gateway as a volume gateway" is incorrect. A volume gateway uses block-based protocols. In this case we are replacing a NAS device which uses file-level protocols so the best option is a file gateway.

INCORRECT: "Create an Amazon EFS volume and use an IPSec VPN" is incorrect. EFS can be mounted over a VPN but it would have more latency than using a storage gateway.

INCORRECT: "Create an Amazon S3 bucket and an S3 gateway endpoint" is incorrect. S3 is an object-level storage system so is not suitable for this use case. A gateway endpoint is a method of accessing S3 using private addresses from your VPC, not from your data center.

References:

https://aws.amazon.com/storagegateway/faqs/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-storage-gateway/

Domain

AWS Storage

Question 33Skipped

A company requires a solution for replicating data to AWS for disaster recovery. Currently, the company uses scripts to copy data from various sources to a Microsoft Windows file server in the on-premises data center. The company also requires that a small amount of recent files are accessible to administrators with low latency.

What should a Solutions Architect recommend to meet these requirements?

Update the script to copy data to an Amazon EBS volume instead of the on-premises file server.

Update the script to copy data to an Amazon S3 Glacier archive instead of the on-premises file server.

Update the script to copy data to an Amazon EFS volume instead of the on-premises file server.

Correct answer

Update the script to copy data to an AWS Storage Gateway for File Gateway virtual appliance instead of the on-premises file server.

Overall explanation

The best solution here is to use an AWS Storage Gateway File Gateway virtual appliance in the on-premises data center. This can be accessed the same protocols as the existing Microsoft Windows File Server (SMB/CIFS). Therefore, the script simply needs to be updated to point to the gateway.

The file gateway will then store data on Amazon S3 and has a local cache for data that can be accessed at low latency. The file gateway provides an excellent method of enabling file protocol access to low cost S3 object storage.

CORRECT: "Update the script to copy data to an AWS Storage Gateway for File Gateway virtual appliance instead of the on-premises file server" is the correct answer.

INCORRECT: "Update the script to copy data to an Amazon EBS volume instead of the on-premises file server" is incorrect. This would also need an attached EC2 instance running Windows to be able to mount using the same protocols and would not offer any local low-latency access.

INCORRECT: "Update the script to copy data to an Amazon EFS volume instead of the on-premises file server" is incorrect. This solution would not provide a local cache.

INCORRECT: "Update the script to copy data to an Amazon S3 Glacier archive instead of the on-premises file server" is incorrect. This would not provide any immediate access with low-latency.

References:

https://aws.amazon.com/storagegateway/file/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-efs/

Domain

AWS Storage

Question 34Skipped

A company runs an eCommerce application that uses an Amazon Aurora database. The database performs well except for short periods when monthly sales reports are run. A Solutions Architect has reviewed metrics in Amazon CloudWatch and found that the Read Ops and CPUUtilization metrics are spiking during the periods when the sales reports are run.

What is the MOST cost-effective solution to solve this performance issue?

Correct answer

Create an Aurora Replica and use the replica endpoint for reporting.

Modify the Aurora database to use an instance class with more CPU.

Create an Amazon Redshift data warehouse and run the reporting there.

Enable storage Auto Scaling for the Amazon Aurora database.

Overall explanation

The simplest and most cost-effective option is to use an Aurora Replica. The replica can serve read operations which will mean the reporting application can run reports on the replica endpoint without causing any performance impact on the production database.

CORRECT: "Create an Aurora Replica and use the replica endpoint for reporting" is the correct answer.

INCORRECT: "Enable storage Auto Scaling for the Amazon Aurora database" is incorrect. Aurora storage automatically scales based on volumes, there is no storage auto scaling feature for Aurora.

INCORRECT: "Create an Amazon Redshift data warehouse and run the reporting there" is incorrect. This would be less cost-effective and require more work in copying the data to the data warehouse.

INCORRECT: "Modify the Aurora database to use an instance class with more CPU" is incorrect. This may not resolve the storage performance issues and could be more expensive depending on instances sizes.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Overview.StorageReliability.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Question 35Skipped

A company wants to migrate a legacy web application from an on-premises data center to AWS. The web application consists of a web tier, an application tier, and a MySQL database. The company does not want to manage instances or clusters.

Which combination of services should a solutions architect include in the overall architecture? (Select TWO.)

Amazon Kinesis Data Streams

Amazon EC2 Spot Instances

Amazon DynamoDB

Correct selection

AWS Fargate

Correct selection

Amazon RDS for MySQL

Overall explanation

Amazon RDS is a managed service and you do not need to manage the instances. This is an ideal backend for the application and you can run a MySQL database on RDS without any refactoring. For the application components these can run on Docker containers with AWS Fargate. Fargate is a serverless service for running containers on AWS.

CORRECT: "AWS Fargate" is a correct answer.

CORRECT: "Amazon RDS for MySQL" is also a correct answer.

INCORRECT: "Amazon DynamoDB" is incorrect. This is a NoSQL database and would be incompatible with the relational MySQL DB.

INCORRECT: "Amazon EC2 Spot Instances" is incorrect. This would require managing instances.

INCORRECT: "Amazon Kinesis Data Streams" is incorrect. This is a service for streaming data.

References:

https://aws.amazon.com/rds/

https://aws.amazon.com/fargate/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

https://digitalcloud.training/amazon-rds/

Domain

AWS Database

Question 36Skipped

A company runs an application on Amazon EC2 instances which requires access to sensitive data in an Amazon S3 bucket. All traffic between the EC2 instances and the S3 bucket must not traverse the internet and must use private IP addresses. Additionally, the bucket must only allow access from services in the VPC.

Which combination of actions should a Solutions Architect take to meet these requirements? (Select TWO.)

Correct selection

Create a VPC endpoint for Amazon S3.

Apply an IAM policy to a VPC peering connection.

Enable default encryption on the bucket.

Correct selection

Apply a bucket policy to restrict access to the S3 endpoint.

Create a peering connection to the S3 bucket VPC.

Overall explanation

Private access to public services such as Amazon S3 can be achieved by creating a VPC endpoint in the VPC. For S3 this would be a gateway endpoint. The bucket policy can then be configured to restrict access to the S3 endpoint only which will ensure that only services originating from the VPC will be granted access.

CORRECT: "Create a VPC endpoint for Amazon S3" is a correct answer.

CORRECT: "Apply a bucket policy to restrict access to the S3 endpoint" is also a correct answer.

INCORRECT: "Enable default encryption on the bucket" is incorrect. This will encrypt data at rest but does not restrict access.

INCORRECT: "Create a peering connection to the S3 bucket VPC" is incorrect. You cannot create a peering connection to S3 as it is a public service and does not run in a VPC.

INCORRECT: "Apply an IAM policy to a VPC peering connection" is incorrect. You cannot apply an IAM policy to a peering connection.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/vpce-gateway.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 37Skipped

A retail company uses an Amazon Aurora MySQL DB cluster for its order management system. The cluster includes eight Aurora Replicas. The company wants to ensure that reporting queries from its analytics team are automatically distributed across three specific Aurora Replicas that have higher compute and memory capacity than the rest of the cluster.

Which solution will meet these requirements?

Correct answer

Create and use a custom endpoint that targets the three high-capacity replicas.

Create a cluster clone for the reporting workload and use the writer endpoint of the cloned cluster.

Use the reader endpoint to automatically distribute reporting queries across all replicas in the cluster.

Direct reporting queries to the instance endpoints of the three high-capacity replicas.

Overall explanation

Create and use a custom endpoint that targets the three high-capacity replicas: This is correct because Aurora custom endpoints allow you to define a subset of replicas for specific workloads. By creating a custom endpoint, the reporting queries can be automatically distributed across the three high-capacity replicas without involving the rest of the cluster.

Use the reader endpoint to automatically distribute reporting queries across all replicas in the cluster: This is incorrect because the reader endpoint distributes queries across all Aurora Replicas in the cluster, which does not restrict queries to the desired three replicas.

Create a cluster clone for the reporting workload and use the writer endpoint of the cloned cluster: This is incorrect because creating a cluster clone duplicates data unnecessarily, which increases costs and operational complexity. Additionally, the writer endpoint does not distribute queries among replicas.

Direct reporting queries to the instance endpoints of the three high-capacity replicas: This is incorrect because managing connections manually to individual instance endpoints is inefficient and does not provide automated query distribution across the replicas.

References:
https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Endpoints.html
https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Replication.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Question 38Skipped

A web application is being deployed on an Amazon ECS cluster using the Fargate launch type. The application is expected to receive a large volume of traffic initially. The company wishes to ensure that performance is good for the launch and that costs reduce as demand decreases

What should a solutions architect recommend?

Correct answer

Use Amazon ECS Service Auto Scaling with target tracking policies to scale when an Amazon CloudWatch alarm is breached.

Use Amazon EC2 Auto Scaling with simple scaling policies to scale when an Amazon CloudWatch alarm is breached.

Use an AWS Lambda function to scale Amazon ECS based on metric breaches that trigger an Amazon CloudWatch alarm.

Use Amazon EC2 Auto Scaling to scale out on a schedule and back in once the load decreases.

Overall explanation

Amazon ECS uses the AWS Application Auto Scaling service to scales tasks. This is configured through Amazon ECS using Amazon ECS Service Auto Scaling.

A Target Tracking Scaling policy increases or decreases the number of tasks that your service runs based on a target value for a specific metric. For example, in the image below the tasks will be scaled when the average CPU breaches 80% (as reported by CloudWatch):

CORRECT: "Use Amazon ECS Service Auto Scaling with target tracking policies to scale when an Amazon CloudWatch alarm is breached" is the correct answer.

INCORRECT: "Use Amazon EC2 Auto Scaling with simple scaling policies to scale when an Amazon CloudWatch alarm is breached" is incorrect

INCORRECT: "Use Amazon EC2 Auto Scaling to scale out on a schedule and back in once the load decreases" is incorrect

INCORRECT: "Use an AWS Lambda function to scale Amazon ECS based on metric breaches that trigger an Amazon CloudWatch alarm" is incorrect

References:

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-auto-scaling.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

Domain

AWS Compute

Question 39Skipped

A company runs an internal application for logging customer support information. The application runs on Amazon EC2 instances in an Auto Scaling group. The ASG scales up to 10 instances during business hours and scales down to 2 instances overnight. Staff have complained of poor performance at the beginning of the business day.

How should a Solutions Architect configure the Auto Scaling group to resolve the performance issues whilst minimizing costs?

Correct answer

Implement a scheduled action that sets the desired capacity to 10 before business hours begin.

Implement a scheduled action that sets the minimum and maximum capacity to 10 before business hours begin.

Implement a step scaling action with a lower CPU threshold and decrease the cooldown period.

Implement a target tracking action with a lower CPU threshold, and decrease the cooldown period.

Overall explanation

Scheduled scaling allows you to set your own scaling schedule. In this example it means the Solutions Architect can configure the scaling action to take place shortly before business hours begin and that will ensure adequate capacity exists from the very beginning of the business day.

In this example below the scheduled scaling policy is configured to scale at 08:45am daily with a desired count of 15. This will result in 15 instances being available shortly after.

CORRECT: "Implement a scheduled action that sets the desired capacity to 10 before business hours begin" is the correct answer.

INCORRECT: "Implement a scheduled action that sets the minimum and maximum capacity to 10 before business hours begin" is incorrect. The minimum and maximums define how many instances CAN run; the desired capacity sets how many you WANT to be running.

INCORRECT: "Implement a step scaling action with a lower CPU threshold and decrease the cooldown period" is incorrect. A cooldown period will result in faster scaling and a lower CPU threshold will cause scaling to happen at a lower loads. However, there is still a lag time before the instances are available to service users and this could result in too many instances running for the rest of the day.

INCORRECT: "Implement a target tracking action with a lower CPU threshold, and decrease the cooldown period" is incorrect. As above, this may achieve faster scaling at lower loads but is also going to be higher cost and applications may still not be ready for the beginning of the business day.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/schedule_time.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2/

Domain

AWS Compute

Question 40Skipped

A healthcare company is building a patient records management application that uses a relational database to store user data and configuration details. The company expects steady growth in the number of patients. The database workload is expected to be variable and read-heavy, with occasional write operations. The company wants to cost-optimize the database solution while ensuring the necessary performance for its workload.

Which solution will meet these requirements MOST cost-effectively?

Deploy the database on Amazon RDS. Use magnetic storage with Multi-AZ deployments to ensure durability and handle the read-heavy workload.

Correct answer

Deploy the database on Amazon Aurora Serverless v2 to automatically scale the database capacity based on actual usage and handle fluctuations in workload.

Deploy the database on Amazon RDS. Use General Purpose SSD (gp3) storage with a read replica to ensure consistent performance for read and write operations.

Deploy the database on Amazon DynamoDB. Use on-demand capacity mode to automatically adjust throughput and accommodate workload changes.

Overall explanation

Deploy the database on Amazon Aurora Serverless v2 to automatically scale the database capacity based on actual usage and handle fluctuations in workload: This is correct because Aurora Serverless v2 is a cost-effective option that dynamically adjusts capacity to meet workload demands. It is particularly suited for variable workloads, offering the performance of Aurora with a pay-per-use pricing model.

Deploy the database on Amazon RDS. Use General Purpose SSD (gp3) storage with a read replica to ensure consistent performance for read and write operations: This is incorrect because while using a read replica can help with read-heavy workloads, it introduces additional costs and management overhead compared to Aurora Serverless v2.

Deploy the database on Amazon DynamoDB. Use on-demand capacity mode to automatically adjust throughput and accommodate workload changes: This is incorrect because DynamoDB is a NoSQL database that is not designed for relational database requirements. While it is highly scalable, it does not meet the company's need for a relational database solution.

Deploy the database on Amazon RDS. Use magnetic storage with Multi-AZ deployments to ensure durability and handle the read-heavy workload: This is incorrect because magnetic storage is outdated, has limited performance, and is not cost-effective for a read-heavy workload.

References:
https://docs.aws.amazon.com/rds/index.html
https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Question 41Skipped

A fitness application company is launching a platform to track user activity, workout logs, and personalized settings. The database must support structured data, allow for transactions between related data, and dynamically scale to handle unpredictable traffic spikes during peak hours. The solution must also support automated backups and minimize operational management.

Which solution will meet these requirements MOST cost-effectively?

Deploy an Amazon RDS MySQL instance in a multi-AZ configuration. Use provisioned IOPS storage and configure automated backups to Amazon S3 Glacier Flexible Retrieval for long-term retention.

Correct answer

Use Amazon Aurora Serverless v2 to store the data. Enable serverless auto-scaling and configure automated backups to Amazon S3 with a 7-day retention period.

Deploy an open-source database on Amazon EC2 Spot Instances in an Auto Scaling group. Configure daily backups to Amazon S3 Intelligent-Tiering for cost optimization.

Use Amazon DynamoDB with on-demand capacity mode to handle fluctuating traffic. Enable DynamoDB Point-in-Time Recovery (PITR) for automated backups.

Overall explanation

Use Amazon Aurora Serverless v2 to store the data. Enable serverless auto-scaling and configure automated backups to Amazon S3 with a 7-day retention period: This is correct because Aurora Serverless supports relational data, transactions, and complex queries while scaling seamlessly to meet workload demands. It integrates natively with Amazon S3 for automated backups, eliminating operational overhead while remaining cost-effective.

Use Amazon DynamoDB with on-demand capacity mode to handle fluctuating traffic. Enable DynamoDB Point-in-Time Recovery (PITR) for automated backups: This is incorrect because, while DynamoDB is cost-effective and highly scalable, it lacks native support for relational data and transactions, which are required in this scenario. For structured data with relational dependencies, Aurora Serverless is the better fit.

Deploy an open-source database on Amazon EC2 Spot Instances in an Auto Scaling group. Configure daily backups to Amazon S3 Intelligent-Tiering for cost optimization: This is incorrect because managing an open-source database on EC2 Spot Instances introduces operational complexity and risks interruptions. Additionally, Spot Instances are less suitable for workloads requiring high availability.

Deploy an Amazon RDS MySQL instance in a multi-AZ configuration. Use provisioned IOPS storage and configure automated backups to Amazon S3 Glacier Flexible Retrieval for long-term retention: This is incorrect because provisioned IOPS increases costs unnecessarily, and Glacier Flexible Retrieval is unsuitable for backups requiring quick access.

References:
https://aws.amazon.com/rds/aurora/serverless/
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/backuprestore_PITR.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-aurora/

Domain

AWS Database

Question 42Skipped

A company allows its developers to attach existing IAM policies to existing IAM roles to enable faster experimentation and agility. However, the security operations team is concerned that the developers could attach the existing administrator policy, which would allow the developers to circumvent any other security policies.

How should a solutions architect address this issue?

Create an Amazon SNS topic to send an alert every time a developer creates a new policy

Correct answer

Set an IAM permissions boundary on the developer IAM role that explicitly denies attaching the administrator policy

Prevent the developers from attaching any policies and assign all IAM duties to the security operations team

Use service control policies to disable IAM activity across all accounts in the organizational unit

Overall explanation

The permissions boundary for an IAM entity (user or role) sets the maximum permissions that the entity can have. This can change the effective permissions for that user or role. The effective permissions for an entity are the permissions that are granted by all the policies that affect the user or role. Within an account, the permissions for an entity can be affected by identity-based policies, resource-based policies, permissions boundaries, Organizations SCPs, or session policies.

Therefore, the solutions architect can set an IAM permissions boundary on the developer IAM role that explicitly denies attaching the administrator policy.

CORRECT: "Set an IAM permissions boundary on the developer IAM role that explicitly denies attaching the administrator policy" is the correct answer.

INCORRECT: "Create an Amazon SNS topic to send an alert every time a developer creates a new policy" is incorrect as this would mean investigating every incident which is not an efficient solution.

INCORRECT: "Use service control policies to disable IAM activity across all accounts in the organizational unit" is incorrect as this would prevent the developers from being able to work with IAM completely.

INCORRECT: "Prevent the developers from attaching any policies and assign all IAM duties to the security operations team" is incorrect as this is not necessary. The requirement is to allow developers to work with policies, the solution needs to find a secure way of achieving this.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-iam/

Domain

AWS Security, Identity, & Compliance

Question 43Skipped

An application upgrade caused some issues with stability. The application owner enabled logging and has generated a 5 GB log file in an Amazon S3 bucket. The log file must be securely shared with the application vendor to troubleshoot the issues.

What is the MOST secure way to share the log file?

Create an IAM user for the vendor to provide access to the S3 bucket and the application. Enforce multi-factor authentication.

Create access keys using an administrative account and share the access key ID and secret access key with the vendor.

Correct answer

Generate a presigned URL and ask the vendor to download the log file before the URL expires.

Enable default encryption for the bucket and public access. Provide the S3 URL of the file to the vendor.

Overall explanation

A presigned URL gives you access to the object identified in the URL. When you create a presigned URL, you must provide your security credentials and then specify a bucket name, an object key, an HTTP method (PUT for uploading objects), and an expiration date and time. The presigned URLs are valid only for the specified duration. That is, you must start the action before the expiration date and time.

This is the most secure way to provide the vendor with time-limited access to the log file in the S3 bucket.

CORRECT: "Generate a presigned URL and ask the vendor to download the log file before the URL expires" is the correct answer.

INCORRECT: "Create an IAM user for the vendor to provide access to the S3 bucket and the application. Enforce multi-factor authentication" is incorrect. This is less secure as you have to create an account to access AWS and then ensure you lock down the account appropriately.

INCORRECT: "Create access keys using an administrative account and share the access key ID and secret access key with the vendor" is incorrect. This is extremely insecure as the access keys will provide administrative permissions to AWS and should never be shared.

INCORRECT: "Enable default encryption for the bucket and public access. Provide the S3 URL of the file to the vendor" is incorrect. Encryption does not assist here as the bucket would be public and anyone could access it.

References:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 44Skipped

An application has been migrated to Amazon EC2 Linux instances. The EC2 instances run several 1-hour tasks on a schedule. There is no common programming language among these tasks, as they were written by different teams. Currently, these tasks run on a single instance, which raises concerns about performance and scalability. To resolve these concerns, a solutions architect must implement a solution.

Which solution will meet these requirements with the LEAST Operational overhead?

Correct answer

Create an Amazon Machine Image (AMI) of the EC2 instance that runs the tasks. Create an Auto Scaling group with the AMI to run multiple copies of the instance.

Use AWS Batch to run the tasks as jobs. Schedule the jobs by using Amazon EventBridge (Amazon CloudWatch Events).

Copy the tasks into AWS Lambda functions. Schedule the Lambda functions by using Amazon EventBridge (Amazon CloudWatch Events).

Convert the EC2 instance to a container. Use AWS App Runner to create the container on demand to run the tasks as jobs.

Overall explanation

The best solution is to create an AMI of the EC2 instance, and then use it as a template for which to launch additional instances using an Auto Scaling Group. This removes the issues of performance, scalability, and redundancy by allowing the EC2 instances to automatically scale and be launched across multiple Availability Zones.

CORRECT: "Create an Amazon Machine Image (AMI) of the EC2 instance that runs the tasks. Create an Auto Scaling group with the AMI to run multiple copies of the instance" is the correct answer (as explained above.)

INCORRECT: "Use AWS Batch to run the tasks as jobs. Schedule the jobs by using Amazon EventBridge (Amazon CloudWatch Events)" is incorrect. AWS Batch is designed to run jobs across multiple instances, there would be less operational overhead by creating an AMI instead.

INCORRECT: "Convert the EC2 instance to a container. Use AWS App Runner to create the container on demand to run the tasks as jobs" is incorrect. Converting your EC2 instances to containers is not the easiest way to achieve this task.

INCORRECT: "Copy the tasks into AWS Lambda functions. Schedule the Lambda functions by using Amazon EventBridge (Amazon CloudWatch Events)" is incorrect. The maximum execution time for a Lambda function is 15 minutes, making it unsuitable for tasks running on a one-hour schedule.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/autoscaling-load-balancer.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

Domain

AWS Compute

Question 45Skipped

Objects uploaded to Amazon S3 are initially accessed frequently for a period of 30 days. Then, objects are infrequently accessed for up to 90 days. After that, the objects are no longer needed.

How should lifecycle management be configured?

Transition to REDUCED_REDUNDANCY after 30 days. After 90 days expire the objects

Correct answer

Transition to ONEZONE_IA after 30 days. After 90 days expire the objects

Transition to STANDARD_IA after 30 days. After 90 days transition to GLACIER

Transition to STANDARD_IA after 30 days. After 90 days transition to ONEZONE_IA

Overall explanation

In this scenario we need to keep the objects in the STANDARD storage class for 30 days as the objects are being frequently accessed. We can configure a lifecycle action that then transitions the objects to INTELLIGENT_TIERING, STANDARD_IA, or ONEZONE_IA. After that we don’t need the objects so they can be expired.

All other options do not meet the stated requirements or are not supported lifecycle transitions. For example:

· You cannot transition to REDUCED_REDUNDANCY from any storage class.

· Transitioning from STANDARD_IA to ONEZONE_IA is possible but we do not want to keep the objects so it incurs unnecessary costs.

· Transitioning to GLACIER is possible but again incurs unnecessary costs.

CORRECT: "Transition to ONEZONE_IA after 30 days. After 90 days expire the objects " is the correct answer.

INCORRECT: "Transition to STANDARD_IA after 30 days. After 90 days transition to GLACIER" is incorrect.

INCORRECT: "Transition to STANDARD_IA after 30 days. After 90 days transition to ONEZONE_IA" is incorrect.

INCORRECT: "Transition to REDUCED_REDUNDANCY after 30 days. After 90 days expire the objects " is incorrect.

References:

https://docs.aws.amazon.com/AmazonS3/latest/dev/lifecycle-transition-general-considerations.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 46Skipped

A company is planning to upload a large quantity of sensitive data to Amazon S3. The company’s security department require that the data is encrypted before it is uploaded.

Which option meets these requirements?

Use server-side encryption with keys stored in KMS.

Correct answer

Use client-side encryption with a master key stored in AWS KMS.

Use server-side encryption with customer-provided encryption keys.

Use client-side encryption with Amazon S3 managed encryption keys.

Overall explanation

The requirement is that the objects must be encrypted before they are uploaded. The only option presented that meets this requirement is to use client-side encryption. You then have two options for the keys you use to perform the encryption:

• Use a customer master key (CMK) stored in AWS Key Management Service (AWS KMS).

• Use a master key that you store within your application.

In this case the correct answer is to use an AWS KMS key. Note that you cannot use client-side encryption with keys managed by Amazon S3.

CORRECT: "Use client-side encryption with a master key stored in AWS KMS" is the correct answer.

INCORRECT: "Use client-side encryption with Amazon S3 managed encryption keys" is incorrect. You cannot use S3 managed keys with client-side encryption.

INCORRECT: "Use server-side encryption with customer-provided encryption keys" is incorrect. With this option the encryption takes place after uploading to S3.

INCORRECT: "Use server-side encryption with keys stored in KMS" is incorrect. With this option the encryption takes place after uploading to S3.

References:

https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 47Skipped

A company operates an e-commerce application hosted on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). Customer transactions and order information are stored in an Amazon Aurora PostgreSQL DB cluster. The company wants to implement a disaster recovery (DR) plan to prepare for Region-wide outages. The DR solution must provide a recovery time objective (RTO) of 30 minutes. The DR infrastructure does not need to be operational unless the primary Region becomes unavailable.

Which solution will meet these requirements?

Deploy an ALB and Auto Scaling group in a second AWS Region. Set the Auto Scaling group desired capacity to a minimum value. Use Amazon RDS Cross-Region Read Replicas to replicate the Aurora DB cluster. Configure Amazon Route 53 for active-active failover.

Use AWS Backup to schedule regular backups of the Aurora DB cluster and EC2 instances. In the second AWS Region, create infrastructure using AWS CloudFormation templates upon failure. Configure Amazon Route 53 with a failover policy to redirect traffic.

Correct answer

Deploy the DR infrastructure in a second AWS Region, including an ALB and an Auto Scaling group with desired and maximum capacities set to zero. Convert the Aurora PostgreSQL DB cluster into an Aurora global database. Use Amazon Route 53 to configure active-passive failover.

Deploy the DR infrastructure in a second AWS Region. Include an Aurora DB cluster configured with Cross-Region Replication and an ALB with the same configuration. Set up an Amazon CloudWatch alarm to increase the Auto Scaling group desired capacity upon failure.

Overall explanation

Deploy the DR infrastructure in a second AWS Region, including an ALB and an Auto Scaling group with desired and maximum capacities set to zero. Convert the Aurora PostgreSQL DB cluster into an Aurora global database. Use Amazon Route 53 to configure active-passive failover: This approach provides minimal operational overhead while meeting the 30-minute RTO. Aurora global database ensures replication with low latency, while Route 53 handles DNS failover.

Deploy an ALB and Auto Scaling group in a second AWS Region. Set the Auto Scaling group desired capacity to a minimum value. Use Amazon RDS Cross-Region Read Replicas to replicate the Aurora DB cluster. Configure Amazon Route 53 for active-active failover: This solution increases costs because active-active failover is unnecessary. Additionally, using read replicas does not provide write capabilities during a failover.

Use AWS Backup to schedule regular backups of the Aurora DB cluster and EC2 instances. In the second AWS Region, create infrastructure using AWS CloudFormation templates upon failure. Configure Amazon Route 53 with a failover policy to redirect traffic: While this reduces costs, it increases the RTO significantly due to the need to create infrastructure and restore data after a failure.

Deploy the DR infrastructure in a second AWS Region. Include an Aurora DB cluster configured with Cross-Region Replication and an ALB with the same configuration. Set up an Amazon CloudWatch alarm to increase the Auto Scaling group desired capacity upon failure: This is less operationally efficient compared to the Aurora global database. Additionally, the solution introduces unnecessary complexity.

References:
https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-route-53/

Domain

AWS Compute

Question 48Skipped

A group of business analysts perform read-only SQL queries on an Amazon RDS database. The queries have become quite numerous and the database has experienced some performance degradation. The queries must be run against the latest data. A Solutions Architect must solve the performance problems with minimal changes to the existing web application.

What should the Solutions Architect recommend?

Load the data into an Amazon Redshift cluster and instruct the business analysts to run their queries against the cluster.

Correct answer

Create a read replica of the primary database and instruct the business analysts to direct queries to the replica.

Load the data into Amazon ElastiCache and instruct the business analysts to run their queries against the ElastiCache endpoint.

Export the data to Amazon S3 and instruct the business analysts to run their queries using Amazon Athena.

Overall explanation

The performance issues can be easily resolved by offloading the SQL queries the business analysts are performing to a read replica. This ensures that data that is being queries is up to date and the existing web application does not require any modifications to take place.

CORRECT: "Create a read replica of the primary database and instruct the business analysts to direct queries to the replica" is the correct answer.

INCORRECT: "Export the data to Amazon S3 and instruct the business analysts to run their queries using Amazon Athena" is incorrect. The data must be the latest data and this method would therefore require constant exporting of the data.

INCORRECT: "Load the data into an Amazon Redshift cluster and instruct the business analysts to run their queries against the cluster" is incorrect. This is another solution that requires exporting the loading the data which means over time it will become out of date.

INCORRECT: "Load the data into Amazon ElastiCache and instruct the business analysts to run their queries against the ElastiCache endpoint" is incorrect. It will be much easier to create a read replica. ElastiCache requires updates to the application code so should be avoided in this example.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

Domain

AWS Database

Question 49Skipped

A university operates its critical IT services, including authentication and DNS, from an on-premises data center. The data center is connected to AWS using AWS Direct Connect (DX). The university is onboarding additional AWS accounts for different departments, all of which need secure and consistent access to the on-premises services.

The university wants a scalable and cost-effective solution that minimizes operational overhead.

What should a solutions architect implement to meet these requirements?

Establish a VPC peering connection between the Direct Connect VPC and each new AWS account. Configure security groups to allow traffic to flow between the VPCs and the on-premises services.

Deploy an AWS Site-to-Site VPN connection from the on-premises data center to each new AWS account. Configure route tables to forward traffic to the VPN.

Create a Direct Connect connection in each new AWS account and configure route tables in each VPC to send traffic to the on-premises data center.

Correct answer

Configure AWS Transit Gateway to connect the Direct Connect gateway to the VPCs in the new accounts. Route network traffic from the new accounts to the on-premises data center through the transit gateway.

Overall explanation

Configure AWS Transit Gateway to connect the Direct Connect gateway to the VPCs in the new accounts. Route network traffic from the new accounts to the on-premises data center through the transit gateway: This is correct because AWS Transit Gateway enables scalable connectivity between multiple VPCs and on-premises networks. By connecting the Direct Connect gateway to the transit gateway, traffic from new AWS accounts can securely access on-premises services with minimal operational overhead.

Deploy an AWS Site-to-Site VPN connection from the on-premises data center to each new AWS account. Configure route tables to forward traffic to the VPN: This is incorrect because setting up individual VPN connections for each account introduces significant operational complexity and ongoing costs. Direct Connect with a transit gateway is more scalable and efficient.

Establish a VPC peering connection between the Direct Connect VPC and each new AWS account. Configure security groups to allow traffic to flow between the VPCs and the on-premises services: This is incorrect because VPC peering is not scalable for managing multiple AWS accounts. Transit Gateway is designed for such use cases and reduces operational overhead.

Create a Direct Connect connection in each new AWS account and configure route tables in each VPC to send traffic to the on-premises data center: This is incorrect because creating multiple Direct Connect connections is expensive and unnecessary. A single Direct Connect gateway connected to a transit gateway can serve multiple accounts.

References:
https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-transit-gateway.html
https://aws.amazon.com/transit-gateway/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 50Skipped

A company runs its critical storage application in the AWS Cloud. The application uses Amazon S3 in two AWS Regions. The company wants the application to send remote user data to the nearest S3 bucket with no public network congestion. The company also wants the application to fail over with the least amount of management of Amazon S3.

Which solution will meet these requirements?

Use an active-passive configuration with S3 Multi-Region Access Points. Create a global endpoint for each of the Regions.

Correct answer

Set up Amazon S3 to use Multi-Region Access Points in an active-active configuration with a single global endpoint. Configure S3 Cross-Region Replication.

Implement an active-active design between the two Regions. Configure the application to use the regional S3 endpoints closest to the user.

Send user data to the regional S3 endpoints closest to the user. Configure an S3 cross-account replication rule to keep the S3 buckets synchronized.

Overall explanation

Set up Amazon S3 to use Multi-Region Access Points in an active-active configuration with a single global endpoint. Configure S3 Cross-Region Replication: This is correct because S3 Multi-Region Access Points allow the application to route user requests automatically to the nearest S3 bucket based on network conditions and proximity, minimizing latency and avoiding public network congestion. It also provides failover capabilities with minimal management effort.

Implement an active-active design between the two Regions. Configure the application to use the regional S3 endpoints closest to the user: This is incorrect because this solution requires the application to manage the routing and failover logic, increasing operational overhead.

Use an active-passive configuration with S3 Multi-Region Access Points. Create a global endpoint for each of the Regions: This is incorrect because active-passive configurations introduce delays in failover and require more manual intervention.

Send user data to the regional S3 endpoints closest to the user. Configure an S3 cross-account replication rule to keep the S3 buckets synchronized: This is incorrect because this approach does not optimize routing and requires manual failover, which increases management overhead.

References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/multi-region-access-points.html
https://aws.amazon.com/s3/features/#Global_Endpoints

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-s3-and-glacier/

Domain

AWS Storage

Question 51Skipped

An application on Amazon Elastic Container Service (ECS) performs data processing in two parts. The second part takes much longer to complete. How can an Architect decouple the data processing from the backend application component?

Process both parts using the same ECS task. Create an Amazon Kinesis Firehose stream

Process each part using a separate ECS task. Create an Amazon SNS topic and send a notification when the processing completes

Create an Amazon DynamoDB table and save the output of the first part to the table

Correct answer

Process each part using a separate ECS task. Create an Amazon SQS queue

Overall explanation

Processing each part using a separate ECS task may not be essential but means you can separate the processing of the data. An Amazon Simple Queue Service (SQS) is used for decoupling applications. It is a message queue on which you place messages for processing by application components. In this case you can process each data processing part in separate ECS tasks and have them write an Amazon SQS queue. That way the backend can pick up the messages from the queue when they’re ready and there is no delay due to the second part not being complete.

CORRECT: "Process each part using a separate ECS task. Create an Amazon SQS queue" is the correct answer.

INCORRECT: "Process both parts using the same ECS task. Create an Amazon Kinesis Firehose stream" is incorrect. Amazon Kinesis Firehose is used for streaming data. This is not an example of streaming data. In this case SQS is better as a message can be placed on a queue to indicate that the job is complete and ready to be picked up by the backend application component.

INCORRECT: "Process each part using a separate ECS task. Create an Amazon SNS topic and send a notification when the processing completes" is incorrect. Amazon Simple Notification Service (SNS) can be used for sending notifications. It is useful when you need to notify multiple AWS services. In this case an Amazon SQS queue is a better solution as there is no mention of multiple AWS services and this is an ideal use case for SQS.

INCORRECT: "Create an Amazon DynamoDB table and save the output of the first part to the table" is incorrect. Amazon DynamoDB is unlikely to be a good solution for this requirement. There is a limit on the maximum amount of data that you can store in an entry in a DynamoDB table.

References:

https://digitalcloud.training/aws-application-integration-services/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Compute

Question 52Skipped

A company hosts a monolithic web application on an Amazon EC2 instance. Application users have recently reported poor performance at specific times. Analysis of Amazon CloudWatch metrics shows that CPU utilization is 100% during the periods of poor performance.
The company wants to resolve this performance issue and improve application availability.

Which combination of steps will meet these requirements MOST cost-effectively? (Select TWO.)

Correct selection

Create an Auto Scaling group and an Application Load Balancer to scale horizontally.

Use AWS Compute Optimizer to obtain a recommendation for an instance type to scale horizontally.

Correct selection

Use AWS Compute Optimizer to obtain a recommendation for an instance type to scale vertically.

Create an Amazon Machine Image (AMI) from the web server. Reference the AMI in a new launch template.

Create an Auto Scaling group and an Application Load Balancer to scale vertically.

Overall explanation

Use AWS Compute Optimizer to obtain a recommendation for an instance type to scale vertically: This is correct because AWS Compute Optimizer can suggest a more appropriate EC2 instance type with adequate resources for improved performance when scaling vertically.

Create an Auto Scaling group and an Application Load Balancer to scale horizontally: This is correct because horizontal scaling improves application availability by adding multiple EC2 instances. The Application Load Balancer ensures traffic is distributed evenly across instances.

Create an Amazon Machine Image (AMI) from the web server. Reference the AMI in a new launch template: This is incorrect because creating an AMI and a launch template alone does not address scaling or performance issues without integrating them into an Auto Scaling group.

Create an Auto Scaling group and an Application Load Balancer to scale vertically: This is incorrect because vertical scaling is achieved by changing the instance type, not by using Auto Scaling groups or load balancers.

Use AWS Compute Optimizer to obtain a recommendation for an instance type to scale horizontally: This is incorrect because horizontal scaling focuses on adding multiple instances, which does not require Compute Optimizer recommendations for instance types.

References:
https://docs.aws.amazon.com/autoscaling/ec2/userguide/what-is-amazon-ec2-auto-scaling.html
https://aws.amazon.com/compute-optimizer

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-elastic-load-balancing-aws-elb/

https://digitalcloud.training/amazon-ec2-auto-scaling/

Domain

AWS Compute

Question 53Skipped

A company operates a globally accessed video-sharing platform where users can upload, view, and download videos from their mobile devices. The platform's static website is hosted in an Amazon S3 bucket.

Due to the platform’s rapid growth, users are experiencing increased latency during video uploads and downloads. The company needs to improve the performance of the platform while minimizing the complexity of the implementation.

Which solution will meet these requirements with the LEAST implementation effort?

Set up AWS Global Accelerator for the S3 bucket to optimize network routing. Configure the platform to use the Global Accelerator endpoint instead of the S3 bucket.

Deploy Amazon EC2 instances in multiple AWS Regions and migrate the platform to these instances. Use an Application Load Balancer to distribute traffic across the instances and configure AWS Global Accelerator for improved global performance.

Configure an Amazon CloudFront distribution with the S3 bucket as the origin to accelerate downloads. Use CloudFront for uploads as well. Create additional S3 buckets in multiple Regions and set up replication rules to sync user content between buckets. Redirect users to the closest bucket for downloads.

Correct answer

Configure an Amazon CloudFront distribution for the S3 bucket to accelerate download performance. Enable S3 Transfer Acceleration to enhance upload performance.

Overall explanation

Configure an Amazon CloudFront distribution for the S3 bucket to accelerate download performance. Enable S3 Transfer Acceleration to enhance upload performance: This is correct because Amazon CloudFront is a global content delivery network (CDN) that improves download performance by caching content closer to users. S3 Transfer Acceleration reduces upload latency by utilizing optimized AWS edge locations to accelerate the data transfer from the user to the S3 bucket. Together, these services provide a cost-effective and low-effort solution to improve the platform's performance.

Deploy Amazon EC2 instances in multiple AWS Regions and migrate the platform to these instances. Use an Application Load Balancer to distribute traffic across the instances and configure AWS Global Accelerator for improved global performance: This is incorrect because migrating the platform to EC2 instances and configuring Global Accelerator is significantly more complex and requires ongoing maintenance. This solution involves more implementation effort compared to using managed AWS services like CloudFront and S3 Transfer Acceleration.

Configure an Amazon CloudFront distribution with the S3 bucket as the origin to accelerate downloads. Use CloudFront for uploads as well. Create additional S3 buckets in multiple Regions and set up replication rules to sync user content between buckets. Redirect users to the closest bucket for downloads: This is incorrect because adding multiple S3 buckets and setting up replication rules increases the complexity of the solution. While CloudFront can accelerate uploads and downloads, replicating buckets adds unnecessary operational overhead when S3 Transfer Acceleration can address upload latency more efficiently.

Set up AWS Global Accelerator for the S3 bucket to optimize network routing. Configure the platform to use the Global Accelerator endpoint instead of the S3 bucket: This is incorrect because AWS Global Accelerator does not directly support S3 buckets as an endpoint. Configuring Global Accelerator would require additional infrastructure, such as custom endpoints, increasing the effort and complexity without directly solving the latency issues.

References:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html

https://docs.aws.amazon.com/AmazonS3/latest/userguide/transfer-acceleration.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Networking & Content Delivery

Question 54Skipped

A company is using AWS DataSync to migrate millions of files from an on-premises system to AWS. The files are 10 KB in size on average. The company wants to use Amazon S3 for file storage. For the first year after the migration, the files will be accessed once or twice and must be immediately available. After 1 year, the files must be archived for at least 7 years.

Which solution will meet these requirements MOST cost-effectively?

Use an archive tool to group the files into large objects. Use DataSync to migrate the objects. Store the objects in S3 Glacier Instant Retrieval for the first year. Use a lifecycle configuration to transition the files to S3 Glacier Deep Archive after 1 year with a retention period of 7 years.

Correct answer

Configure a DataSync task to transfer the files to S3 Standard-Infrequent Access (S3 Standard-IA). Use a lifecycle configuration to transition the files to S3 Deep Archive after 1 year with a retention period of 7 years.

Configure the destination storage class for the files as S3 Glacier Instant Retrieval. Use a lifecycle policy to transition the files to S3 Glacier Flexible Retrieval after 1 year with a retention period of 7 years.

Use an archive tool to group the files into large objects. Use DataSync to copy the objects to S3 Standard-Infrequent Access (S3 Standard-IA). Use a lifecycle configuration to transition the files to S3 Glacier Instant Retrieval after 1 year with a retention period of 7 years.

Overall explanation

Configure a DataSync task to transfer the files to S3 Standard-Infrequent Access (S3 Standard-IA). Use a lifecycle configuration to transition the files to S3 Deep Archive after 1 year with a retention period of 7 years:

This is correct because S3 Standard-IA is cost-effective for infrequently accessed data. After 1 year, transitioning to S3 Deep Archive is the most cost-effective choice for long-term storage with infrequent access requirements.

Use an archive tool to group the files into large objects. Use DataSync to migrate the objects. Store the objects in S3 Glacier Instant Retrieval for the first year. Use a lifecycle configuration to transition the files to S3 Glacier Deep Archive after 1 year with a retention period of 7 years:

This is incorrect because grouping files into large objects increases operational overhead, and S3 Glacier Instant Retrieval is more expensive than S3 Standard-IA for the initial storage.

Use an archive tool to group the files into large objects. Use DataSync to copy the objects to S3 Standard-Infrequent Access (S3 Standard-IA). Use a lifecycle configuration to transition the files to S3 Glacier Instant Retrieval after 1 year with a retention period of 7 years:

This is incorrect because transitioning files to S3 Glacier Instant Retrieval is unnecessary and less cost-effective compared to S3 Deep Archive.

Configure the destination storage class for the files as S3 Glacier Instant Retrieval. Use a lifecycle policy to transition the files to S3 Glacier Flexible Retrieval after 1 year with a retention period of 7 years:

This is incorrect because S3 Glacier Instant Retrieval is not needed for the first year. S3 Standard-IA provides a more cost-effective solution for the use case.

References:
https://aws.amazon.com/s3/storage-classes/
https://aws.amazon.com/datasync/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-migration-services/

Domain

AWS Storage

Question 55Skipped

A company runs an application in an Amazon VPC that requires access to an Amazon Elastic Container Service (Amazon ECS) cluster that hosts an application in another VPC. The company’s security team requires that all traffic must not traverse the internet.

Which solution meets this requirement?

Create a Network Load Balancer and AWS PrivateLink endpoint for Amazon ECS in the VPC that hosts the ECS cluster.

Configure an Amazon Route 53 private hosted zone for each VPC. Use private records to resolve internal IP addresses in each VPC.

Correct answer

Create a Network Load Balancer in one VPC and an AWS PrivateLink endpoint for Amazon ECS in another VPC.

Configure a gateway endpoint for Amazon ECS. Update the route table to include an entry pointing to the ECS cluster.

Overall explanation

The correct solution is to use AWS PrivateLink in a service provider model. In this configuration a network load balancer will be implemented in the service provider VPC (the one with the ECS cluster in this example), and a PrivateLink endpoint will be created in the consumer VPC (the one with the company’s application).

CORRECT: "Create a Network Load Balancer in one VPC and an AWS PrivateLink endpoint for Amazon ECS in another VPC" is the correct answer.

INCORRECT: "Create a Network Load Balancer and AWS PrivateLink endpoint for Amazon ECS in the VPC that hosts the ECS cluster" is incorrect. The endpoint should be in the consumer VPC, not the service provider VPC (see the diagram above).

INCORRECT: "Configure a gateway endpoint for Amazon ECS. Update the route table to include an entry pointing to the ECS cluster" is incorrect. You cannot use a gateway endpoint to connect to a private service. Gateway endpoints are only for S3 and DynamoDB.

INCORRECT: "Configure an Amazon Route 53 private hosted zone for each VPC. Use private records to resolve internal IP addresses in each VPC" is incorrect. This does not provide a mechanism for resolving each other’s addresses and there’s no method of internal communication using private IPs such as VPC peering.

References:

https://aws.amazon.com/privatelink/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 56Skipped

A retail company runs its order processing system on AWS. The system uses an Amazon RDS for MySQL Multi-AZ database cluster as its backend. The company must retain database backups for 30 days to meet compliance requirements. The company uses both automated RDS backups and manual backups for specific points in time. The company wants to enforce the 30-day retention policy for all backups while ensuring that both automated and manual backups created within the last 30 days are preserved. The solution must be cost-effective and require minimal operational effort.

Which solution will meet these requirements MOST cost-effectively?

Disable RDS automated backups. Use AWS Backup to create and retain daily backups for 30 days. Use AWS Backup lifecycle policies to delete backups older than 30 days.

Correct answer

Configure the RDS backup retention policy to 30 days for automated backups. Use a script to identify and delete manual backups that are older than 30 days.

Use AWS Backup to enforce a 30-day retention policy for automated backups. Configure an AWS Lambda function to identify and delete manual backups older than 30 days.

Retain the current configuration with both automated and manual backups. Use Amazon CloudWatch Events with AWS Lambda to automatically delete both automated and manual backups that are older than 30 days.

Overall explanation

Configure the RDS backup retention policy to 30 days for automated backups. Use a script to identify and delete manual backups that are older than 30 days: This is correct because RDS backup retention policies can only be applied to automated backups. Manual backups must be managed separately. Using a script to identify and delete older manual backups ensures compliance without additional costs. Use AWS Backup to enforce a 30-day retention policy for automated backups. Configure an AWS Lambda function to identify and delete manual backups older than 30 days: This is incorrect because AWS Backup is not required for RDS automated backups, which natively support retention policies. Using Lambda for manual backup deletion adds unnecessary operational overhead. Disable RDS automated backups. Use AWS Backup to create and retain daily backups for 30 days. Use AWS Backup lifecycle policies to delete backups older than 30 days: This is incorrect because disabling automated backups introduces operational risks and does not provide a cost-effective solution compared to the built-in RDS backup retention feature. Retain the current configuration with both automated and manual backups. Use Amazon CloudWatch Events with AWS Lambda to automatically delete both automated and manual backups that are older than 30 days: This is incorrect because CloudWatch Events and Lambda add complexity and operational overhead compared to simply using RDS retention policies and a script for manual backups.

References:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithDBInstanceAutomatedBackups.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

Domain

AWS Database

Question 57Skipped

A pharmaceutical company is migrating its legacy inventory management system to AWS. The system runs on Microsoft Windows Server and uses shared block storage for data consistency and failover. The company requires a highly available solution that supports active-passive clustering across multiple Availability Zones. The storage solution must minimize operational overhead while ensuring low-latency access to data.

Which solution will meet these requirements with the LEAST implementation effort?

Correct answer

Deploy Amazon FSx for Windows File Server in Multi-AZ mode. Configure a Windows Server failover cluster across two Amazon EC2 instances in different Availability Zones, using FSx for Windows File Server as the shared storage.

Deploy the inventory application on Amazon EC2 instances in two Availability Zones with an active-passive configuration. Use Amazon Elastic File System (Amazon EFS) in Standard mode to store and share application data across the two instances.

Use AWS Storage Gateway with cached volumes to provide block storage. Deploy the application on a Windows Server cluster spanning two Availability Zones, using Storage Gateway to store and access shared data.

Deploy the inventory application on Amazon EC2 instances in two Availability Zones with an active-passive setup. Use Amazon S3 with the S3 File Gateway to provide shared storage for the application data.

Overall explanation

Deploy Amazon FSx for Windows File Server in Multi-AZ mode. Configure a Windows Server failover cluster across two Amazon EC2 instances in different Availability Zones, using FSx for Windows File Server as the shared storage: This is correct because FSx for Windows File Server provides fully managed, highly available shared storage designed specifically for Windows-based workloads. It integrates seamlessly with Windows failover clusters, minimizing operational complexity.

Deploy the inventory application on Amazon EC2 instances in two Availability Zones with an active-passive setup. Use Amazon S3 with the S3 File Gateway to provide shared storage for the application data: This is incorrect because S3 File Gateway provides object storage through file-based interfaces (e.g., NFS), which is not compatible with Windows failover clustering or block-level storage requirements.

Use AWS Storage Gateway with cached volumes to provide block storage. Deploy the application on a Windows Server cluster spanning two Availability Zones, using Storage Gateway to store and access shared data: This is incorrect because AWS Storage Gateway is not designed for high-availability block storage in AWS-native workloads. It is intended for hybrid environments and adds operational complexity compared to FSx for Windows File Server.

Deploy the inventory application on Amazon EC2 instances in two Availability Zones with an active-passive configuration. Use Amazon Elastic File System (Amazon EFS) in Standard mode to store and share application data across the two instances: This is incorrect because Amazon EFS is a shared file system, not a block storage solution. It is better suited for Linux-based workloads and does not support the block-level requirements of Windows failover clusters.

References:
https://docs.aws.amazon.com/fsx/latest/WindowsGuide/multiAZ.html
https://aws.amazon.com/storagegateway/
https://aws.amazon.com/efs/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-fsx/

Domain

AWS Storage

Question 58Skipped

An organization plans to deploy a higher performance computing (HPC) workload on AWS using Linux. The HPC workload will use many Amazon EC2 instances and will generate a large quantity of small output files that must be stored in persistent storage for future use.

A Solutions Architect must design a solution that will enable the EC2 instances to access data using native file system interfaces and to store output files in cost-effective long-term storage.

Which combination of AWS services meets these requirements?

Correct answer

Amazon FSx for Lustre with Amazon S3.

AWS DataSync with Amazon S3 Intelligent tiering.

Amazon FSx for Windows File Server with Amazon S3.

Amazon EBS volumes with Amazon S3 Glacier.

Overall explanation

Amazon FSx for Lustre is ideal for high performance computing (HPC) workloads running on Linux instances. FSx for Lustre provides a native file system interface and works as any file system does with your Linux operating system.

When linked to an Amazon S3 bucket, FSx for Lustre transparently presents objects as files, allowing you to run your workload without managing data transfer from S3.

This solution provides all requirements as it enables Linux workloads to use the native file system interfaces and to use S3 for long-term and cost-effective storage of output files.

CORRECT: "Amazon FSx for Lustre with Amazon S3" is the correct answer.

INCORRECT: "Amazon FSx for Windows File Server with Amazon S3" is incorrect. This service should be used with Windows instances and does not integrate with S3.

INCORRECT: "Amazon EBS volumes with Amazon S3 Glacier" is incorrect. EBS volumes do not provide the shared, high performance storage solution using file system interfaces.

INCORRECT: "AWS DataSync with Amazon S3 Intelligent tiering" is incorrect. AWS DataSync is used for migrating / synchronizing data.

References:

https://aws.amazon.com/fsx/lustre/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-fsx/

Domain

AWS Storage

Question 59Skipped

A solutions architect has been tasked with designing a highly resilient hybrid cloud architecture connecting an on-premises data center and AWS. The network should include AWS Direct Connect (DX).

Which DX configuration offers the HIGHEST resiliency?

Correct answer

Configure DX connections at multiple DX locations.

Configure a DX connection with an encrypted VPN on top of it.

Configure multiple public VIFs on top of a DX connection.

Configure multiple private VIFs on top of a DX connection.

Overall explanation

The most resilient solution is to configure DX connections at multiple DX locations. This ensures that any issues impacting a single DX location do not affect availability of the network connectivity to AWS.

Take note of the following AWS recommendations for resiliency:

AWS recommends connecting from multiple data centers for physical location redundancy. When designing remote connections, consider using redundant hardware and telecommunications providers. Additionally, it is a best practice to use dynamically routed, active/active connections for automatic load balancing and failover across redundant network connections. Provision sufficient network capacity to ensure that the failure of one network connection does not overwhelm and degrade redundant connections.

The diagram below is an example of an architecture that offers high resiliency:

CORRECT: "Configure DX connections at multiple DX locations" is the correct answer.

INCORRECT: "Configure a DX connection with an encrypted VPN on top of it" is incorrect. A VPN that is separate to the DX connection can be a good backup. But a VPN on top of the DX connection does not help. Also, encryption provides security but not resilience.

INCORRECT: "Configure multiple public VIFs on top of a DX connection" is incorrect. Virtual interfaces do not add resiliency as resiliency must be designed into the underlying connection.

INCORRECT: "Configure multiple private VIFs on top of a DX connection" is incorrect. Virtual interfaces do not add resiliency as resiliency must be designed into the underlying connection.

References:

https://aws.amazon.com/directconnect/resiliency-recommendation/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-direct-connect/

Domain

AWS Networking & Content Delivery

Question 60Skipped

A company is planning a migration for a high performance computing (HPC) application and associated data from an on-premises data center to the AWS Cloud. The company uses tiered storage on premises with hot high-performance parallel storage to support the application during periodic runs of the application, and more economical cold storage to hold the data when the application is not actively running.

Which combination of solutions should a solutions architect recommend to support the storage needs of the application? (Select TWO.)

Amazon EFS for cold data storage

Correct selection

Amazon FSx for Lustre for high-performance parallel storage

Correct selection

Amazon S3 for cold data storage

Amazon S3 for high-performance parallel storage

Amazon FSx for Windows for high-performance parallel storage

Overall explanation

Amazon FSx for Lustre provides a high-performance file system optimized for fast processing of workloads such as machine learning, high-performance computing (HPC), video processing, financial modeling, and electronic design automation (EDA).

These workloads commonly require data to be presented via a fast and scalable file system interface, and typically have data sets stored on long-term data stores like Amazon S3.

Amazon FSx works natively with Amazon S3, making it easy to access your S3 data to run data processing workloads. Your S3 objects are presented as files in your file system, and you can write your results back to S3. This lets you run data processing workloads on FSx for Lustre and store your long-term data on S3 or on-premises data stores.

Therefore, the best combination for this scenario is to use S3 for cold data and FSx for Lustre for the parallel HPC job.

CORRECT: "Amazon S3 for cold data storage" is the correct answer.

CORRECT: "Amazon FSx for Lustre for high-performance parallel storage" is the correct answer.

INCORRECT: "Amazon EFS for cold data storage" is incorrect as FSx works natively with S3 which is also more economical.

INCORRECT: "Amazon S3 for high-performance parallel storage" is incorrect as S3 is not suitable for running high-performance computing jobs.

INCORRECT: "Amazon FSx for Windows for high-performance parallel storage" is incorrect as FSx for Lustre should be used for HPC use cases and use cases that require storing data on S3.

References:

https://aws.amazon.com/fsx/lustre/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-fsx/

Domain

AWS Storage

Question 61Skipped

A company uses a Microsoft Windows file share for storing documents and media files. Users access the share using Microsoft Windows clients and are authenticated using the company’s Active Directory. The chief information officer wants to move the data to AWS as they are approaching capacity limits. The existing user authentication and access management system should be used.

How can a Solutions Architect meet these requirements?

Move the documents and media files to an Amazon Simple Storage Service bucket and apply bucket ACLs.

Correct answer

Move the documents and media files to an Amazon FSx for Windows File Server file system.

Move the documents and media files to an Amazon FSx for Lustre file system.

Move the documents and media files to an Amazon Elastic File System and use POSIX permissions.

Overall explanation

Amazon FSx for Windows File Server makes it easy for you to launch and scale reliable, performant, and secure shared file storage for your applications and end users. With Amazon FSx, you can launch highly durable and available file systems that can span multiple availability zones (AZs) and can be accessed from up to thousands of compute instances using the industry-standard Server Message Block (SMB) protocol.

It provides a rich set of administrative and security features, and integrates with Microsoft Active Directory (AD). To serve a wide spectrum of workloads, Amazon FSx provides high levels of file system throughput and IOPS and consistent sub-millisecond latencies.

You can also mount FSx file systems from on-premises using a VPN or Direct Connect connection. This topology is depicted in the image below:

CORRECT: "Move the documents and media files to an Amazon FSx for Windows File Server file system" is the correct answer.

INCORRECT: "Move the documents and media files to an Amazon FSx for Lustre file system" is incorrect. FSx for Lustre is not suitable for migrating a Microsoft Windows File Server implementation.

INCORRECT: "Move the documents and media files to an Amazon Elastic File System and use POSIX permissions" is incorrect. EFS can be used from on-premises over a VPN or DX connection but POSIX permissions are very different to Microsoft permissions and mean a different authentication and access management solution is required.

INCORRECT: "Move the documents and media files to an Amazon Simple Storage Service bucket and apply bucket ACLs" is incorrect. S3 with bucket ACLs would be changing to an object-based storage system and a completely different authentication and access management solution.

References:

https://aws.amazon.com/fsx/windows/features/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-fsx/

Domain

AWS Storage

Question 62Skipped

A company runs a number of core enterprise applications in an on-premises data center. The data center is connected to an Amazon VPC using AWS Direct Connect. The company will be creating additional AWS accounts and these accounts will also need to be quickly, and cost-effectively connected to the on-premises data center in order to access the core applications.

What deployment changes should a Solutions Architect implement to meet these requirements with the LEAST operational overhead?

Correct answer

Configure AWS Transit Gateway between the accounts. Assign Direct Connect to the transit gateway and route network traffic to the on-premises servers.

Create a Direct Connect connection in each new account. Route the network traffic to the on-premises servers.

Configure VPC endpoints in the Direct Connect VPC for all required services. Route the network traffic to the on-premises servers.

Create a VPN connection between each new account and the Direct Connect VPC. Route the network traffic to the on-premises servers.

Overall explanation

AWS Transit Gateway connects VPCs and on-premises networks through a central hub. With AWS Transit Gateway, you can quickly add Amazon VPCs, AWS accounts, VPN capacity, or AWS Direct Connect gateways to meet unexpected demand, without having to wrestle with complex connections or massive routing tables. This is the operationally least complex solution and is also cost-effective.

The image below depicts how transit gateway can assist with simplifying network deployments:

CORRECT: "Configure AWS Transit Gateway between the accounts. Assign Direct Connect to the transit gateway and route network traffic to the on-premises servers" is the correct answer.

INCORRECT: "Create a VPN connection between each new account and the Direct Connect VPC. Route the network traffic to the on-premises servers" is incorrect. You cannot connect VPCs using AWS managed VPNs and would need to configure a software VPN and then complex routing configurations. This is not the best solution.

INCORRECT: "Create a Direct Connect connection in each new account. Route the network traffic to the on-premises servers" is incorrect. This is an expensive solution as you would need to have multiple Direct Connect links.

INCORRECT: "Configure VPC endpoints in the Direct Connect VPC for all required services. Route the network traffic to the on-premises servers" is incorrect. You cannot create VPC endpoints for all services and this would be a complex solution for those you can.

References:

https://aws.amazon.com/transit-gateway/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-direct-connect/

Domain

AWS Networking & Content Delivery

Question 63Skipped

A transportation company uses GPS devices installed on its fleet of delivery trucks to monitor their location in real time. Each GPS device sends location updates every 5 minutes if the truck has traveled more than 100 meters. The data is transmitted to a web application running on three Amazon EC2 instances deployed across multiple Availability Zones in a single AWS Region.

Recently, during a peak delivery period, the web application was overwhelmed by the increased volume of GPS data, leading to data loss with no way to replay the events. The company wants to ensure that no location data is lost and that the application can scale efficiently to handle traffic spikes, all with minimal operational overhead.

What should the solutions architect do to meet these requirements?

Use an Amazon S3 bucket to store the GPS location updates. Modify the application to periodically scan the bucket for new files and process the data.

Store the GPS location updates in an Amazon DynamoDB table. Modify the application to query the table for unprocessed data and process it. Use DynamoDB TTL to remove old records after processing.

Correct answer

Use an Amazon Simple Queue Service (Amazon SQS) queue to store the incoming GPS data. Modify the application to poll the queue for new messages and process the data.

Use Amazon Kinesis Data Streams to ingest the GPS data. Configure an AWS Lambda function to process the data in real time and store results in an Amazon DynamoDB table.

Overall explanation

Use an Amazon Simple Queue Service (Amazon SQS) queue to store the incoming GPS data. Modify the application to poll the queue for new messages and process the data: This is correct because SQS decouples the data ingestion process from the application. It ensures that no data is lost during traffic spikes and allows the application to process data at its own pace, minimizing the risk of being overwhelmed.

Use an Amazon S3 bucket to store the GPS location updates. Modify the application to periodically scan the bucket for new files and process the data: This is incorrect because Amazon S3 is not ideal for real-time ingestion and processing. Scanning the bucket periodically introduces latency and may not be able to handle high throughput use cases efficiently.

Use Amazon Kinesis Data Streams to ingest the GPS data. Configure an AWS Lambda function to process the data in real time and store results in an Amazon DynamoDB table: This is incorrect because Kinesis Data Streams introduces additional operational complexity and is typically suited for high throughput streaming workloads. SQS provides a simpler, lower-overhead solution for this use case.

Store the GPS location updates in an Amazon DynamoDB table. Modify the application to query the table for unprocessed data and process it. Use DynamoDB TTL to remove old records after processing: This is incorrect because using DynamoDB as a temporary data store for this purpose is less efficient and increases complexity. SQS is specifically designed to handle message queues for this type of workload.

References:
https://docs.aws.amazon.com/sqs/index.html
https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-how-it-works.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 64Skipped

A gaming company operates a leaderboard application for a popular multiplayer game. The application uses an Amazon Aurora PostgreSQL DB cluster for storage. The game servers, hosted on Amazon EC2 instances, frequently update the leaderboard with player scores.

The company has a strict security policy that requires database credentials to be encrypted and rotated every 30 days. The company wants to minimize operational overhead while ensuring the application can seamlessly retrieve and use updated credentials.

What should a solutions architect do to meet this requirement?

Use AWS Systems Manager Parameter Store to store the database credentials as SecureString parameters encrypted with AWS KMS. Implement a custom AWS Lambda function to rotate the credentials every 30 days and update the parameters.

Store the database credentials in an Amazon DynamoDB table encrypted with AWS KMS. Configure an AWS Lambda function to rotate the credentials in Aurora every 30 days and update the DynamoDB table with the new credentials.

Configure Amazon Cognito to generate temporary database credentials. Use Cognito's built-in mechanisms to rotate the credentials every 30 days. Update the game server application to request temporary credentials from Cognito.

Correct answer

Use AWS Secrets Manager to store the database credentials. Configure Secrets Manager to rotate the credentials automatically every 30 days. Update the game server application to retrieve credentials from Secrets Manager.

Overall explanation

Use AWS Secrets Manager to store the database credentials. Configure Secrets Manager to rotate the credentials automatically every 30 days. Update the game server application to retrieve credentials from Secrets Manager: This is correct because AWS Secrets Manager integrates seamlessly with Aurora PostgreSQL, providing built-in credential rotation and secure storage. This minimizes operational overhead and meets the security requirements.
Use AWS Systems Manager Parameter Store to store the database credentials as SecureString parameters encrypted with AWS KMS. Implement a custom AWS Lambda function to rotate the credentials every 30 days and update the parameters: This is incorrect because while Parameter Store securely stores credentials, it does not natively integrate with Aurora for automatic rotation. Writing a custom Lambda function increases complexity.
Configure Amazon Cognito to generate temporary database credentials. Use Cognito's built-in mechanisms to rotate the credentials every 30 days. Update the game server application to request temporary credentials from Cognito: This is incorrect because Cognito is primarily designed for user identity management and is not intended for database credential management. This approach does not directly address the security requirements.
Store the database credentials in an Amazon DynamoDB table encrypted with AWS KMS. Configure an AWS Lambda function to rotate the credentials in Aurora every 30 days and update the DynamoDB table with the new credentials: This is incorrect because DynamoDB is not a service designed to securely store or manage database credentials. This approach requires unnecessary custom implementations and adds operational complexity.

References:
https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html
https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-secrets-manager/

Domain

AWS Security, Identity, & Compliance

Question 65Skipped

A company operates a three-tier architecture for their online order processing system. The architecture includes EC2 instances in the web tier behind an Application Load Balancer, EC2 instances in the processing tier, and Amazon DynamoDB for storage. To decouple the web and processing tiers, the company uses Amazon Simple Queue Service (Amazon SQS).

During peak demand, some customers experience delays or failures in order processing. At these times, the EC2 instances in the processing tier reach 100% CPU utilization, and the SQS queue length increases significantly. These peak periods are unpredictable.

What should the company do to improve the application's performance?

Deploy Amazon ElastiCache for Redis to reduce the read and write load on DynamoDB. Use a scheduled scaling policy for the processing tier instances

Implement an Amazon CloudFront distribution to cache static content in the web tier. Use HTTP request count as a scaling metric for the processing tier.

Use predictive scaling in Amazon EC2 Auto Scaling to add instances to the processing tier ahead of peak times. Use CPU utilization as the key metric to scale.

Correct answer

Configure an Amazon EC2 Auto Scaling target tracking policy for the processing tier instances. Use the SQS ApproximateNumberOfMessages metric to dynamically scale the tier based on queue length.

Overall explanation

Use an Amazon EC2 Auto Scaling target tracking policy for the processing tier instances. Use the SQS ApproximateNumberOfMessages metric to dynamically scale the tier based on queue length: This is correct because target tracking policies allow Auto Scaling to dynamically adjust the number of processing tier instances based on real-time conditions. Using the ApproximateNumberOfMessages attribute from SQS ensures that the application can handle the increasing workload when the queue length grows, preventing CPU exhaustion and processing delays.

Use predictive scaling in Amazon EC2 Auto Scaling to add instances to the processing tier ahead of peak times. Use CPU utilization as the key metric to scale: This is incorrect because predictive scaling may not work well with unpredictable traffic patterns. Additionally, CPU utilization is not the best indicator for scaling when dealing with queue-based workloads, as the queue length is a more direct reflection of demand.

Deploy Amazon ElastiCache for Redis to reduce the read and write load on DynamoDB. Use a scheduled scaling policy for the processing tier instances: This is incorrect because DynamoDB is not the bottleneck in this scenario. The issue lies in the processing tier's inability to handle the workload, not in the storage tier. Scheduled scaling also does not address the unpredictable nature of traffic peaks.

Implement an Amazon CloudFront distribution to cache static content in the web tier. Use HTTP request count as a scaling metric for the processing tier: This is incorrect because the problem is not related to static content delivery or HTTP request volume in the web tier. The delays occur due to processing tier limitations, so caching in the web tier will not resolve the issue.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-scaling-target-tracking.html

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-monitoring-using-cloudwatch.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ec2-auto-scaling/

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Compute

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Expanded view

Beta

0 / 10used queries